Edit tour

Windows Analysis Report
https://download.info.apple.com/Mac_OS_X/031-30890-20150812-ea191174-4130-11e5-a125-930911ba098f/bootcamp5.1.5769.zip

Overview

General Information

Sample URL:	https://download.info.apple.com/Mac_OS_X/031-30890-20150812-ea191174-4130-11e5-a125-930911ba098f/bootcamp5.1.5769.zip
Analysis ID:	1369790
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Downloads suspicious files via Chrome

Sample is not signed and drops a device driver

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2896 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5100 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=2024,i,4500164741189345867,16917234656794013603,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

unarchiver.exe (PID: 3140 cmdline: C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\bootcamp5.1.5769.zip MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 6576 cmdline: C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges" "C:\Users\user\Downloads\bootcamp5.1.5769.zip MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 1144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1448 cmdline: cmd.exe" /C "C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Setup.exe (PID: 2136 cmdline: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe MD5: D45E19599BE570DDE85F757051AB3E69)

chrome.exe (PID: 6448 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://download.info.apple.com/Mac_OS_X/031-30890-20150812-ea191174-4130-11e5-a125-930911ba098f/bootcamp5.1.5769.zip MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaCHS.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaCHT.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaCSY.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaDAN.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaDEU.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaENU.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaESP.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaFIN.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaFRA.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaGRK.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaHNG.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaITA.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaJPN.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaKOR.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaNLD.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaNOR.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaPLK.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaPTB.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaRSA.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaSVE.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaTHA.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaTRK.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseCHS.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseCHT.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseCSY.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseDAN.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseDEU.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseENU.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseESP.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseFIN.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseFRA.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseGRK.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseHNG.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseITA.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseJPN.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseKOR.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseNLD.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseNOR.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licensePLK.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licensePTB.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseSVE.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseTHA.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseTRK.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1028\eula.rtf	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1031\eula.rtf	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1033\eula.rtf	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1036\eula.rtf	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1040\eula.rtf	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1041\eula.rtf	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1042\eula.rtf	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1049\eula.rtf	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\2052\eula.rtf	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\3082\eula.rtf	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source:	Binary string: g.pdb source: atikmdag.sy_.8.dr
Source:	Binary string: D:\BWA\BootCampPackageDataWin_Final-5769\srcroot\setup64\x64\Release\Setup.pdb source: Setup.exe, 0000000D.00000000.2507656223.0000000140018000.00000002.00000001.01000000.00000008.sdmp, Setup.exe, 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: c:\workarea\14.301\drivers\uvdmft\decode\AMDMFTVDec\wNow\B_rel\AMDhwDecoder_32.pdb source: amdhwdecoder_32.dll.8.dr
Source:	Binary string: C:\a\stg\install\install\Monet\Apps\Bin\Win32\B_rel\Monet_CA.pdb source: ccc-fuel.msi.8.dr
Source:	Binary string: c:\workarea\14.301\drivers\uvdmft\MediaSDK\sources\mft-mjpeg-decoder\wNow64a\B_rel\amf-mft-mjpeg-decoder64.pdb source: amf-mft-mjpeg-decoder64.dll.8.dr
Source:	Binary string: c:\workarea\14.301\install\Monet\Apps\Bin\Win64a\B_rel\DLMCom.pdb&& source: DLMCom.dll.8.dr
Source:	Binary string: pO.pdb source: amdmmcl.dl_.8.dr
Source:	Binary string: c:\ccviews\atjes_L10N_ASE_Staging\ASE_Installers\Iif2\Installer\Chipset\Resource\Src\Debug\Resource.pdb source: ChipsetELL.dll.8.dr, ChipsetARA.dll.8.dr, ChipsetENU.dll.8.dr, ChipsetPLK.dll.8.dr, ChipsetRUS.dll.8.dr, ChipsetESP.dll.8.dr
Source:	Binary string: dva.pdb source: atiumdva.dl_.8.dr
Source:	Binary string: c:\workarea\14.301\install\Monet\Apps\Bin\Win64a\B_rel\DetectionManager.pdb source: DetectionManager.dll.8.dr
Source:	Binary string: 6.pdb source: amdmmcl6.dl_.8.dr
Source:	Binary string: c:\workarea\14.301\install\Monet\Apps\Bin\Win64a\B_rel\DLMCom.pdb source: DLMCom.dll.8.dr
Source:	Binary string: difxapi.pdb source: difxapi.dll.8.dr
Source:	Binary string: SetupResources.pdb source: SetupResources.dll6.8.dr, SetupResources.dll8.8.dr
Source:	Binary string: difxapi.pdbE3 source: difxapi.dll.8.dr

Source: DetectionManager.dll.8.dr	String found in binary or memory: http://atimonet.atitech.comMemSzhttp://172.24.5.135http://localhosthttp://www2.ati.comCPUFlhttp://ww
Source: DLMCom.dll.8.dr, DetectionManager.dll.8.dr	String found in binary or memory: http://atimonet.atitech.comhttp://172.24.5.135http://localhosthttp://www2.ati.comhttp://www.amd.comh
Source: DetectionManager.dll.8.dr	String found in binary or memory: http://atimonet.atitech.comyeshttp://172.24.5.135http://localhosthttp://www2.ati.comhttp://www.amd.c
Source: 7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certificates.intel.com/repository/CRL/Intel%20External%20Basic%20Issuing%20CA%203A(1).crl0
Source: 7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certificates.intel.com/repository/CRL/Intel%20External%20Basic%20Policy%20CA.crl0
Source: 7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certificates.intel.com/repository/certificates/Intel%20External%20Basic%20Issuing%20CA%203A(1
Source: 7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certificates.intel.com/repository/certificates/Intel%20External%20Basic%20Policy%20CA.crt0
Source: 7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.geotrust.com/crls/secureca.crl0
Source: 7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp, ChipsetELL.dll.8.dr, ChipsetARA.dll.8.dr, ChipsetENU.dll.8.dr, ChipsetPLK.dll.8.dr, ChipsetRUS.dll.8.dr, ChipsetESP.dll.8.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp, ChipsetELL.dll.8.dr, ChipsetARA.dll.8.dr, ChipsetENU.dll.8.dr, ChipsetPLK.dll.8.dr, ChipsetRUS.dll.8.dr, ChipsetESP.dll.8.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: 7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp, ChipsetELL.dll.8.dr, ChipsetARA.dll.8.dr, ChipsetENU.dll.8.dr, ChipsetPLK.dll.8.dr, ChipsetRUS.dll.8.dr, ChipsetESP.dll.8.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp, ChipsetELL.dll.8.dr, ChipsetARA.dll.8.dr, ChipsetENU.dll.8.dr, ChipsetPLK.dll.8.dr, ChipsetRUS.dll.8.dr, ChipsetESP.dll.8.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp, ChipsetELL.dll.8.dr, ChipsetARA.dll.8.dr, ChipsetENU.dll.8.dr, ChipsetPLK.dll.8.dr, ChipsetRUS.dll.8.dr, ChipsetESP.dll.8.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 2052.mst0.8.dr, 1054.mst.8.dr, 1049.mst0.8.dr	String found in binary or memory: http://www.AMD.comDisplayNameCustom
Source: ChipsetELL.dll.8.dr, ChipsetARA.dll.8.dr, ChipsetENU.dll.8.dr, ChipsetPLK.dll.8.dr, ChipsetRUS.dll.8.dr, ChipsetESP.dll.8.dr	String found in binary or memory: http://www.apple.com/
Source: eulaCHS.txt.8.dr	String found in binary or memory: http://www.bis.doc.gov/
Source: eulaENU.txt.8.dr	String found in binary or memory: http://www.bis.doc.gov/.
Source: 7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.intel.com/repository/CRL/Intel%20External%20Basic%20Issuing%20CA%203A(1).crl
Source: 7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.intel.com/repository/CRL/Intel%20External%20Basic%20Policy%20CA.crl
Source: 7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.intel.com/repository/certificates/Intel%20External%20Basic%20Issuing%20CA%203A(1).crt0u
Source: 7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.intel.com/repository/certificates/Intel%20External%20Basic%20Policy%20CA.crt0l
Source: amdocl_ld64.exe.8.dr	String found in binary or memory: http://www.sourceware.org/bugzilla/

Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\W764A\atihdw76.cat	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmafd\WB64A\amdkmafd.cat	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdkmpfd.csz	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\WB64A\atihdwb6.cat	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmpfd\WB64A\amdkmpfd.cat	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmpfd\W764A\amdkmpfd.cat	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdkmpfd.cbz	Jump to dropped file

System Summary

Downloads suspicious files via Chrome

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File dump: C:\Users\user\Downloads\bootcamp5.1.5769.zip (copy)

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe

Code function: 13_2_00000001400013C0 GetUserDefaultLangID,lstrlenA,LoadStringA,LoadStringA,MessageBoxA,OutputDebugStringA,lstrcpyA,LoadStringA,GetModuleFileNameA,GetLastError,lstrlenA,lstrlenA,OutputDebugStringA,LoadStringA,MessageBoxA,CloseHandle,ExitWindowsEx,CreateMutexA,GetLastError,lstrlenA,lstrlenA,LoadStringA,lstrlenA,lstrlenA,GetFullPathNameA,GetLastError,swprintf,GetFullPathNameA,GetFullPathNameA,GetFileAttributesA,swprintf,#141,#91,#31,#159,#160,#117,#112,#31,#159,#160,#117,#31,#159,#160,#117,#8,#8,#8,#8,#8,#8,#8,lstrlenA,lstrlenA,lstrlenA,lstrlenA,#281,#87,DestroyWindow,

13_2_00000001400013C0

Source: C:\Windows\SysWOW64\7za.exe

File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\atdcm64a.sys

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_2896_1525860731

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Code function: 13_2_0000000140006CC0	13_2_0000000140006CC0
Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Code function: 13_2_00000001400013C0	13_2_00000001400013C0
Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Code function: 13_2_00000001400117F4	13_2_00000001400117F4
Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Code function: 13_2_0000000140010C0C	13_2_0000000140010C0C
Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Code function: 13_2_0000000140005020	13_2_0000000140005020
Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Code function: 13_2_000000014001085C	13_2_000000014001085C
Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Code function: 13_2_0000000140016474	13_2_0000000140016474
Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Code function: 13_2_000000014000A8D0	13_2_000000014000A8D0
Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Code function: 13_2_0000000140003DF0	13_2_0000000140003DF0
Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Code function: 13_2_000000014000BDF8	13_2_000000014000BDF8
Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Code function: 13_2_000000014000C210	13_2_000000014000C210
Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Code function: 13_2_0000000140002E20	13_2_0000000140002E20
Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Code function: 13_2_0000000140003220	13_2_0000000140003220
Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Code function: 13_2_0000000140003A30	13_2_0000000140003A30
Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Code function: 13_2_0000000140003660	13_2_0000000140003660
Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Code function: 13_2_0000000140014F28	13_2_0000000140014F28
Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Code function: 13_2_000000014001577C	13_2_000000014001577C
Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Code function: 13_2_0000000140007780	13_2_0000000140007780

Source: amdocl.dll.8.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: amdocl64.dll.8.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: SetupResources.dll3.8.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: amdmftdecoder_32.dll.8.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: amdmftdecoder_64.dll.8.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: ChipsetPTG.dll.8.dr	Static PE information: No import functions for PE file found
Source: SetupResources.dll6.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetCHS.dll.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetELL.dll.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetSVE.dll.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetENU.dll.8.dr	Static PE information: No import functions for PE file found
Source: SetupResources.dll4.8.dr	Static PE information: No import functions for PE file found
Source: SetupResources.dll7.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetESP.dll.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetNLD.dll.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetARA.dll.8.dr	Static PE information: No import functions for PE file found
Source: SetupResources.dll5.8.dr	Static PE information: No import functions for PE file found
Source: SetupResources.dll8.8.dr	Static PE information: No import functions for PE file found
Source: SetupResources.dll2.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetPLK.dll.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetFRA.dll.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetHEB.dll.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetDAN.dll.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetTHA.dll.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetFIN.dll.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetTRK.dll.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetDEU.dll.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetNOR.dll.8.dr	Static PE information: No import functions for PE file found
Source: SetupResources.dll.8.dr	Static PE information: No import functions for PE file found
Source: SetupResources.dll1.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetRUS.dll.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetCHT.dll.8.dr	Static PE information: No import functions for PE file found
Source: SetupResources.dll3.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetITA.dll.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetJPN.dll.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetPTB.dll.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetCSY.dll.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetHUN.dll.8.dr	Static PE information: No import functions for PE file found
Source: SetupResources.dll0.8.dr	Static PE information: No import functions for PE file found
Source: ChipsetKOR.dll.8.dr	Static PE information: No import functions for PE file found

Source: classification engine

Classification label: mal48.win@27/927@0/9

Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe

Code function: 13_2_00000001400045E0 GetLastError,FormatMessageA,lstrlenA,lstrlenA,LocalAlloc,LocalSize,MessageBoxA,LocalFree,LocalFree,

13_2_00000001400045E0

Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe

Code function: 13_2_0000000140006CC0 malloc,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,_com_util::ConvertStringToBSTR,SysFreeString,CoSetProxyBlanket,_com_util::ConvertStringToBSTR,_com_util::ConvertStringToBSTR,SysFreeString,SysFreeString,VariantInit,SysStringLen,WideCharToMultiByte,VariantClear,free,

13_2_0000000140006CC0

Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe

Code function: 13_2_0000000140004480 GetTempPathA,FindResourceA,LoadResource,LockResource,SizeofResource,CreateFileA,WriteFile,CloseHandle,CloseHandle,

13_2_0000000140004480

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\fef1fb72-cd98-4729-b46e-4089c4828746.tmp

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1144:120:WilError_03

Source: C:\Windows\SysWOW64\unarchiver.exe

File created: C:\Users\user\AppData\Local\Temp\unarchiver.log

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\276d7f4a20a3c21c3bf6fc9bfc1915a2\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=2024,i,4500164741189345867,16917234656794013603,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://download.info.apple.com/Mac_OS_X/031-30890-20150812-ea191174-4130-11e5-a125-930911ba098f/bootcamp5.1.5769.zip
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\bootcamp5.1.5769.zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges" "C:\Users\user\Downloads\bootcamp5.1.5769.zip
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C "C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=2024,i,4500164741189345867,16917234656794013603,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\bootcamp5.1.5769.zip	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges" "C:\Users\user\Downloads\bootcamp5.1.5769.zip	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C "C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\SysWOW64\7za.exe

File written: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\Monet.ini

Jump to behavior

Source: C:\Windows\SysWOW64\7za.exe

File opened: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\DLMServer.cfg

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source:	Binary string: g.pdb source: atikmdag.sy_.8.dr
Source:	Binary string: D:\BWA\BootCampPackageDataWin_Final-5769\srcroot\setup64\x64\Release\Setup.pdb source: Setup.exe, 0000000D.00000000.2507656223.0000000140018000.00000002.00000001.01000000.00000008.sdmp, Setup.exe, 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: c:\workarea\14.301\drivers\uvdmft\decode\AMDMFTVDec\wNow\B_rel\AMDhwDecoder_32.pdb source: amdhwdecoder_32.dll.8.dr
Source:	Binary string: C:\a\stg\install\install\Monet\Apps\Bin\Win32\B_rel\Monet_CA.pdb source: ccc-fuel.msi.8.dr
Source:	Binary string: c:\workarea\14.301\drivers\uvdmft\MediaSDK\sources\mft-mjpeg-decoder\wNow64a\B_rel\amf-mft-mjpeg-decoder64.pdb source: amf-mft-mjpeg-decoder64.dll.8.dr
Source:	Binary string: c:\workarea\14.301\install\Monet\Apps\Bin\Win64a\B_rel\DLMCom.pdb&& source: DLMCom.dll.8.dr
Source:	Binary string: pO.pdb source: amdmmcl.dl_.8.dr
Source:	Binary string: c:\ccviews\atjes_L10N_ASE_Staging\ASE_Installers\Iif2\Installer\Chipset\Resource\Src\Debug\Resource.pdb source: ChipsetELL.dll.8.dr, ChipsetARA.dll.8.dr, ChipsetENU.dll.8.dr, ChipsetPLK.dll.8.dr, ChipsetRUS.dll.8.dr, ChipsetESP.dll.8.dr
Source:	Binary string: dva.pdb source: atiumdva.dl_.8.dr
Source:	Binary string: c:\workarea\14.301\install\Monet\Apps\Bin\Win64a\B_rel\DetectionManager.pdb source: DetectionManager.dll.8.dr
Source:	Binary string: 6.pdb source: amdmmcl6.dl_.8.dr
Source:	Binary string: c:\workarea\14.301\install\Monet\Apps\Bin\Win64a\B_rel\DLMCom.pdb source: DLMCom.dll.8.dr
Source:	Binary string: difxapi.pdb source: difxapi.dll.8.dr
Source:	Binary string: SetupResources.pdb source: SetupResources.dll6.8.dr, SetupResources.dll8.8.dr
Source:	Binary string: difxapi.pdbE3 source: difxapi.dll.8.dr

Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe

Code function: 13_2_0000000140012C80 EncodePointer,__crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

13_2_0000000140012C80

Source: initial sample

Static PE information: section where entry point is pointing to: .rdata

Source: amdocl_as32.exe.8.dr	Static PE information: section name: /4
Source: amdocl_as64.exe.8.dr	Static PE information: section name: /4
Source: amdocl_ld32.exe.8.dr	Static PE information: section name: /4
Source: amdocl_ld64.exe.8.dr	Static PE information: section name: /4
Source: delayapo.dll.8.dr	Static PE information: section name: RT_CODE
Source: delayapo.dll.8.dr	Static PE information: section name: RT_BSS
Source: delayapo.dll.8.dr	Static PE information: section name: RT_CONST
Source: delayapo.dll.8.dr	Static PE information: section name: RT_DATA
Source: dotnetfx45_full_x86_x64.exe.8.dr	Static PE information: section name: .boxld01
Source: vcredist_x64.exe.8.dr	Static PE information: section name: .wixburn
Source: delayapo.dll0.8.dr	Static PE information: section name: RT_CODE
Source: delayapo.dll0.8.dr	Static PE information: section name: RT_BSS
Source: delayapo.dll0.8.dr	Static PE information: section name: RT_CONST
Source: delayapo.dll0.8.dr	Static PE information: section name: RT_DATA
Source: Difx64.exe0.8.dr	Static PE information: section name: .srdata
Source: difxapi.dll1.8.dr	Static PE information: section name: .srdata
Source: vcredist_x86.exe0.8.dr	Static PE information: section name: .wixburn

Source: initial sample

Static PE information: section name: .text entropy: 6.9113720938783825

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\atdcm64a.sys	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmafd\WB64A\amdkmafd.sys	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmpfd\W764A\amdkmpfd.sys	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmpfd\WB64A\amdkmpfd.sys	Jump to behavior

Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\CSY\ChipsetCSY.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1028\SetupResources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleKeyboardInstaller64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amd_opencl64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ATILog.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\KOR\ChipsetKOR.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Broadcom\BroadcomCardReader64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\clinfo.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleNullDriver64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\DAN\ChipsetDAN.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ESP\ChipsetESP.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdhsasc64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ATIManifestDLMExt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\3082\SetupResources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\WB64A\delayapo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\W764A\delayapo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\msvcr110.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\mfc110u.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\msvcp110.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Broadcom\BroadcomWirelessWin8x64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleDisplayInstaller64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\ia64\difxapi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\mcl32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\sqmapi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ATISetup.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdmftdecoder_64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC12RTx86\vcredist_x86\vcredist_x86.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\FIN\ChipsetFIN.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\SVE\ChipsetSVE.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Broadcom\BroadcomComController64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdocl_ld32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\HEB\ChipsetHEB.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1031\SetupResources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdh264enc32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdocl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1033\SetupResources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\SetupUi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdocl_as32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleWirelessMouse64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\HUN\ChipsetHUN.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\IntelMgmtEngine.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmpfd\W764A\amdkmpfd.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleSDCardReader64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1042\SetupResources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1041\SetupResources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdocl_as64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\msvcr110.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Cirrus\CirrusAudioCS4206x64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\THA\ChipsetTHA.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdocl64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Broadcom\BroadcomWirelessWin7x64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\x64\difxapi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\DLMCom.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\WB64A\atihdwb6.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmafd\WB64A\amdkmafd.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1036\SetupResources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\NOR\ChipsetNOR.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ARA\ChipsetARA.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\atdcm64a.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdh264enc64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\NLD\ChipsetNLD.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1040\SetupResources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\mfc110u.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\TRK\ChipsetTRK.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleWirelessTrackpad64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\PLK\ChipsetPLK.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\LanguageMgr.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\FRA\ChipsetFRA.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\DotNet45\dotnet45\dotnetfx45_full_x86_x64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1049\SetupResources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdocl_ld64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\difxapi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\ovdecode.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ENU\ChipsetENU.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleODDInstaller64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\PackageManager.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\PTG\ChipsetPTG.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\WB64A\amdacpksl.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amd_opencl32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Asix\AsixSetup64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\RUS\ChipsetRUS.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\Setup.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdkmpfd.sbz	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\difxapi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\CHS\ChipsetCHS.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\CHT\ChipsetCHT.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ITA\ChipsetITA.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Microsoft\vcredist_x64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\Setup.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\ia64\Difx64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\CRCVerDLMExt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\EncryptionDLMExt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Broadcom\BroadcomEthernet64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdkmpfd.ssz	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\InstallManager.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleMultiTouchTrackPadInstaller64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\CompressionDLMExt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Setup.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\mcl64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\openvideo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\ovdecode64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amf-mft-mjpeg-decoder64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ControlCenterActions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\InstallManagerApp.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdmftvideodecoder_32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\x64\Difx64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\xerces-c_2_6.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\coinst_14.30.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdmftdecoder_32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdhwdecoder_64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdhsasc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ELL\ChipsetELL.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\PTB\ChipsetPTB.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\openvideo64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amf-mft-mjpeg-decoder32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\2052\SetupResources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleBluetoothInstaller64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\CSVer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleRemoteInstaller64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Cirrus\CirrusAudioCS4208x64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\DEU\ChipsetDEU.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmpfd\WB64A\amdkmpfd.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Setup.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\JPN\ChipsetJPN.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\SetupEngine.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\DetectionManager.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdhwdecoder_32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdmftvideodecoder_64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\msvcp110.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\W764A\atihdw76.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Microsoft\vcredist_x86.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\zlibwapi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\IntelEthernetInstaller64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleCamera64.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdkmpfd.sbz			Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdkmpfd.ssz			Jump to dropped file

Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaCHS.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaCHT.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaCSY.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaDAN.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaDEU.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaENU.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaESP.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaFIN.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaFRA.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaGRK.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaHNG.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaITA.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaJPN.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaKOR.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaNLD.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaNOR.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaPLK.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaPTB.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaRSA.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaSVE.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaTHA.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaTRK.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseCHS.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseCHT.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseCSY.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseDAN.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseDEU.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseENU.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseESP.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseFIN.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseFRA.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseGRK.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseHNG.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseITA.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseJPN.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseKOR.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseNLD.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseNOR.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licensePLK.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licensePTB.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseSVE.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseTHA.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseTRK.txt	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1028\eula.rtf	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1031\eula.rtf	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1033\eula.rtf	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1036\eula.rtf	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1040\eula.rtf	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1041\eula.rtf	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1042\eula.rtf	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1049\eula.rtf	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\2052\eula.rtf	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\3082\eula.rtf	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\CSY\ChipsetCSY.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1028\SetupResources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleKeyboardInstaller64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ATILog.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amd_opencl64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\KOR\ChipsetKOR.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Broadcom\BroadcomCardReader64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\clinfo.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleNullDriver64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\DAN\ChipsetDAN.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ESP\ChipsetESP.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdhsasc64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ATIManifestDLMExt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\3082\SetupResources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\WB64A\delayapo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\W764A\delayapo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\msvcr110.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\mfc110u.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\msvcp110.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Broadcom\BroadcomWirelessWin8x64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleDisplayInstaller64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\ia64\difxapi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\mcl32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\sqmapi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ATISetup.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdmftdecoder_64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC12RTx86\vcredist_x86\vcredist_x86.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\FIN\ChipsetFIN.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\SVE\ChipsetSVE.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Broadcom\BroadcomComController64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdocl_ld32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\HEB\ChipsetHEB.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1031\SetupResources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdh264enc32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\SetupUi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1033\SetupResources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdocl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdocl_as32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleWirelessMouse64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\HUN\ChipsetHUN.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\IntelMgmtEngine.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleSDCardReader64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmpfd\W764A\amdkmpfd.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1042\SetupResources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1041\SetupResources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdocl_as64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\msvcr110.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Cirrus\CirrusAudioCS4206x64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\THA\ChipsetTHA.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdocl64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Broadcom\BroadcomWirelessWin7x64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\x64\difxapi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\DLMCom.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\WB64A\atihdwb6.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmafd\WB64A\amdkmafd.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\NOR\ChipsetNOR.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1036\SetupResources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\atdcm64a.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ARA\ChipsetARA.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdh264enc64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\NLD\ChipsetNLD.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1040\SetupResources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\mfc110u.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\TRK\ChipsetTRK.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleWirelessTrackpad64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\PLK\ChipsetPLK.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\LanguageMgr.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\FRA\ChipsetFRA.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1049\SetupResources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\DotNet45\dotnet45\dotnetfx45_full_x86_x64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdocl_ld64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\difxapi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\ovdecode.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\PackageManager.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ENU\ChipsetENU.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleODDInstaller64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\PTG\ChipsetPTG.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\WB64A\amdacpksl.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amd_opencl32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Asix\AsixSetup64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\RUS\ChipsetRUS.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\Setup.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdkmpfd.sbz	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\difxapi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\CHS\ChipsetCHS.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\CHT\ChipsetCHT.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ITA\ChipsetITA.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Microsoft\vcredist_x64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\Setup.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\EncryptionDLMExt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\ia64\Difx64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\CRCVerDLMExt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Broadcom\BroadcomEthernet64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdkmpfd.ssz	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\InstallManager.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleMultiTouchTrackPadInstaller64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\CompressionDLMExt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Setup.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\mcl64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\openvideo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ControlCenterActions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amf-mft-mjpeg-decoder64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\ovdecode64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\InstallManagerApp.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdmftvideodecoder_32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\x64\Difx64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\xerces-c_2_6.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdmftdecoder_32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\coinst_14.30.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdhwdecoder_64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdhsasc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\PTB\ChipsetPTB.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ELL\ChipsetELL.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\openvideo64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amf-mft-mjpeg-decoder32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleBluetoothInstaller64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\2052\SetupResources.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\CSVer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleRemoteInstaller64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\DEU\ChipsetDEU.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmpfd\WB64A\amdkmpfd.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Cirrus\CirrusAudioCS4208x64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\JPN\ChipsetJPN.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\SetupEngine.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Setup.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\DetectionManager.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdhwdecoder_32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdmftvideodecoder_64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\msvcp110.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\W764A\atihdw76.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Microsoft\vcredist_x86.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\zlibwapi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleCamera64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\IntelEthernetInstaller64.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_13-9900

Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe

API coverage: 5.4 %

Source: C:\Windows\SysWOW64\unarchiver.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 7_2_0125B1D6 GetSystemInfo,

7_2_0125B1D6

Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe

API call chain: ExitProcess graph end node

graph_13-9902

Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe

13_2_0000000140012C80

Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe

13_2_00000001400013C0

Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe

13_2_0000000140012C80

Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe

Code function: 13_2_000000014000E228 GetProcessHeap,

13_2_000000014000E228

Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Code function: 13_2_000000014000E56C SetUnhandledExceptionFilter,		13_2_000000014000E56C
Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Code function: 13_2_000000014000E54C SetUnhandledExceptionFilter,UnhandledExceptionFilter,		13_2_000000014000E54C

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges" "C:\Users\user\Downloads\bootcamp5.1.5769.zip	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C "C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe

Code function: 13_2_000000014000B50C cpuid

13_2_000000014000B50C

Source: C:\Windows\SysWOW64\cmd.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe

Code function: 13_2_000000014000EF68 GetSystemTimeAsFileTime,GetCurrentThreadId,GetTickCount64,GetTickCount64,QueryPerformanceCounter,

13_2_000000014000EF68

Source: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe

Code function: 13_2_00000001400068A0 GetVersionExA,

13_2_00000001400068A0

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	2 Native API	1 Windows Service	1 Windows Service	21 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 System Shutdown/Reboot	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	3 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	25 System Information Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	Protocol Impersonation			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://download.info.apple.com/Mac_OS_X/031-30890-20150812-ea191174-4130-11e5-a125-930911ba098f/bootcamp5.1.5769.zip	0%	Virustotal		Browse
https://download.info.apple.com/Mac_OS_X/031-30890-20150812-ea191174-4130-11e5-a125-930911ba098f/bootcamp5.1.5769.zip	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ATILog.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ATILog.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ATIManifestDLMExt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ATIManifestDLMExt.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ATISetup.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ATISetup.exe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\CRCVerDLMExt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\CRCVerDLMExt.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\CompressionDLMExt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\CompressionDLMExt.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ControlCenterActions.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ControlCenterActions.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\DLMCom.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\DLMCom.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\DetectionManager.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\DetectionManager.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\EncryptionDLMExt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\EncryptionDLMExt.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\InstallManager.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\InstallManager.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\InstallManagerApp.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\InstallManagerApp.exe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\LanguageMgr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\LanguageMgr.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\PackageManager.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\PackageManager.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\Setup.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\Setup.exe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\atdcm64a.sys	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\atdcm64a.sys	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\difxapi.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\difxapi.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\mfc110u.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\mfc110u.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\msvcp110.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\msvcp110.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\msvcr110.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\msvcr110.dll	0%	Virustotal	Browse

Source	Detection	Scanner	Label
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://atimonet.atitech.comhttp://172.24.5.135http://localhosthttp://www2.ati.comhttp://www.amd.comh	0%	Avira URL Cloud	safe
http://atimonet.atitech.comMemSzhttp://172.24.5.135http://localhosthttp://www2.ati.comCPUFlhttp://ww	0%	Avira URL Cloud	safe
http://www.AMD.comDisplayNameCustom	0%	Avira URL Cloud	safe
http://atimonet.atitech.comyeshttp://172.24.5.135http://localhosthttp://www2.ati.comhttp://www.amd.c	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://certificates.intel.com/repository/certificates/Intel%20External%20Basic%20Issuing%20CA%203A(1	7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.intel.com/repository/certificates/Intel%20External%20Basic%20Issuing%20CA%203A(1).crt0u	7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.AMD.comDisplayNameCustom	2052.mst0.8.dr, 1054.mst.8.dr, 1049.mst0.8.dr	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp, ChipsetELL.dll.8.dr, ChipsetARA.dll.8.dr, ChipsetENU.dll.8.dr, ChipsetPLK.dll.8.dr, ChipsetRUS.dll.8.dr, ChipsetESP.dll.8.dr	false		high
http://atimonet.atitech.comMemSzhttp://172.24.5.135http://localhosthttp://www2.ati.comCPUFlhttp://ww	DetectionManager.dll.8.dr	false	Avira URL Cloud: safe	unknown
http://atimonet.atitech.comhttp://172.24.5.135http://localhosthttp://www2.ati.comhttp://www.amd.comh	DLMCom.dll.8.dr, DetectionManager.dll.8.dr	false	Avira URL Cloud: safe	unknown
http://www.bis.doc.gov/	eulaCHS.txt.8.dr	false		high
http://ocsp.thawte.com0	7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp, ChipsetELL.dll.8.dr, ChipsetARA.dll.8.dr, ChipsetENU.dll.8.dr, ChipsetPLK.dll.8.dr, ChipsetRUS.dll.8.dr, ChipsetESP.dll.8.dr	false	URL Reputation: safe	unknown
http://atimonet.atitech.comyeshttp://172.24.5.135http://localhosthttp://www2.ati.comhttp://www.amd.c	DetectionManager.dll.8.dr	false	Avira URL Cloud: safe	unknown
http://certificates.intel.com/repository/CRL/Intel%20External%20Basic%20Policy%20CA.crl0	7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.intel.com/repository/CRL/Intel%20External%20Basic%20Policy%20CA.crl	7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sourceware.org/bugzilla/	amdocl_ld64.exe.8.dr	false		high
http://certificates.intel.com/repository/certificates/Intel%20External%20Basic%20Policy%20CA.crt0	7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.bis.doc.gov/.	eulaENU.txt.8.dr	false		high
http://www.intel.com/repository/certificates/Intel%20External%20Basic%20Policy%20CA.crt0l	7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.intel.com/repository/CRL/Intel%20External%20Basic%20Issuing%20CA%203A(1).crl	7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp	false		high
http://certificates.intel.com/repository/CRL/Intel%20External%20Basic%20Issuing%20CA%203A(1).crl0	7za.exe, 00000008.00000003.2501524692.0000000001550000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.16.103	unknown	United States	15169	GOOGLEUS	false
172.253.62.94	unknown	United States	15169	GOOGLEUS	false
23.62.230.48	unknown	United States	20940	AKAMAI-ASN1EU	false
172.253.63.101	unknown	United States	15169	GOOGLEUS	false
172.253.122.84	unknown	United States	15169	GOOGLEUS	false
172.253.122.94	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1369790
Start date and time:	2024-01-04 14:05:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://download.info.apple.com/Mac_OS_X/031-30890-20150812-ea191174-4130-11e5-a125-930911ba098f/bootcamp5.1.5769.zip
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@27/927@0/9
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 50 Number of non-executed functions: 43

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Skipping network analysis since amount of network traffic is too extensive

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1602
Entropy (8bit):	5.11922475107542
Encrypted:	false
SSDEEP:	48:VqxLGUGbUGUGpGGWGUGpTGbCGoG8GcGUGJGUGDGwRGTfG4P6hn:Vs3w4Po
MD5:	4229DED48D312541C57C34B046EDCD85
SHA1:	6760C8EDCA185EEB980B06CC82BCA95427E4DC98
SHA-256:	313D7C66C66187CF3888F5A6ACAA962EA099827EEF0193DBC17D3469A72DBCBB
SHA-512:	794BA9EFFECBFE0C1997FC6955AD9D38F829AE15FA60A7C956F97F349EC60326DD15477B884B8ADBF5DB900670F34C6644B3454B4F90B4B7B2947D849465644D
Malicious:	false
Reputation:	low
Preview:	01/04/2024 2:07 PM: Unpack: C:\Users\user\Downloads\bootcamp5.1.5769.zip..01/04/2024 2:07 PM: Tmp dir: C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges..01/04/2024 2:07 PM: Received from standard out: ..01/04/2024 2:07 PM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..01/04/2024 2:07 PM: Received from standard out: ..01/04/2024 2:07 PM: Received from standard out: Scanning the drive for archives:..01/04/2024 2:07 PM: Received from standard out: 1 file, 542286415 bytes (518 MiB)..01/04/2024 2:07 PM: Received from standard out: ..01/04/2024 2:07 PM: Received from standard out: Extracting archive: C:\Users\user\Downloads\bootcamp5.1.5769.zip..01/04/2024 2:07 PM: Received from standard out: --..01/04/2024 2:07 PM: Received from standard out: Path = C:\Users\user\Downloads\bootcamp5.1.5769.zip..01/04/2024 2:07 PM: Received from standard out: Type = zip..01/04/2024 2:07 PM: Received from standard out: Physical Size = 542286415..01/04/2024

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\BootCamp.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	144522
Entropy (8bit):	5.401303026460357
Encrypted:	false
SSDEEP:	1536:/kGSrj/pQJVWo2YHw5lUYzyqHHR0jDCPjiHi30GNyngdFbSrXdc8C/xm:/kGq30G5xm
MD5:	17307432DFDB86A78136C35EE15BB137
SHA1:	0F0CC126EE986E72410051299EF66E6DA2A5F9BB
SHA-256:	C5B89D880C0784694FEC7295B256588F957C7C4C346C0420CD09B67A3AD11C08
SHA-512:	389072C5272BF3B782DF4247BD27B24747352E72729E6D55669AC7697C9EEC57BF87AE9AE642851332D27E50118A982EC4C28E742BDBA340D88D8BF15E9FFCFE
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0"?>..<?xml-stylesheet type='text/xml' href='test.xsl'?>.. Information on Boot Camp build-->..<BuildInfo BuildNumber="5769" ProductName="Boot Camp">...<MsiInfo>....<ProductManufacturer>Apple Inc.</ProductManufacturer>....<ProductVersion>5.1.5769</ProductVersion>....<ProductCode>{FA2B2C2A-EA41-495A-9308-60726125D562}</ProductCode>....<Component Name="AppleOSSMgr.exe" GUID="*" SharedDLL="yes">.....<File Name="AppleOSSMgr.exe">......<KeyPath>yes</KeyPath>......<FileVersion>4.2.0.0</FileVersion>.....</File>.....<Registry>......<Key>HKLM\SOFTWARE\Apple Inc.\Boot Camp</Key>......<Name>Build Version</Name>......<Type>string</Type>......<Value>[BUILDVERSION]</Value>.....</Registry>.....<Registry>......<Key>HKLM\SOFTWARE\Apple Inc.\Boot Camp</Key>......<Name>VersionNT</Name>......<Type>string</Type>......<Value>[VersionNT]</Value>.....</Registry>.....<Registry>......<Key>HKLM\SOFTWARE\Apple Inc.\Boot Camp</Key>......<Name>ModelID</Name>......<Type>string</Type>......<Value>[

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ATILog.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	116736
Entropy (8bit):	5.535725344000434
Encrypted:	false
SSDEEP:	3072:xAV+1JhAt718XI3lOyAyk1zi99zUO3/69RChmY:Bh88yA7z6zUO3/69YAY
MD5:	4BD20821D2923CD92656994FE2448BCA
SHA1:	BB148CE37523C94ABEA7DE326580C87E19B952B3
SHA-256:	F3835C3D2E15518887578DD1C561403297578101C7AD78E61640893A36E19E2E
SHA-512:	0CBED85203808E1E5B16E3D198FB4E4BAF3103B5B176857CCD19845ECD86EC16798CB6D28099F060B0B35543B8949FFEA41E16CE3C034F7F6FCED58334BB209E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........wt..wt..wt.....wt.o....wt.o....wt.o....wt.o....wt..wu..vt.b...wt......wt......wt......wt......wt.Rich.wt.........PE..d.....UT.........." .....,........... ....................................................`.........................................P...I.......d...................................................................0\..p............@..(............................text....*.......,.................. ..`.rdata...q...@...r...0..............@..@.data...P...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ATIManifestDLMExt.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	443392
Entropy (8bit):	5.631673600918603
Encrypted:	false
SSDEEP:	6144:7kL2yFevxlCSkhdv89M/VDfZp/uBWSHCpLewq5wTwQ3O33tGYjbN:7kL2QmxlBIdv8c/4PWTwQ1Y3N
MD5:	8DE9A29387317224108F2CE9E2D81163
SHA1:	1A5E794EF77CB899674F542C93A35174329D6D72
SHA-256:	9F0C58367FC8A737FCE1C6DD28BD4DBDF9F6100FD7230B065CF53C90275129D7
SHA-512:	A21C2B099215294349C2BFB99415664DB2E67E2A7981F8A964B52751468D3195B1A3F92734A75274A52E999D49C0C5E7B251277EA84272B6AC655D5B25A22AA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:...~..~..~...8..p...^..\|...^..s...^..x...^..v....n.j...s..}..~.....s..j...s......s......s.....Rich~..................PE..d...&.UT.........." .....z...Z............................................... ............`......................................................................6..................p...8...............................p............................................text....x.......z.................. ..`.rdata...G.......H...~..............@..@.data...............................@....pdata...6.......8...f..............@..@.rsrc...............................@..@.reloc..,!......."..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ATISetup.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	581320
Entropy (8bit):	5.400446128167908
Encrypted:	false
SSDEEP:	6144:5QrnMNExBjjfi0z/+6USBQON7Ul9vHCtxOfzQKDzKiIJT:5Qr/Bnfi0z//vQOJuvCMzhKlJT
MD5:	FCD7ECF7902FACFB111C8B949DC27423
SHA1:	DF266D3EA04077F45B964C0EC3C9515D74053CAA
SHA-256:	70B6F45B7AF73651198287DC5E368DC05FCFBF489475B1F06821BD026878F9F3
SHA-512:	635D58C31C9F7E09E1FC1BEB7E58803812C0B8F334ADFA125144438891EC917B8EE94ACF57348BAEB576CD3D5D2B90F0E4F2A0D54C7D8593CD12B045C1EA99DD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............`B..`B..`B/R.B..`B@4.B..`B@4.B..`B@4.B..`B@4.B..`B.o.B..`B..aB:.`B..B..`B..B..`B...B..`B*..B..`BRich..`B........PE..d...V.UT.........."...........................@.....................................Z....`.................................................\|z.......p...w.......R..................@...8...............................p............................................text...Q........................... ..`.rdata..0...........................@..@.data....].......L..................@....pdata...R.......T..................@..@.rsrc....w...p...x...4..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\CRCVerDLMExt.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	188928
Entropy (8bit):	5.35442958981537
Encrypted:	false
SSDEEP:	3072:t+zhmZAq0933p543rIdryaxC0j20JrbvTXzE364Jaf1t/jt/Bjl5pVLPZ+JFhRh1:kWAq09+irDxCnz+O3H5bL
MD5:	728A83893404D0CBA684F32E494D360D
SHA1:	BB542E41E0C68B9E2B835A62D9374677A91B2614
SHA-256:	55EBC510B259F61D7CCF81439FBA62270E10D8C6CF39CFB17752434973679477
SHA-512:	8C4CEE758018DBB47A8D9EF7771437F6FC28B0BCC7856DD01385663B8B3DFAEBEB15A0689C235ADCD32A041CEC3393E0C42AD5528C0C818B84D74969BAA5604F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........m.>.>.>s.A>.>.}K>.>.}H>.>.}M>.>.}I>.>..?>.>.>...>vPM>.>vPI>.>vPL>.>vPO>.>vPJ>.>Rich.>........................PE..d.....UT.........." ................ ........................................0............`..................................................h..x............................ .......7..8........................... %..p............0...............................text...i........................... ..`.rdata...a...0...b..................@..@.data...`J.......:...~..............@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\CompressionDLMExt.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	195584
Entropy (8bit):	5.376693316943743
Encrypted:	false
SSDEEP:	3072:J3lSt6pFE6J3Lv/ZdIZ62NrDiaBJC6chO3t8OG:J1StQFJ/o6wrZm6chO3t8O
MD5:	10876D027707327127D2BDFEC3385AFF
SHA1:	2F1788F50636F53903C7BF7A4671782900256D08
SHA-256:	C6AA4057262B0674C7C0461E3C883CCDE705723D7F172D53E941B122DDD66019
SHA-512:	B336BE89FC267E0F532EA8E82B7769ADD6FB3DCFEBFD0BE0D4DDF3474BA165E3B7E76F4A732984AC9E1D8E5848A142CEFAFF95F863CE328B09DC3E092C6F1AFB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S..C2u@C2u@C2u@5..@A2u@..@B2u@...@A2u@...@O2u@...@G2u@...@K2u@.E.@M2u@C2t@43u@..@@2u@..@H2u@..@B2u@..@B2u@..@B2u@RichC2u@........................PE..d...*.UT.........." .....(...................................................@............`.........................................`.......x~....... .......................0......pG..8........................... 8..p............@...............................text....'.......(.................. ..`.rdata..ih...@...j...,..............@..@.data....F.......:..................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ControlCenterActions.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	216576
Entropy (8bit):	5.931697023016733
Encrypted:	false
SSDEEP:	3072:x0uGysvZFH0GiCNuOJe0T9pUZv5VWCKQskPnEQ+K5IWGpf33miOK:xonvUduZI0T+v5VDZYxGk
MD5:	ACE3D5BE1753AD4F2FC67CF72E5859A2
SHA1:	D7E12D321F2FBFEF2046809D3D798481DB780A88
SHA-256:	D8C05B157ABBE3AF0272AACB5B893FAEE53885D6A7D06893321A78BCB05E9632
SHA-512:	8B14EEE6D7ED278660E6CEC7342CB1DC3F606C6EAC863EC23F79B2DBB3790A253B038D5ED79DD266C2E79C6C58E530D6C2C14AC2A8A60AD4F08E4C5163DBEDC5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........XhdDXhdDXhdD...DRhdD...D.hdD...D.hdD...DUhdDXheD(hdD..DYhdD..DYhdD..DYhdDXh.DYhdD..DYhdDRichXhdD........PE..d...S.UT.........." .........r......x.....................................................`.........................................0...s.......x....p..(....P..........................8...............................p...............0............................text............................... ..`.rdata..............................@..@.data....J.......$..................@....pdata.......P......................@..@.rsrc...(....p.......4..............@..@.reloc...............>..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\DLMCom.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	782848
Entropy (8bit):	5.622426210196143
Encrypted:	false
SSDEEP:	6144:8Mkc5+7hFe81INHp5AOzBnBqbFr6uRr5ZFIXtqjfu+g62wlO3pqmT1stFJDobS13:8Mkc07luebRZ57jfXLMqmT1strDcC
MD5:	6B78EC496F7B08149F25CA8305041B0A
SHA1:	310E1E98D278EC4504DF278217A59BCF2D9BD0DE
SHA-256:	29ECBFDFEDBB0A19D1B9BF233F55460BAB1AE8F3CD27D4F4CEC081B5983F2561
SHA-512:	D54F237AA5EC61C077898118381614718A34BA6D26523A812EC077A4C6776C8D575A12C48674516931E26A1C1E3CD0A7B13C2F1791FF8F4D9766C66A2F02C639
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4...4...4...._b.5....9h.6....9k.8....9n.0....9j.2...4...i......9.....j. .....o.5.....l.5.....i.5...Rich4...........................PE..d.....UT.........." .........p...............................................0............`.........................................`........N...............`..H................%......8...............................p...............(............................text...y........................... ..`.rdata..............................@..@.data...@...........................@....pdata..H....`.......:..............@..@.rsrc...............................@..@.reloc...+.......,..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\DetectionManager.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1491968
Entropy (8bit):	5.190839833257951
Encrypted:	false
SSDEEP:	6144:6Elotcxpz/205xNOoa2hmUSeW8Bp8Bnvus2IWc2DvQIx9ZNEF4sLi4O3cTOFqjvl:7lZzu05jOobSrjWJvFZ4hWw/vrJ/
MD5:	8D24CA8EDD838FA19C90B676ABB513F3
SHA1:	969341271EC60E4649126EADF04CA384BA8A3A36
SHA-256:	DD5D2CBDA6F0633CA5C979736C12497C4807C814B8FD69A7DFFFBE455BFEC1BB
SHA-512:	7167B538492FD13891AAE7AD475DED1D6C94CB043D01ACC60245B4FD7326EF3083683FC14269514B35EB003C12F3844E249EAB088569F86C0E5DE162BF6E8C83
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>z.Bz...z...z....lz.{......{.......x.......v.......\|.......v....lx.{...z........l}.c.......].......{.......{...z.S.{.......{...Richz...........PE..d....UT.........." .........\............................................... ............`.........................................P...>...............H<......x................F......8...............................p............................................text...a........................... ..`.rdata..............................@..@.data.......0......................@....pdata..x...........................@..@.rsrc...H<.......>...2..............@..@.reloc..lS.......T...p..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\EncryptionDLMExt.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	197632
Entropy (8bit):	5.392471466370208
Encrypted:	false
SSDEEP:	3072:kW0oU3zfcDehnI9hsmKQ0+W0dwO3K2VV92Vc+:kBoSDkh/PNqO3K2B26+
MD5:	4A2F16D971D17646980421A614FD89FE
SHA1:	E9BF5C4CA12EBBC318AE0E1B8B21974400BE944A
SHA-256:	8A9EBE97D00C8134D0C613D24EF70D8F96B904628FA2D986DF296BDCE92A91AF
SHA-512:	206D9DA3738A752FD184389700F2E6C9EB9B8A1E8E8C8382A593C2C440989DFF6441ED93EB278126E9E09FAABC31D02DD9EF68CE7B8B85A80A81D1B3F9946A0B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................o.$....e.....e-.....e(.....e,......Z........jH(...jH,....jH)...jH...jH/...Rich..................PE..d...1.UT.........." ...............D........................................@............`.................................................x........ .......................0.......G..8............................;..p............@...............................text....).......*.................. ..`.rdata...n...@...p..................@..@.data....I.......:..................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\InstallManager.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1664512
Entropy (8bit):	5.390754661424009
Encrypted:	false
SSDEEP:	12288:bqG20gJKhrBRBKuL2k5mw4U2UO6FdodY/6OxV/E7D9HutkqE7AuFe:WG2RwBRBxKUO6k5OxV/QDYkv7AuFe
MD5:	68BA1D25BC329002FDBB83CAA1FCEBF6
SHA1:	BE2B2A06562D2539E9114D25F7F4A952BA12A7C1
SHA-256:	C48EED1ABB1F62ECD27F9C30392D4104F329E483B49816D376BEB60A77D65AFD
SHA-512:	464EF96B4230E64DA2919D04FD1ADA015696B25C19748157D7CB06A945EB2B2A46B8BC5127D5E469C2DAF99D0CC81DEF1622CBABB9A50684B655A3F1BFF9359C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?o9t{.W'{.W'{.W'.'z.W'..'y.W'..'v.W'..'..W'..'s.W'..'y.W'..,'n.W'{.V'..W'..'_.W'..'z.W'..'z.W'{..'z.W'..'z.W'Rich{.W'................PE..d...".UT.........." .....j...........c....................................................`.........................................0........k....... ...$...P..l............P..DD..`...8...........................@...p............................................text....h.......j.................. ..`.rdata...>.......@...n..............@..@.data...`........t..................@....pdata..l....P......."..............@..@.rsrc....$... ...&..................@..@.reloc...S...P...T..................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\InstallManagerApp.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5767368
Entropy (8bit):	5.864769772464508
Encrypted:	false
SSDEEP:	98304:OTaFXZ7mVsC17P8GZMMRHGV7EDD4kIQB2XOdCaCE0fEMXk:iaPGLGV7EX1gaCaC1jX
MD5:	D8992F748DFB97C30FDA6E7D508A2296
SHA1:	5E1AFBFB4159DEBBF79917F6D1A3A5D38735B6BA
SHA-256:	48A6CE0A4EF09AAE855A39398000591A7C70C5BB225ACD65085EEA84A8A1D2C5
SHA-512:	6242B986FD7FE8EFBEE4FD92FCE84579097B53096820A50D92A6B409CBC30EE2C90185F43555D2E7300342BC854DE1DF8A8D84C4BEEAD7A06CFA0E45D7723055
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.S./.../.../..{..../..{..../..{..../..{..../......./......./....\|../..vX.../.../...+....j../......./......./.../.../......./..Rich./..........PE..d.....UT.........."......R....F................@.............................@X......X...`..................................................h/......`7.0q....6..\....W.......V..+......8............................,.p............p..."...........................text...UP.......R.................. ..`.rdata..xY...p...Z...V..............@..@.data...0+..../......./.............@....pdata...\....6..^....5.............@..@.rsrc...0q...`7..r....7.............@..@.reloc...\....V..^....V.............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\LanguageMgr.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	387584
Entropy (8bit):	5.4364888481355855
Encrypted:	false
SSDEEP:	3072:P/jIyOfJwW8KniPW23N/O33ZMYY/IKPf4TimMBmr/d8F52romBUO3AK+wfKYuKm:XjjVd/XLwTPGIU52kkUO3AK+h
MD5:	2866111578B13CB7DE3B8A798DF67B30
SHA1:	3FA730FB006E072F4A6CCB82CEAABE4E1B732F9F
SHA-256:	16A1C8DA2EA9ADE80DA3BCA1ED3E49899AC21BD8D7E8BB03C68D555B60A415C7
SHA-512:	E826A275E64FB5E16FA331F10FB089D5F05FD8088D4E33E5547D051EA6EE2128D93BDBFEBF31AE3316DC4D7D55EA1D305BD726AF355B3ED7378CCAAD41E2EE93
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v..2..2..2...%..3...C..0...C..>...C..6...C..;....a.<..2..D...n..1...n..>...n..3...n..3..2.O.3...n..3..Rich2..........................PE..d....UT.........." .....$................................................... ............`.........................................@l.......?..................X>..............@....G..8........................... ...p............@...............................text....#.......$.................. ..`.rdata...,...@.......(..............@..@.data...PH...p...<...V..............@....pdata..X>.......@..................@..@.rsrc...............................@..@.reloc..f...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\PackageManager.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	848896
Entropy (8bit):	5.306961574573624
Encrypted:	false
SSDEEP:	6144:fqWrpfNpcsb5tCF8LRmFKoDd12ibrudZpt0Y5JP8AYj+kAdVVy27o5eO3eAyGnwt:iApf75b5tnQbqrD04P8AK+kA7Vyvzc
MD5:	96399F5F50CD1918D39EE6B20A674033
SHA1:	3FA0D193E98DF31040A0BFF315D2D6A1057B568B
SHA-256:	6D65D815ADA5A8B648A6E5D1E30031006B08DAE12529257883C7400FF91C8B1B
SHA-512:	04A3AC2B8D04E463EB14DF6B0F55B926DACF32420217618F4EEBC239CDF27E7FC7FCAB5C42766ACBDF78872261DBCFE5566BDD3FB2480DA23C701899BBAD539B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................qx@......J......I......L......H............E........f..t3H....t3M....t3N...........t3K....Rich...........PE..d.....UT.........." .........\|......d........................................@............`.........................................`.......T....................l......................8...........................@...p...............(............................text............................... ..`.rdata..............................@..@.data...............................@....pdata...l.......n...V..............@..@.rsrc...............................@..@.reloc..*'.......(..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\Setup.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	663240
Entropy (8bit):	5.473137118152638
Encrypted:	false
SSDEEP:	6144:EfGrQQ2cwhmCB54gbLNdSJESIg5BgfFnkk0tsAHA6zExWQ/+QiQdQiQ+EB0Ox0OH:E+cQ2+i54gbOvOrRyKvOlfJB
MD5:	52DFF3DA9D5F8952F9BCCEEA1C6C2A4F
SHA1:	AAD970D01350E17DB9B2B95A1DAD0993A24CF050
SHA-256:	053F71856CDD6EBB9887EFEE8835B9FFF54D35D988703A5580A8EA26367970A6
SHA-512:	617BB7E2727C34F0947F731F816B68DC332552DA7C2D6EB223C4748D7B98B09557331745838879DE2C1C0E2BC89A12ADBC027B5D4E2E45048AD9ACB1D134F9D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d. . iN. iN. iN.....iN...."iN....3iN....&iN....(iN. iO..hN.V.5.9iN.....:iN.....!iN. i.!iN.....!iN.Rich iN.................PE..d.....UT.........."..................!.........@.............................@............`..........................................................`....... ...>..............T(......8...............................p............................................text...%........................... ..`.rdata...z.......\|..................@..@.data........ ......................@....pdata...>... ...@..................@..@.rsrc........`.......,..............@..@.reloc...........0..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\atdcm64a.sys

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28872
Entropy (8bit):	6.411605451383069
Encrypted:	false
SSDEEP:	384:O5QZI9+67zDNHVRnBrkK+3iDoCrDzS+5yKnYPLByUHeMm:QQZI0YDNjnROiDhHSK
MD5:	1589AADC69BF71C0DBD9B3C50515D55A
SHA1:	E06102D9841CE4D0127C7C0C003E12E0BC8E826C
SHA-256:	3A44DD921BACEC4AB377362A72051125AE30E63787FD8CFAABFEC2D178A705FF
SHA-512:	D16CE2B1C9D67F4528AC04B48292E2ACF737B2CBB92766EBE3CB5DB8B3C9E4A8DB2B875B1D1459AF5576E1F2FF7C181D7C0EB8BE4F50FB11F8F5168A3BE35126
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,.0.M.c.M.c.M.cx..c.M.cx..c.M.c.M.c.M.cx..c.M.c...c.M.c...c.M.c...c.M.cRich.M.c........................PE..d.....UT.........."......6...........p.........@....................................Uy....`..................................................p..<............`.......R..............................................pK...............@...............................text..../.......0.................. ..h.rdata.......@.......4..............@..H.data...0....P.......B..............@....pdata.......`.......D..............@..HINIT.........p.......F.............. ....rsrc................L..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\difxapi.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	525792
Entropy (8bit):	6.011813537089828
Encrypted:	false
SSDEEP:	12288:6sxYL+kJmoPdVp6s3EJBjCvuF17+2NdJfx:6sxwSoPdVoBjCvuF17+2NdJfx
MD5:	F5558C67A3ADB662D43D40A1CBDE4160
SHA1:	74AD5DD123037CF4D434C5073CBE04C0BCBA4E79
SHA-256:	83C43D65084CD202AA9982AF6D87C963A05035F1E2CDAC48304FA299584E3242
SHA-512:	6DF9F780ADDA4F52D7FBB3BAA6AF3028C0523FF514F1DF0E7DFE380CE21116E09A6F1F3820C316A9AF7E16043EB04CDBFE5E885CA24528661C05E32CD18B2046
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T1...P.F.P.F.P.F7..F.P.F.P.F#Q.F7..F.P.F7..F.P.F7..F/P.F7..F.P.F7..F.P.F7..F.P.F7..F.P.F7..F.P.FRich.P.F........................PE..d.....IE.........." .....$.....................a.............................0.......W....@..........................................0......P................`............... ......p...................................................(............................text...L".......$.................. ..`.data...0....@.......(..............@....pdata.......`.......0..............@..@.rsrc...............................@..@.reloc..$.... ......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\mfc110u.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5620192
Entropy (8bit):	6.640291718772438
Encrypted:	false
SSDEEP:	98304:B0SwgK7eJwoX9Q07vUVSqRqxasFLOAkGkzdnEVomFHKnP:B0CKaJpX9DUsFLOyomFHKnP
MD5:	3D8B311A16F40C08B2487CFAA2FCD621
SHA1:	C37EDD56549706BE607E82EF4233DDDCB3CA28A7
SHA-256:	146E7116E1230B62E692FEE7F204D315A2C93FB59A12EBDDD3B5797D6D06995A
SHA-512:	51329522D96A1701E4D01043C7DBDF828B9551C0F36D8164F9ABFEF986DB8AE455DEEB9F61012159BA3388803B404EFDB0585954F065D79045C4586129697E9F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........773[VY`[VY`[VY`.!.`ZVY`.!.`YVY`.!.`SVY`.!.`VVY`...`YVY`...`ZVY`...`VVY`...`VVY`[VX`.UY`.!.`HVY`...`_VY`...`.WY`...`ZVY`...`ZVY`...`ZVY`Rich[VY`................PE..d......P.........." .....x...+.......(......................................PV.......V...`.........................................0v:......%:.......?.......<..7....U..=....T..`..................................3.p....................:......................text....v......x................. ..`.rdata..............\|*.............@..@.data...(s...P;......<;.............@....pdata...7....<..8....<.............@..@.rsrc.........?......P>.............@..@.reloc........T.......S.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\msvcp110.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	661456
Entropy (8bit):	6.2479591860670896
Encrypted:	false
SSDEEP:	12288:akhiz9iVQi6mpiyMATITfluR3G1YdpTzYJQIbRdJN2EKZm+DWodEEt2L:WaQeIJN2EKZm+DWodEEt2L
MD5:	7CAA1B97A3311EB5A695E3C9028616E7
SHA1:	2A94C1CECFB957195FCBBF1C59827A12025B5615
SHA-256:	27F394AE01D12F851F1DEE3632DEE3C5AFA1D267F7A96321D35FD43105B035AD
SHA-512:	8818AF4D4B1DE913AAE5CB7168DCEC575EABC863852315E090245E887EF9036C81AABAF9DFF6DEE98D4CE3B6E5E5FC7819ECCF717A1D0A62DC0DF6F85B6FEEB8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v.:..si..si..si~`.i..si..ri^.sis.i..si...i..sis.i..sis.i..sis.i..sis.i..sis.i..sis.i..sis.i..siRich..si................PE..d......P.........." ........."......<........................................p......L+....`..........................................3......l...<...............0E.......=... ..,....(..............................`...p............ ...............................text...:........................... ..`.rdata....... ......................@..@.data...p.... ...:..................@....pdata..0E.......F...D..............@..@.rsrc...............................@..@.reloc..FJ... ...L..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\msvcr110.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	849360
Entropy (8bit):	6.542151190128927
Encrypted:	false
SSDEEP:	24576:I+9BbHqWVFlB7s2ncm9NBrqWJgS0wzsYmyy6OQ:z9d7M3nS0wV
MD5:	7C3B449F661D99A9B1033A14033D2987
SHA1:	6C8C572E736BC53D1B5A608D3D9F697B1BB261DA
SHA-256:	AE996EDB9B050677C4F82D56092EFDC75F0ADDC97A14E2C46753E2DB3F6BD732
SHA-512:	A58783F50176E97284861860628CC930A613168BE70411FABAFBE6970DCCCB8698A6D033CFC94EDF415093E51F3D6A4B1EE0F38CC81254BDCCB7EDFA2E4DB4F8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........c.O.0.O.0.O.0.O.0}O.028g0.O.0?..02N.0?..0.O.0?..0.O.0?..0wO.0?..0.O.0?..0.O.0?..0.O.0Rich.O.0........................PE..d...n..P.........." ................l3.......................................@............`..........................................E.......1..(............... g.......=......8...`6..............................P...p............0...............................text............................... ..`.rdata.......0......................@..@.data...(q.......@..................@....pdata.. g.......h...(..............@..@.rsrc...............................@..@.reloc...".......$..................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\xerces-c_2_6.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2377216
Entropy (8bit):	6.162886915531439
Encrypted:	false
SSDEEP:	24576:NC8f9ja/5RXHGrSNLdXiNPzMhf92ZNxIGB57vIkbpfdjvG7H:Nq7XLLdc7MhFONxIGB57fG7H
MD5:	B12D201FF4AC15A134D82923C0B9B302
SHA1:	FEBBDCECD8D1973C69DBC83796F6CE74164EF82D
SHA-256:	C08E8ABFA56E240BD5C84BDC0C6604934F3EEADC574A8466735511CC023A2B67
SHA-512:	922FC432073D94E3E612905556AB0C5B004A4A2FF2142D67DDE7D09C72F1D200C64EFFC7F21D19870485A793CF6A5561DFF0DF3A4CABCC843D7DEF6F3908185C
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................^.6.....1q:.....^.0.....^.3.....^.2.............S.D.....4:2.....4:7.....4:4.......j.....4:1.....Rich............PE..d...s^zQ.........." ..........................................................$...........`......................................... 4..R...t)..P....."..j....!.8............0$..6......................................p...............p............................text...!........................... ..`.rdata..r?.......@..................@..@.data...0.... ......................@....pdata..8.....!.......!.............@..@.rsrc....j...."..l....".............@..@.reloc..jK...0$..L....#.............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\zlibwapi.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	6.4196073834943865
Encrypted:	false
SSDEEP:	1536:3d34luTY6/aYPBqxRjt3JRSVoIOFIORnToIfHyRXCWdd:3hIuBZKjtZMuP5TBfqX/d
MD5:	DD91E4C7D445C31682EBDD22E732D93D
SHA1:	2ED9D1A085FA9179D199E0372D81462816FD7504
SHA-256:	1F047FAEC08D9A35C304FB4A7CF13853589359A8F7CBFDD48C5D5807712DCF05
SHA-512:	0E610C0B97A970ED6077E27F8071F32CCEEF6410133B9EE8934849443B8EBFB022F1D88F9B7BFF77F3B5A243C73B5A4E05FAE843BDBC849BA09168ECB61D5F87
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U.V.;.V.;.V.;. gV.S.;. g@.S.;.V.:.u.;. gF.T.;..ZF.W.;. gJ.G.;. gA.W.;. gG.W.;. gC.W.;.RichV.;.........PE..d...[..B.........." .........z......@................................................................................ ...............J.......G..<.......p....p..,...............T....................................................................................text............................... ..`.rdata...b.......d..................@..@.data........`.......F..............@....pdata..,....p.......H..............@..@.rsrc...p............V..............@..@.reloc.."............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\DLMServer.cfg

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	932
Entropy (8bit):	7.7631962502988
Encrypted:	false
SSDEEP:	24:z3KCOvLHOgsCOnT33hPfP1WjiTGktK07X3g90tFEY:z31OvLuX1nD3hHgjItxj3JtZ
MD5:	2AF436ECB9696189482700C67EF42812
SHA1:	6E9BB956EEF2FC5E0263311FB2A8BDAF389438BD
SHA-256:	6459AE5ED07D2B2FBB3AD95E45809A6511AF5BCD7A786A633B806B7BAA79DEF4
SHA-512:	CC023778737ADE746438631FA90B3E3D215A815FAF4C5C87FF1CEB1A5C6AB99208F711088D993F23ED921D3FE27B6BE15DFE8C649BF74EEA31E4F6E41CBF07E8
Malicious:	false
Reputation:	low
Preview:	#.E.N.C.M.O.N.E.T.$.q..V.iA..B..SF.....7=C..Q.].p.#$.f...5.....+.n^..T..r.z..\|.r..8...W..E..[.%>......:.L..'....A.....O.......x.\.&.".s3.1....#.te.~.._.q..G....8.K.>kZ...]%9.`7e...sc...7...."..A@.:JZw.mi..%......{$.a=!.P...J...Y2).W.t.\|.hF...2........fj.R..&.........-.%d...}..@.5....d..I.4...T."...&.;.I6W.......\|..Ed.....4..s...I..[..7..h.a5..l..(.....HL...K.E...PuI.....4uE.H....)..k".k..0......m...^..x.B@..xM4.\|W.c.e..<.<AOu.4..aa.Ln..16....75Tx..j..z$z..Z.........<.z..n.BiG.!..G.F%[~.9%... .to.8.;:..=C...TWK.d..<..t.c.{f.Q.. .....0.-I.......G.'.......a./.m.<.\|z.V._..OZ....._...i..}..........E.'.$.%Q..Q....AE.w..#q.0.-...~..yC..f5.F...z..^.......m.e.P...M..g...k]Q.5[..5w.}T......f..aT9.V...]..w"O..To....>...'..Uh....e.."...z....q...{....~...D..XKA.+.u.f".J.......w.f......W..z.S..0.Q.w.#H.....W..N]m..Ul...VC...X.x5rw=./.v...,.3..H. .P....&...O.I....%.hb/@.........X.7.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\InstallManager.cfg

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	5.191008065890201
Encrypted:	false
SSDEEP:	12:IH8Xs8XjtiahdwQW8BpvnQcpf5VCQbHtupD75JgfPgZJN+J:IcfTwahdc8BxnQnQDt6bte
MD5:	5592764F3BF54AACFAA2FB5FD9BE235C
SHA1:	D22DBB9A95CA570DE955FAE5B92E9E883ED48B00
SHA-256:	5169A6BD91F44FB8316F651CA005EF243F5DDABA32E745450E0DA0EDCCC92B18
SHA-512:	CE216ADACE4D8B1C6C90DCBB98E6F816208261AC9DB411C40E8E17BCB76C37A79B6607CD0EFAAB4E204E9634D4EE038D3A6CAABDAD10AEF1601B40196014D5BC
Malicious:	false
Reputation:	low
Preview:	UseCustomSettings=true..EnableHWCustomSettings=true..UseCustomColor=true..BackgroundColor=0xf0f0f0..FontColor=0x1e1e1e..FontDisableColor=0x6d6d6d..ButtonColor=0xa1cbca..ButtonDisableColor=0x738c89..TextColorPast=0x94a4a3..TextColorPresent=0x536567..TextColorFuture=0x94a4a3..ButtonBrightness=0.35..URL_DefaultColor=0xED1C24..URL_HoverColor=0x516564..URL_VisitedColor=0x516564..ShowLanguageOption=false..ShowOEMLogo=false..ShowUpdate=false..ShowOEMUrl=true..DGPUWorkaround=true..WorkaroundInstall=false..a=http://raptr.com/amd..b=http://raptr.com/amd..c=http://raptr.com/amd..d=http://raptr.com/amd..e=http://raptr.com/amd..f=http://raptr.com/amd..

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\Language.Dat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	953
Entropy (8bit):	5.4556633828041585
Encrypted:	false
SSDEEP:	12:zlSfGiJ+CyVo4pB6QJxEjfWUFCsWlDKDoIaZ6zYa951vzV1z5+MjMdvwa:WGRCyVoknJCjWi0eDoIaZ6fLLu
MD5:	0F6271E5E4D9BB8D38553511C8EABE3C
SHA1:	D3C22A872406F4863862EE0C633EFCC33839CC83
SHA-256:	735AD9EED2AD5FC395A413B9CACC6664522512096C94F5B27972198B896AAACE
SHA-512:	987D1BCBFFBBFF4CA7F88E11BA18CB9D1B0837570DDD4AF0159A9DB7AC39D587B061C94175DD9FE3CCDA0288B6944732A799AA964F77B8944FC2CF0636D4737B
Malicious:	false
Reputation:	low
Preview:	.######################################################..## This will contain all of the Supported Languages ##..## ##..## The format is as follows: ##..## [Name]=[Value] ##..######################################################....None=00..English(English)=01.........(Arabic)=02...e.tina(Czech)=03..Dansk(Danish)=04..Deutsch(German)=05..........(Greek)=06..Espa.ol(Espa.ol)=07..suomi(Finnish)=08..Fran.ais(French)=09.......(Hebrew)=10..Magyar(Hungarian)=11..Italiano(Italian)=12.....(Japanese)=13.....(Korean)=14..Nederlands(Dutch)=15..Norsk(Norwegian)=16..Polski(Polish)=17..Portugu.s (BR)(Portugu.s (BR))=18.........(Russian)=19..Svenska(Swedish)=20.....(Thai)=21..T.rk.e(Turkish)=22........(Chinese (Simplified))=23........(Chinese (Traditional))=24..All=25....

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MMTableRev0.MSI

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	3.0737774321894964
Encrypted:	false
SSDEEP:	96:sQtFFDjLxuPhDVUwHh2kyCxnEGDQkOEcrz7ACe9e6rBcnoyFf4R4JIUXvEe:sYX9uPhDSSHEtkSrA9e6rq9f
MD5:	5386D7047C640067193223866BFD5B03
SHA1:	54D1881ABCAC7B898208C45F57CED525486C59D9
SHA-256:	05601E36A1B041ED69BFD5D0BD967E2D04283876309C60A9B672786C9A04A4F9
SHA-512:	F04EB2D581F628C4E31D0E4D9020F3EEAF62E6421844249227E866E5E4AE8CA921342F0BC7A1755DC18775FAEAD6F9C2B4D074930966481A4E3BF0E7FE2D667D
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MMTableRev1.MSI

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	4.2853349805715935
Encrypted:	false
SSDEEP:	192:NASFP/Lg8KH3fGU6r8BVD3ghsn3E8vauPnnf37g/EMKTV:Q1VU8Qev
MD5:	A574150DE1ED64FDC2DD9CB522FA403E
SHA1:	555331A5A71FCD527FF432AA0E352B2840484FA9
SHA-256:	E0FF85F1E9D6DFF25694692C53D3301E6EE39448B69D7DB6367B1F8A3802D5CA
SHA-512:	A336BCD2BA60B351E46EE7C723E17970651C57D841DA8C68C2EC4EBBA6F0DEE038F5E8A060A778F22CE111B863AA02BE9974B2F437F8979E1A3D154A95D8BE77
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MMTableRev2.MSI

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	17408
Entropy (8bit):	4.653590078275481
Encrypted:	false
SSDEEP:	192:Swu4PFfN8nTr4H/lWxU6rn3VCwL2IsQIesvTwVh1JVB1hz5N9ulDofPYlRWOV9:TfFUno/jOsvKpYl
MD5:	866D8A36609EFDDD5BCFABED75CF836B
SHA1:	BAAA1826867823625E1938544DC4DC67789F05A7
SHA-256:	B5F042DFC05D0162301FF4738DB4030CE67D0B749C19083DB67807F6008D90E2
SHA-512:	963D92A19F916C93EC6D9E57E44B2C68101DA2B0BCB55D87D2EB7DFD1C5375A0DC566D2DCCEBD36782D386193CC4AF78F2FF3B07E97B0BE7EC85A4F5016F3669
Malicious:	false
Reputation:	low
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\Monet.ini

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	919
Entropy (8bit):	4.768833494323987
Encrypted:	false
SSDEEP:	24:jlZ1t6+BHLLmyyUMm31A9mOERUMPZ3GA9xOeEpGL/o:by+BHXmyssC9kfPhJ9sTn
MD5:	19A00552536AAA2D32273551CFD93DF4
SHA1:	42ADE217CDC2D81DF0865C7C8D773D7186766E31
SHA-256:	CCF370F250CA68FF0229A598D650F57B3B8BF1FF180869D63E380FA134144B0F
SHA-512:	FA21677B2FA771949403443B0568E20F93A66EEB20A18F09768DE93CA012C55AAED2FB977B319CE8933421FE73B3E6666A5589FA4A9085711FB56A4964447495
Malicious:	false
Reputation:	low
Preview:	#############################################################..## list files that need to install or Uninstall (for testing) ..## Format:..##. InstallPackage.X=[Package name][,Command line]..## Note: X number orde from 0....#############################################################..InstallPackage.1=ATI UnitTest Install 1.Msi,\A \B \C..InstallPackage.2=ATI UnitTest Install 2.Msi,\D \E\ F:..InstallPackage.3=ATI UnitTest Install 3.Msi,\G"HKLM"..InstallPackage.4=ATI UnitTest Install 4.Msi,..InstallPackage.5=ATI UnitTest Install 5.Msi,\Silent....##Uninstall Packages sample ....UnInstallPackage.1=ATI UnitTest Install 1.Msi,\A \B \C..UnInstallPackage.2=ATI UnitTest Install 2.Msi,\D \E\ F:..UnInstallPackage.3=ATI UnitTest Install 3.Msi,\G"HKLM"..UnInstallPackage.4=ATI UnitTest Install 4.Msi,..UnInstallPackage.5=ATI UnitTest Install 5.Msi,\Silent....## Uninstall all detect packages ..UnInstallPackage.5=.,\S

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetCHS.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text
Category:	dropped
Size (bytes):	100674
Entropy (8bit):	4.431666343976645
Encrypted:	false
SSDEEP:	3072:Vw3xApvKSAFn7L16yPnWYg3sCmqdE0LTKleFTk3umU:ELLw
MD5:	D36C75E7FDE15594D290F80A899D76F7
SHA1:	C30C70027F0C4A2632FC72D3495701B7E2C82CD9
SHA-256:	14DA44AA27260228223E6C79CF41BA69B8230246C585C260D64A100630736573
SHA-512:	AE183295B5B78256FB5495DC9C325A311B6FEDB165C7D7A043E36B0A62ECBD65DBC26B46A7C853FC510E7D5367CDE9D877FA8E1EBA75BCC2AF4B647838A353D9
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>...<.R.o.o.t.>...<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".C.h.i.n.e.s.e. .(.S.i.m.p.l.i.f.i.e.d.).". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".C.H.S.".>...<.P.r.o.d.u.c.t.s.>...<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>..]/T.Rlx.N.hKm<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>..]\Pbklx.N.hKm<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>.(u7b.].S.mlx.N.hKm<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.". .V.a.l.u.e.=.".1.2.8.".>..].hKm0Rlx.N<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.E.R.R.O.R._.N.O._.M.O.R.E._.M.E.M.O.R.Y.". .V.a.l.u.e.=.".5.0.1.".>.......QX[.N..<./.C.a.p.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetCHT.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text
Category:	dropped
Size (bytes):	101018
Entropy (8bit):	4.436472988992305
Encrypted:	false
SSDEEP:	3072:fxHi3430zpvf/ByAIgRXstsNE6GsA94M0SuEhdUPmN3a:0IIVOC
MD5:	372A291A95DDA05BF6AA4D6D3BF3A6EB
SHA1:	9E8472B7252FE7C23499A3F5F0EFAC0C3F75D2A5
SHA-256:	C3FBEBAF16B2DAB2D9D62A7948A2F41DC9334A24A87D66403288C4A4BF2A4288
SHA-512:	7A727A4B2A45974CA3606466623F5DE7049ED4D88470346EBB11EE45941228690A6E4BA3D3B22AB60D0C7FC16462FB1C3453AA0E5543B17A62F4BD2B6B2897F8
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>...<.R.o.o.t.>...<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".C.h.i.n.e.s.e. .(.T.r.a.d.i.t.i.o.n.a.l.).". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".C.H.T.".>...<.P.r.o.d.u.c.t.s.>...<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>....Ylx.uP,n<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>.lx.uP,n\Pbk<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>..O(u...S.mlx.uP,n<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.". .V.a.l.u.e.=.".1.2.8.".>.uP,n0Rlx.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.E.R.R.O.R._.N.O._.M.O.R.E._.M.E.M.O.R.Y.". .V.a.l.u.e.=.".5.0.1.".>./..... ....a..N..<./.C.a.p.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetCSY.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text
Category:	dropped
Size (bytes):	131306
Entropy (8bit):	3.845908407277747
Encrypted:	false
SSDEEP:	3072:jX2yfxEwbfocSISmpxlSafsG8tU3DbIwIw3sV3bEBUJ9Jwa2fE8A:o5lD
MD5:	4DC7FC9D0E19C7D4C7AA5734384E5540
SHA1:	62137E45E41F6AF8D1186497E70A80D59EF71D46
SHA-256:	E1B1DA26E0226D8568F617DD3B7BF823E84CB1B010AFD64AB2378735E01DE585
SHA-512:	C17DA7A80163AE982282A2D71BDD941057162E55C56E7BCBD0AB04C983254B1E5A6F9DF81217CB956C1792A7CC2072A134F86CE0DFCACF79264D5EA52C2EA9FE
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>...<.R.o.o.t.>...<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".C.z.e.c.h.". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".C.S.Y.".>...<.P.r.o.d.u.c.t.s.>...<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>.D.e.t.e.k.c.e. .h.a.r.d.w.a.r.u. .z.a.h...j.e.n.a.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>.D.e.t.e.k.c.e. .h.a.r.d.w.a.r.u. .u.k.o.n...e.n.a.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>.D.e.t.e.k.c.e. .h.a.r.d.w.a.r.u. .z.r.u.a.e.n.a. .u.~.i.v.a.t.e.l.e.m.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.". .V.a.l.u.e.=.".1.2.8.".>.B.y.l. .z.j.i.a.t...n. .h.a.r.d.w.a.r.e.<./.C.a.p.t.i.o.n.>...<.C.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetDAN.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text
Category:	dropped
Size (bytes):	132454
Entropy (8bit):	3.738706544885214
Encrypted:	false
SSDEEP:	3072:YYkyhQQIg7xCd2VMCo9PAT5HU3oup2WY4uX8N5mYVdYhCqfWqInV3MHf:YW
MD5:	B2270042585BCCF65E55C312C5C16958
SHA1:	FF0F56326D13E1B1A3AB577E8983E16A5F22C533
SHA-256:	782A45E23D76093EB7E23C80267E274F4854C9F8DE8BA178E6A9869A1A7B54FD
SHA-512:	2D44D415290434324CDE0B2CB96915D1B2ECB1690F7A2476B70EB849A432D2E7A3F880AA2561C2AC23CD4B4FA3FA90C999072F2F5F9DEF9A3E51D2D21FF07899
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>...<.R.o.o.t.>...<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".D.a.n.i.s.h.". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".D.A.N.".>...<.P.r.o.d.u.c.t.s.>...<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>.H.a.r.d.w.a.r.e.l.o.k.a.l.i.s.e.r.i.n.g. .s.t.a.r.t.e.t.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>.H.a.r.d.w.a.r.e.l.o.k.a.l.i.s.e.r.i.n.g. .s.t.o.p.p.e.t.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>.H.a.r.d.w.a.r.e.l.o.k.a.l.i.s.e.r.i.n.g. .a.n.n.u.l.l.e.r.e.t. .a.f. .b.r.u.g.e.r.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.". .V.a.l.u.e.=.".1.2.8.".>.H.a.r.d.w.a.r.e. .f.u.n.d.e.t.<./.C.a.p.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetDEU.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (342)
Category:	dropped
Size (bytes):	138274
Entropy (8bit):	3.749800766806128
Encrypted:	false
SSDEEP:	3072:wmB8u/mJR+b3p2cCbuCfXUSh9QTNAbLpmLqyjmh+IQb31EM+w1aIalU3zqLmMOJd:cWh
MD5:	F81E5DB1F78CA310385C4C3D6263AC2D
SHA1:	7EC1FB877434999C2D8E2A5AF2DBD0DE784F99F1
SHA-256:	E97C24B4299907E284B0354BCEC6B4B5FCD72D41E2B4FF3085EF8CD77EA08BB9
SHA-512:	3452292F3D38D0F9DE09A937B531F2FD2B19643004D127857E8F4AAEC9274AB3318BBE33521DD9CC4259B65394A33DFA2FA76EAF6BB91A061A3F74604F6F6E31
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>...<.R.o.o.t.>...<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".G.e.r.m.a.n.". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".D.E.U.".>...<.P.r.o.d.u.c.t.s.>...<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>.H.a.r.d.w.a.r.e.e.r.k.e.n.n.u.n.g. .g.e.s.t.a.r.t.e.t.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>.H.a.r.d.w.a.r.e.e.r.k.e.n.n.u.n.g. .g.e.s.t.o.p.p.t.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>.H.a.r.d.w.a.r.e.e.r.k.e.n.n.u.n.g. .d.u.r.c.h. .B.e.n.u.t.z.e.r. .a.b.g.e.b.r.o.c.h.e.n.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.". .V.a.l.u.e.=.".1.2.8.".>.H.a.r.d.w.a.r.e. .g.e.f.u.n.d.e.n.<./.C.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetENU.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	131476
Entropy (8bit):	3.7415330166507204
Encrypted:	false
SSDEEP:	3072:ltNB+e3pZN8tCglMoDtmLbcWXJhiHE9n486Mucq6pkenOwJk:ypDI4F
MD5:	8A87851EAA0D7C90DE09B36D4F28204B
SHA1:	DC3B25A7568178B24FE3C49D6AF9E359F4717F41
SHA-256:	6490E70B374344BA648FE0C9F14E183364EE4F0DEDB74BB453C9C68D53652021
SHA-512:	C8B994808FD821E4E70BEE13D775B7A822ADD4F83D95BBC47C5821FCD644064E6938A3F4FFA587A1A9D59DC58D08D68D53080C4BBFB249BA58592EBD14148C3F
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t.>.....<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".E.n.g.l.i.s.h.". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".E.N.U.".>.....<.P.r.o.d.u.c.t.s.>.....<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>.....<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>.H.a.r.d.w.a.r.e. .d.e.t.e.c.t.i.o.n. .s.t.a.r.t.e.d.<./.C.a.p.t.i.o.n.>.....<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>.H.a.r.d.w.a.r.e. .d.e.t.e.c.t.i.o.n. .s.t.o.p.p.e.d.<./.C.a.p.t.i.o.n.>.....<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>.H.a.r.d.w.a.r.e. .d.e.t.e.c.t.i.o.n. .c.a.n.c.e.l.e.d. .b.y. .u.s.e.r.<./.C.a.p.t.i.o.n.>.....<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.". .V.a.l.u.e.=.".1.2.8.".>.H.a.r.d.w.a.r.e. .d.e.t.e.c.t.e.d.<./.C.a.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetESP.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (333)
Category:	dropped
Size (bytes):	139056
Entropy (8bit):	3.704108073549061
Encrypted:	false
SSDEEP:	3072:vRo7ZYlkb7BplDqV2H/g1E3uosqDH6CwIiTD8k:8VA
MD5:	6B752C44D769BD7DABE2C404BF1C3AFB
SHA1:	1D66550F2E7F45F26BB6D3D33336BB9307DA0049
SHA-256:	0073D3EA4E32284BF26379ABA20A381C31673568D2716AD72B6850DF08C6F7FE
SHA-512:	F3591A251C2B3FF3FBBE43722CA4FC6E61EF6CF570E2485963DB7F42777BC7CF4A4137E8C632FBE53E2CA1BA8B2531844FDAE5C0176265EEFC8577B7D77877C9
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>...<.R.o.o.t.>...<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".S.p.a.n.i.s.h.". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".E.S.P.".>...<.P.r.o.d.u.c.t.s.>...<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>.S.e. .i.n.i.c.i... .l.a. .d.e.t.e.c.c.i...n. .d.e. .h.a.r.d.w.a.r.e.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>.S.e. .d.e.t.u.v.o. .l.a. .d.e.t.e.c.c.i...n. .d.e. .h.a.r.d.w.a.r.e.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>.E.l. .u.s.u.a.r.i.o. .c.a.n.c.e.l... .l.a. .d.e.t.e.c.c.i...n. .d.e. .h.a.r.d.w.a.r.e.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.". .V.a.l.u.e.=.".1.2.8.".>.H.a.r.d.w.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetFIN.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text
Category:	dropped
Size (bytes):	131808
Entropy (8bit):	3.7153835784949827
Encrypted:	false
SSDEEP:	3072:reksN1sPympuUOXtK5Yx2cRZwf6fsOcV2NHhjyrNnSPFn6cJF3eCob:GS
MD5:	3FA5D03C948FB04B0D2649D7DD52AB5A
SHA1:	26FF2ABD5D229ACA0E75B7F19777903C1ED0D5A1
SHA-256:	48C00C70B784934A1F3B1F598019D1EFB7558CCFA180FE4D057252D611C7BA28
SHA-512:	D2BDA9DE049C35C8565DDC3ADBED699B316B5FFAD0B9F167C753A282E1C81A0ACAECDEFE29AF4106542CF2AA9795B950CA8202905C479C31CB2DAE4065747312
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>...<.R.o.o.t.>...<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".F.i.n.n.i.s.h.". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".F.I.N.".>...<.P.r.o.d.u.c.t.s.>...<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>.L.a.i.t.t.e.i.d.e.n. .h.a.v.a.i.t.s.e.m.i.n.e.n. .k...y.n.n.i.s.t.e.t.t.y.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>.L.a.i.t.t.e.i.d.e.n. .h.a.v.a.i.t.s.e.m.i.n.e.n. .p.y.s...y.t.e.t.t.y.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>.K...y.t.t...j... .p.e.r.u.u.t.t.i. .l.a.i.t.t.e.i.d.e.n. .h.a.v.a.i.t.s.e.m.i.s.e.n.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.". .V.a.l.u.e.=.".1.2.8.".>.H.a.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetFRA.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (335)
Category:	dropped
Size (bytes):	139752
Entropy (8bit):	3.725335250118528
Encrypted:	false
SSDEEP:	3072:kDAJ5FhFkyZOomQQv8d3rcvHZlYGCqg34odoZGjk:K
MD5:	0CC4BEA9473124A74A87F8DE1D576065
SHA1:	499F9B3674E1D9942B098B1C3A0630FF16E917FF
SHA-256:	97F1F40BC02E0FC34E13C3355ADC2E165C91B1A69A437DE1D1C0C1E50691A1B2
SHA-512:	29FA6D63674241BA4743218540EDB875A2652B703562697676C27E0AF78778EAF4F5EE94C72AD02B73047F014EAC2352E2061B8C8C5BFEE37857A08BABB654B6
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>...<.R.o.o.t.>...<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".F.r.e.n.c.h.". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".F.R.A.".>...<.P.r.o.d.u.c.t.s.>...<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>.D...t.e.c.t.i.o.n. .d.e. .m.a.t...r.i.e.l. .d...m.a.r.r...e.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>.D...t.e.c.t.i.o.n. .d.e. .m.a.t...r.i.e.l. .a.r.r...t...e.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>.D...t.e.c.t.i.o.n. .d.e. .m.a.t...r.i.e.l. .a.n.n.u.l...e. .p.a.r. .l.'.u.t.i.l.i.s.a.t.e.u.r.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.". .V.a.l.u.e.=.".1.2.8.".>.M.a.t...r.i.e.l. .d...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetGRK.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (324)
Category:	dropped
Size (bytes):	140018
Entropy (8bit):	4.473251122772864
Encrypted:	false
SSDEEP:	3072:aquuFSYnFMTXsq2b4svYGVeNagKiKpMcJd3Ge97eim2Y1mMQK0hNcLYjnr+GsDnq:Mu
MD5:	9C343E51785B215E3B5022FC24309EA6
SHA1:	6BBB96F644B2F7EA2C81E1E39A58DCD30242328E
SHA-256:	2A8EA419CC0DE5C33A0E003E1B65A515E372A551B9C09A5673E81E0E28F4D5C5
SHA-512:	BCDCE222254C06632D6B31ABDEB4B8F8155E4C5E33086E219ACDE97C301BE08EC2184BF6AE5923CE5BBB662FF2593768B782FA7B410483111B34CDFE81F47C63
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>...<.R.o.o.t.>...<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".G.r.e.e.k.". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".G.R.K.".>...<.P.r.o.d.u.c.t.s.>...<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>... ..................... ............. .................<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>... ..................... ............. ...................<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>... ..................... ............. ..................... ....... ....... .............<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.". .V.a.l.u.e.=.".1.2.8.".>....................... .........

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetHNG.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text
Category:	dropped
Size (bytes):	132112
Entropy (8bit):	3.8298971104164674
Encrypted:	false
SSDEEP:	3072:agj4b5ygXocCkStAC1vLyGhS9peff4sD3KcPRIFWOJII5wU3ou8PXARk5JScqdDY:K4h
MD5:	C399B10087C43CCEB3545B1C0E9629DF
SHA1:	E8678238AA58B2FABE2AA50A61634F37EAA00848
SHA-256:	493DAE2514FEBDD07F45BFCCD2498F88F04C7B942B92A87C9453E77D9D8B15DC
SHA-512:	DAAB8EB865A222A34150992F57A61C3DEE15220C02B5884C49BB8EB140370811FDD9B0CDD37F20C68F473D867BBCF0E87F4755E2AC6F1D7739FAF50DE2F47997
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>...<.R.o.o.t.>...<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".H.u.n.g.a.r.i.a.n.". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".H.N.G.".>...<.P.r.o.d.u.c.t.s.>...<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>.H.a.r.d.v.e.r...s.z.l.e.l...s. .e.l.i.n.d.u.l.t.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>.H.a.r.d.v.e.r...s.z.l.e.l...s. .l.e...l.l.t.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>.A. .h.a.r.d.v.e.r...s.z.l.e.l...s.t. .a. .f.e.l.h.a.s.z.n...l... .l.e...l.l...t.o.t.t.a.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.". .V.a.l.u.e.=.".1.2.8.".>.H.a.r.d.v.e.r.t. ...s.z.l.e.l.v.e.<./.C.a.p.t.i.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetITA.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (312)
Category:	dropped
Size (bytes):	137634
Entropy (8bit):	3.6891876077028876
Encrypted:	false
SSDEEP:	3072:Bs7VsPl0yWPAEMlNd4H/19rOHll1xSTdlcSYZQ2L3NrNj:Jx
MD5:	DDC48EF889F37D4FA2CE0FB2226B1A7F
SHA1:	D4489B2B611A9BEFCFFCB6E68523C39D632569C4
SHA-256:	E8D80E042E6BD42DE5AAEC304FD9F85F2898A89C32E8894B6E8DC0A30A24F7FC
SHA-512:	0164E59AC7D89BA7D384B98A9DEC59F430E59DFF4771B17DA11B9CC5F347CFA0BC7771D750E2AB72DC0817485DF9025BE0FA3F9AF9F44C205D9632B2E2AFF8AE
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>...<.R.o.o.t.>...<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".I.t.a.l.i.a.n.". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".I.T.A.".>...<.P.r.o.d.u.c.t.s.>...<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>.A.v.v.i.a.t.o. .r.i.l.e.v.a.m.e.n.t.o. .h.a.r.d.w.a.r.e.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>.I.n.t.e.r.r.o.t.t.o. .r.i.l.e.v.a.m.e.n.t.o. .h.a.r.d.w.a.r.e.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>.R.i.l.e.v.a.m.e.n.t.o. .h.a.r.d.w.a.r.e. .a.n.n.u.l.l.a.t.o. .d.a.l.l.'.u.t.e.n.t.e.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.". .V.a.l.u.e.=.".1.2.8.".>.R.i.l.e.v.a.t.o. .h.a.r.d.w.a.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetJPN.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text
Category:	dropped
Size (bytes):	112798
Entropy (8bit):	4.541844415739574
Encrypted:	false
SSDEEP:	3072:wruIuiVRP7H4lK2g8W8C+DSbyrewX93V3EOSpsOuJGgH36X0:5v
MD5:	D395E193A628C738340E644A4F02BA7E
SHA1:	CC052FFF1C7521F09A4943F8D84D3843FA95096B
SHA-256:	131F32E5C310C7207D5D5364AF6DC317165C93EBEAE86319E322CF733F032FD2
SHA-512:	B925FB8ECF7260C2BBACDB3999D87C9CE02110CF26893360230958BCF1FFCFFDFFB0C23F9FC1F8BC6934C8FB0B69FE49654C679616C573B9C351C8459CA84686
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>...<.R.o.o.t.>...<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".J.a.p.a.n.e.s.e.". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".J.P.N.".>...<.P.r.o.d.u.c.t.s.>...<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>..0.0.0.0.0.0n0.i.QL0...YU0.0~0W0_0.0<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>..0.0.0.0.0.0n0.i.QL0\PbkW0~0W0_0.0<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>..0.0.0.0.0.0n0.i.QL0.0.0.0k0.0c0f0.0.0.0.0.0U0.0~0W0_0.0<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.". .V.a.l.u.e.=.".1.2.8.".>..0.0.0.0.0.0L0.i.QU0.0~0W0_0.0<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.E.R.R.O.R._.N.O._.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetKOR.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text
Category:	dropped
Size (bytes):	109838
Entropy (8bit):	4.557736303142367
Encrypted:	false
SSDEEP:	3072:EpN+FjYCaplsRPBxJPGT3lJCrbBgCxhynA9PECRyr:i
MD5:	AD83C2071B008E4447D47DB7D97AD435
SHA1:	444B526315E63F808C138218F35D3AA47883262E
SHA-256:	8D86AF8AEF8789858BC147BD8C9A30EE7B8F58A0FA70ADE1B9E8CEB49A648635
SHA-512:	A647F51906DFD7FE3027547952E0124391F4CE7FDD715D929CB8100CA5CBB0F673D5E89804AA0DC63165C180404F71D1AC35E023AEE59CC78DD051E39CC9F23F
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>...<.R.o.o.t.>...<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".K.o.r.e.a.n.". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".K.O.R.".>...<.P.r.o.d.u.c.t.s.>...<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>.X..... ....... .............<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>.X..... ....... ..............<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>.X..... ....... ........ .X.t. .............<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.". .V.a.l.u.e.=.".1.2.8.".>.X....... ..............<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.E.R.R.O.R._.N.O._.M.O.R.E._.M.E.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetNLD.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text
Category:	dropped
Size (bytes):	135970
Entropy (8bit):	3.720315706488501
Encrypted:	false
SSDEEP:	3072:QQMo7netsnaZLwswBlyVSh1+aSmjMXITiPKwjrscXbpzabSxgwcOc6zYwmLXU3i7:0M9pyU
MD5:	5D2443D0A52525C4FF6278239D858401
SHA1:	9AE41069A8192FAE7E99768D64A5C348E1ACA9C2
SHA-256:	A10D2C3D7CF663578B5E478C24207117D93770DB7D9C0BABFDE4B56458CE6E6B
SHA-512:	C26B45A55666BADC2DC612A97259B7A954B8DCEF9560D8993278E9F43A5A63A4BC94DC479FCAD512C08372091DD433B844FB9797F0C5AFC0FEDBB9D88806536B
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>...<.R.o.o.t.>...<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".D.u.t.c.h.". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".N.L.D.".>...<.P.r.o.d.u.c.t.s.>...<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>.D.e. .h.a.r.d.w.a.r.e.d.e.t.e.c.t.i.e. .i.s. .g.e.s.t.a.r.t.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>.D.e. .h.a.r.d.w.a.r.e.d.e.t.e.c.t.i.e. .i.s. .g.e.s.t.o.p.t.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>.D.e. .h.a.r.d.w.a.r.e.d.e.t.e.c.t.i.e. .i.s. .g.e.a.n.n.u.l.e.e.r.d. .d.o.o.r. .d.e. .g.e.b.r.u.i.k.e.r.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.". .V.a.l.u.e.=.".1.2.8.".>.H.a.r.d.w.a.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetNOR.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text
Category:	dropped
Size (bytes):	130532
Entropy (8bit):	3.738823350136492
Encrypted:	false
SSDEEP:	3072:8nj77VrLm6aItiZQxSyhJNOk5kHJO4UqmLSJj2uib7dH1FX2uBTkv2psPcKx9u:E
MD5:	7C2BA490B5D84ACFE8CD4D8F70174949
SHA1:	F6ABB6D54AE1011F818E58FD973BAB29B8549AD5
SHA-256:	2360AE9CE95AC311ABAD4499469B4BFA5D03BB7FD1A77F59C469C121A6F799F2
SHA-512:	6800579073B833C843547D7D0C5413771F557EB5AE409E21DBAE3451911215214316F05234E14C0251B1A40E14991913D3BEF538C5008E5419C1DD02B6DEA5A1
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>...<.R.o.o.t.>...<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".N.o.r.w.e.g.i.a.n.". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".N.O.R.".>...<.P.r.o.d.u.c.t.s.>...<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>.M.a.s.k.i.n.v.a.r.e.s...k. .e.r. .s.t.a.r.t.e.t.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>.M.a.s.k.i.n.v.a.r.e.s...k. .e.r. .s.t.o.p.p.e.t.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>.B.r.u.k.e.r. .a.v.b.r...t. .m.a.s.k.i.n.v.a.r.e.s...k.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.". .V.a.l.u.e.=.".1.2.8.".>.M.a.s.k.i.n.v.a.r.e. .e.r. .f.u.n.n.e.t.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetPLK.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text
Category:	dropped
Size (bytes):	135256
Entropy (8bit):	3.8347644893199457
Encrypted:	false
SSDEEP:	3072:oc7LmlXKhgmqFZbmAwqdhJeQ/1InewmaiYuLGt5Rcv:m2K
MD5:	2F6AC57BBFBBCC53D1AC17C36C2545A7
SHA1:	7F76999D27148C10950CE1CF7A4BC0291D5C5EE4
SHA-256:	519A24B2B88382A5736DDB883E6DA179B40236EB70BAFDE86F32F956907E0341
SHA-512:	58A542354C096E31E2A56992FDA614F98D1FB68FE68C434523C9FB4CE3AFF8E1377B3DF7363F28949E2394060767ADB1402E6ED0C92C18ECB15705D7BAF7737E
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>...<.R.o.o.t.>...<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".P.o.l.i.s.h.". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".P.L.K.".>...<.P.r.o.d.u.c.t.s.>...<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>.R.o.z.p.o.c.z...t.o. .w.y.k.r.y.w.a.n.i.e. .s.p.r.z...t.u.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>.Z.a.t.r.z.y.m.a.n.o. .w.y.k.r.y.w.a.n.i.e. .s.p.r.z...t.u.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>.W.y.k.r.y.w.a.n.i.e. .s.p.r.z...t.u. .z.o.s.t.a.B.o. .a.n.u.l.o.w.a.n.e. .p.r.z.e.z. .u.\|.y.t.k.o.w.n.i.k.a.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.". .V.a.l.u.e.=.".1.2.8.".>.W.y.k.r.y.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetPTB.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (304)
Category:	dropped
Size (bytes):	135244
Entropy (8bit):	3.729425050382302
Encrypted:	false
SSDEEP:	3072:l8SUF7Jey7z96az3r/Y06H81CG/fKq1tnQ+lc0:v6
MD5:	DC7142B8A0522870D0B8927900E6AFFE
SHA1:	F62D16AE92F5449E1A77BDBB1793F349480BB0C0
SHA-256:	06AFDD03B03959C9065BD20F3E1AFDEDAF90DE0F40B20A4B1EBCB8BEF75E660A
SHA-512:	8279FD25067E58A154B17EEA615C39F4A5991C610458C953A8FF1E1F2229F18E4AB67AA5B2F77C543D83223FA9EDDEB4F9CA234964967C399E46A53E8A357AD4
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>...<.R.o.o.t.>...<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".P.o.r.t.u.g.u.e.s.e. .(.B.r.a.z.i.l.).". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".P.T.B.".>...<.P.r.o.d.u.c.t.s.>...<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>.D.e.t.e.c.....o. .d.e. .h.a.r.d.w.a.r.e. .i.n.i.c.i.a.d.a.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>.D.e.t.e.c.....o. .d.e. .h.a.r.d.w.a.r.e. .p.a.r.a.d.a.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>.D.e.t.e.c.....o. .d.e. .h.a.r.d.w.a.r.e. .c.a.n.c.e.l.a.d.a. .p.e.l.o. .u.s.u...r.i.o.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.". .V.a.l.u.e.=.".1.2.8.".>.H.a.r.d.w.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetRSA.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (307)
Category:	dropped
Size (bytes):	133164
Entropy (8bit):	4.256134940372211
Encrypted:	false
SSDEEP:	3072:GO3uJFX46e9d+Xja3gKpL6VBw5Bp8raN1ubFUqsi+MmgQq+6:JY
MD5:	FE960CED9FD87D5F014C0F9CEF664AE2
SHA1:	EC1C764049479EB703EF87C455BDD1849C8072BF
SHA-256:	758A9EA736155D17ECDCDBA90DDE2470EFD838472F417CB0B77D284557B74087
SHA-512:	3844717A52613AE1662854F662136E1865B1A3394ED78E86F51D3F6EB880B371AC05DCF4D3DFA1BC7444D93198D5D45975479AA95AACC6AA4E3EE5F5623D6DFB
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>...<.R.o.o.t.>...<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".R.u.s.s.i.a.n.". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".R.S.A.".>...<.P.r.o.d.u.c.t.s.>...<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>...@.>.F.5.A.A. .?.>.8.A.:.0. .>.1.>.@.C.4.>.2.0.=.8.O. .7.0.?.C.I.5.=.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>...@.>.F.5.A.A. .?.>.8.A.:.0. .>.1.>.@.C.4.>.2.0.=.8.O. .>.A.B.0.=.>.2.;.5.=.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>...@.>.F.5.A.A. .?.>.8.A.:.0. .>.1.>.@.C.4.>.2.0.=.8.O. .>.B.<.5.=.5.=. .?.>.;.L.7.>.2.0.B.5.;.5.<.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.". .V.a.l.u.e.=.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetSVE.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text
Category:	dropped
Size (bytes):	133288
Entropy (8bit):	3.730720382482371
Encrypted:	false
SSDEEP:	3072:Y4S+L4lIFZOzfMDH/+c41UlWLD5ZkUN+qvEo1AecLKyluVyM8W1cn/5VP5AxRaiK:nh
MD5:	55097738A02B4F997D03C9BCFFAF436E
SHA1:	D61DDACEE752C47E112DA3E5301BA7DCA34ECCBB
SHA-256:	A290E189033C113796E76D0E514F33045F8B61640B3A8DE609D7C6DD9A6F6578
SHA-512:	74CE3F6CB9B0D7895034C8DCF713F21A6E6233A3BBA6E9D8B787A8C9636AFD1C36A590AD33849BEB3A0CC025237971CAB1FAA8787FF348AC74A4A6757A1B8ADA
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>...<.R.o.o.t.>...<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".S.w.e.d.i.s.h.". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".S.V.E.".>...<.P.r.o.d.u.c.t.s.>...<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>.I.d.e.n.t.i.f.i.e.r.i.n.g.e.n. .a.v. .m.a.s.k.i.n.v.a.r.a. .s.t.a.r.t.a.d.e.s.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>.I.d.e.n.t.i.f.i.e.r.i.n.g.e.n. .a.v. .m.a.s.k.i.n.v.a.r.a. .s.t.o.p.p.a.d.e.s.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>.I.d.e.n.t.i.f.i.e.r.i.n.g.e.n. .a.v. .m.a.s.k.i.n.v.a.r.a. .a.v.b.r...t.s. .a.v. .a.n.v...n.d.a.r.e.n.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.".

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetTHA.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text
Category:	dropped
Size (bytes):	128602
Entropy (8bit):	4.398367770492063
Encrypted:	false
SSDEEP:	3072:Ywq3j7uEb8q6oIGWQmICGLMRqJbmy3b4EBhcgZBPwLAa8bCJ:Lf
MD5:	760CB4F032F99988B791D74E57E6E34C
SHA1:	4D9123FAEBA2E309D65351368290684FCDAC8385
SHA-256:	4A97077CEAE34F44DBDAB4A06D1785BC6648C0DE9ECED265556620E3C5BA7F06
SHA-512:	C93230A8BC1E2FE99DE0F55C4B6D64FB49959B66569CA53FCED241EC0B93E4C74C9D3F1FF23AED5C8105262B6DCD0697E2B40C79F249A80B9CE332D22FA9F413
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>...<.R.o.o.t.>...<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".T.h.a.i.". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".T.H.A.".>...<.P.r.o.d.u.c.t.s.>...<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>.@.#.4.H.!...2.#...#.'....-.....2.#.L...A.'.#.L.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>.+.".8.....2.#...#.'....-.....2.#.L...A.'.#.L.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>."...@.%.4.....2.#...#.'...*.-.....2.#.L...A.'.#.L.B..."...9.I.C...I.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.". .V.a.l.u.e.=.".1.2.8.".>...#.'.........2.#.L...A.'.#.L.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\MonetTRK.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text
Category:	dropped
Size (bytes):	130682
Entropy (8bit):	3.8510545053454717
Encrypted:	false
SSDEEP:	3072:MZ51sij9zYjE5O6Bdq8GvHRF9qiNdBKhmeha9CU7c1hcQ23N7jRUGvN5wzEg/5Y4:Aqa
MD5:	9AD3A37FCFC520BF35CBC6C0E062081C
SHA1:	DC2936329B2C4360528FD5404A9DA7331664AD3C
SHA-256:	C0F617E1D6F65BFD61A73EC8E9B72BDE3E188981F1701BDC13A07F516E18A00E
SHA-512:	75D74D0796D8FB10263719A8966A4C1C3C980209044F22DE13962F0E46DA56C5EC710561FC0531EBB6F729553F7B95E9B5BA7309129D43EDAC76B01070E9F416
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>...<.R.o.o.t.>...<.L.a.n.g.u.a.g.e. .N.a.m.e.=.".T.u.r.k.i.s.h.". .A.l.i.g.n.=.".L.e.f.t.". .I.D.=.".T.R.K.".>...<.P.r.o.d.u.c.t.s.>...<.P.r.o.d.u.c.t. .N.a.m.e.=.".D.e.t.e.c.t.i.o.n. .M.a.n.a.g.e.r.". .I.D.=.".D.C.M.".>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.S.T.A.R.T._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.5.".>.D.o.n.a.n.1.m. .a.l.g.1.l.a.m.a. .b.a._.l.a.d.1.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.E.N.D._.W.O.R.K.I.N.G.". .V.a.l.u.e.=.".1.2.6.".>.D.o.n.a.n.1.m. .a.l.g.1.l.a.m.a. .d.u.r.d.u.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.T.E.C.T.O.R._.U.S.E.R._.A.B.O.R.T.". .V.a.l.u.e.=.".1.2.7.".>.D.o.n.a.n.1.m. .a.l.g.1.l.a.m.a. .k.u.l.l.a.n.1.c.1. .t.a.r.a.f.1.n.d.a.n. .i.p.t.a.l. .e.d.i.l.d.i.<./.C.a.p.t.i.o.n.>...<.C.a.p.t.i.o.n. .I.D.=.".I.D.S._.D.E.V.I.C.E._.D.E.T.E.C.T.E.D.". .V.a.l.u.e.=.".1.2.8.".>.D.o.n.a.n.1.m. .a.l.g.1.l.a.n.d.1.<./.C.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\OEM.Dat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3755
Entropy (8bit):	5.471468134154721
Encrypted:	false
SSDEEP:	48:kPge5sdWgYZxTCJSsWY4uXOeWAly6ywtBsjmokkYYibvuYPmt9AS5OmmwoPXBLl0:o5sd0mJfwuEAlDybLab1dj/BLlSTsxs1
MD5:	B48C02AC7DFBDD896D482D0A484E6D19
SHA1:	0E9031A68894D918901BA80C1516100E24869AC9
SHA-256:	B5A80A47BB82C8BC964781309733FF5D0FA4B20FA804E4768947E29C968BA85C
SHA-512:	E64949A1620A1903E39C07F2A337589AEADD5E669B507CC35562C6969CC69864C21FB3D8A06746FFC804D7919DD5AF44E00EF8989F7AEE1C502B0D9EE93889F1
Malicious:	false
Reputation:	low
Preview:	######################################..## This will contain all of the OEM ##..## ##..## The format is as follows: ##..## [Name]=[Value] ##..######################################....None=000..AMD=001..DELL=002..Hewlet Packard=003..Fujitsu=004..Gateway=005..Gigabyte=006..Hitachi=007..IBM=008..Sony=009..Toshiba=010..NEC=011..Emachine=012..Dell-NoDefaultCF=013..IBM-Lenovo=014..IBM-LenovoIntl=015..Lenovo-Wistron=016..HP-Notebook=017..HP-Whitman=018..NEC-CI=019..NEC-GenbuK=020..Acer=021..Alienware=022..Asus=023..Asus-Mobile=024..BenQ=025..BenQ-Quanta=026..Catalyst=027..Depo=028..Diamond=029..ELSA=030..FIC=031..Fujitsu-Desktop=032..Gateway-M=033..ITC=034..LG=035..MiTAC=036..MSI=037..MSI-NoDOT=038..NoName=039..PackardBell=040..Palit=041..Panasonic=042..Samsung=043..Sapphire=044..Sony-Asus=045..Sony-In-House=046..Toshiba-Compal=047..Toshiba-InHouse=048..Toshiba-Inventec=049..Toshiba-Quanta=050..Uniwill=051..Uniwill-P72IA=052..Visionte

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\OS.Dat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	279
Entropy (8bit):	3.433957852062697
Encrypted:	false
SSDEEP:	3:RGRGI74CTlEMSfx/vjV+705eXFeY/e7U/ToJV4//I4GuakJWkw4y8o:aNTllSVvS3iJi//0AW+y8o
MD5:	4106267606D1C8D3D753FADC702C6E11
SHA1:	EF10BAA45C1DB44DB61433497185FC51B728C48D
SHA-256:	1A25F26482D276A08014256F47B8B4159CC55D7C0D0449D7D9DC650A2040B772
SHA-512:	757BCA35CE72F15980A15AA26FB35F17F5E41B609AD4A1F30E1D2FF8F44585EC6582FE06CF38A3739FD0C88D9E522A09BA2343E99B04E4D06B159A8AF1B42313
Malicious:	false
Reputation:	low
Preview:	######################################..## This will contain all of the OEM ##..## ##..## The format is as follows: ##..## [Name]=[Value] ##..######################################....All=A..MS Windows=W..Linux=L..Apple=M

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\OSMajorMinor.Dat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.056030765332284
Encrypted:	false
SSDEEP:	48:gcyGx44DCV1xOUKsa87RrtIfJfiBDQIkk8xkiOiB+Fa4xya:3HqE8OUGiRrCyK4xya
MD5:	B11720B0A36E3AF57C078AF4CCE2F5C7
SHA1:	0BF1EE98F2C6AA099383F68F5075C0E561AE9E89
SHA-256:	5A4AE0D4719E42FE51F9DB265FC8C0E860F7B107C5ABE8C9A2ED8D457A8424A4
SHA-512:	107C2C0B0991713757FCD940F208577352112DB7673D5E19F2699E47E788AE429669D1802BA5418B0899E7802EA43DAB1C8F85EAC686CE849C197D991C751CC2
Malicious:	false
Reputation:	low
Preview:	############################################..## This will contain all of the supported ## ..## OS Major Packages ##..## ##..## The format is as follows: ##..## [OS];Major=[value] ##..## [OS] == values from OS.Dat ##..## [value]==N means no checks required ##..############################################....# All the Major version list, use None as no checks..# The form is of xx.yyzz, where xx denotes the major version..# yy denotes the minor version and zz are special case listed below..# zz = 0U minimun os requirememt..# zz = 01 implies AMD 64bit processor..# zz = 02 implies Intel 64bit processor..# zz = 03 implies AMD 64bit and 32bit processor..# Note: Windows Vista 64bit (AMD (Legacy)) are for entries that has pid's that was generated before vista 64bit was tested, hence the..# entries in the table did not reflect the proper version...A;All=00.0000..W;All=00.0000..W;Windows 9

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\OSServicePacks.Dat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	727
Entropy (8bit):	3.8269104634410755
Encrypted:	false
SSDEEP:	12:slSIWEMEQK+ICDDjJBL1fPU9xjDuyM6WpkWtYVAcWOWMZr:CDMEQdICBL1U9BDvM6RUYqclrl
MD5:	CE8D2181073B464D12F2F597FEAFFD66
SHA1:	08C25D84B9B08FAB61E25915C81AD75194526174
SHA-256:	9A819FFC3F4949B70979A6A439A4A3E1D0AD90935DC47ADB8179F07136BC4143
SHA-512:	67CBCF2743B1573CED988D3F53AF710CDBEA9201E509B958A26A0D2ADF745D49DE91DD37AEAB63A53004CD40922BDADD26D00B81D77297C3DC682F2D9D644C0F
Malicious:	false
Reputation:	low
Preview:	################################################################..## This will contain all of the supported OS Service Packages ##..## ##..## The format is as follows: ##..## [OS].[Major].[Minor]=[Value] ##..## [OS] == values from OS.Dat ##..## [value]==N means no checks required ##..################################################################....#Use this for no service package required..None=000....#Service packages required for Windows XP , service pack 2..Service Pack 1=001..Service Pack 2=002..Service Pack 3=003..Service Pack 4=004....

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\PackageSubType.Dat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10547
Entropy (8bit):	5.193675561403376
Encrypted:	false
SSDEEP:	192:AcmXKXgELK5whs3LxngBi0Pqa0K0eollVsyi5Y:AfwgErhs31gB4peollWyi5Y
MD5:	A06E885B0A59F9D133560D5D62F941EB
SHA1:	D597BC2442B91A38DA9E11D3DB2DEF80A1D29664
SHA-256:	39F47C6677A1CF1C294BA4611A30C4B00ED8BEEFDCE629203AC37DCCA03E02AA
SHA-512:	AF49D627FD139A5D76818844A0B1934825125D45DB742D009E114878B5D1313C6E424C0024835D44A1FCEA8D57E8D11FF1D6136257FAC303F685791C33822C46
Malicious:	false
Reputation:	low
Preview:	#############################################################..## This will contain all of the supported Install Packages ##..## ##..## The format is as follows: ##..## [Package Type];[Name]=[Value] ##..## [Package Type] is be value from PackageType.dat ##..#############################################################....#None == NA..000;None=000....#All Drivers, append 001 to link to drivers category..001;Display Drivers=001..001;Windows Device Module=002..001;Windows Device Module for AMD64=003..001;South Bridge Drivers=004..001;North Bridge Drivers=005..001;HydraVision=006..001;3D StudioMax FireGL=007..001;Remote Wonder=008..001;Remote Wonder USB Drivers=009..001;TV Wonder USB2 Drivers=010..001;TV Wonder Capture Drivers=011..001;HydraVisionLE=012..001;IDE Driver=013..001;Audio Driver=014..001;IDEATA133 Driver=015..001;Silicon Image SATA RAID Driver=016..001;AMD T20

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\PackageType.Dat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	543
Entropy (8bit):	3.485997648439881
Encrypted:	false
SSDEEP:	6:atTllSG5LJq3iJi//UrQ9sQd6/iTXeKTL9MaTGXan:ulS2OiJ+yyWKTXVTTGK
MD5:	D4300930295DB990807468E92F09FBA1
SHA1:	D034CC60779D7B18D32C695FBCEA3DB26A33C6A7
SHA-256:	6C8BD34788C47E3688CF3CAAAB1E99A5C2D1DD1EFA991D3E28906E45CFCCD3CB
SHA-512:	0001E5032E13CC2ED4D828F0678B9973C86C5D7BF71485C36AC3DFDADBE361E8AA3A4CE8BB403C302ADBB7075EF0D1C2079BB07CFE20A5BCCB6C0F0CE1C42080
Malicious:	false
Reputation:	low
Preview:	######################################################################..## This will contain all of the supported Install Packages Category ##..## ##..## The format is as follows: ##..## [Name]=[Value] ##..######################################################################....None=000..Drivers=001..Applications=002..Installer=003..Decoders=004..Encoders=005..3rdParty=006..ExecCmd=007

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\Profile1.cfg

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	366
Entropy (8bit):	5.046254475812662
Encrypted:	false
SSDEEP:	6:IbzOCdKUMAxM8IESEQW+7DpaKGdYHqKGd5yI+wUpEcvT37ybEt:It1dUEQWWE7dY6dEpfqbM
MD5:	8E088D0219364A052EF982C2AC299E49
SHA1:	58C592D1607D6B0BEF6AB546C122075B4CDF7464
SHA-256:	CE32FF92387A131F6F76FC55AE0835E4A31A9FE91BAEE0CAE7366260449F5850
SHA-512:	E8DFB44D0BDC7B890ACAA87A9A5D9B90F8E899E8C23164F36CC033987DC6124244E3DE6ABCE242B9C33F98BA7F35F3741720EE26E4B66253F466EA049D01B49F
Malicious:	false
Reputation:	low
Preview:	UseCustomColor=true..BackgroundColor=0xdddcca..FontColor=0x383838..FontDisableColor=0x6d6d6d..ButtonColor=0xb4d2b8..ButtonDisableColor=0x78a784..TextColorPast=0x383838..TextColorPresent=0x383838..TextColorFuture=0x383838..ButtonBrightness=0.35..URL_DefaultColor=0x40946c..URL_HoverColor=0x40946c..URL_VisitedColor=0x40946c..ShowLanguageOption=false..ShowUpdate=false

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\Security.Dat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	454
Entropy (8bit):	2.6391188835750685
Encrypted:	false
SSDEEP:	3:RGRGo74CTlEMSwP2FFQ7V+705eXFeY/e7U/ToJV4//I4GOarQ9qnGQQWvn:atTllSweFFD3iJi//UrQ9SwWv
MD5:	D0D6D183050CCDD63C5A9A02ED27BA03
SHA1:	4336A68B0BD9A2B89C5FACD2EF3DB7A8AE90A3A2
SHA-256:	0583957069E2F89112E602F5903B60EEFF0BE63F5E6A2241309EF2FA38F9A105
SHA-512:	C5B9968FE62BEE0648D047F7F972092A3C96775AAAA575512EAD71F097B7AF011B8F0101C65B06D240EB8CC81DF0CAD1548A4EAF51160D3D90E4B9F0A38E99E4
Malicious:	false
Reputation:	low
Preview:	######################################################################..## This will contain all if the packages are secure ##..## ##..## The format is as follows: ##..## [Name]=[Value] ##..######################################################################....None=00..Secure=01..

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\Splash.bmp

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PC bitmap, Windows 3.x format, 500 x 333 x 24, image size 499500, resolution 2835 x 2835 px/m, cbSize 499554, bits offset 54
Category:	dropped
Size (bytes):	499554
Entropy (8bit):	6.36685549673212
Encrypted:	false
SSDEEP:	12288:uAGc3ay08qhsBHQ1OPZyygMIb2TIfbMMwMU:uAFLTjgMXk0
MD5:	1273007F6BE02D48EA37EE42F04B2BCF
SHA1:	46CFA54A6313FD32760895867656779423A197BF
SHA-256:	379A5765A9CC89F840801C3FD146CDD7B7A4B8C11DAFCBDF13E8B7FB8AEE39EB
SHA-512:	DD91083C14895B7D1301EB7E2C1ECAFCFAA34B63D86C290B71DC3599DE26770F430307D2A0C24CAE585CA667831B0F2559798DB45784A491B487A4E41AF505C7
Malicious:	false
Reputation:	low
Preview:	BMb.......6...(.......M...........,........................................!..".. ..!..!..!..!...................................!..".............. ..!..!..!..!..!..!..!..!..!..!..!..!..!..............!..............!..... .............. ..!..!..!..!..!..!................................ .. .. ..............!...................................!.. ..............!................................... ................. .............. ........ .. ..!.............. .. .....!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!.......................................................................................................................................................r.......................................................................................................................6......... ..!.. .......................... .. ................................ .. .. .. ........ .. .............................!..... .. .. ........ .. ........... ........... .. .. .. ..

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\TVW_USB_ID.MSI

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Template: ;, Last Saved By: wliao, Last Saved Time/Date: Tue Oct 9 20:28:04 2007, Number of Pages: 100, Number of Words: 0, Security: 1
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.1513887906898272
Encrypted:	false
SSDEEP:	48:rgNRCt7lPHLXX2eucDwEMrTlEwCPMOmsUp8NlM:ttxac8rTlE4PGM
MD5:	4B2B529C0C8658743E59777D7FB359E6
SHA1:	660C9503F745A8D15CC172EB37E8D920D5170BAB
SHA-256:	3A05EE59CA487E3B14C212345B44EB214EE25FFDEB86E684D0AB3C0604235D25
SHA-512:	38968E32559671E504E4FA5A6F0248528980048471B9A5A131FB33444F8F1DA6ED40820A313A9667344C83ABE8BC24DA54857994D8C226087C46ECB7CE9E055A
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\atiicdxx.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1200, Locale ID: 1033, 0: 1.2732e-313, Title: Driver Ins, Subject: MSI ASI, Author: ATI Technol, Comments: 2014 July 9, Revision Number: 6.10.1
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	4.702435811591139
Encrypted:	false
SSDEEP:	768:SVzMxlV4/sllfX+iay9AYX0YlshWwU9yP2mTMtouBIbQDrZsnDts9N8bI4moImeh:Ym4/yYiFAOs4V9hWoZsDtULoG7NJ44
MD5:	DB99CE84C596EBE76EB6D976C0AB6A74
SHA1:	C6B6909525DC202436482545094E66824F733F71
SHA-256:	F857EAFF280436E37DCE64B061653F9F5ABF11AB82191878CE15E92EA7D1A1DF
SHA-512:	0DFA980817CBA0EB2A262C840CD3CBD0043EAA052E83FFD77F6388ED46582F8226DF0BCABAD383FB375B6CFB95EBDD66036A1F66338AF619057841CBA731A133
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\chipset.MSI

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Template: ;, Last Saved By: jujiang, Last Saved Time/Date: Fri Dec 7 18:49:30 2012, Number of Pages: 100, Number of Words: 0, Security: 0
Category:	dropped
Size (bytes):	26112
Entropy (8bit):	5.607695719257966
Encrypted:	false
SSDEEP:	384:3UYDhCqa4arm50G1krLAIDUG4mrNvFhfMwg/itDWS5tkgAWshbToRgnZyKo0j:EYQrBrUntIDUG4mrNvFh4/itDWeGzV
MD5:	B5A239E0F1A6F776595CB4E1DD55C0BC
SHA1:	31C56875C84171C913101DA4C7A92F88A389F506
SHA-256:	1E2CC4B7A20D0AD996B9F47CFA7A716D174765B082AA1BA1465B7D65B15EB086
SHA-512:	107B0B84316E31C6FE64A8CF80B5C98AA77C97B6A37ED9EEFAAECF61E7A06F96BD5263FEFC64B5BB6F6E366F930988C940F05DF71B1C54522F280C8D3530426F
Malicious:	false
Reputation:	low
Preview:	......................>...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................&...+................... ...!..."...#...$...%.......'.......)...*...,.......-......./...0...1.......................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaCHS.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (434), with CRLF line terminators
Category:	dropped
Size (bytes):	6580
Entropy (8bit):	6.729791331099182
Encrypted:	false
SSDEEP:	96:qZ5wB1hkuc0AjLcWJ0aW7jmwkoJzyhcAAwyEz2YsdNPKkpkI2WzPxPubpg2Wmfui:hzcxJ0r7j9kOTfeAPxPu1Wmfu52NFr2s
MD5:	87035F60AF2AED5828C20A7E1D400F59
SHA1:	B4804B70668A3748242F18081FE71D447BC368BE
SHA-256:	88E8C94028893CEEAFA9FB24427D397B827651758D92AECFE560A093B352A7E0
SHA-512:	2E8802BBBB415FCEA9159108EE1482077E5AC77F46DF2242B9925F710D79B29962B9ED23EA6A0C7927F118DA21CC3CBE56F70241F71ADD3DBDA38D2D689F3127
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C........~.z(u7b...SOS......(.A.M.D. .C.A.T.A.L.Y.S.T."!)............. . ...N.~...... . .(W.`.N.~....v^.T.a.N.Rag.Nag>kKNMR.....N...[..0.Y6R.0.O(u.\..vo..N.0.O(uD..e...[IN...N.e.....bvQ.NUO..R...T.y. o..N. ...0,gOS../f.`..N.N.b.[SO.......y:N. .`. .T. `O.N.v. )..NA.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C... .(.A.M.D.). .KN...v.Ny..l.[OS....OS.....0.........Y.g.`.N.T.a,gOS....vag.Nag>k....HN1\.N...[..0.Y6R.b.O(u,go..N.0`O.[,go..N.v.[..0.Y6R.b.O(usSh..f.`.].~.T.a.N,gOS....vag.N.Nag>k.0........1... ..[IN............a.). .. .e.N. .c.N,go..N.bvQ.NUO..R.gsQ.v.0.No..N.Nw..c.O.b.S+T(WvQ-N.v.[..cWS.0(W.~.b5uP[.ech.0....b.). .. .w..NCg. .c(WhQ.t.NUO.S.l.{..:S.W.Q.....S.vW.\OCg.0FU.N.y.[.0FU.h.0.c!j\O.T...N.S@b.g.vsQ.v.0{\|<O.v.0.bvQ.[.w..NCg...S.b.[..N.w..NCg.v.O(u.S{v...0........2... ....S...0 . ..Onc,gOS...vag.Nag>k..A.M.D.(Wdk.T.`.c.N^..c.N'`.v.0.e{./e.Nyr..9..v.0.S.d...v.0.N.Sl....v.0.gP.6R.vW.\OCg...S.....Q...`N

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaCHT.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (558), with CRLF line terminators
Category:	dropped
Size (bytes):	6520
Entropy (8bit):	6.593402611012624
Encrypted:	false
SSDEEP:	96:qr7ZO8SH+VyoCBvYiWzGp8mDNfH0GqWPIjLO1GXdZMebNiEmaIKASbbfF5K+:u7FBVRRit8KNvVj8JXdZMetlb++
MD5:	74070F71D10237C108378D0AD2E2253B
SHA1:	EEB60E7B706E65BE896C34FE04038B85EF17D908
SHA-256:	71572F3E32B3765035C59C324E4EA19E88AA42182A230638978B8AD891347E71
SHA-512:	CA1F82B7312067998CB8B306B6B3E0D01F4EA7545FFC182720AB688427AD848E4E75F3D82CFECB1C9DE57419AD3DEA7CEB77607ACB83C7DE2EEB7B5126C110E1
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C........gB}.O(u...c.k.T.}....(.A.M.D. .C.A.T.A.L.Y.S.T."!)............ .. ...N0}...... . ..`._..HQ.N0}....&N.T.a.N.N.h>k...h.N._..Mb...[..0.....b.O(u..D..v...0...f.e.N .(..Y.N.N.[..)....bvQ.NUO..R .(..N.N.T1z.p.0,g...0)..0 .,g.T.}/f.`.N.P.N.b.[. .(..N.Nq}1z.p.0.`.0.T.0.`.v.0). ....R.... .A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C... .(..N.N1z.p.0A.M.D..0). .=\|...v.T.lTSp..0.........Y.g.`.N.T.a,g.T.}.v.h>k....R.[..0.....b.O(u,g...0 ..[..0.....b.O(u,g....h.:y.`.T.a,g.T.}.v@b.g.h>k...h.N.0........1... ..[...0..........a.). ..0...f.e.N.0/f.c..,g...bvQ.NUO..R.v..0.S+T.b..D..v.[..c.N.x.T.}.N.b..P[...f.e.N.0....b.). ..0zfga.."u.k.0/f.chQ.t.NUO.S.l.{D.@S...S.v@b.gHr.k.0FU.j.0FUmi_j.[.0.\)R.0IQi.\O.T.T@b.g.v..0^.<O.bvQ.Nzfga.."u.k...S.b@b.g.v..v.a(u.z._.T;..Q.0........2... ..c.k.0 . .9h.d,g.T.}.v.h>k...h.N...[..A.M.D. .2..c.N.`^..\l\.0MQ/e.NHr.z.0.S.d...0.N.SI....0.gP..vW.\O.c.k...S...\,g.....S+T.bte.T .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaCSY.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1133), with CRLF line terminators
Category:	dropped
Size (bytes):	19330
Entropy (8bit):	3.81231931482335
Encrypted:	false
SSDEEP:	192:+VW9zuFAmsMcffQIiEcoJgI6u9o75EGaodFMY/zsVrYkjHE8gRiFEKT4ore9:+lhsPTJ1WFEZU/grYingku9
MD5:	98AE6455CF7F1070BA0371FFA4011A4D
SHA1:	9DE74BB4C9414C598402FACE90B97D7D938B3246
SHA-256:	1269292AC52A743EB8C4D6CDA8F5395098D155616C3A605C0886717EE87EEFC2
SHA-512:	E090FD5CED67083AA56512C5E94893EF9D21B9ED04AAF9FA578E29F1492FA574486FD8AFDB85663127FCEACBF21AB099396DBBAEA79A8BC5660F98CC0347450A
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C.......L.I.C.E.N...N... .S.M.L.O.U.V.A. .S. .K.O.N.C.O.V...M. .U.}.I.V.A.T.E.L.E.M.....(.A.M.D. .C.A.T.A.L.Y.S.T."!).........D.n.L.E.}.I.T... .. .P.X.E...T...T.E. .S.I. .P.O.Z.O.R.N...:. . .D.O.K.U.D. .S.I. .N.E.P.X.E...T.E.T.E. .A. .N.E.O.D.S.O.U.H.L.A.S...T.E. .N...S.L.E.D.U.J...C... .P.O.D.M...N.K.Y.,. .N.E.S.M...T.E. .N.A.I.N.S.T.A.L.O.V.A.T.,. .K.O.P...R.O.V.A.T. .A.N.I. .P.O.U.}...V.A.T. .P.X.I.L.O.}.E.N... .S.O.F.T.W.A.R.E.,. .D.O.K.U.M.E.N.T.A.C.I. .(.P.O.D.L.E. .D.E.F.I.N.I.C.E. .N...}.E.). .A.N.I. .}...D.N... .J.E.J.I.C.H. .....S.T.I. .(.S.O.U.H.R.N.N... .. S.O.F.T.W.A.R.E.. )... .T.O.T.O. .J.E. .P.R...V.N... .D.O.H.O.D.A. .(.D...L.E. .J.E.N. .. D.O.H.O.D.A.. ). .M.E.Z.I. .V...M.I. .(.F.Y.Z.I.C.K.O.U. ...I. .P.R...V.N.I.C.K.O.U. .O.S.O.B.O.U.). .(.D...L.E. .S.P.O.L.E...N... .. V.Y.. .A. .. V...`.. ). .A. .S.P.O.L.E...N.O.S.T... .A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C... .(.D...L.E. .J.E.N. .. A.M.D.. )...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaDAN.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1449), with CRLF line terminators
Category:	dropped
Size (bytes):	21044
Entropy (8bit):	3.469681163481908
Encrypted:	false
SSDEEP:	192:CNKObPyGpFEnc4IAyETSdnF/esLRnEBWvGF8rrDCbBQbZwDHvgoN+6iZcc3Vz9EP:C7qE94SPlEAeuDHJ59U
MD5:	F612EB54E9A49C62835848BFB05D9E30
SHA1:	25698ECAD4C9F4859EDF1C33449ECA17991EA03E
SHA-256:	25A16692626739BC991F4F6A580DBE561708321F67642AE2CE68020B6F6515D3
SHA-512:	67787B3436564B9C848AD12810EF7FFD3CD917D98CC5DCB0119358F08F1511F19D3D78F5B2FF686E62E959C125E35D7A63EF4704FF3EB969DAC59E129023A663
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C.......S.L.U.T.B.R.U.G.E.R.L.I.C.E.N.S.A.F.T.A.L.E.....(.A.M.D. .C.A.T.A.L.Y.S.T."!).........V.I.G.T.I.G.T.-.L...S. .G.R.U.N.D.I.G.T.:. . .D.U. .M... .I.K.K.E. .I.N.S.T.A.L.L.E.R.E.,. .K.O.P.I.E.R.E. .E.L.L.E.R. .B.R.U.G.E. .D.E.N. .V.E.D.L.A.G.T.E. .S.O.F.T.W.A.R.E.,. .D.O.K.U.M.E.N.T.A.T.I.O.N. .(.S.O.M. .D.E.F.I.N.E.R.E.T. .N.E.D.E.N.F.O.R.). .E.L.L.E.R. .N.O.G.E.N. .D.E.L. .H.E.R.A.F.,. .(.U.N.D.E.R. ...T. .".S.O.F.T.W.A.R.E.".).,. .I.N.D.E.N. .D.U. .G.R.U.N.D.I.G.T. .H.A.R. .L...S.T. .O.G. .A.C.C.E.P.T.E.R.E.T. .D.E. .F...L.G.E.N.D.E. .V.I.L.K...R. .O.G. .B.E.T.I.N.G.E.L.S.E.R... .D.E.T.T.E. .E.R. .E.N. .J.U.R.I.D.I.S.K. .B.I.N.D.E.N.D.E. .A.F.T.A.L.E. .(.".A.F.T.A.L.E.".). .M.E.L.L.E.M. .D.I.G. .(.E.N.T.E.N. .S.O.M. .F.Y.S.I.S.K. .E.L.L.E.R. .J.U.R.I.D.I.S.K. .P.E.R.S.O.N.). .(.U.N.D.E.R. .E.T. .".D.U.". .O.G. .".D.I.N.".). .O.G. .A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C... .(.".A.M.D.".)...........H.V.I.S. .D.U.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaDEU.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1309), with CRLF line terminators
Category:	dropped
Size (bytes):	22496
Entropy (8bit):	3.5281428376166475
Encrypted:	false
SSDEEP:	192:xzo1WwzyZBaZQbj9s6a3GC0Y73qoRQXHmmEKpgpUgyvtGp:ZoYBZBaZQbxs6aWKtQh1gpUt1+
MD5:	5FF57120806182975829F6B46BD93AD5
SHA1:	6C5AB33BD2FA7B5393B51A8160D84B779A965975
SHA-256:	E0594BDF94ABEB15A9E3689BDA10CF9BFF90F55FD5C9109A2CEB6443988DEE06
SHA-512:	2D09A10EBDB34372FF3DA853A6B696E44D9FCE99C4B552AA19896936E8FE4DEEF62366ED3A5E1FD577C74284C57F3C29F9329013A92D7C3E3078668DB8D37BA1
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C.......L.I.Z.E.N.Z.V.E.R.E.I.N.B.A.R.U.N.G. .F...R. .E.N.D.A.N.W.E.N.D.E.R.....(.A.M.D. .C.A.T.A.L.Y.S.T."!).........W.I.C.H.T.I.G.!. .A.U.F.M.E.R.K.S.A.M. .L.E.S.E.N. . .S.I.E. .D...R.F.E.N. .D.I.E. .B.E.I.L.I.E.G.E.N.D.E. .S.O.F.T.W.A.R.E.,. .D.I.E. .D.O.K.U.M.E.N.T.A.T.I.O.N. .(.W.I.E. .U.N.T.E.N. .D.E.F.I.N.I.E.R.T.). .O.D.E.R. .T.E.I.L.E. .D.A.V.O.N. .(.Z.U.S.A.M.M.E.N. .. S.O.F.T.W.A.R.E.. ). .W.E.D.E.R. .I.N.S.T.A.L.L.I.E.R.E.N.,. .N.O.C.H. .K.O.P.I.E.R.E.N. .O.D.E.R. .B.E.N.U.T.Z.E.N.,. .B.E.V.O.R. .S.I.E. .D.E.N. .F.O.L.G.E.N.D.E.N. .B.E.D.I.N.G.U.N.G.E.N. .Z.U.G.E.S.T.I.M.M.T. .H.A.B.E.N... .D.I.E.S. .I.S.T. .E.I.N.E. .R.E.C.H.T.L.I.C.H.E. .V.E.R.E.I.N.B.A.R.U.N.G. .(.. V.E.R.E.I.N.B.A.R.U.N.G.. ). .Z.W.I.S.C.H.E.N. .I.H.N.E.N. .(.E.N.T.W.E.D.E.R. .E.I.N.E. .E.I.N.Z.E.L.P.E.R.S.O.N. .O.D.E.R. .J.U.R.I.S.T.I.S.C.H.E. .P.E.R.S.O.N.). .(.I.N.S.G.E.S.A.M.T. .A.L.S. .. S.I.E.. .U.N.D. .. I.H.R.E.. .B.E.Z.E.I.C.H.N.E.T.). .U.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaENU.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1223), with CRLF line terminators
Category:	dropped
Size (bytes):	19374
Entropy (8bit):	3.4919201411394036
Encrypted:	false
SSDEEP:	192:mMiadmkstbtB9wpysAaNAPgBVEkf9aiA2m/CBb64HPmTAOSFkz3l4uGWykS/I:7lkkguVEkf973HuSWZvS/I
MD5:	8D79CABD842C01445A9768E3E8F66B78
SHA1:	EBC54A57B336348D13138D754D0C1F86AA1C41B4
SHA-256:	893E4B20DD5F6A2CE55C1BB8B6F801832B45FABD04517BB0650A015375B680DD
SHA-512:	1DC33655C818792496F561D7F91715831AF0A2DF6D2E6612989B70A4ECCA7E8DB40CFFE817DC0CF874283399DAE5947A010ADDF373F5FA1A079C93CC360C37BB
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C.......E.N.D. .U.S.E.R. .L.I.C.E.N.S.E. .A.G.R.E.E.M.E.N.T.....(.A.M.D. .C.A.T.A.L.Y.S.T."!). .........I.M.P.O.R.T.A.N.T.-.R.E.A.D. .C.A.R.E.F.U.L.L.Y.:. . .D.O. .N.O.T. .I.N.S.T.A.L.L.,. .C.O.P.Y. .O.R. .U.S.E. .T.H.E. .E.N.C.L.O.S.E.D. .S.O.F.T.W.A.R.E.,. .D.O.C.U.M.E.N.T.A.T.I.O.N. .(.A.S. .D.E.F.I.N.E.D. .B.E.L.O.W.).,. .O.R. .A.N.Y. .P.O.R.T.I.O.N. .T.H.E.R.E.O.F.,. .(.C.O.L.L.E.C.T.I.V.E.L.Y. .".S.O.F.T.W.A.R.E.".). .U.N.T.I.L. .Y.O.U. .H.A.V.E. .C.A.R.E.F.U.L.L.Y. .R.E.A.D. .A.N.D. .A.G.R.E.E.D. .T.O. .T.H.E. .F.O.L.L.O.W.I.N.G. .T.E.R.M.S. .A.N.D. .C.O.N.D.I.T.I.O.N.S... . .T.H.I.S. .I.S. .A. .L.E.G.A.L. .A.G.R.E.E.M.E.N.T. .(.".A.G.R.E.E.M.E.N.T.".). .B.E.T.W.E.E.N. .Y.O.U. .(.E.I.T.H.E.R. .A.N. .I.N.D.I.V.I.D.U.A.L. .O.R. .A.N. .E.N.T.I.T.Y.). .(.C.O.L.L.E.C.T.I.V.E.L.Y. .".Y.O.U.". .A.N.D. .".Y.O.U.R.".). .A.N.D. .A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C... .(.".A.M.D.".)... .........I.F. .Y.O.U. .D.O. .N.O.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaESP.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1486), with CRLF line terminators
Category:	dropped
Size (bytes):	22352
Entropy (8bit):	3.450376437405832
Encrypted:	false
SSDEEP:	192:pnhOQe3l0R9iuFIh0/eCiTKIut1Y5Ef+LpfIRErc40pJgZVai6:Pe3lYOhyeClfYKmLOyrc+ai6
MD5:	EC789D8F655CEABD697188AFA10D25BD
SHA1:	D404ED50B3CADE71062D37C9261F2E3BD35A30BE
SHA-256:	FD53504FDA169DA20C8CBD92FFE5303AE3FDE33A2F1F227C9F3746BF78C9737A
SHA-512:	5EB9C757D051BAB65E8A65B4CBF2D1A04281138003B8B30980CF30C7AE90FD3148A96FF05D5258A9931D5553B630831AB6687526C866B9FBD689F59C1C49E0D6
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C.......A.C.U.E.R.D.O. .D.E. .L.I.C.E.N.C.I.A. .D.E.L. .U.S.U.A.R.I.O. .F.I.N.A.L.....(.A.M.D. .C.A.T.A.L.Y.S.T."!).........I.M.P.O.R.T.A.N.T.E... .L.E.A. .D.E.T.E.N.I.D.A.M.E.N.T.E.:. . .N.O. .I.N.S.T.A.L.E.,. .C.O.P.I.E. .N.I. .U.T.I.L.I.C.E. .E.L. .S.O.F.T.W.A.R.E. .A.D.J.U.N.T.O.,. .L.A. .D.O.C.U.M.E.N.T.A.C.I...N. .(.C.O.M.O. .S.E. .D.E.F.I.N.E. .A. .C.O.N.T.I.N.U.A.C.I...N.). .N.I. .C.U.A.L.Q.U.I.E.R. .P.A.R.T.E. .D.E.L. .M.I.S.M.O. .(.C.O.N.J.U.N.T.A.M.E.N.T.E.,. .".S.O.F.T.W.A.R.E.".).,. .H.A.S.T.A. .Q.U.E. .H.A.Y.A. .L.E...D.O. .D.E.T.E.N.I.D.A.M.E.N.T.E. .Y. .H.A.Y.A. .A.C.O.R.D.A.D.O. .L.O.S. .S.I.G.U.I.E.N.T.E.S. .T...R.M.I.N.O.S. .Y. .C.O.N.D.I.C.I.O.N.E.S... ...S.T.E. .E.S. .U.N. .A.C.U.E.R.D.O. .L.E.G.A.L. .(.".E.L. .A.C.U.E.R.D.O.".). .E.N.T.R.E. .U.S.T.E.D. .(.P.E.R.S.O.N.A. .D.E. .E.X.I.S.T.E.N.C.I.A. .R.E.A.L. .O. .P.E.R.S.O.N.A. .J.U.R...D.I.C.A.). .(.E.N. .C.O.N.J.U.N.T.O. .".U.S.T.E.D.". .O. .".S.U.".). .Y. .A.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaFIN.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1125), with CRLF line terminators
Category:	dropped
Size (bytes):	19912
Entropy (8bit):	3.47887370282554
Encrypted:	false
SSDEEP:	384:swZouv4cYzA1IwesAHyphysIC8Mt4Es177blUXDTfPkagcdmVVC2/n+246vY:JZ0sMsAH/2tzZGp4yY
MD5:	6D3507316D3F330D3A2F09AC226EF650
SHA1:	2269D7C70871C13B287F5162372EDFA749F9FFD7
SHA-256:	4B9D0854040C798F1C683BA67308574F4AA3E045A460CC964086FB45DB8FD859
SHA-512:	5510691CD29F0C7BFBEB9AD07F62CCBD92B3CC53F7241A0520C0DBC31D8ACC316C89B4F1D58BEA908668CD44CDA24CCC5CE89A817268F4CDAAC4326EF1B88706
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C.......K...Y.T.T...O.I.K.E.U.S.S.O.P.I.M.U.S.....(.A.M.D. .C.A.T.A.L.Y.S.T."!).........T...R.K.E..... .. .L.U.E. .H.U.O.L.E.L.L.I.S.E.S.T.I.:. . ...L... .A.S.E.N.N.A.,. .K.O.P.I.O.I. .T.A.I. .K...Y.T... .O.H.E.I.S.T.A. .O.H.J.E.L.M.I.S.T.O.A.,. .D.O.K.U.M.E.N.T.A.A.T.I.O.T.A. .(.M.....R.I.T.E.L.T.Y. .A.L.L.A.). .T.A.I. .M.I.T.....N. .N.I.I.D.E.N. .O.S.A.A. .(.Y.H.T.E.I.S.E.S.T.I. .".O.H.J.E.L.M.I.S.T.O.".).,. .E.N.N.E.N. .K.U.I.N. .O.L.E.T. .L.U.K.E.N.U.T. .S.E.U.R.A.A.V.A.T. .K...Y.T.T...E.H.D.O.T. .H.U.O.L.E.L.L.A. .J.A. .H.Y.V...K.S.Y.N.Y.T. .N.E... .T...M... .O.N. .L.A.I.L.L.I.N.E.N. .S.O.P.I.M.U.S. .(.".S.O.P.I.M.U.S.".). .S.I.N.U.N. .(.J.O.K.O. .Y.K.S.I.L... .T.A.I. .Y.H.T.I...). .(.K.O.L.L.E.K.T.I.I.V.I.S.E.S.T.I. .".S.I.N...". .J.A. .".S.I.N.U.N.".). .J.A. .A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C.:.I.N. .(.".A.M.D.".). .V...L.I.L.L.............J.O.S. .E.T. .H.Y.V...K.S.Y. .T...M...N. .S.O.P.I.M.U.K.S.E.N. .E.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaFRA.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1591), with CRLF line terminators
Category:	dropped
Size (bytes):	23544
Entropy (8bit):	3.479898888564438
Encrypted:	false
SSDEEP:	192:oXFXetSr15lZ7+gY9Kg5TEcxRVCWydvWOFg70JsKy2Yi5nncOeUlfMk96yLW62AA:m1PVlp7STCdv/Ycnz39XB4MWve9m4S
MD5:	619093B9FA95D356558A04847A6D1E10
SHA1:	817EE91946E92BD2B86CF9101031DF5E6060FA56
SHA-256:	C80027E203DBCC479D2405DAE53A11DB9D6D89FC95F66534A79DF2EEA65248FD
SHA-512:	421B84C67D5A120A2C5D421571CAE4702AC4250D8DA631B7ED6A6DD1F1739AD421B0CA6EC6937E51663E5338D8F526693D9422F5F20B6F2395181BCFAC8DC53D
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C.......C.O.N.T.R.A.T. .D.E. .L.I.C.E.N.C.E. .D.E. .L.'.U.T.I.L.I.S.A.T.E.U.R. .F.I.N.A.L.....(.A.M.D. .C.A.T.A.L.Y.S.T."!).........I.M.P.O.R.T.A.N.T. .-. ... .L.I.R.E. .A.T.T.E.N.T.I.V.E.M.E.N.T...:. . .N.'.I.N.S.T.A.L.L.E.Z. .P.A.S.,. .N.E. .C.O.P.I.E.Z. .P.A.S. .O.U. .N.'.U.T.I.L.I.S.E.Z. .P.A.S. .L.E. .L.O.G.I.C.I.E.L. .C.I.-.J.O.I.N.T.,. .L.A. .D.O.C.U.M.E.N.T.A.T.I.O.N. .(.T.E.L.L.E. .Q.U.E. .D...F.I.N.I.E. .C.I.-.D.E.S.S.O.U.S.). .O.U. .T.O.U.T.E. .P.A.R.T.I.E. .D.E. .C.E.S. .D.E.R.N.I.E.R.S. .(.D...S.I.G.N...S. .D.A.N.S. .L.E.U.R. .E.N.S.E.M.B.L.E. .....L.O.G.I.C.I.E.L.....). .A.V.A.N.T. .D.'.A.V.O.I.R. .L.U. .A.T.T.E.N.T.I.V.E.M.E.N.T. .E.T. .A.C.C.E.P.T... .L.E.S. .T.E.R.M.E.S. .E.T. .C.O.N.D.I.T.I.O.N.S. .S.U.I.V.A.N.T.S... .C.E.C.I. .C.O.N.S.T.I.T.U.E. .U.N. .A.C.C.O.R.D. .J.U.R.I.D.I.Q.U.E. .(.....A.C.C.O.R.D.....). .E.N.T.R.E. .V.O.U.S. .(.Q.U.E. .V.O.U.S. .S.O.Y.E.Z. .U.N.E. .P.E.R.S.O.N.N.E. .P.H.Y.S.I.Q.U.E. .O.U. .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaGRK.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1478), with CRLF line terminators
Category:	dropped
Size (bytes):	24140
Entropy (8bit):	4.0203677137757206
Encrypted:	false
SSDEEP:	384:dm0AYAZ4xmA/qoptZLvlGD37dMQ1j6Vd8R1WS+KmWvdwMckfcsy:dCZYDGbhuV81VDvEsy
MD5:	0E2D6AA08F6FD199CF48E8DE84C8B8E9
SHA1:	C5373CEA4BB43CAD93F49A31B44DA46F9BD0F7B3
SHA-256:	FD856180987A08618D03BAE051785BC0EB4F6C9F3907A3A8FB70DD1D2049D5BE
SHA-512:	6441448BB2DE6E31364E01E24CE99B801C156726B9E95D1262D5606779194A81755FC6E1EF67D2C350FE195BDB67BB4B6DB5E75FCA05385744EC30CF74318D5F
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C.....................A. ............. ............. ............... .................(.A.M.D. .C.A.T.A.L.Y.S.T."!)........................... .-. ....................... ................. .....................:. . ....... ................. ......... .......................,. ................... ... ........... ....... ....................... .....................,. ....... ....................... .(......... ................. .................).,. ... ......................... ................. ...........,. .(................... ."...................".).,. ............. ................... ..................... ....... ....................... ..... ......... ..................... ........... ....... ........................... ..... ........... ................. ............. ............... .(."...............".). ............. ......... .(............. ............... ... .................). .(................... ."...........".

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaHNG.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1261), with CRLF line terminators
Category:	dropped
Size (bytes):	20694
Entropy (8bit):	3.7011963721133587
Encrypted:	false
SSDEEP:	384:69B43WTrTYvTruN2QCJLGbtkQTxGX4GogigN4nYok:/G/ToP6xCZEtkQTxGX4GogiY4Yok
MD5:	E0543B378F7CC5674B1B01542A23AA37
SHA1:	43A99F952724FCD6D1DE440768F2256FF1F1F0FB
SHA-256:	71E95B0D18E1AA53B3B837406E1AB3CEF4DA1430A7A1F64221A83F1F8B7A0840
SHA-512:	92CE6D258F4A50F47FD121806B2AC7B6E2BC6386C006DAEEEEEE67C83E1DAF31397869B0CBCA8F39A879C2ECE590E2589A970347BFFE5280C720155BE1DCD57C
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C.......V...G.F.E.L.H.A.S.Z.N...L...I. .L.I.C.E.N.C.S.Z.E.R.Z.P.D...S.....(.A.M.D. .C.A.T.A.L.Y.S.T."!).........F.O.N.T.O.S. .. .F.I.G.Y.E.L.M.E.S.E.N. .O.L.V.A.S.S.A. .E.L.!. . .A. .M.E.L.L...K.E.L.T. .S.Z.O.F.T.V.E.R.T.,. .D.O.K.U.M.E.N.T...C.I...T. .(.E.G.Y...T.T.E.S.E.N.:. .. S.Z.O.F.T.V.E.R.. ). .V.A.G.Y. .(.A.L...B.B.I. .M.E.G.H.A.T...R.O.Z...S. .S.Z.E.R.I.N.T.). .A.N.N.A.K. .B...R.M.E.L.Y. .E.L.E.M...T. .A.D.D.I.G. .N.E. .T.E.L.E.P...T.S.E. .F.E.L.,. .N.E. .M...S.O.L.J.A. .L.E.,. .V.A.G.Y. .N.E. .H.A.S.Z.N...L.J.A. .F.E.L.,. .A.M...G. .A. .K...V.E.T.K.E.Z.P. .F.E.L.T...T.E.L.E.K.E.T. .F.I.G.Y.E.L.M.E.S.E.N. .E.L. .N.E.M. .O.L.V.A.S.T.A.,. ...S. .E.L. .N.E.M. .F.O.G.A.D.T.A... .E.Z. .E.G.Y. .J.O.G.I. .S.Z.E.R.Z.P.D...S. .(.. S.Z.E.R.Z.P.D...S.. ). ...N. .(.M.I.N.T. .T.E.R.M...S.Z.E.T.E.S. .V.A.G.Y. .J.O.G.I. .S.Z.E.M...L.Y.). .(.E.G.Y...T.T.E.S.E.N. .. ..N.. ). ...S. .A.Z. .A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaITA.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1457), with CRLF line terminators
Category:	dropped
Size (bytes):	22644
Entropy (8bit):	3.4290506195674406
Encrypted:	false
SSDEEP:	192:oJq26UbpM3anlSOPT/yql16NpzoqZi+si23b7lhBMzG57zVq2YvthlTxGse8rOfE:Hl+DTn/6xsB74GwHeW8Fznzlg
MD5:	65A699F6700B8387B6FFC278D1B52F49
SHA1:	10FFADFFB9C7BED726E53C2593D37743423F02AA
SHA-256:	21192061BA2F0D178ADABBA171DC8DC4FEE9E77731DB2F7243959AA737B4ABF9
SHA-512:	2CE6EE35C05E73833328BB18B5B53D5105C779A0E92B0498A7B01A92176213FF5CACDC669658A62D200512AE1CC691346804313333039297214F693D041D7D97
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C.......C.O.N.T.R.A.T.T.O. .D.I. .L.I.C.E.N.Z.A. .C.O.N. .L.'.U.T.E.N.T.E. .F.I.N.A.L.E.....(.A.M.D. .C.A.T.A.L.Y.S.T."!).........I.M.P.O.R.T.A.N.T.E. .-. .L.E.G.G.E.R.E. .C.O.N. .A.T.T.E.N.Z.I.O.N.E.:. . .N.O.N. .I.N.S.T.A.L.L.A.R.E.,. .C.O.P.I.A.R.E. .O. .U.S.A.R.E. .I.L. .S.O.F.T.W.A.R.E.,. .L.A. .D.O.C.U.M.E.N.T.A.Z.I.O.N.E. .(.C.O.M.E. .D.E.F.I.N.I.T.A. .D.I. .S.E.G.U.I.T.O.). .O. .P.A.R.T.E. .D.E.G.L.I. .S.T.E.S.S.I. .(.D.E.F.I.N.I.T.I. .C.O.N.G.I.U.N.T.A.M.E.N.T.E. .".S.O.F.T.W.A.R.E.".). .P.R.I.M.A. .D.I. .A.V.E.R. .A.T.T.E.N.T.A.M.E.N.T.E. .L.E.T.T.O. .E. .A.C.C.E.T.T.A.T.O. .I. .S.E.G.U.E.N.T.I. .T.E.R.M.I.N.I. .E. .C.O.N.D.I.Z.I.O.N.I... .I.L. .P.R.E.S.E.N.T.E. ... .U.N. .A.C.C.O.R.D.O. .L.E.G.A.L.E. .(.".C.O.N.T.R.A.T.T.O.".). .T.R.A. .L.'.U.T.E.N.T.E. .(.P.E.R.S.O.N.A. .F.I.S.I.C.A. .O. .G.I.U.R.I.D.I.C.A.). .(.C.O.L.L.E.T.T.I.V.A.M.E.N.T.E. .".L.'.U.T.E.N.T.E.". .E. .".D.E.L.L.'.U.T.E.N.T.E.".). .E. .A.D.V.A.N.C.E.D. .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaJPN.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (576), with CRLF line terminators
Category:	dropped
Size (bytes):	8970
Entropy (8bit):	5.682212289325587
Encrypted:	false
SSDEEP:	192:ZwrXqUGD0yjxtzExrcAchAdGUvUEunDbwRAt6EM2Ahx/asdXQedioBV8BNDehrkP:8w0gxtzOrimGUvliDbwR8ud7Q2ioB+T5
MD5:	9DB16CF3DFCF65FECE81816A03DFBE7E
SHA1:	024D9CDFC2D2244EE53BB42772B902C06FE2E0D9
SHA-256:	0C2BAA217F53568461186DC6E438B6A2D33C945CF697EEE712A73300D0CB4A94
SHA-512:	6FC7D0C18D7D3726A7D1D9B7281B57758C6055CA2A5AFE7D9963DF6CA329F61309DECEB932C3EE244E8DFF9D157E9913C5A8C94F23879FC215990FF218F7D86B
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C........O(u1...QY.}.f....(.A.M.D. .C.A.T.A.L.Y.S.T."!).............N.....l.aW0f0J0...0O0`0U0D0.0 . ..N.Nn0)R(uag.N.0Na.k0J0...0k0j0.0.0.T.aW0j0D0P..0.0.T.hn0.0.0.0.0.0.0.0.e.f...N..k0.[....~0_0o0]0n0.N..R..~0h0.0f0.0.0.0.0.0.0.0.0h0\|Tv0...0.0.0.0.0.0.0.0.0.0.0~0_0o0.O(uW0j0D0g0O0`0U0D0.0 .S0.0o0J0.[.i...P.N~0_0o0.VSO....~0h0.0f0.0B0j0_0.0J0.0s0.0B0j0_0n0.0h0\|Tv0..J0.0s0A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C......0A.M.D..0..h0n0..n0.l.vQY.}...0QY.}.0..g0Y0.0........S0n0QY.}.fn0ag.Nk0.T.aW0j0D0P..0.0S0n0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0~0_0o0.O(uW0j0D0g0O0`0U0D0.0 ..0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0~0_0o0.O(uY0.0S0h0k0.0.0.0S0n0QY.}.fn0Y0y0f0n0)R(u...[k0.T.aY0.0S0h0k0j0.0~0Y0.0........1... ..[............a.). ..0.e.f.0h0o0.0.0.0.0.0.0.0k0..#..0.N^\.0~0_0o0.c.OU0.0f0D0.0.0.0.0.0.0.0.0.0.0.0.0J0.0s0.0.0.0.0.0~0_0o0..P[.e.f.0B0.0D0o0]0n0.N.n0S0h0.0.asTW0~0Y0.0....b.). ..0.w.v@b.g)j.0h0o0.0Y0y0f0n0W.\O)j.0FU.j.0FUmi.N

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaKOR.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (608), with CRLF line terminators
Category:	dropped
Size (bytes):	9454
Entropy (8bit):	5.507179561495764
Encrypted:	false
SSDEEP:	96:qufmh4ZcHPQ/1sb6xRoQ/SivTuaa9pLes1cq7TAAtUZPLUq3xzL32ZGBYPw2Gwhu:DO0cvW1OiPA8zL3IzMCLeqqH
MD5:	39D05FC13861D7195C5A705EDA30EC94
SHA1:	CA68A0CFA43CB495F9D32D0D81FABB341DA419DA
SHA-256:	5D83FB84AACED2B3219DCFA17879FA65E1638B75F78ECB55D1FB0781B69D22E4
SHA-512:	37C60A958AA25E9245CD3A5BF2BFA252067229D27C0D721F585D39AD4ED97C280530B4B5B048ECBFB550BDFB719E76F0A212837D58056E9C97AE48D291466B15
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C.......\.. ...... ...... ..}.....(.A.M.D. .C.A.T.A.L.Y.S.T."!)............-...X. .J... .}........$.:. . ..L. .t.. .}...D. .}.. ..X.X.0. ...L.... ...... .........,. .8...(.D.. .....). ..... ... .\|..(.".........". ...m.).\|. .$.X. ..... .....X.p... .....X... ......$... ... ..}.@. ...X.(...x. ..... ...x.).(...m.X... ."...X.". ..... ."...X.X.".).@. .A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C...(.".A.M.D.".). ..... ........ ..... ..}...(."..}.".)...............X... ... ..}.X. .p.m... ..X.X... .J.. .....,. .........\|. .$.X. ..... .....X.p... .....X... ......$... .........\|. .$.X.,. .....,. .....X.. ...... ... ..}.X. .... .}..... ..X.X.. .................1... .... ...X.............a.). .".8..."... ... ........... ..... ..... ...h.....p... ...(..... .......p... .$.X. ...l....,. .(.\|.x. ..... .... .8...\|. .X...i.........b.). ."..... ......".@. .... .....,. ...\.,. ..... .D...,. .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaNLD.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1332), with CRLF line terminators
Category:	dropped
Size (bytes):	21692
Entropy (8bit):	3.4603636832444127
Encrypted:	false
SSDEEP:	192:IzDqobOGYDHmPB4V49AbOSE7tMxOSsUeNQyr:EzbOxDHa9AKGOSFehr
MD5:	68E067E3C6FA5D9C6380DB792E5FA6C7
SHA1:	F4E994CA857A294D6A362C1DDF88F29569391852
SHA-256:	B909E21DEF9E20A3E50A4902409C2F8F1852BE1B1C46369EE5D390E55C65CF65
SHA-512:	288484F2386710B2CA6EF6AF1FA3AE699F24C6B8A5D4315F90522FD9BBF24A411793A6ADF6D17602BDBED470A00FDCBBF399EC23846E1AAC8CDA53B65F08B33A
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C.......L.I.C.E.N.T.I.E.O.V.E.R.E.E.N.K.O.M.S.T. .V.O.O.R. .E.I.N.D.G.E.B.R.U.I.K.E.R.S.....(.A.M.D. .C.A.T.A.L.Y.S.T."!).........B.E.L.A.N.G.R.I.J.K.-.L.E.E.S. .A.A.N.D.A.C.H.T.I.G.:. . .I.N.S.T.A.L.L.E.E.R.,. .K.O.P.I.E.E.R. .O.F. .G.E.B.R.U.I.K. .D.E. .B.I.J.G.E.L.E.V.E.R.D.E. .S.O.F.T.W.A.R.E.,. .D.O.C.U.M.E.N.T.A.T.I.E. .(.Z.O.A.L.S. .H.I.E.R.O.N.D.E.R. .G.E.D.E.F.I.N.I.E.E.R.D.). .O.F. .E.E.N. .D.E.E.L. .E.R.V.A.N. .(.S.A.M.E.N. .".S.O.F.T.W.A.R.E.". .G.E.N.O.E.M.D.). .N.I.E.T. .T.O.T. .U. .D.E. .V.O.L.G.E.N.D.E. .V.O.O.R.W.A.A.R.D.E.N. .A.A.N.D.A.C.H.T.I.G. .H.E.B.T. .G.E.L.E.Z.E.N... .D.I.T. .I.S. .E.E.N. .J.U.R.I.D.I.S.C.H.E. .O.V.E.R.E.E.N.K.O.M.S.T. .(.".O.V.E.R.E.E.N.K.O.M.S.T.".). .T.U.S.S.E.N. .U. .(.O.F. .E.E.N. .P.E.R.S.O.O.N. .O.F. .E.N.T.I.T.E.I.T.). .(.S.A.M.E.N. .".U.". .E.N. .".U.W.".). .E.N. .A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C... .(.".A.M.D.".)...........A.L.S. .U. .H.E.T. .N.I.E.T. .E.E.N.S.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaNOR.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1340), with CRLF line terminators
Category:	dropped
Size (bytes):	20282
Entropy (8bit):	3.4561602969236245
Encrypted:	false
SSDEEP:	384:Wn5qS95ZzWC8WW83n7byFpMu4MWSuOwEIrOuV:Wn5vpWC8WW83n7byFpMu4MWSuOwpCuV
MD5:	9C454B25EF4BB052F02C7E0D9510F540
SHA1:	072337DB9B9A492C381F758CFC247B3AF6FEB7DD
SHA-256:	63984750FD12A2D51B2D3BB77084CCE406DA96C068099BA78D62F1DB1274538A
SHA-512:	3020901FB7CD75D0538752825C8193409E147592DBA8D3090642E9768AC04FEB112517F56505DFF49DBBBDD63043302F328E465012D6167D2A2F667595323A2A
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C.......L.I.S.E.N.S.A.V.T.A.L.E. .F.O.R. .S.L.U.T.T.B.R.U.K.E.R.E.....(.A.M.D. .C.A.T.A.L.Y.S.T."!).........V.I.K.T.I.G. .. .L.E.S. .N...Y.E.:. . .I.K.K.E. .I.N.S.T.A.L.L.E.R.,. .K.O.P.I.E.R. .E.L.L.E.R. .B.R.U.K. .D.E.N. .M.E.D.F...L.G.E.N.D.E. .P.R.O.G.R.A.M.V.A.R.E.N.,. .D.O.K.U.M.E.N.T.A.S.J.O.N.E.N. .(.S.O.M. .D.E.F.I.N.E.R.T. .N.E.D.E.N.F.O.R.). .E.L.L.E.R. .N.O.E.N. .D.E.L. .A.V. .D.E.N.N.E. .(.S.A.M.L.E.T. .K.A.L.T. ...P.R.O.G.R.A.M.V.A.R.E.N...). .F...R. .D.U. .H.A.R. .L.E.S.T. .O.G. .G.O.D.T.A.T.T. .F...L.G.E.N.D.E. .V.I.L.K...R. .O.G. .B.E.T.I.N.G.E.L.S.E.R... .D.E.T.T.E. .E.R. .E.N. .J.U.R.I.D.I.S.K. .A.V.T.A.L.E. .(...A.V.T.A.L.E...). .M.E.L.L.O.M. .D.E.G. .(.E.N.T.E.N. .E.N. .E.N.K.E.L.P.E.R.S.O.N. .E.L.L.E.R. .E.N. .E.N.H.E.T.). .(.S.A.M.L.E.T. ...D.U./.D.E.G... .E.L.L.E.R. ...D.I.N./.D.I.T.T...). .O.G. .A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C... .(...A.M.D...)...........H.V.I.S. .D.U. .I.K.K.E. .E.R. .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaPLK.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1422), with CRLF line terminators
Category:	dropped
Size (bytes):	23182
Entropy (8bit):	3.7528051734088255
Encrypted:	false
SSDEEP:	384:Dbopf0VaXUl479eRazdKK2fJT3uQz6jMctheyzUy:DhH47wOdOJT3fz6Y2ey9
MD5:	B2532F21DE60049FD465BA86B8CF3A64
SHA1:	A5082812F08927F95816E7BA621FFE747DC66DA0
SHA-256:	76C5067ED8F94D4B07CC2152EFED25C6408FD507F5397A9E082AA99804B72E4D
SHA-512:	963EE03E4F1B8A1DBBEEEE8E0368B08B0DEC9D3ACC79EA59DBCB3D87A532D5F0129FB6CAC06CD99C7C0DE7F04178957947780D4BE9AA7452672E5EF5D1533D44
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C.......U.M.O.W.A. .L.I.C.E.N.C.Y.J.N.A. .U.{.Y.T.K.O.W.N.I.K.A. .K.O.C.C.O.W.E.G.O.....(.A.M.D. .C.A.T.A.L.Y.S.T."!).........W.A.{.N.E. .. .P.R.Z.E.C.Z.Y.T.A.J. .U.W.A.{.N.I.E.:. . .P.R.Z.E.D. .Z.A.I.N.S.T.A.L.O.W.A.N.I.E.M.,. .S.K.O.P.I.O.W.A.N.I.E.M. .L.U.B. .U.{.Y.C.I.E.M. .D.O.A...C.Z.O.N.E.G.O. .O.P.R.O.G.R.A.M.O.W.A.N.I.A.,. .D.O.K.U.M.E.N.T.A.C.J.I. .(.O.K.R.E.Z.L.O.N.Y.C.H. .P.O.N.I.{.E.J.). .L.U.B. .J.A.K.I.E.J.K.O.L.W.I.E.K. .I.C.H. .C.Z...Z.C.I. .(.A...C.Z.N.I.E. .. O.P.R.O.G.R.A.M.O.W.A.N.I.A.. ). .U.W.A.{.N.I.E. .P.R.Z.E.C.Z.Y.T.A.J. .I. .Z.A.A.K.C.E.P.T.U.J. .N.I.N.I.E.J.S.Z.E. .W.A.R.U.N.K.I... .T.O. .J.E.S.T. .P.R.A.W.N.I.E. .W.I...{...C.A. .U.M.O.W.A. .(.. U.M.O.W.A.. ). .P.O.M.I...D.Z.Y. .U.{.Y.T.K.O.W.N.I.K.I.E.M. .(.O.S.O.B... .F.I.Z.Y.C.Z.N... .L.U.B. .P.R.A.W.N...). .(.D.A.L.E.J. .Z.W.A.N.Y.M. .. U.{.Y.T.K.O.W.N.I.K.I.E.M.. ). .O.R.A.Z. .S.P...A.K... .A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C... .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaPTB.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1329), with CRLF line terminators
Category:	dropped
Size (bytes):	21646
Entropy (8bit):	3.4888203766391386
Encrypted:	false
SSDEEP:	192:ogk3m8tWucVlnDgP7iDrwrWPXxa/+jdaLaBBW/4I8okUBOWgmXDuhiQcC5STpBaL:nR1CNgBC+ZagW/44WhxSIYm
MD5:	646C0B0D4D988F4CEEE91F678F5E0E8B
SHA1:	729FB4761AD68E8580347B02B938A5F34BE478D0
SHA-256:	197F0FEFAC104EDD697E21A21AB52BF963DB4739C9574728EF8F819E841BF46D
SHA-512:	A6FA40C7219A61094ABDDF9BC6E837186FAEEA9B1F54EFEC352FFD4EF4F4CEFB0BC5BCD49134EF381C200E401E513047E1781DCC02FD81AF430ADD3C4A532AD5
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C.......C.O.N.T.R.A.T.O. .D.E. .L.I.C.E.N...A. .D.E. .U.S.U...R.I.O. .F.I.N.A.L.....(.A.M.D. .C.A.T.A.L.Y.S.T."!).........I.M.P.O.R.T.A.N.T.E. .. .L.E.I.A. .A.T.E.N.T.A.M.E.N.T.E.:. . .N...O. .I.N.S.T.A.L.E.,. .C.O.P.I.E. .O.U. .U.S.E. .O. .S.O.F.T.W.A.R.E. .E. .A. .D.O.C.U.M.E.N.T.A.....O. .(.C.O.N.F.O.R.M.E. .D.E.F.I.N.I.D.A. .A. .S.E.G.U.I.R.). .I.N.C.L.U...D.O.S.,. .N.E.M. .N.E.N.H.U.M.A. .P.A.R.T.E. .D.E.L.E.S.,. .(.C.O.L.E.T.I.V.A.M.E.N.T.E. .O. .".S.O.F.T.W.A.R.E.".). .A.T... .Q.U.E. .V.O.C... .T.E.N.H.A. .L.I.D.O. .A.T.E.N.T.A.M.E.N.T.E. .E. .C.O.N.C.O.R.D.A.D.O. .C.O.M. .O.S. .T.E.R.M.O.S. .E. .C.O.N.D.I.....E.S. .A. .S.E.G.U.I.R... .E.S.T.E. ... .U.M. .C.O.N.T.R.A.T.O. .L.E.G.A.L. .(.. C.O.N.T.R.A.T.O.. ). .E.N.T.R.E. .V.O.C... .(.S.E.J.A. .C.O.M.O. .P.E.S.S.O.A. .F...S.I.C.A. .O.U. .E.N.T.I.D.A.D.E.). .(.C.O.L.E.T.I.V.A.M.E.N.T.E. .. V.O.C.... .E. .. S.E.U.. ). .E. .A. .A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaRSA.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1318), with CRLF line terminators
Category:	dropped
Size (bytes):	22910
Entropy (8bit):	3.9354077655747184
Encrypted:	false
SSDEEP:	384:d5sh/7AlVTuTpTxTIT+TCTT1TRYdUw1huRm7MTK8f4b88QxsTAILYvoTc:jSN1sieTxVmgmLb8Sc0Y
MD5:	E137D51134B665D803A6E8CF02B9D318
SHA1:	854639958A0BC7A28ADD97819D9697653550BEA0
SHA-256:	ED6E237E8750696E4F31311C1A3422291B738BC988ABEAEF990BBCC053FE6A89
SHA-512:	EFBDFE357B2FD964617CED04E0FAEB5DC2342EF0F2B02C35545FE17CDA2F0106485A9904FFAC43C896ECC0147A5FBEB6D696B90FFD85E8DCFA588258FB2A99B1
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C...........&................... .!.........(......... .!. .........'...+... .......,.........".............(.A.M.D. .C.A.T.A.L.Y.S.T."!).................../. .....$... .....&.../. .. ... ...'."..."... ...........".....,.....:. . ..... .#.!."..................."...,. ..... ......... .#..."... ... ..... ...!.......,...#..."... ... ................... ... ..... ............. .......!.....'.........,. .......#......."...&..... .(.#.............#... .........). ....... .......+... ...%. .'...!."... .(.!....... ...".....,..... ..... ..... ............. .......!.....'...........). ..... ."...%. ..... .,. ......... ...+. ..... ... ...'."..."... ...........".....,..... .!.......#...)..... .#.!........./. ... ..... .!.........!..."...!.,. .!. ........... .-."... ... ............. .!.........(......... .(...!.........(...........). .........#. ......... .(.$.......'...!....... ....... ... .......'...!....... .....&.....). .(.!.........!."...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaSVE.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1237), with CRLF line terminators
Category:	dropped
Size (bytes):	20484
Entropy (8bit):	3.5324928485542677
Encrypted:	false
SSDEEP:	192:20HelM2GKIhF6lUfvgpMnwTxkr2O43G29PFmEeQvGjOxOo4dBrIbE7EfEzm0OBHG:FHxipMngFG2AQlxMdIBHaQJzO7
MD5:	5653CE9DE6BBFD96C82B40D3D505540E
SHA1:	4E05EBE17969791C66333C58DDA701FCAB33E836
SHA-256:	1752D2C9308904F43F719173B052EDE24D05C232CA4AC594E9AE0F48E93D43D0
SHA-512:	A140D5CF0A70E8BDCAE6C993C7D767E773959BB4D15573FBF500931EE908A3073359FBCB60546ED4BF5AFFC68315A6A508CD6F83EDECE58BF78DCA8616D3CC3A
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C.......L.I.C.E.N.S.A.V.T.A.L. .F...R. .S.L.U.T.A.N.V...N.D.A.R.E.....(.A.M.D. .C.A.T.A.L.Y.S.T."!).........V.I.K.T.I.G.T.-.L...S. .N.O.G.G.R.A.N.T.:. . .D.U. .S.K.A. .I.N.T.E. .I.N.S.T.A.L.L.E.R.A.,. .K.O.P.I.E.R.A. .E.L.L.E.R. .A.N.V...N.D.A. .D.E.N. .B.I.F.O.G.A.D.E. .P.R.O.G.R.A.M.V.A.R.A.N.,. .D.O.K.U.M.E.N.T.A.T.I.O.N.E.N. .(.E.N.L.I.G.T. .D.E.F.I.N.I.T.I.O.N.E.N. .N.E.D.A.N.).,. .E.L.L.E.R. .N...G.O.N. .D.E.L. .D...R.A.V.,. .(.S.A.M.M.A.N.T.A.G.E.T. .".P.R.O.G.R.A.M.V.A.R.".). .F...R.R...N. .D.U. .H.A.R. .N.O.G.G.R.A.N.T. .L...S.T. .O.C.H. .G.O.D.K...N.T. .F...L.J.A.N.D.E. .V.I.L.L.K.O.R... .D.E.T.T.A. ...R. .E.T.T. .J.U.R.I.D.I.S.K.T. .A.V.T.A.L. .(.".A.V.T.A.L.".). .M.E.L.L.A.N. .D.I.G. .(.A.N.T.I.N.G.E.N. .E.N. .I.N.D.I.V.I.D. .E.L.L.E.R. .E.N.H.E.T.). .(.S.A.M.M.A.N.T.A.G.E.T. .".D.U.". .O.C.H. .".D.I.N."./.".D.I.T.T."./.".D.I.N.A.".). .O.C.H. .A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C... .(.".A.M.D.".).......

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaTHA.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1114), with CRLF line terminators
Category:	dropped
Size (bytes):	18610
Entropy (8bit):	4.075185732139611
Encrypted:	false
SSDEEP:	192:ObHJR/itLW3OMfHvT7X6h+IVmUy5yBS+AVO0iftSAtJu/R/AmYqoFHsG8ZY4TR2D:C0Wj++z50SL0lD
MD5:	B9BB2ABEF81DB05B39E663AD6F729A7E
SHA1:	F280F3470FB8C0AB4D194B67452C161422CC1FE5
SHA-256:	1CA9213A8655019C42E15A4F52F1710AF17772D2DD3FEA0C57384CD87D00D3DD
SHA-512:	E7382E18135F5251283D0522DFB38069892A1604C1A16BB5930E29CFDA151F953943363B67B2FC865668606E5B0BE5AA9FD2589302049C5615F6C220CEE6FAD0
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C........1.....2.%.4....4.....4.L..3.+.#.1.....9.I.C...I...%.2."...2.......(.A.M.D. .C.A.T.A.L.Y.S.T."!).........@.-....2.#..3...1... .B...#...-.H.2...-.".H.2...%.0.@.-.5."...:. . .B...#...-.".H.2...4.....1.I... ...1...%.-... .+.#.7.-.C...I...-.....L.A.'.#.L...5.I. .@.-....2.#. .(...2.!...5.H.D...I.#.0...8.D.'.I...I.2...%.H.2...). .+.#.7.-..H.'...C....H.'...+...6.H.....-....4.H.....1.....%.H.2.'. .(.@.#.5."...#.'.!...1...'.H.2. ."...-.....L.A.'.#.L.".). .......'.H.2...8.....0.D...I.-.H.2...@.-....2.#.....1.....5.I.-.".H.2...%.0.@.-.5."...A.%.0.".-.!.#.1...@...7.H.-...D...A.%.0...I.-...3.+.......1.I...+.!... .@.-....2.#.....1.....5.I.@...G....1.....2...2.!.....+.!.2.". .(.".*.1.....2.".). .#.0.+.H.2.....8... .(...1.I...C.....2...0...8.....%.+.#.7.-.+...H.'."...2...). .(.@.#.5."...#.'.!...1...'.H.2. ."...8...". .+.#.7.-. ."...-.....8...".). .A.%.0. .A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C... .(.".A.M.D.".)...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\eulaTRK.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1170), with CRLF line terminators
Category:	dropped
Size (bytes):	19636
Entropy (8bit):	3.7539856112400876
Encrypted:	false
SSDEEP:	384:R3yPEXKr3a0m9Max8yJQ7sjqr9o0sRvfO/47k0GRc7mterU8IYHEA:RiPEXM3a0m9MaG97brC0sR23c7mteASp
MD5:	4B03E3CBE8222D4F8D39464135CD2066
SHA1:	80E8A56E22866B8FC0BD5D2BEE52C35D53AA92DC
SHA-256:	A9E3CE9EE6EBA1F171C7EAC9A688983C7E480F875B78D264007E8FC8A136BEED
SHA-512:	50B8D2ADAC139C1B8C01ED9E0C12CCABF29E760143EBD4222864149D4DB6867370F7F62F96980BDD6BAC37CEA3C7B54564795CFEE0632DB28F0274E0265E5C53
Malicious:	false
Reputation:	low
Preview:	..A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C.......S.O.N. .K.U.L.L.A.N.I.C.I. .L.0.S.A.N.S. .A.N.L.A.^.M.A.S.I.....(.A.M.D. .C.A.T.A.L.Y.S.T."!)...........N.E.M.L.0.-.D.0.K.K.A.T.L.E. .O.K.U.Y.U.N.:. . .A.^.A...I.D.A.K.0. .^.A.R.T. .V.E. .K.O.^.U.L.L.A.R.I. .D.0.K.K.A.T.L.E. .O.K.U.Y.U.P. .K.A.B.U.L. .E.T.M.E.D.E.N. .Y.A.Z.I.L.I.M.,. .D.O.K...M.A.N.T.A.S.Y.O.N. .(.A.^.A...I.D.A. .A...I.K.L.A.N.M.A.K.T.A.D.I.R.). .V.E.Y.A. .B.U.N.L.A.R.L.A. .0.L.G.0.L.0. .H.E.R.H.A.N.G.0. .B.0.R. .B...L...M... .(.T.O.P.L.U. .H.A.L.D.E. .".Y.A.Z.I.L.I.M.". .O.L.A.R.A.K. .A.N.I.L.A.C.A.K.). .K.U.R.M.A.Y.I.N.,. .K.O.P.Y.A.L.A.M.A.Y.I.N. .V.E.Y.A. .K.U.L.L.A.N.M.A.Y.I.N... .B.U.,. .S.0.Z.0.N. .(...Z.E.L. .V.E.Y.A. .T...Z.E.L.). .(.B.0.R. .A.R.A.D.A. .".S.0.Z.". .V.E. .".S.0.Z.0.N.".). .0.L.E. .A.D.V.A.N.C.E.D. .M.I.C.R.O. .D.E.V.I.C.E.S.,. .I.N.C... .(.".A.M.D.".). .A.R.A.S.I.N.D.A. .Y.A.P.I.L.A.N. .R.E.S.M.0. .B.0.R. .A.N.L.A.^.M.A.D.I.R. .(.".A.N.L.A.^.M.A.".)...........0.^.B.U. .A.N.L.A.^.M.A.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseCHS.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1292
Entropy (8bit):	6.0860724293614945
Encrypted:	false
SSDEEP:	24:QmoHaS2wDBv+FswtojnCsDci7OLpyBxZsxg0oinI3Bt+EE9KaS2wD22Te32mx+G:8aEwh+C4qluP3BtBmKaE2TZZ
MD5:	EEEBA9691AD59C7ED1443120B1B7ED10
SHA1:	C4C5E707DF73941DD27B934772C9B09B06246ACF
SHA-256:	CD54B616AA2DF94E81E606637F66EB26721973DBB37272DB295A7BFBEA885DBC
SHA-512:	395A74C0843998C39A4BCFD5EBE661118E0C0187F16789B28D10361791EFEAC12045A106AC76C49D36C284A7294A7C37BB82F7C93AF8AAB63987712B216ABA80
Malicious:	false
Reputation:	low
Preview:	..C.a.t.a.l.y.s.t. ..[..{.thV...yCg.X.f........A.d.v.a.n.c.e.d. .M.i.c.r.o. .D.e.v.i.c.e.s.,. .I.n.c... ....{.y .. A.M.D.. .. ..b...O.b.`.v...yCg.0,g...yCg.X.f.S..(u.N .A.M.D. .... .C.a.t.a.l.y.s.t. ..[..{.thV.N}..g.R ....{.y ."..^(u.z.^"... .6e..vpenc.0,g.X.f.N..(u.N...vQ.N .A.M.D. .(W.~.b.y.~Q..z.0.N.T.b.g.R6e..vpenc.0.........Oo`.v6e..T.O(u........,g.^(u.z.^.N..Bl.c.O.N.N6e..N.`.v.NUON.N.Oo`.0.S6e..N.N.N...{:g.SvQM.n..vsQ.v?S.T.Oo`...Y...{:g.vlx.N'`...T.].[.o..N.vHr,g.0..Oo`.N.O.S...~ .A.M.D...FO/f.O.N .A.M.D. ..bvQ.N.tFU.g.RhV.N.v.Oo`.L..k.....Nnx.[/f&TX[(W.eHro..N.blx.N.Oo`...Q9hnc(u7b..Bl.N}..v.^.vo..N.blx.N.Oo`v^.[.0R.`.v...{:g.N.0........,g.^(u.z.^.S..+T.g.N.NQ..z.T.g.R...c.0.b.N...R.`(W.....NQ..z.T.g.RMR....vQ...yCg.X.f...N.O.N..N.N.YUO6e..0.O(u.T.R.NN.N.Oo`.0.[.NvQ.NlQ.S.b.~.~@b.m.SQ..z.T.g.R.v...yCg.X.f..A.M.D. ..N.b.b.NUO#..N.0........T..\|.Oo`....A.M.D. ."k..`.[,g...yCg.X.f.c.Q.^...0.Y.g.NUO.u..bG.0R..S.X.f..[.v.`.Q.....S..5uP[...N. .p.r.i.v.a.c.y.@.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseCHT.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1326
Entropy (8bit):	6.162716641866091
Encrypted:	false
SSDEEP:	24:Qmo/maS2wDiPmliqPispNNCGRbksmQ04D0AegRhjJKNVhp5ZJrHXPKaS2wD22Tef:QmaEiPml/g+kPJaZKZp5HDPKaE2TZx
MD5:	F8B275537EFF086A11060B564C14836F
SHA1:	A5C21AC18D6846BC3AB87149649F3BFB049B644B
SHA-256:	2E9BDDBCDB3BB06AD95355D2E63A8061163ACBEF6C5AA35738CB42049CF4F8CB
SHA-512:	8668B52309AC99E8BBC4B8E36BED63BE3C9B99D5A80ADC791AE28827C91534CC306FD25418E43746DD88B4B3A0368B05A0C15B6213EBB72607E9D350103D77DB
Malicious:	false
Reputation:	low
Preview:	..C.a.t.a.l.y.s.t. ..[..{.t.T...y.kr..f........A.d.v.a.n.c.e.d. .M.i.c.r.o. .D.e.v.i.c.e.s.,. .I.n.c... ....N.N1z.p.0A.M.D..0.. ..R.e.}w..`.v...y.k.0dk...y.kr..fi.(u.e .A.M.D. ...N..O(u .C.a.t.a.l.y.s.t. ..[..{.t.T.v.N...g.R ....N.N1z.p.0.a(u.z._.0.. .@b6e..v..e.0...Ni.(u.e..N.vQ.N.}.N.b..} .A.M.D. ..}.z.0"u.T.b.g.RI{@b6e..v..e.0..........e6e....O(u.........a(u.z._.N.g..Bl.b6e..`.v.NUO.P.N....0(W.`.O(u.a(u.z._Bf...a(u.z._.g6e...e.`..f..TvQ-ND}Ka.v.g.N?S.T......Ylx..R...T..f.@b.[..v..Hr,g.0...N....N.g.P... .A.M.D...FO/f.g..A.M.D..bvQ.N.tFU:O.ghV.N.v....v.k.\...N$R.[/f&T.g.NUO...e.vHr,g.S.O.O(u..&N.N.g(W.`..BlBf.\...T/..blx.....N...`.v..f...&N.R.N.[..0.........a(u.z._.S...S+T.}.z.T.g.R.v#.P}.0.b.P.^p..`.j.....N@b ...}.z.T.g.R.v...y.kr..f...N.O.w....N.}.z.T.g.R6e..0.O(u.TqQ(u.`.P.N....v.e._.0A.M.D. ..N....vQ.NlQ.S@bl\.}.z.T.g.R.v...y.k/f&T.[L..0........o.a}.......A.M.D. .ak..`..\dk...y.kr..f.c.O.[...a...0.Y.g.`.g.una.b...p.b.Pgu..[r..f...S..N...P[...N

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseCSY.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (582), with CRLF line terminators
Category:	dropped
Size (bytes):	3808
Entropy (8bit):	3.571753491272456
Encrypted:	false
SSDEEP:	48:iDj9MaEUir1T5eCSKSibCCL1SZRkGoCQH3le/CmIEvzqDQdxRvrCMYoQ/9IttCZo:gMadKgO1SkjQj8OiZcal+
MD5:	00F3846F767F439A734AA34B1CB4E96E
SHA1:	CC4E39751302F1EDD0ECD3EF732F9163F4A45A06
SHA-256:	A6B3A9DE175A03A96BE081138B055DE8789526025ED247828B5F10158BDD4F62
SHA-512:	B20C0CE1FF34065F84DC8C2664494E214DF920263121618A96FC73B947CCC221ED349EF189A86273E0E0D162F20DC2D1D5648F81A13837D79B683729F9E4DA1A
Malicious:	false
Reputation:	low
Preview:	..P.r.o.h.l...a.e.n... .k. .p.r.o.g.r.a.m.u. .S.p.r...v.c.e. .i.n.s.t.a.l.a.c.e. .C.a.t.a.l.y.s.t. .o. .o.c.h.r.a.n... .s.o.u.k.r.o.m...........S.p.o.l.e...n.o.s.t. .A.d.v.a.n.c.e.d. .M.i.c.r.o. .D.e.v.i.c.e.s.,. .I.n.c... .(.d...l.e. .j.e.n. .A.M.D.). .s.e. .z.a.v.a.z.u.j.e. .c.h.r...n.i.t. .v.a.a.e. .s.o.u.k.r.o.m..... .T.o.h.o. .p.r.o.h.l...a.e.n... .o. .o.c.h.r.a.n... .s.o.u.k.r.o.m... .s.e. .v.z.t.a.h.u.j.e. .n.a. ...d.a.j.e. .s.h.r.o.m...~.d...n... .s.p.o.l.e...n.o.s.t... .A.M.D. .p.Y.i. .p.o.u.~...v...n... .s.l.u.~.b.y. .s.t.a.h.o.v...n... .v...a.p.l.i.k.a.c.i. .S.p.r...v.c.e. .i.n.s.t.a.l.a.c.e. .C.a.t.a.l.y.s.t. .(.d...l.e. .j.e.n. .. a.p.l.i.k.a.c.e.. )... .N.e.v.z.t.a.h.u.j.e. .s.e. .n.a. ...d.a.j.e. .s.h.r.o.m...~.d...n... .p.r.o.s.t.Y.e.d.n.i.c.t.v...m. .j.i.n...c.h. .o.n.l.i.n.e. .n.e.b.o. .o.f.f.l.i.n.e. .s.e.r.v.e.r.o.,. .p.r.o.d.u.k.t.o. .n.e.b.o. .s.l.u.~.e.b. .s.p.o.l.e...n.o.s.t.i. .A.M.D...........S.h.r.o.m.a.~...o.v...n... .a. .p.o.u.~.i.t... .i.n.f.o.r.m.a.c.....

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseDAN.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (604), with CRLF line terminators
Category:	dropped
Size (bytes):	3940
Entropy (8bit):	3.2762804593348664
Encrypted:	false
SSDEEP:	96:gUSai1Uure8OG/tpgyDQVKKVgyFHQe0usqRDKdxnJwJF6yMalf:8ai/cwycDaN
MD5:	ACB5B837E88254443837343FA8746216
SHA1:	97B4DA806C5023273EA7466A6B239A4C9102B730
SHA-256:	B3FBA91365C2C0F95D295252134617F05268A8F1E925B6824B3488C918DF29DA
SHA-512:	D0204830E50CA20DB3F8315B17AC3CF1BB5DCB9668C2F91CB04B2B1E26B538B4070875CDDDA7E1ABBBD392DC1F42C60498683EF235AFBB02972746C606E0B40B
Malicious:	false
Reputation:	low
Preview:	..E.r.k.l...r.i.n.g. .o.m. .b.e.s.k.y.t.t.e.l.s.e. .a.f. .p.e.r.s.o.n.l.i.g.e. .o.p.l.y.s.n.i.n.g.e.r. .f.o.r. .C.a.t.a.l.y.s.t. .I.n.s.t.a.l.l. .M.a.n.a.g.e.r.........A.d.v.a.n.c.e.d. .M.i.c.r.o. .D.e.v.i.c.e.s.,. .I.n.c... .(.. A.M.D.. ). .b.e.s.k.y.t.t.e.r. .d.i.n.e. .p.e.r.s.o.n.l.i.g.e. .o.p.l.y.s.n.i.n.g.e.r... .D.e.n.n.e. .e.r.k.l...r.i.n.g. .o.m. .b.e.s.k.y.t.t.e.l.s.e. .a.f. .p.e.r.s.o.n.l.i.g.e. .o.p.l.y.s.n.i.n.g.e.r. .g...l.d.e.r. .f.o.r. .d.a.t.a.,. .d.e.r. .e.r. .i.n.d.s.a.m.l.e.t. .a.f. .A.M.D. .m.e.d. .C.a.t.a.l.y.s.t. .I.n.s.t.a.l.l. .M.a.n.a.g.e.r.s. .D.o.w.n.l.o.a.d. .f.u.n.k.t.i.o.n. .(.".P.r.o.g.r.a.m.m.e.t.".)... .D.e.n. .g...l.d.e.r. .i.k.k.e. .f.o.r. .d.a.t.a.,. .d.e.r. .e.r. .i.n.d.s.a.m.l.e.t. .g.e.n.n.e.m. .a.n.d.r.e. .o.n.l.i.n.e. .e.l.l.e.r. .o.f.f.l.i.n.e. .A.M.D.-.w.e.b.s.t.e.d.e.r.,. .A.M.D.-.p.r.o.d.u.k.t.e.r. .e.l.l.e.r. .A.M.D.-.t.j.e.n.e.s.t.e.r...........I.n.d.s.a.m.l.i.n.g. .o.g. .b.r.u.g. .a.f. .o.p.l.y.s.n.i.n.g.e.r.........P.r.o.g.r.a.m.m.e.t. .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseDEU.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (602), with CRLF line terminators
Category:	dropped
Size (bytes):	3864
Entropy (8bit):	3.3289092220370042
Encrypted:	false
SSDEEP:	96:KSamL9KfsxCCa5FMR4SnhF0ZSIHtifLuSgTmQalf:PaoabM3unbaN
MD5:	55B092654A243D2428E0E06A08E70BBA
SHA1:	E1CE3B05B3E83DC0CC08607075391E1885A89FA2
SHA-256:	50415138DC28D7D36284FFCAD8B4F12F520F0E6AD4E37B2BD0B5F7D4F0F93AE3
SHA-512:	071CD93C3C4FE758C0546A489E7C8256CF569C780D0B669C94CCF960B3B51A327229FFF3E3F144C2B1DE4DFA2A5D2922860877EC620ED42C9040B023985C0F63
Malicious:	false
Reputation:	low
Preview:	..D.a.t.e.n.s.c.h.u.t.z.e.r.k.l...r.u.n.g. .z.u.m. .C.a.t.a.l.y.s.t.-.I.n.s.t.a.l.l.a.t.i.o.n.s.m.a.n.a.g.e.r.........A.d.v.a.n.c.e.d. .M.i.c.r.o. .D.e.v.i.c.e.s.,. .I.n.c... .(.. A.M.D.. ). .v.e.r.p.f.l.i.c.h.t.e.t. .s.i.c.h.,. .I.h.r.e. .P.r.i.v.a.t.s.p.h...r.e. .z.u. .s.c.h...t.z.e.n... .D.i.e.s.e. .D.a.t.e.n.s.c.h.u.t.z.e.r.k.l...r.u.n.g. .b.e.z.i.e.h.t. .s.i.c.h. .a.u.f. .I.n.f.o.r.m.a.t.i.o.n.e.n.,. .d.i.e. .b.e.i. .N.u.t.z.u.n.g. .d.e.s. .D.o.w.n.l.o.a.d.-.D.i.e.n.s.t.e.s. .v.o.n. .C.a.t.a.l.y.s.t.-.I.n.s.t.a.l.l.a.t.i.o.n.s.m.a.n.a.g.e.r. .(.n.a.c.h.f.o.l.g.e.n.d. .a.l.s. .. A.n.w.e.n.d.u.n.g.. .b.e.z.e.i.c.h.n.e.t.). .v.o.n. .A.M.D. .e.r.f.a.s.s.t. .w.e.r.d.e.n... .S.i.e. .b.e.z.i.e.h.t. .s.i.c.h. .n.i.c.h.t. .a.u.f. .I.n.f.o.r.m.a.t.i.o.n.e.n.,. .d.i.e. .w...h.r.e.n.d. .d.e.r. .N.u.t.z.u.n.g. .a.n.d.e.r.e.r. .I.n.t.e.r.n.e.t.s.e.i.t.e.n.,. .P.r.o.d.u.k.t.e. .o.d.e.r. .D.i.e.n.s.t.e. .v.o.n. .A.M.D. .e.r.f.a.s.s.t. .w.e.r.d.e.n...........E.r.f.a.s.s.u.n.g. .u.n.d. .V.e.r.w.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseENU.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (583), with CRLF line terminators
Category:	dropped
Size (bytes):	3456
Entropy (8bit):	3.2557286283050817
Encrypted:	false
SSDEEP:	48:WaU5aEsaUmXFRlT+YBzNWZhwwFVhwKBtWWwmWxAkOckqfLqEaacvSKaE2TZx:7U5ayUmXFzT+UzKTCzxAkp/fLqJvPalv
MD5:	BD6C1800BE95935A9519B9293A673DD3
SHA1:	254708367564C7F1EE5C4125BF6C2FA39FE37E27
SHA-256:	1BDCF5A6643D9D5247ADC2A2399C5E87A87E4BBDE4DB83034DA353CE0CF9EB77
SHA-512:	E5308054EEC51F89343EF7DF8E7C8E7FB7940F4FAB43432D5F507696E7B6808CEBDE231E39925C927BBF211B85CB60F81ABAA103CFB2062FBEE1076D4964F616
Malicious:	false
Reputation:	low
Preview:	..C.a.t.a.l.y.s.t. .I.n.s.t.a.l.l. .M.a.n.a.g.e.r. .P.r.i.v.a.c.y. .S.t.a.t.e.m.e.n.t. .........A.d.v.a.n.c.e.d. .M.i.c.r.o. .D.e.v.i.c.e.s.,. .I.n.c... .(.".A.M.D.".). .i.s. .c.o.m.m.i.t.t.e.d. .t.o. .p.r.o.t.e.c.t.i.n.g. .y.o.u.r. .p.r.i.v.a.c.y... .T.h.i.s. .p.r.i.v.a.c.y. .s.t.a.t.e.m.e.n.t. .a.p.p.l.i.e.s. .t.o. .t.h.e. .d.a.t.a. .c.o.l.l.e.c.t.e.d. .b.y. .A.M.D. .t.h.r.o.u.g.h. .t.h.e. .u.s.e. .o.f. .t.h.e. .C.a.t.a.l.y.s.t. .I.n.s.t.a.l.l. .M.a.n.a.g.e.r.'.s. .D.o.w.n.l.o.a.d. .s.e.r.v.i.c.e. .(.t.h.e. .".A.p.p.l.i.c.a.t.i.o.n.".)... .I.t. .d.o.e.s. .n.o.t. .a.p.p.l.y. .t.o. .d.a.t.a. .c.o.l.l.e.c.t.e.d. .t.h.r.o.u.g.h. .o.t.h.e.r. .o.n.l.i.n.e. .o.r. .o.f.f.l.i.n.e. .A.M.D. .s.i.t.e.s.,. .p.r.o.d.u.c.t.s.,. .o.r. .s.e.r.v.i.c.e.s...........C.o.l.l.e.c.t.i.o.n. .a.n.d. .u.s.e. .o.f. .i.n.f.o.r.m.a.t.i.o.n. .........T.h.e. .A.p.p.l.i.c.a.t.i.o.n. .d.o.e.s. .n.o.t. .r.e.q.u.e.s.t. .o.r. .c.o.l.l.e.c.t. .a.n.y. .p.e.r.s.o.n.a.l. .i.n.f.o.r.m.a.t.i.o.n. .f.r.o.m. .y.o.u... .W.h.e.n.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseESP.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (610), with CRLF line terminators
Category:	dropped
Size (bytes):	3808
Entropy (8bit):	3.2130400015959104
Encrypted:	false
SSDEEP:	96:0NasmG7NnxJgl33X6sLNV72QKtbebagRz9alv:2aFAa/NVt3at
MD5:	D0D3BA1563A78AFD544E2070CDA13F28
SHA1:	7D73E8713FDA80A6E9BD4E3F72F5E3FDC56B6177
SHA-256:	528740326A3014770F548B31C42382FF6C06E04B6B6F326C11F3B59206E8EC75
SHA-512:	2177CAAADF1DFBF9A6BDE711FECB799B3E1A5026031690AAD09EF6990DBD4AC8D3244395708B316BD36523651C05E752AE7689CC238A47122C426E2816F1C455
Malicious:	false
Reputation:	low
Preview:	..D.e.c.l.a.r.a.c.i...n. .d.e. .p.r.i.v.a.c.i.d.a.d. .d.e.l. .a.d.m.i.n.i.s.t.r.a.d.o.r. .d.e. .i.n.s.t.a.l.a.c.i...n. .C.a.t.a.l.y.s.t.........A.d.v.a.n.c.e.d. .M.i.c.r.o. .D.e.v.i.c.e.s.,. .I.n.c... .(.. A.M.D.. ). .s.e. .c.o.m.p.r.o.m.e.t.e. .a. .p.r.o.t.e.g.e.r. .s.u. .p.r.i.v.a.c.i.d.a.d... .L.a. .p.r.e.s.e.n.t.e. .d.e.c.l.a.r.a.c.i...n. .d.e. .p.r.i.v.a.c.i.d.a.d. .s.e. .a.p.l.i.c.a. .a. .l.o.s. .d.a.t.o.s. .r.e.c.o.p.i.l.a.d.o.s. .p.o.r. .A.M.D. .m.e.d.i.a.n.t.e. .e.l. .u.s.o. .d.e.l. .s.e.r.v.i.c.i.o. .d.e. .d.e.s.c.a.r.g.a. .d.e.l. .a.d.m.i.n.i.s.t.r.a.d.o.r. .d.e. .i.n.s.t.a.l.a.c.i...n. .C.a.t.a.l.y.s.t. .(.l.a. .. A.p.l.i.c.a.c.i...n.. )... .N.o. .s.e. .a.p.l.i.c.a. .a. .d.a.t.o.s. .r.e.c.o.p.i.l.a.d.o.s. .m.e.d.i.a.n.t.e. .o.t.r.o.s. .s.i.t.i.o.s.,. .p.r.o.d.u.c.t.o.s. .o. .s.e.r.v.i.c.i.o.s. .d.e. .A.M.D. .e.n. .l...n.e.a. .o. .s.i.n. .c.o.n.e.x.i...n...........R.e.c.o.p.i.l.a.c.i...n. .y. .u.t.i.l.i.z.a.c.i...n. .d.e. .l.a. .i.n.f.o.r.m.a.c.i...n.........L.a. .A.p.l.i.c.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseFIN.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (564), with CRLF line terminators
Category:	dropped
Size (bytes):	3606
Entropy (8bit):	3.2555872030987265
Encrypted:	false
SSDEEP:	96:paA04brd0BT5njj8sBZCsuf2mJXPV20SalO:par4bp4r8sMPJXPV2hag
MD5:	91F0A875CBB9D40D9B48F1822F9EAACF
SHA1:	8828F2A1EF2F0467AA3E4D392B31DF7D8C010ED7
SHA-256:	F3B4EA193D0C1C5E4B1625DAB1CBD107F606223D897D9C3CA4F599993AF7CD86
SHA-512:	1F509F8D1B2A483CB09E2E5CC5DAE72266F885C92D735DD8231DC73A43E5A7930B891C3473B1766F97F9A5E1A231F29A7DEC9BABA8E5234FB16BEB8C2E8B55B6
Malicious:	false
Reputation:	low
Preview:	..C.a.t.a.l.y.s.t. .-. .A.s.e.n.n.u.s.t.e.n. .h.a.l.l.i.n.n.a.n. .t.i.e.t.o.s.u.o.j.a.l.a.u.s.u.n.t.o.........A.d.v.a.n.c.e.d. .M.i.c.r.o. .D.e.v.i.c.e.s.,. .I.n.c... .(.. A.M.D.. ). .o.n. .s.i.t.o.u.t.u.n.u.t. .s.i.n.u.n. .y.k.s.i.t.y.i.s.y.y.t.e.s.i. .s.u.o.j.a.a.m.i.s.e.e.n... .T...m... .t.i.e.t.o.s.u.o.j.a.l.a.u.s.u.n.t.o. .k.o.s.k.e.e. .A.M.D.:.n. .C.a.t.a.l.y.s.t. .-. .A.s.e.n.n.u.s.t.e.n. .h.a.l.l.i.n.n.a.n. .l.a.t.a.u.s.p.a.l.v.e.l.u.n. .(.. s.o.v.e.l.l.u.s.. ). .a.v.u.l.l.a. .k.e.r...t.t.y.j... .t.i.e.t.o.j.a... .L.a.u.s.u.n.t.o. .e.i. .k.o.s.k.e. .m.u.i.l.l.a. .A.M.D.:.n. .o.n.l.i.n.e.-. .t.a.i. .o.f.f.l.i.n.e.-.s.i.v.u.s.t.o.i.l.l.a.,. .-.t.u.o.t.t.e.i.l.l.a. .t.a.i. .-.p.a.l.v.e.l.u.i.l.l.a. .k.e.r...t.t.y.j... .t.i.e.t.o.j.a...........T.i.e.d.o.n. .k.e.r.....m.i.n.e.n. .j.a. .k...y.t.t...m.i.n.e.n.........S.o.v.e.l.l.u.s. .e.i. .p.y.y.d... .t.a.i. .k.e.r..... .s.i.n.u.l.t.a. .m.i.t.....n. .h.e.n.k.i.l...k.o.h.t.a.i.s.i.a. .t.i.e.t.o.j.a... .K.u.n. .k...y.t...t. .s.o.v.e.l.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseFRA.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	3.2486849458031966
Encrypted:	false
SSDEEP:	96:HaTjAKs0KkSt7lOpTTNL1msvq16rTIalv:HaTkK3KT7kvIat
MD5:	00789E7A2E8762FA30E6E068EA1298F1
SHA1:	2B947C6222CF75456BA84390D492AC2473B0C6C9
SHA-256:	51F92357FBD56EF8263C1DB02C01CCB8279BAAFC28986D0DCD2461C2327051FB
SHA-512:	074E31D117DCD6297D3DE8E323E8BA5E9227D12DECF412A150380314DB26F6C386FEB9E1181E5D7AB085FB005505254244B24D04875A843A233AE336A4029127
Malicious:	false
Reputation:	low
Preview:	..G.e.s.t.i.o.n.n.a.i.r.e. .d.'.i.n.s.t.a.l.l.a.t.i.o.n. .C.a.t.a.l.y.s.t. .-. .C.h.a.r.t.e. .d.e. .c.o.n.f.i.d.e.n.t.i.a.l.i.t... .........A.d.v.a.n.c.e.d. .M.i.c.r.o. .D.e.v.i.c.e.s.,. .I.n.c... .(.....A.M.D.....). .s.'.e.n.g.a.g.e. ... .p.r.o.t...g.e.r. .v.o.t.r.e. .v.i.e. .p.r.i.v...e... .C.e.t.t.e. .c.h.a.r.t.e. .d.e. .c.o.n.f.i.d.e.n.t.i.a.l.i.t... .s.'.a.p.p.l.i.q.u.e. .a.u.x. .d.o.n.n...e.s. .c.o.l.l.e.c.t...e.s. .p.a.r. .A.M.D. .d.a.n.s. .l.e. .c.a.d.r.e. .d.e. .l.'.u.t.i.l.i.s.a.t.i.o.n. .d.u. .s.e.r.v.i.c.e. .d.e. .t...l...c.h.a.r.g.e.m.e.n.t. .d.u. .G.e.s.t.i.o.n.n.a.i.r.e. .d.'.i.n.s.t.a.l.l.a.t.i.o.n. .C.a.t.a.l.y.s.t. .(.l.'.....A.p.p.l.i.c.a.t.i.o.n.....)... .E.l.l.e. .n.e. .s.'.a.p.p.l.i.q.u.e. .p.a.s. .a.u.x. .d.o.n.n...e.s. .c.o.l.l.e.c.t...e.s. .p.a.r. .l.e. .b.i.a.i.s. .d.'.a.u.t.r.e.s. .s.i.t.e.s.,. .p.r.o.d.u.i.t.s. .o.u. .s.e.r.v.i.c.e.s. .A.M.D. .e.n. .l.i.g.n.e. .o.u. .h.o.r.s. .l.i.g.n.e...........C.o.l.l.e.c.t.e. .e.t. .u.t.i.l.i.s.a.t.i.o.n. .d.e.s. .i.n.f.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseGRK.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (677), with CRLF line terminators
Category:	dropped
Size (bytes):	4122
Entropy (8bit):	3.9536719391464414
Encrypted:	false
SSDEEP:	96:mgBaqFgEpW1zlbneWDq1ERDk5f+8ivt9NZDD22s4NijoNMAg5AY3glkzLyWz5NHp:m+aqFPW1Vne0k5m8UzZDDEods5s0Lp57
MD5:	E8BECEEF97ABFF98318A113D3F39BC84
SHA1:	CA486334D12461EDBEE49223FD5F747C4F5F5E86
SHA-256:	99BCED937A98CCAEB8654F61F90AFBE5A62BF2A50550EC5D63E98BC9A3E1DF0B
SHA-512:	C542023480A8E678A0409AC459AC1C54148C8E0A636050EA15A32901E760EAB7D11F4FB52C0BC7FC94882762301CC8AD0854C61E771741EB74D57AAE3D17ACDC
Malicious:	false
Reputation:	low
Preview:	.............. ..................... ................... ....... ..... ................... ."..................... ......................... ....... .C.a.t.a.l.y.s.t."........... .A.d.v.a.n.c.e.d. .M.i.c.r.o. .D.e.v.i.c.e.s.,. .I.n.c... .(.".A.M.D.".). ......... ................... ....... ....... ................... ....... ..................... ................... ......... ... ............... ............. ..................... ................... ..................... ....... ................. ....... ................. ... .A.M.D. ..... ..... ........... ....... ................... ........... ....... ......................... ."..................... ......................... ....... .C.a.t.a.l.y.s.t.". .(... .".................".)... ....... ............. ....... ................. ....... ....................... ....... ........... ......................... ....... ..... .....................,. ................. ... ................... ....... .A.M.D......................... .....

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseHNG.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	4218
Entropy (8bit):	3.461597801522979
Encrypted:	false
SSDEEP:	96:X0Eah9FOnzTGOij8jlTpAldEGwO225uEFlNmFal+:X0EarFakwTOdJFlwFaA
MD5:	A5E90C2ADB2520EC5FEDBE8FE664D936
SHA1:	DD1B60CDBBBD226F478913B551A9BF7CDBC556A2
SHA-256:	4D983E93454092EF91444C7C7C1547AD3036252A9FE59171050D7D7EE44F9179
SHA-512:	11E9EBD146ECBB7E65C402E6E1F701EFF74AFECDBF7F7EA22B427F2E256860369A750A2FBEAED7EFF6AA4D170EE64F2D2F87CE2999F69E19FCA18FA478EF623F
Malicious:	false
Reputation:	low
Preview:	..C.a.t.a.l.y.s.t. .t.e.l.e.p...t...s.k.e.z.e.l.Q. .. .A.d.a.t.v...d.e.l.m.i. .n.y.i.l.a.t.k.o.z.a.t.........A.z. .A.d.v.a.n.c.e.d. .M.i.c.r.o. .D.e.v.i.c.e.s.,. .I.n.c... .(.. A.M.D.. ). .e.l.k...t.e.l.e.z.e.t.t. .a.m.e.l.l.e.t.t.,. .h.o.g.y. .m.e.g.v...d.j.e. .a.z. ...n. .a.d.a.t.a.i.n.a.k. .b.i.z.a.l.m.a.s. .j.e.l.l.e.g...t... .A. .j.e.l.e.n. .a.d.a.t.v...d.e.l.m.i. .n.y.i.l.a.t.k.o.z.a.t. .h.a.t...l.y.a. .a.z. .A.M.D. ...l.t.a.l. .a. .C.a.t.a.l.y.s.t. .t.e.l.e.p...t...s.k.e.z.e.l.Q. .l.e.t...l.t...s.i. .s.z.o.l.g...l.t.a.t...s...n.a.k. .(.a. .t.o.v...b.b.i.a.k.b.a.n.:. .. A.l.k.a.l.m.a.z...s.. ). .h.a.s.z.n...l.a.t.a. .s.o.r...n. .g.y.q.j.t...t.t. .a.d.a.t.o.k.r.a. .t.e.r.j.e.d. .k.i... .A. .d.o.k.u.m.e.n.t.u.m. .h.a.t...l.y.a. .n.e.m. .t.e.r.j.e.d. .k.i. .a.z. .A.M.D. .e.g.y...b.,. .o.n.l.i.n.e. ...s. .o.f.f.l.i.n.e. .m...d.o.n. .e.l...r.h.e.t.Q. .w.e.b.h.e.l.y.e.i.,. .t.e.r.m...k.e.i. .v.a.g.y. .s.z.o.l.g...l.t.a.t...s.a.i. .r...v...n. .g.y.q.j.t...t.t. .a.d.a.t.o.k.r.a.........

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseITA.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (565), with CRLF line terminators
Category:	dropped
Size (bytes):	3634
Entropy (8bit):	3.2187341701690495
Encrypted:	false
SSDEEP:	48:vGaESExhEWDluDvgMnPw8umazkmFhKuFw7p1Kk6+mt92wtMA9NevPj25HCKaE2Tv:uarEHvsHunkhuTjHN+A9IaJ/alv
MD5:	F9BED2EBA77AD51BA59FA8067DC46B94
SHA1:	4CC827501CC981D1F2CE47F384F0C771C785667C
SHA-256:	537D59E3C9CCD4DD6F29D8496A15BFD49D78BDF339B2AB6F1CF15AD20C726D6E
SHA-512:	3C5FF6BD741ADF04F5BF2C2167E337818A7732C266A82BC23AFE9AA10A9E1D06410F02D8564DF92AA9785E7A902316EDE576E99A35D538B331BE706422C15342
Malicious:	false
Reputation:	low
Preview:	..I.n.f.o.r.m.a.t.i.v.a. .s.u.l.l.a. .p.r.i.v.a.c.y. .d.e.l. .P.r.o.g.r.a.m.m.a. .d.i. .i.n.s.t.a.l.l.a.z.i.o.n.e. .d.i. .C.a.t.a.l.y.s.t.........A.d.v.a.n.c.e.d. .M.i.c.r.o. .D.e.v.i.c.e.s.,. .I.n.c... .(.".A.M.D.".). .g.a.r.a.n.t.i.s.c.e. .l.a. .t.u.t.e.l.a. .d.e.i. .d.a.t.i. .p.e.r.s.o.n.a.l.i... .Q.u.e.s.t.a. .i.n.f.o.r.m.a.t.i.v.a. .s.i. .a.p.p.l.i.c.a. .a.i. .d.a.t.i. .r.a.c.c.o.l.t.i. .d.a. .A.M.D. .d.u.r.a.n.t.e. .l.'.u.t.i.l.i.z.z.o. .d.e.l. .s.e.r.v.i.z.i.o. .d.i. .d.o.w.n.l.o.a.d. .d.i. .P.r.o.g.r.a.m.m.a. .d.i. .i.n.s.t.a.l.l.a.z.i.o.n.e. .d.i. .C.a.t.a.l.y.s.t. .(.".A.p.p.l.i.c.a.z.i.o.n.e.".)... .L.e. .i.n.f.o.r.m.a.z.i.o.n.i. .c.h.e. .s.e.g.u.o.n.o. .n.o.n. .s.i. .a.p.p.l.i.c.a.n.o. .p.e.r.t.a.n.t.o. .a.d. .a.l.t.r.i. .s.e.r.v.i.z.i.,. .p.r.o.d.o.t.t.i. .o. .s.i.t.i. .d.i. .A.M.D.,. .i.n. .l.i.n.e.a. .e. .n.o.n. .i.n. .l.i.n.e.a...........R.a.c.c.o.l.t.a. .e. .u.t.i.l.i.z.z.o. .d.e.l.l.e. .i.n.f.o.r.m.a.z.i.o.n.i. .........L.'.a.p.p.l.i.c.a.z.i.o.n.e. .n.o.n. .r.i.c.h.i.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseJPN.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (322), with CRLF line terminators
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	5.377557597148772
Encrypted:	false
SSDEEP:	48:ppaE1wLQo6uIiyXf8KeuI+9ADhlHfMdO0KVaBKaE2TZx:XaFQomNReEUhFf6Qasalv
MD5:	9469706D3F00ACB462B270ED7CB64D25
SHA1:	BDC9F1DB1B591E20188000A0CAD6B1E359E9207B
SHA-256:	6746EE9E5990CA0A6ED8D6C334FC98BE92BB77D3F7692A8026F779B166C57722
SHA-512:	CB14FB20688D7E59E1CD61A9699C9EC2B5395E9DBEE42C9D3C39C232615D840C25682F0663C35209606DF4FBA81EB2AEA862E7680DE422936186ADD2646271EA
Malicious:	false
Reputation:	low
Preview:	..C.a.t.a.l.y.s.t. ..0.0.0.0.0.0 ..0.0.0.0.0 ..P.N.`1X.Ow..e.........A.d.v.a.n.c.e.d. .M.i.c.r.o. .D.e.v.i.c.e.s.,. .I.n.c... .(..N.N.0.0A.M.D..0). .o0.0J0.[.in0.P.N.`1Xn0.Ow.k0.R.0f0J0.0~0Y0.0S0n0.P.N.`1X.Ow..e.o0.0A.M.D. .L0 .C.a.t.a.l.y.s.t. ..0.0.0.0.0.0 ..0.0.0.0.0 .n0.0.0.0.0.0.0 ..0.0.0.0 .(..N.N.0.0,g.0.0.0.0.0.0.0.0.0). ..0..X0f0.S.W0_0.0.0.0k0.[W0f0i.(uU0.0~0Y0.0]0n0.Nn0.0.0.0.0.0~0_0o0.0.0.0.0.0n0 .A.M.D. ..0.0.0.0...T.0.0.0.0.0.0..X0f0.S.W0_0.0.0.0k0.[W0f0o0i.(u.Yh0D0_0W0~0Y0.0.........`1Xn0.S.J0.0s0)R(uk0d0D0f0........,g.0.0.0.0.0.0.0.0L0J0.[.in0.P.N.`1X.0..Bl~0_0o0.S.Y0.0S0h0o0B0.0~0[0.0.0J0.[.iL0,g.0.0.0.0.0.0.0.0.0.O(uW0f0D0.0..k0.0,g.0.0.0.0.0.0.0.0L0.0J0.[.in0.0.0.0.0.0.0k0..Y0.0?S.T.`1Xh0.i.b.`1X .(..0.0.0.0.0.0n0'`...0.0.0.0.0.0.0U0.0f0D0.0.0.0.0.0.0.0n0.0.0.0.0.0j0i0). ..0.S.Y0.0S0h0L0B0.0~0Y0.0S0n0.`1Xo0 .A.M.D. .k0...OU0.0.0n0g0o0j0O0.0A.M.D. .~0_0o0 .A.M.D. ..N.t.Nn0.0.0.0.0.Nn0.0.0.0h0.k..U0.0.0.eW0D0.0.0.0.0.0n0.0.0.0.0.0.0.`1X~0_0o0.0.0.0.0.0.0.`1XL0eQ

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseKOR.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1900
Entropy (8bit):	5.420201178572368
Encrypted:	false
SSDEEP:	48:tgaEz6IiEgcwz9ZhTCDekxt6pYXXj9eKaE2TZx:iaACJZ92eFCXhDalv
MD5:	0E1FC4B658D54C5422CBF44056AD82BD
SHA1:	B5097860A16FE5D3A36B6584FA602B92722814B6
SHA-256:	6C85D3597F7026A48880B7DC1C915ABC5E11AE7EF5E27021A4813C58567D0B39
SHA-512:	B3C663EA6CE2A3CB4A14E3EB81B992CAB5358386A2DAE6B8CC9D25EF38692B4BBF2E4A25AF264E9BCB82D12EAD3B0D10152A0CAE70416BA15956D0DF266EDD4D
Malicious:	false
Reputation:	low
Preview:	..C.a.t.a.l.y.s.t. .$.X. ....... ...x. ..... ...8. .).h. .........A.d.v.a.n.c.e.d. .M.i.c.r.o. .D.e.v.i.c.e.s.,. .I.n.c...(.".A.M.D.".)... ....X. ...x. .....\|. ...8.X.0. ...t. .\. .X. .x.%.D. ..X.. ........ ... ...x. ..... ...8. .).h.@. .A.M.D... .C.a.t.a.l.y.s.t. .$.X. ....... ...\.. ...D...(.".Q.. ...\.....".).\|. .....X... .....X.. .p.t.0... ....)..... ..x. .(.\|.x./.$...\|.x. .A.M.D. ...t..,. .... ..... ...D...\|. ...t. ......... .p.t.0.... ........ .J..................X. ..... ... .............t. .Q.. ...\........... ......\...0. .... ...x. ...... ....X.p... .....X... .J...... .Q.. ...\..... ..... ... ......X. .....0. ... ... .l.1... ...\. ..... .u.. .....(...:. .X..... .0...,. .$.X... ......... .....)... .....X.. .)..... .t. .....\|. .A.M.D.\. ........ .J....,. .A.M.D. ..... ... ......X. ....... .... .....@. .D.P.X... .T. ...\... .....X. .......... .X..... ....... ...... .U.x.X.. .[...... .... ...]. .t... ......... .../..... .X..

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseNLD.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (651), with CRLF line terminators
Category:	dropped
Size (bytes):	3834
Entropy (8bit):	3.238159970231152
Encrypted:	false
SSDEEP:	96:qyaeGxSA/3trZXey7WtsiIaWleGUr4Q8Tz7GiKalv:XaeWSuttXesWKaweG41at
MD5:	1547BC63DDF7133E4CA2C09735A692C8
SHA1:	A582B279F795F37725A8B95456736B4A5576175E
SHA-256:	92526EDFC5BA2C40BFC0E738D626EFC4FE21D389AF4FC0323624E4A2D53DD454
SHA-512:	C882678FA538A74809E6019309A5CFE131B29EFC353748B271F8712AF2335DA989F11F64F16246B3170AD74EA66A196AF891503B3D2EC08483A5C86681EE30E9
Malicious:	false
Reputation:	low
Preview:	..P.r.i.v.a.c.y.v.e.r.k.l.a.r.i.n.g. .C.a.t.a.l.y.s.t. .i.n.s.t.a.l.l.a.t.i.e.m.a.n.a.g.e.r. .........A.d.v.a.n.c.e.d. .M.i.c.r.o. .D.e.v.i.c.e.s.,. .I.n.c... .(.".A.M.D.".). .d.o.e.t. .h.a.a.r. . .b.e.s.t. .o.m. .e.r.v.o.o.r. .t.e. .z.o.r.g.e.n. .d.a.t. .u.w. .p.r.i.v.a.c.y. .b.e.s.c.h.e.r.m.d. .w.o.r.d.t... .D.e.z.e. .p.r.i.v.a.c.y.v.e.r.k.l.a.r.i.n.g. .i.s. .v.a.n. .t.o.e.p.a.s.s.i.n.g. .o.p. .d.e. .g.e.g.e.v.e.n.s. .d.i.e. .A.M.D. .h.e.e.f.t. .v.e.r.z.a.m.e.l.d. .d.o.o.r. .m.i.d.d.e.l. .v.a.n. .d.e. .d.o.w.n.l.o.a.d.s.e.r.v.i.c.e. .v.a.n. .d.e. .C.a.t.a.l.y.s.t. .i.n.s.t.a.l.l.a.t.i.e.m.a.n.a.g.e.r. .(.d.e. .".t.o.e.p.a.s.s.i.n.g.".)... .D.e. .v.e.r.k.l.a.r.i.n.g. .i.s. .n.i.e.t. .v.a.n. .t.o.e.p.a.s.s.i.n.g. .o.p. .g.e.g.e.v.e.n.s. .d.i.e. .z.i.j.n. .v.e.r.z.a.m.e.l.d. .v.i.a. .a.n.d.e.r.e. .o.n.l.i.n.e. .o.f. .o.f.f.l.i.n.e. .s.i.t.e.s.,. .p.r.o.d.u.c.t.e.n. .o.f. .d.i.e.n.s.t.e.n. .v.a.n. .A.M.D...........V.e.r.z.a.m.e.l.i.n.g. .e.n. .g.e.b.r.u.i.k. .v.a.n. .i.n.f.o.r.m.a.t.i.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseNOR.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (592), with CRLF line terminators
Category:	dropped
Size (bytes):	3688
Entropy (8bit):	3.2487670827793504
Encrypted:	false
SSDEEP:	96:F7na7ukaxUWSh+lbt0U5YDiu0fPBBY1yRmwpX0JXYhNpEvValf:5aakanY+9MipPgzIEaN
MD5:	C28695FADEAD97194CF062DEE078A307
SHA1:	A592938FC5A24499DFB8ECCF4CB1D0B886B77E23
SHA-256:	CEDEF5D0393BA2C40D1688E90E729BDFAF427F166A2D56B915FB7066F36AF878
SHA-512:	183544BC709212D8C49AE5D32384C292F0A5B52501E6F5BEB5BF7E55FA9BC84F1A86D31B7F218F46D2D42472151E6505AEF4DAD1E251D88A177557335C590B99
Malicious:	false
Reputation:	low
Preview:	..P.e.r.s.o.n.v.e.r.n.e.r.k.l...r.i.n.g. .. .C.a.t.a.l.y.s.t. .i.n.s.t.a.l.l.a.s.j.o.n.s.b.e.h.a.n.d.l.i.n.g.........A.d.v.a.n.c.e.d. .M.i.c.r.o. .D.e.v.i.c.e.s.,. .I.n.c... . .(.".A.M.D.".). .e.r. .f.o.r.p.l.i.k.t.e.t. .t.i.l. ... .b.e.s.k.y.t.t.e. .p.r.i.v.a.t.l.i.v.e.t.s. .f.r.e.d... .D.e.n.n.e. .p.e.r.s.o.n.v.e.r.n.e.r.k.l...r.i.n.g.e.n. .g.j.e.l.d.e.r. .d.a.t.a.e.n.e. .s.a.m.l.e.t. .i.n.n. .a.v. .A.M.D. .i. .f.o.r.b.i.n.d.e.l.s.e. .m.e.d. .b.r.u.k.e.n. .a.v. .C.a.t.a.l.y.s.t. .i.n.s.t.a.l.l.a.s.j.o.n.s.b.e.h.a.n.d.l.i.n.g.s. .n.e.d.l.a.s.t.i.n.g.s.t.j.e.n.e.s.t.e. .(.".p.r.o.g.r.a.m.m.e.t.".)... .D.e.n. .g.j.e.l.d.e.r. .i.k.k.e. .d.a.t.a. .s.a.m.l.e.t. .i.n.n. .i. .f.o.r.b.i.n.d.e.l.s.e. .m.e.d. .a.n.d.r.e. .A.M.D.-.s.t.e.d.e.r.,. .-.p.r.o.d.u.k.t.e.r. .e.l.l.e.r. .-.t.j.e.n.e.s.t.e.r.,. .e.n.t.e.n. .d.i.s.s.e. .e.r. .f.o.r.m.i.d.l.e.t. .v.i.a. .I.n.t.e.r.n.e.t.t. .e.l.l.e.r. .p... .a.n.n.e.t. .v.i.s...........I.n.n.s.a.m.l.i.n.g. .o.g. .b.r.u.k. .a.v. .i.n.f.o.r.m.a.s.j.o.n.....

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licensePLK.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (675), with CRLF line terminators
Category:	dropped
Size (bytes):	4208
Entropy (8bit):	3.5229606902221953
Encrypted:	false
SSDEEP:	96:MPbna89Vkvfoc+o7SCQB4FGANSsgq7DZbbJmwHzalv:MLa4Jc+oWCu4kAssnbJXTat
MD5:	105A3DBE0F9EB61045686E73FD1AEF96
SHA1:	CFF4EA7E3E152B2E7B712068F677134A3AD91B54
SHA-256:	6A587638D030FCE2B9E5D4830D17654ED42877161A14FDF4F4DD74A01AC2C01D
SHA-512:	9168A27BF7C13FCB54CBFD41A4E15B26DDBE91CC97200610CB22D5BB1D05754C8B9776335B417807893F63FC321899484316BE2D48F444355C45B7B564521F30
Malicious:	false
Reputation:	low
Preview:	..O.[.w.i.a.d.c.z.e.n.i.e. .o. .o.c.h.r.o.n.i.e. .p.r.y.w.a.t.n.o.[.c.i. .u.\|.y.t.k.o.w.n.i.k...w. .p.r.o.g.r.a.m.u. .M.e.n.e.d.\|.e.r. .I.n.s.t.a.l.a.c.j.i. .C.a.t.a.l.y.s.t.........F.i.r.m.a. .A.d.v.a.n.c.e.d. .M.i.c.r.o. .D.e.v.i.c.e.s. .I.n.c... .(.. A.M.D.. ). .d.o.k.B.a.d.a. .w.s.z.e.l.k.i.c.h. .s.t.a.r.a.D.,. .a.b.y. .c.h.r.o.n.i... .p.r.y.w.a.t.n.o.[... .s.w.o.i.c.h. .k.l.i.e.n.t...w... .N.i.n.i.e.j.s.z.e. .o.[.w.i.a.d.c.z.e.n.i.e. .o. .o.c.h.r.o.n.i.e. .p.r.y.w.a.t.n.o.[.c.i. .o.d.n.o.s.i. .s.i... .d.o. .d.a.n.y.c.h. .z.e.b.r.a.n.y.c.h. .p.r.z.e.z. .f.i.r.m... .A.M.D. .w. .r.a.m.a.c.h. .u.s.B.u.g.i. .p.o.b.i.e.r.a.n.i.a. .p.r.o.g.r.a.m.u. .M.e.n.e.d.\|.e.r. .I.n.s.t.a.l.a.c.j.i. .C.a.t.a.l.y.s.t. .(.. A.p.l.i.k.a.c.j.a.. )... .N.i.e. .o.d.n.o.s.i. .s.i... .o.n.o. .d.o. .d.a.n.y.c.h. .z.e.b.r.a.n.y.c.h. .z. .w.y.k.o.r.z.y.s.t.a.n.i.e.m. .i.n.n.y.c.h. .w.i.t.r.y.n.,. .z.a.r...w.n.o. .w. .t.r.y.b.i.e. .o.n.l.i.n.e.,. .j.a.k. .i. .o.f.f.l.i.n.e.,. .p.r.o.d.u.k.t...w. .o.r.a.z. .u.s.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licensePTB.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (584), with CRLF line terminators
Category:	dropped
Size (bytes):	3618
Entropy (8bit):	3.259924363959034
Encrypted:	false
SSDEEP:	48:I4aETr9j4L+kBKIm5RdWrvDI45wKUiwv5XGBr1PCExa4tHVK2HT+0OIKaE2TZx:9aAnnIeEFBGGB5vt1K2HiHalv
MD5:	E26CAF0ED737E81A231FB92B0F54DFF9
SHA1:	51E65C70B52AF050CD4BA4EAA153106AB54DD360
SHA-256:	B481FC206C8E6CF6DE4A2B66F3402B73378A226051A6C86F00FBE9A064B9D997
SHA-512:	62694B23DA4130AB5A76F631F3DA22D92871CBC8F5BA9EEA2C80271FC4C338813CC5739573EE3DA39DC36DD5111144174CC65438487A3BD455B15942D97E8E08
Malicious:	false
Reputation:	low
Preview:	..D.e.c.l.a.r.a.....o. .d.e. .P.r.i.v.a.c.i.d.a.d.e. .d.o. .G.e.r.e.n.c.i.a.d.o.r. .d.e. .I.n.s.t.a.l.a.....o. .d.o. .C.a.t.a.l.y.s.t.........A. .A.d.v.a.n.c.e.d. .M.i.c.r.o. .D.e.v.i.c.e.s.,. .I.n.c... .(.".A.M.D.".). .e.s.t... .e.m.p.e.n.h.a.d.a. .e.m. .p.r.o.t.e.g.e.r. .s.u.a. .p.r.i.v.a.c.i.d.a.d.e... .E.s.t.a. .d.e.c.l.a.r.a.....o. .d.e. .p.r.i.v.a.c.i.d.a.d.e. .s.e. .a.p.l.i.c.a. .a.o.s. .d.a.d.o.s. .c.o.l.e.t.a.d.o.s. .p.e.l.a. .A.M.D. .p.o.r. .m.e.i.o. .d.o. .u.s.o. .d.o. .s.e.r.v.i...o. .d.e. .d.o.w.n.l.o.a.d. .d.o. .G.e.r.e.n.c.i.a.d.o.r. .d.e. .I.n.s.t.a.l.a.....o. .d.o. .C.a.t.a.l.y.s.t. .(.o. .".A.p.l.i.c.a.t.i.v.o.".)... .E.l.a. .n...o. .s.e. .a.p.l.i.c.a. .a.o.s. .d.a.d.o.s. .c.o.l.e.t.a.d.o.s. .p.o.r. .m.e.i.o. .d.e. .o.u.t.r.o.s. .s.i.t.e.s.,. .p.r.o.d.u.t.o.s. .o.u. .s.e.r.v.i...o.s. .o.n.-.l.i.n.e. .o.u. .o.f.f.-.l.i.n.e. .d.a. .A.M.D...........C.o.l.e.t.a. .e. .u.s.o. .d.e. .i.n.f.o.r.m.a.....e.s.........O. .A.p.l.i.c.a.t.i.v.o. .n...o. .s.o.l.i.c.i.t.a. .n.e.m. .c.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseSVE.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (637), with CRLF line terminators
Category:	dropped
Size (bytes):	3712
Entropy (8bit):	3.2749355097602564
Encrypted:	false
SSDEEP:	96:WrCa+qdy4/L5dPhCJcuEbm5HKi+rWoTpRTtU3J2uudAgkalv:5ap9ThCqm5qiUN03kuhat
MD5:	ED5E955F7AF04A4E05B3BF09881A9230
SHA1:	518C9FFB21CFAEA949A62D165C93FDA6B0501B26
SHA-256:	A0CEC0C40DA76B80BCA3A710D5A7D670AE5964E25000EC2B39BCEF7D8014A451
SHA-512:	CD36569971AB9F85F216D2E0FBFAD91B701D9AB5B78148F3A17DA7A6991A1F20ADE0411860FBB3521C74DBA92382EF028A93A28E14317791DDD288AC41B24C67
Malicious:	false
Reputation:	low
Preview:	..I.n.t.e.g.r.i.t.e.t.s.a.v.t.a.l. .f...r. .C.a.t.a.l.y.s.t.s. .i.n.s.t.a.l.l.a.t.i.o.n.s.h.a.n.t.e.r.a.r.e.........A.d.v.a.n.c.e.d. .M.i.c.r.o. .D.e.v.i.c.e.s.,. .I.n.c... .(.".A.M.D.".). ...r. .f...r.p.l.i.k.t.a.t. .a.t.t. .s.k.y.d.d.a. .d.i.n. .i.n.t.e.g.r.i.t.e.t... .D.e.t.t.a. .i.n.t.e.g.r.i.t.e.t.s.a.v.t.a.l. ...r. .t.i.l.l...m.p.l.i.g.t. .t.i.l.l. .d.e.n. .i.n.f.o.r.m.a.t.i.o.n. .s.o.m. .s.a.m.l.a.t.s. .a.v. .A.M.D. .g.e.n.o.m. .a.t.t. .a.n.v...n.d.a. .n.e.d.l.a.d.d.n.i.n.g.s.t.j...n.s.t.e.n. .(.".p.r.o.g.r.a.m.m.e.t.".). .f...r. .C.a.t.a.l.y.s.t.s. .i.n.s.t.a.l.l.a.t.i.o.n.s.h.a.n.t.e.r.a.r.e... .D.e.t. .g...l.l.e.r. .i.n.t.e. .d.a.t.a. .s.o.m. .s.a.m.l.a.t.s. .i.n. .g.e.n.o.m. .a.n.d.r.a. .n...t.a.n.s.l.u.t.n.a. .e.l.l.e.r. .i.c.k.e. .n...t.a.n.s.l.u.t.n.a. .A.M.D.-.p.l.a.t.s.e.r.,. .-.p.r.o.d.u.k.t.e.r. .e.l.l.e.r. .-.t.j...n.s.t.e.r...........I.n.s.a.m.l.i.n.g. .o.c.h. .a.n.v...n.d.n.i.n.g. .a.v. .i.n.f.o.r.m.a.t.i.o.n. .........P.r.o.g.r.a.m.m.e.t. .v.a.r.k.e.n. .b.e.g...r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseTHA.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (525), with CRLF line terminators
Category:	dropped
Size (bytes):	3374
Entropy (8bit):	4.146281340274567
Encrypted:	false
SSDEEP:	48:5fXaEDUexZsnc6+RHhY6L896psKG4RehsTtfhkNBUGMz+XKbA01AklcYV8YAorGr:xXak3r6+/zJTt5pfzoIZ9tV80ggalv
MD5:	A949E2503B85FF72850EEA5C563B803F
SHA1:	491EE1171E6FFE5E280A953073AE4BDA7A24AB92
SHA-256:	0E739B6F784253CFFE2DE6A8D49490F52F8C97CBD3507E397E3F5F0E266E4EA7
SHA-512:	97CB06CD752D41674C85AACC92AF7187C0DADDEBABC824E6050ED86E8FE56D5423092CEFD22CD41EDBEA4685180F5BA136E51225F1622FACCE0D66841D86B002
Malicious:	false
Reputation:	low
Preview:	....3...5.I.A.......'.2.!.@...G....H.'.....1.'...-.....1.'...1.....2.#...2.#...4.....1.I... .C.a.t.a.l.y.s.t.........A.d.v.a.n.c.e.d. .M.i.c.r.o. .D.e.v.i.c.e.s.,. .I.n.c... .(.".A.M.D.".). .!.5.@.......2.#.!...L...5.H...0.......I.-.....'.2.!.@...G....H.'.....1.'...-.....8... ...3...5.I.A.......'.2.!.@...G....H.'.....1.'...5.I...0...3.D...C...I...1.....I.-.!.9.%...5.H. .A.M.D. .@...G.....9.I.#.'...#.'.!...6.I... ...2.....2.#.C...I...#.4...2.#...2.'...L.B.+.%.....-.....1.'...1.....2.#...2.#...4.....1.I... .C.a.t.a.l.y.s.t. .(.C.....5.H...5.I.@.#.5."...'.H.2. .. A.-.....%.4.@.....1.... ). ...3...5.I.A.......5.I.D.!.H.#.'.!...6.....I.-.!.9.%...5.H.!.5...2.#.#.'...#.'.!...H.2...D.....L. .A.M.D. .-.-...D.%...L.+.#.7.-.-.-...D.%...L. ...%.4... .1.....L. .+.#.7.-...#.4...2.#...2...-.7.H.............2.#.#.'...#.'.!.A.%.0...2.#.C...I...I.-.!.9.%.........A.-.....%.4.@.....1.....0.D.!.H.@.#.5."...#.I.-...+.#.7.-.@...G...#.'...#.'.!...I.-.!.9.%..H.'.....8.....%.C...F. ...2.....8... .@.!.7.H.-.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\licenseTRK.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (548), with CRLF line terminators
Category:	dropped
Size (bytes):	3594
Entropy (8bit):	3.508971007315871
Encrypted:	false
SSDEEP:	96:jaJsygpiLNHTZa8BkVtQ6beDINrOLyx+alv:jaiyDLNzZa82HQ6bM9at
MD5:	2A2C5DE62F436FDA6641078314C364C4
SHA1:	00CC03CF3BEA374CA113105E67824565A00BF2B6
SHA-256:	87F67942A12766E25D990B4C55D79ED5DC1B6DA4E1385F048847ABBD7378D509
SHA-512:	EF2B68FE1B43A34ADF9F84289EE8D83A535159B40FB6A879A8C1E042CEE20431CC2C85427720A99DD48787A372CCC83E3018963D28EC692F3869B8F5456E1356
Malicious:	false
Reputation:	low
Preview:	..C.a.t.a.l.y.s.t. .Y...k.l.e.m.e. .Y...n.e.t.i.c.i.s.i. .G.i.z.l.i.l.i.k. .B.i.l.d.i.r.i.m.i.........A.d.v.a.n.c.e.d. .M.i.c.r.o. .D.e.v.i.c.e.s.,. .I.n.c... .(.".A.M.D.".). .g.i.z.l.i.l.i.k. .h.a.k.l.a.r.1.n.1.z.1. .k.o.r.u.m.a.y.1. .i.l.k.e. .e.d.i.n.m.i._.t.i.r... .B.u. .g.i.z.l.i.l.i.k. .b.i.l.d.i.r.i.m.i.,. .C.a.t.a.l.y.s.t. .Y...k.l.e.m.e. .Y...n.e.t.i.c.i.s.i. .u.y.g.u.l.a.m.a.s.1.n.1.n. .0.n.d.i.r.m.e. .h.i.z.m.e.t.i.n.i.n. .(.".U.y.g.u.l.a.m.a.".). .k.u.l.l.a.n.1.l.m.a.s.1. .y.o.l.u.y.l.a. .A.M.D. .t.a.r.a.f.1.n.d.a.n. .t.o.p.l.a.n.a.n. .v.e.r.i.l.e.r. .i...i.n. .g.e...e.r.l.i. .o.l.u.p. .d.i...e.r. ...e.v.r.i.m.i...i. .y.a. .d.a. ...e.v.r.i.m.d.1._.1. .A.M.D. .s.i.t.e.l.e.r.i.,. ...r...n.l.e.r.i. .v.e.y.a. .h.i.z.m.e.t.l.e.r.i. .i.l.e. .t.o.p.l.a.n.a.n. .v.e.r.i.l.e.r. .i...i.n. .g.e...e.r.l.i. .d.e...i.l.d.i.r...........B.i.l.g.i.l.e.r.i.n. .t.o.p.l.a.n.m.a.s.1. .v.e. .k.u.l.l.a.n.1.m.1.........U.y.g.u.l.a.m.a. .s.i.z.d.e.n. .h.e.r.h.a.n.g.i. .b.i.r. .k.i._.i.s.e.l. .b.i.l.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Config\tvtablerev1.MSI

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.8425617284933902
Encrypted:	false
SSDEEP:	24:rgNQWmsi5j4xBW2w2q0O0XIls03tBGAK:rgNQXsi5jyby0TXIaiaAK
MD5:	2FCF228DBE24F18DE16044478026A6DD
SHA1:	ECDE94659E087E2908D87206560CFE0C4CA36915
SHA-256:	5EC7A09CC6201F30035FB750438084591DCCD5C10FF6D928347077CC436FD385
SHA-512:	18D3551283F32CD22D624348E7DA61079FDCE728D9DE67FEE636A68E70BBE8C16A9C28121D757FC9145C6D54092FA2626D95532DB9DD9377A544A0A65B4F97F8
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Images\Thumbs.db

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.731358579156418
Encrypted:	false
SSDEEP:	768:yohisqDrNZqGHlnIldADdYTFSDohdDNx5Sz1Pk/8U0:yohUq5PX8ohdpxYpc/
MD5:	3AAAEE2053956792182CC5F70B363DD9
SHA1:	10605CB0129F82BD070FF0ABED5DD1F50B166671
SHA-256:	917C2D902263970B27F95B1183902EC37DEBB2B6B234550BE5B48DCDE56683B6
SHA-512:	8633BA32553A7CA4471D85686CA956EDF884641DF0522C8666409960BAF165415E13C0D1E4CD5C5E90B5A23DF491D0706CC4D957D3785505D69F922F8C701C2B
Malicious:	false
Reputation:	low
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#.......%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Images\a.jpg

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 378x210, components 3
Category:	dropped
Size (bytes):	30641
Entropy (8bit):	7.973766670702341
Encrypted:	false
SSDEEP:	768:9I/J8Cs2IoyahQoCyV3DAINrktLBzvbLuNwYrN:9I/Gah9CkzPrsnLuN3N
MD5:	4E34D374F5F5D63CE46E1074267C033A
SHA1:	6DDFA5F8D8E7B0E31828CBD37C4F8ADF97259CFB
SHA-256:	1FC2AD2F88C6B6C44DD5268FBE31848BD697B290D601F2CA8A2E2148A976B1A3
SHA-512:	DEA11C135D1F65FB67913995EA90D8729ED5EE3DEA581F2682C7D38F2142F1C0B23C0C8FEE09B71C648C66A6E234BEB5E4A10D4B29FC06E7654A90E08A5E5D82
Malicious:	false
Reputation:	low
Preview:	......JFIF.....d.d......Ducky.......<......Adobe.d...................................................................................................................................................z......................................................................................!..1A.Qaq"2......BR#.br3...S$.C4T...D5..c.t%EU&6......................!1..AQaq".2.......Rb#............?..].m.:.m%.c..VAV...\|#.$}G.]_Z[.j.....F#&.}j2.:.V......g..(._..Ny.J\|q.......[)...+...@w.L..8j.K..n..B .[x.s...AS..>.M..U..^o.5..m!...$AU.k....ZM+.:..{.....>K..#.O:0..\|0..`.....osi.KuN.e.&M...Wd.w....t..\|..v..(U...u/.{M.q........43.x<E4...p./....\.b..[.-..}.w.@.=.ix...m.i@....... Wlq.].$....;.s_+{}E.;.Tr?....9}U...q.m.,.^.<..~kgx.a....c$V..1........`...gsmys.m>k...Q$.....-JyN.N>.........H..l.":'.!0.FUY.j...,!y%..kK...'%.6..~.}:..@{I.b.v....O\..[.m>Z..,mc...(K...bx.....oQ.t.D..r...=.U ...%.g..aE...?3.A.n..n5.]..5UX..u..5..\..b0s......o......"R.....R.cN..PY@.7...6.gg.;.p

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Images\b.jpg

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 378x210, components 3
Category:	dropped
Size (bytes):	30357
Entropy (8bit):	7.977708026161702
Encrypted:	false
SSDEEP:	768:QWamSU0Cb+DpNXORaa7oQBd3yFvfm2Ho3xOj991xr2qJ1viq:QWam9SDpraHz3yZNHo3wTLr2S1vz
MD5:	80159B0A6F207EF57EEB6B35B1ADDB30
SHA1:	24D20A13A09FB1B007C050088D3352BF4DA10289
SHA-256:	39A0CB753D2E56CA73072A39A954F44CF0BE5300BADBB7762F96F746120FADFD
SHA-512:	4D8B31F44E6311AD5DD6CA808EBA57ADB93347A12AA6A3FFC89823C46C572D7FEAB66B99C2B529F35BB8C1A3CB7E6BE2BC15C35210CC2B193A7B49140E59B412
Malicious:	false
Reputation:	low
Preview:	......JFIF.....d.d......Ducky.......<......Adobe.d...................................................................................................................................................z........................................................................................!..1A.Qa"2.q....BR#3...br.4...CS$5.T.6...s%.c.D..t.EU7.....................!.1.AQ..aq".2..B...R.#.............?...[F.@.qJa.'....js......".yc.....@.T...O..2C3.`UHf.0.W........V+Ta.....A....J./..()J..VT.W..].....Q..rM......J.z......8.Ym...U$c...p...H............&..w...S.Q.~.3.Qeb...A.L.4n4....R.c\.L.~..0..rPq....7!.u%.."H.i.1.h....iI....b.....c......T..0..C...k........"l.XZDb....p..V.+.2...u.)_S"DD....8-...YU....{q.y<r...I....R....{.c.....H.}..!..6.S.W.*vbMd..A.X.GH..#....v...6AO....H.i...>!F..{@....X.x../&.Y.]..ze..>.Q4.&...z._k....}Q]..\L228<.s..:.O ...G....=.....5.@t..R.....q+7..$..p..;i..EQ..V5....Ya......v.. .CE..sT5'#.i..m].U4.....J$..I) +@yg..r..p..M.8..S0......L.MMB..

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Images\c.jpg

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 378x210, components 3
Category:	dropped
Size (bytes):	26458
Entropy (8bit):	7.974327598367741
Encrypted:	false
SSDEEP:	768:eQGA/EPHp0tISv6j3vJeBLAV6dO0DvSYuL:JqKyTj3oCV6EX
MD5:	785EA6DF6D225288B66D2C52DF197AD8
SHA1:	EBB752E9D7B962B3C8A1C5045E3F6428B944675D
SHA-256:	EEF0E86A614D49A6D3DC83EBB13CB744F7126D4CFF94E0CC3463A4D956139C8F
SHA-512:	3B67ED014DC3113747FFD8E43C324EF06DE6FC91030C64FEE30970A95F9B0810874C7EBD9F1A770BE89FC127FE86BBCE1465AA89329517E9BB16C22A71F403B0
Malicious:	false
Reputation:	low
Preview:	......JFIF.....d.d......Ducky.......<......Adobe.d...................................................................................................................................................z......................................................................................!..1A.Qa"2.q.....BR#3..br4...CS$.T5.6...c.ED....%UV7.....................!.1.AQaq"2.......B.3.............?....$..$...%.o_.....y..so.P~b..,o.8...Q../i....5>.w%....d........1a......w.P-.H.cN.Q...l.......c:..~2.0..J..SS....\|.l...............(.=..1....T...kV....dS.1...}......D.....5..CMZh\|.g.`I~../Q.M+..KS...&..u.j..A..h.w..J#.G..-....i...v."........1##.....H.+E..Ox.4>..-.0F.=.......0\|.....GA.(,.6$..N..4.'.z[....MEy..>..x.....S....Pj..P...Q.v ...,.M....+#}....N#.T..O+..nyc5..Ac!..r../...f(.........Y[(}R9L..p..O..t....6../X.N......(`K.9r.TbIR.;.W..do%y0.U#..$v.c...8c,.[u...~...My.I$...#u..i..:....Kts.......?~(....p..z.......F#hn..^.3.`i.ARNC#.R...IRT...1....1x.KW...9{!....tr.2.....v.N

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Images\d.jpg

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 378x210, components 3
Category:	dropped
Size (bytes):	29838
Entropy (8bit):	7.977513239887959
Encrypted:	false
SSDEEP:	768:X90wjgTGvQhK1gywiwfyedni/Si1KIZj4pZClRx5lT:X9GGvQk1Bwhdi/9oUsfUT
MD5:	760BC707D70843E285740088BB789FFE
SHA1:	A8BC7D0C3940EE5580C994AF37028A47E44C9B04
SHA-256:	59927D11EF577497A544E0DF3CAFC2B5A10017BEE402C3AF64136F844A972F37
SHA-512:	B268D33474E6E8E954C05BAB77D6AB47D9E3C77FBFD45E783E79321142CBEBA10E2C7D2CD96D2B280161C3BEF21BCE2D0E1D04826C6489180315A92164393CF2
Malicious:	false
Reputation:	low
Preview:	......JFIF.....d.d......Ducky.......<......Adobe.d...................................................................................................................................................z......................................................................................!1..AQ"2..aq.B...R#3..b....r.C.S$4T5..D..dU...%7.....................!1A..Qaq."2......BR..............?..6.y...EH\|t&.R...7i..).o$.....N...De(..h;J.........nw]]Ekm..B6J.)...<....En.z...<.^.h....$....D.........$..j...2+...&...Z....e.\M...R....}. .Z.....oxU.'.>."..r...$c\|..gP4...EMt.Q..R..i...$....~L.E...T.ys...P.X......E)B2.h...#v.D.q[r7.PC..Qr.9.@{H.;.'.d..B.q5'.J`.HCqf.p..I. ...V.8t.S!rT...g\...% .l,..d.X.-$.R2)......f.....'..p...1..h@U..)........=./VI.F.6.L...t.c?.#Ou.9...H..Q.`d...e..O....w....D.D.p..r...O....]q7..I4...-(.c.E.W..N]...=O..)...UC...4.{2..E9c++9f.-.....n'.\...b0...]I..L.:.W....0..V.8.....{hO.....\.\|..s......C37>..fh...k.6%.A..0:.V.....E.M,....{....d.)0Q%..

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Images\e.jpg

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 378x210, components 3
Category:	dropped
Size (bytes):	26445
Entropy (8bit):	7.974180812815603
Encrypted:	false
SSDEEP:	384:6i7Mg4hVvOpzqE59UMwgbTrHRJo3W6iR04CTZWOpY/uQbLFdkhltoXc4Gp0:6xg6vxEdw8T/o3Ni64iZWfFdkxoXc4o0
MD5:	02641E37DE7A8FF27E0DC3BCA0D42A55
SHA1:	5CFAAED53F7744AF00580AD97BAED2EC89EA016D
SHA-256:	CD14B974C8E7684BB4E8325AA414AFFF6BE6C0F4A8DB07638138DCDF2E1AFCA1
SHA-512:	D88CE7B09EEF40E111C9C57FA9CCC29A65197CAF94BF09AD3023F80311B5CBA7E344504839B10ADEF0A10DDC24D78069C58FB028483073041904739563C960F2
Malicious:	false
Reputation:	low
Preview:	......JFIF.....d.d......Ducky.......<......Adobe.d...................................................................................................................................................z......................................................................................!..1A.Qa"2.q.3...BR#4...b....r.CS5.c$.DT.6..s.tU..E7.....................!1A.Q.aq"2...B......3............?......<.....\..M..S.0.E...@......VV@..J.F....}.......B-.YA....8AZ.o$QI....R0.7..Ao..d.K.L.h.....<.T..,{...{.......k...t.J6.=.rp....DU.'.d..L..m...:.#..$.....0.....S..&.p.=..&.I.8..RM2...#5....$...6........i.1....".@.d.J.U.\.4o.....i..j`.3..@x..,.....A.h.I9.A...{...x..F.........Xb..!j\f2...+&v.d..k$Y.=..(.F%.......7Mq-dcQ........hM..Of.c}...E..0......0.6.o..[..-BA..w...y[$A@;p.AZ....`.p.G...au.R.KL.L>^....J..O.......K.....Z..4.!.s...i!..eQN....=.RFBCdA.p'+v...(..~.x*...V...dTwv`.d...S..:y/i.#-..._!.....F\1.....v.6.UT..2..<.N......[...F .y.1>.&...~...i"..!L<.X....

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Images\f.jpg

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 378x210, components 3
Category:	dropped
Size (bytes):	26458
Entropy (8bit):	7.974327598367741
Encrypted:	false
SSDEEP:	768:eQGA/EPHp0tISv6j3vJeBLAV6dO0DvSYuL:JqKyTj3oCV6EX
MD5:	785EA6DF6D225288B66D2C52DF197AD8
SHA1:	EBB752E9D7B962B3C8A1C5045E3F6428B944675D
SHA-256:	EEF0E86A614D49A6D3DC83EBB13CB744F7126D4CFF94E0CC3463A4D956139C8F
SHA-512:	3B67ED014DC3113747FFD8E43C324EF06DE6FC91030C64FEE30970A95F9B0810874C7EBD9F1A770BE89FC127FE86BBCE1465AA89329517E9BB16C22A71F403B0
Malicious:	false
Reputation:	low
Preview:	......JFIF.....d.d......Ducky.......<......Adobe.d...................................................................................................................................................z......................................................................................!..1A.Qa"2.q.....BR#3..br4...CS$.T5.6...c.ED....%UV7.....................!.1.AQaq"2.......B.3.............?....$..$...%.o_.....y..so.P~b..,o.8...Q../i....5>.w%....d........1a......w.P-.H.cN.Q...l.......c:..~2.0..J..SS....\|.l...............(.=..1....T...kV....dS.1...}......D.....5..CMZh\|.g.`I~../Q.M+..KS...&..u.j..A..h.w..J#.G..-....i...v."........1##.....H.+E..Ox.4>..-.0F.=.......0\|.....GA.(,.6$..N..4.'.z[....MEy..>..x.....S....Pj..P...Q.v ...,.M....+#}....N#.T..O+..nyc5..Ac!..r../...f(.........Y[(}R9L..p..O..t....6../X.N......(`K.9r.TbIR.;.W..do%y0.U#..$v.c...8c,.[u...~...My.I$...#u..i..:....Kts.......?~(....p..z.......F#hn..^.3.`i.ARNC#.R...IRT...1....1x.KW...9{!....tr.2.....v.N

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\AVT64\AVT64.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, MSI Installer, Last Saved By: InstallShield , Number of Characters: 0, Security: 1, Number of Words: 0, Title: AMD Accelerated Video Transcoding, Comments: Contact: Your local administrator, Keywords: Installer,MSI,Database,AMD,AVT, Subject: AMD Accelerated Video Transcoding INstallation package, Author: Advanced Micro Devices, Inc., Number of Pages: 200, Name of Creating Application: InstallShield DevStudio 9.0, Last Saved Time/Date: Fri Jan 23 10:56:57 2015, Create Time/Date: Fri Jan 23 10:56:57 2015, Last Printed: Fri Jan 23 10:56:57 2015, Revision Number: {BC2DD1B9-2674-433F-9CF2-6232CCB34583}, Code page: 1252, Template: AMD64;1033
Category:	dropped
Size (bytes):	2734592
Entropy (8bit):	7.848044123868257
Encrypted:	false
SSDEEP:	49152:tszT9ZYy3VftwUxji7WilZwws0d2h7GXmS16UyQZovhDPjqvB99Qy7XCnNU6H1M2:GZYy3Vfro7ZZqKNtZovpeTQy7XCNUeM5
MD5:	37FE8DD0DE57E267672BC516012F5C33
SHA1:	9066F2931A72601BB5DE888204FC0246AF33A7EC
SHA-256:	B7E92A1216DC663F1A4D59DA695B4983997B2791217F106812ACCBAD4CE8F0F2
SHA-512:	046CDEBA65168E18CC41578119A62B23FEC07086EA203C7A63DE9AEC5FBA274B4F2C0ACC75F55E9C03728FE7FCDC0310CDF410BBB1B455B024633B1AEC9C025F
Malicious:	false
Reputation:	low
Preview:	......................>..................................8...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................^................................................................................................................... ...!..."...#...$...%...&...'...(...)......+...,...-......./...0...1...2...3...4...5...6...7...E...e...:...;...<...=...>...?...@...A...B...C...D...\...`...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...X...]..._...d...c...a...b.......f...g...'...h...q...i...j...k...l...m...n...o...p..."...!...s...t...u...v...w.......y...z...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Branding\Branding.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Last Saved By: InstallShield , Number of Characters: 0, Security: 1, Number of Words: 0, Title: Installation Database, Comments: Contact: Your local administrator, Keywords: Installer,MSI,Database, Subject: Branding, Author: Advanced Micro Devices, Inc., Number of Pages: 200, Name of Creating Application: InstallShield DevStudio 9.0, Last Saved Time/Date: Mon Mar 10 10:16:51 2014, Create Time/Date: Mon Mar 10 10:16:51 2014, Last Printed: Mon Mar 10 10:16:51 2014, Revision Number: {E4D7AC8F-8A56-45EF-95FF-E3644BAAA716}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	416768
Entropy (8bit):	6.134537683237041
Encrypted:	false
SSDEEP:	6144:wWEc0BZFMoGvYgaFSzONYyysivyZJ2L1gFO/RYQ+oxIgUl0FLd:330BZ8a1YyyrvO8vxIP0
MD5:	F19BDF6551961A7B6BF5B2779DFCA689
SHA1:	DEA0B80A13D349E4E94FA5978728E7550DBB17D6
SHA-256:	0E7AD2B470B26BDC211DC3C64E71D5E2B3782110488CCA92635508A77640F73F
SHA-512:	5EFCDF4BC12B3BEA991CF8AC81732320BBCDEDC7A795895CCDBA8EF3B42421FBB703CB1C4E52179243E81FBA4DBE24BE16B23C71F3C9DD997CEE040592508377
Malicious:	false
Reputation:	low
Preview:	......................>...................................8...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................^................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...E...e...:...;...<...=...>...?...@...A...B...C...D...\...`...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[.......]..._...d...c...a...b.......f...g...;...h...i...~.......k...l...m...n...o...x...q...r...s...t...u...v...w...j...y...z...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\1028.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 950, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield?DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1028, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	5.800440926669001
Encrypted:	false
SSDEEP:	768:t8n3E/XDrhcIBW68gxBxP2Btkfh1CRWASZnQMfI5b+qFCrOqAzR:OnUPDFcIcgxjP2BtEDQmqoTA
MD5:	7996ED56C5BE9F26D56003A6453D0E6A
SHA1:	2CCA97E30BEB58086DA08FB86CA2FBC2A3AC5396
SHA-256:	6ACC59F0A62F12A8719B4C3D5DE4E6E92D0A4E9DF0875E1A7100640C0F2DAB19
SHA-512:	33827E1B7BCF59585295426100AEC95B2E538339A4BA1893CC1857A67D5C5FA7F0E50276635E6F9213AE4740123CF56EC8D151D75553837DE1351CDA6C5CEE42
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\1029.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1250, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1029, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.397487410238755
Encrypted:	false
SSDEEP:	1536:Rsl3GkFcIcgxjP2BtEwzb/zcl1V7KZwc1ibt:ml3G2cIcgFO/f/vZwc1ip
MD5:	BFD47449BB2A8AB3FF1A309A7932BE86
SHA1:	E66067065F60B44F0ECCD3768DBCFD811B21CAEE
SHA-256:	C235B3B1E3D840A298E760704B5245681F3F7EB3BDE61BCD19082E5875442C36
SHA-512:	E4A9FD9BC5E4A448ECE853022D31EA543F6DDD1F77AE22D418CD93349F2E38257379B42EFEC358BFEB7C12E808C13F2960FDF0DF2ACEFF28A94E640EB61125CA
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\1030.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1030, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.331827331226602
Encrypted:	false
SSDEEP:	768:iyV5KIT7k6rhcIBW68gxBxP2Btkfh1VZHKcv/gqTQ90AZ+DEUaTzEdl7DPzLU2EZ:rV51FcIcgxjP2BtEJgqTKZ+DEUaTnr
MD5:	52FF4570417DC047654BE5DC56ED3097
SHA1:	AE6CB75FAFAC4AE0BA39822BC000FE03A6627297
SHA-256:	B47C5571B2E098CECD7DFD5BBED99D774AB2F1CC71D3F84C86012E14D231326F
SHA-512:	0A411EA07E48A7B68F459AFF8E549570C8621B95273D4F5B7B3C49C2E7682DE6740BEABD1355C2BF7A0BA4BF33E63786D864753FDEE31B24B23FDD87E8B3D951
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\1031.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1031, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	5.289093198668327
Encrypted:	false
SSDEEP:	768:+wZLSfy9yfdXMpmtWTrhcIBW68gxBxP2Btkfh1WFhzh0/0R0g0Q0+0m0f20L0NY+:kewcTFcIcgxjP2BtEYhvP80f
MD5:	8108470172BC032E8B3C4589C32EA682
SHA1:	F865D7A7E7A7FC0A0511B7EDFF60AE57C9D69043
SHA-256:	84D0E9900DE83C9682CF878C91CCE8AD2890A954C142C7EFE73A8DF4D753D069
SHA-512:	D96A5574AB5E8697B12E1A68FC23218E86C48C73979B98D95F6E5B78B5BDE929FB91EDDABFC367414F8E28179EBBC960AD4C336FDB6DFAC3CAA7A9D30BDF2589
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\1032.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1253, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1032, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	5.782569689033242
Encrypted:	false
SSDEEP:	1536:MAHl4FcIcgxjP2BtEegCOL7ZJ6RDSTky2JQr6z6OX870j8pl4TzhU7UamA:MAHUcIcgFO/1YkNwoA
MD5:	34B1A3B223D87756A1EE88B88215FCA8
SHA1:	87D5FD0B7794114AEBB8AAC4A9EDE4BA8AFCFA64
SHA-256:	107474DA4294EDCAF1602C6A380F5EEBF3194A9E9CEF4B5DA98A99FF53C4D880
SHA-512:	DD9C154C40AEF7E9DF3C3317E92B74244FD684C0C6D19A6ECAC5BCB55C5D6F47D43F8076D732E164E7D558448A97F2A275ED6C4482CDB79BAC92383B5DBDD5FE
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\1033.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1033, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	4.766031975245478
Encrypted:	false
SSDEEP:	384:8ar9bIphom7tgoO9bMw3BW6uRqbGJYgiBlPP+hTdKEf4NJRwS4+RdIY3vh8v6olv:8arhcIBW68gxBxP2Btkfh1RO
MD5:	70BDE39E09C8DD016451F21844AC01B7
SHA1:	C25D2713DA6BBE9481FB2DA7208CC7203BE80C79
SHA-256:	991C1B6C8AC914650F5A90A44BE6FDC3834438F4B9856F7F4350B295AAC6CD6A
SHA-512:	9575F9BD1A17CDEDA3747BE4530C953CE9074FF994939BC6409612A1DA3337364C19A45E91F6D630FD1EDC065D7965FE58317B4E943A0FF6FEA84878E773A283
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\1034.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1034, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.280395495980868
Encrypted:	false
SSDEEP:	768:HfDovn7mrhcIBW68gxBxP2Btkfh1FkxMl49SGeBHc5T:/EvqFcIcgxjP2BtEjG2c
MD5:	5D0EE8E952B9485976461461C0F979EF
SHA1:	C7EBC54BDEE3C440249BB61C6106939FF115DED4
SHA-256:	25385E65FFB98205C0BEE5AF0E9321E0FE6B19B4DFA7DCE7AE9FF8D4162F289E
SHA-512:	D194EA563E036FF603E95D68923315E1C8BB605BA701F5B1D7A49E1018018913140110926FF55EF19873359D256502CB4E3351D0FCE76047E5FD6A7A8022D012
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\1035.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1035, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.371809945167174
Encrypted:	false
SSDEEP:	768:f3yILCErhcIBW68gxBxP2Btkfh17McwRrUhTnVvCeGLz4fLxl1:PljFcIcgxjP2BtEYbUhTnVvCgf
MD5:	52DF28BBCAAB120CF185B789C21DB0D8
SHA1:	8C3C041A37D220887F2D136699B416AAC14BC066
SHA-256:	DEB0F979B653D480AD6704B64F922990325B9A5F4A13B6921944626194AB22A8
SHA-512:	2C8BB8671F428065C8BBD2A331185F1BAE583DA898022729AAACED0B5D25E46A5137BB5F49EB60ADD5BF4BAC184EE40CEB98457010FE214959147B6CDA8895EB
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\1036.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1036, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	5.2599593753555425
Encrypted:	false
SSDEEP:	1536:vjuiqIFcIcgxjP2BtE+9AW6WxEBJMzoO:vaincIcgFO/PLxEfbO
MD5:	6BD635089C45ACFC69E31EADBD3B13F2
SHA1:	DA7C82FBE675D0E540CDDCDE1118526B4F50AE28
SHA-256:	9FD084822746E7763B6F4F54C5A459F32093726269B3FE6E5B543245126E0945
SHA-512:	F2EE4D48B2D07460F740CAAB32D493C5024E615099A95164B7402235F451568C83F31DB785FCBCCD65873F28A3D7B639D4094A1A96E939CEAC4E069A872E4DC1
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\1038.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1250, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1038, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.4638296459513915
Encrypted:	false
SSDEEP:	1536:Enlhqs0aq6UgbSGIqFcIcgxjP2BtEiV6zZ62bsAZ2cuuKSqWaq:ulhqs0aq6Ugb0EcIcgFO//V6Ldqw
MD5:	394E180663098A454723B5F4C1BFC553
SHA1:	BB1970E5FC812512CB1EC53F6CD8048001341134
SHA-256:	D810E409B04F9484F627D38D4866DA5FFE9875AF2AA5387248661A9BAF8F40DB
SHA-512:	623604BDAC12A707EB1769902BC184BF145D73CBEB4980275735534D79218A3C9D0779699021D656268D391AD58B3E0EA93A1D05B680C910922D3591A9EA97EB
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\1040.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1040, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	5.231905201271988
Encrypted:	false
SSDEEP:	768:QWx0Kzj2Ounp2XQfkmrhcIBW68gxBxP2Btkfh1d/BxwBDkG51KKFSwcJlDCE:QUvqO+FcIcgxjP2BtESFyJlD
MD5:	E7CF1F057A9503651ED31EE704E453FF
SHA1:	6A3712812FA82100E8A9956A2424530850C0F1B1
SHA-256:	AE64D9CAB7B5C510908ACE2751D7E957FC550B9FCBFC74ACB77027647C938029
SHA-512:	C347EAE3FCF9123FA3594F6E4ACB7A2F3C48FD3C9BF5528933A0C7BD321BA30615A128624CB5710738773CA89286EA612A7E8093533CF9C2A3A934F73D13B3C5
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\1041.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 932, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1041, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.929449118904112
Encrypted:	false
SSDEEP:	768:hQBIvvs/5ofrhcIBW68gxBxP2Btkfh1BsCvwx9nXEmEJDVssk1S2+:KBEsuFcIcgxjP2BtE+vx9XEvDVT
MD5:	7D86C523BFADF19DB51831F126485A09
SHA1:	830C1C719625165DC6FDDCC94518B10BB1C33913
SHA-256:	BBB6A21010C58F36FFD00D02FF5782CF1786DE17260E4DB739A6632F93E5B629
SHA-512:	5CED9EDC7B41191321EF6F5AB1AB5C0DE049241E61C43426AAE275592D73BFC4FB4FD609DDCB29846C62365DEE2D17511B2AD7FA39861433EFF864F49C3A09B3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\1042.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 949, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield?DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1042, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.943700346686301
Encrypted:	false
SSDEEP:	1536:3p9PkFcIcgxjP2BtEDgOYhwAbPndzn0IJCD:3p9ucIcgFO/d0bD
MD5:	B7F7FB096DD88CE1D2E8EBBC6E9E9A1E
SHA1:	A618DFC7800B1708564938BCCC872D1ADD39732F
SHA-256:	EA64DBD51447EBCE7BC581C0B53A402DA05FBD2ACFCC58529C54A2767C867CE6
SHA-512:	BC10E410E3B605089C944D6486F89F23F2AC5B79CAC388CB7BF8D3EF00C80C03CAC13F94BDF4DCF02D8E1CC82F4AE9CC59AF3BC574AE86EB9DF7C547DA343D73
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\1043.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1043, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.314409838429142
Encrypted:	false
SSDEEP:	1536:zTrFcIcgxjP2BtE1OK/6OfSWey66UoDfun:zTBcIcgFO/s7/xf9ey66Ru
MD5:	B6D3616A74E3F0A3FE00D751F24DF602
SHA1:	B0F19480C4C2BF86DC4B859F52A7F699BD5F22F1
SHA-256:	3B23777EDE3C67B7A58DC4BD7805DA8927F4BF29F1D6F7B6963FB613C58DE6EA
SHA-512:	1349FB36F5BBA25DD33A16175BDD12F42169C7970E9C2B46C83AC56B1C34D8B95FC2E6EFC9A90EFAD5292758A1C1AB6CA27A356AFC040B3727596384E1D025EB
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\1044.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1044, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.336953707857715
Encrypted:	false
SSDEEP:	1536:Ulw1FcIcgxjP2BtEFU7RaBSIHcMpoC+yGxKS+bCJf:UlucIcgFO/UU7wSIHcMpoC+yGxKS+bC
MD5:	35715D1B87632C123D1FB6224CCAA59B
SHA1:	77C1019111A04BB1F5FA4C26B8631065515C0F8B
SHA-256:	C02C81596AEE834F4A555F73A333C7A86FB112568F60FB47FCB2EE3231AB20B7
SHA-512:	C7876AE51F3ED30F5A5E1C59C2F56001EE853C3807048ED53828156D75FFB0E1A2C2C7445B69A5ECF283EECF739B97811C6A82D83E01AB58FE0235AC68667049
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\1045.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1250, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1045, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.38964645394193
Encrypted:	false
SSDEEP:	768:Ea6YsaAHINZqbrsJrhcIBW68gxBxP2Btkfh1JWP+rtDe0O03X+s7bA9qZCCD7rEY:eYhFcIcgxjP2BtEjZZMNJ
MD5:	73675CAB87A1BC13A3EAA8A6379203AD
SHA1:	734754AF82CD0660C27D95376AE2722F388B7244
SHA-256:	E599666E68E773E23A8B3130676E3D7010613EBB60A436DE1F85871C2419ED4B
SHA-512:	7235F2FB283A7D4B0EC81F8B4237060490B664CBE7C4B26F85A49290F1DE2D1598C0E1CCBEB10F984568D5ACC5959FF47C6186EB2002A4845ABAB27D722B0BAD
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\1046.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1046, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.296686059840765
Encrypted:	false
SSDEEP:	768:qDSnGlTRU+R9gJrhcIBW68gxBxP2Btkfh1u9a7XJCT0DTfISDnNtBAka7zZJZdYZ:qWnGtWFcIcgxjP2BtEezZJZdYW
MD5:	3F73B102E511FCA857F7229475E0A655
SHA1:	56BABDDC3F29539130853B87CACF815F9E89E721
SHA-256:	581B09DBBDFCDC56E92EF2DAEF2780A76CB076BEF47748E157364D883F8ADA0A
SHA-512:	88644A0A90387B02EAEC392F7A7CEC18381A07AB69999807066BA112705FE6123858DA3CC0327816EC776872D2B5F60576248C8EC97927291314A970876AAAE8
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\1049.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1251, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1049, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.8015936876150676
Encrypted:	false
SSDEEP:	768:I4SVWqd6LrhcIBW68gxBxP2Btkfh1TxxfICHjNIbjrEgDc:z+h8LFcIcgxjP2BtEtxfibjrtD
MD5:	FFE0C60A0C311ECC3F2F6644603A1AAF
SHA1:	82F1360C6A79860A481EB6171B611FDA12F0DBBC
SHA-256:	CB3F7E5751256267453F5A9F57C75E1B27BF1C801917C017C81145B8681738E2
SHA-512:	AF46449648418FF2E7FB1B1C3676B13C151FDEFBD43B1A4D5B2B180C31C348689B2BF83D6BB9EB3A8F4D92A0248269E5A2B649447F81511141B6C14D2B24D012
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\1053.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1053, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.345284789521355
Encrypted:	false
SSDEEP:	1536:lhLecFcIcgxjP2BtE4wpcyf9tCJXdG5OmB:l9eecIcgFO/nwcJt3
MD5:	7E05A2E647C4B0765F799AA845D6F3EC
SHA1:	0733E20A9E946A0C355355B8B148E2D02C24B526
SHA-256:	39DDDEEAE605D2AB0CB3D127913346F16927A33B625C9320A7896587BDB779DB
SHA-512:	37CD0812A60B8DDD712B1053D62F74E909B472ACFBEC0E9DFD6FC3257468C41ECAFA40EF2290BDC759CC06D859199A7A123765A41483A7C30C9E6A92365E538F
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\1054.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 874, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1054, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.911948607743904
Encrypted:	false
SSDEEP:	768:me4nBMjN61rhcIBW68gxBxP2Btkfh1u5XE6n2esGmIEOmd+GIxKV1f4yk7RlK:D4bFcIcgxjP2BtE6Xoe7mIEt+rq1YD
MD5:	80CE0DF88CC517CA1828B8C49CAC3FEB
SHA1:	A95565D6360BF7AE5D6E90AB696C60D572AFE873
SHA-256:	3D2E079B45054EC18EF629823526F435E02FFAC0661446EC588361E98C675718
SHA-512:	B6D2092BF3975701001B814A10952C6CFAA8AFA073E805705175E5DD4FC7F02CD9534001C32B08DFD33BB766F68BA7607B655D4869447F515F8A2B833C927CDE
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\1055.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1254, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1055, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.422886685668893
Encrypted:	false
SSDEEP:	1536:fTz1oaD6RaDXsB0opFcIcgxjP2BtE0cPbWXp6BQm5V+con:fVTccIcgFO/+qXp6BQm5V+c
MD5:	D530C90C3EB342C2A869F252AA46228E
SHA1:	4D0D84F2617F3E53F960520A8EDE6F915D8FCEAC
SHA-256:	D19185D92C2D6BD365DCF857E289D4B29491A9F17C56CBAF7EF7D6D6E7E14D04
SHA-512:	E4CE16AD8507AD276125A6785CDB6C1AAF7B8600DB0C6A8E425BCDCCB3BC7EE1F0C569AF6BAF628155CE767A53338958A2DDC8314C71361E9CD762586EE2B716
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\2052.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 936, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield?DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;2052, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	5.967275479537541
Encrypted:	false
SSDEEP:	1536:fZ2ZV9wFcIcgxjP2BtEYSlvDEX+HD92p9ge6+i:fZ3cIcgFO/ebe67
MD5:	AA89CAEC0B63F7DAC7315132C73379A6
SHA1:	FDCAA061E4107E86007134D99631357459DCC2C9
SHA-256:	8922F8FDE0257930B2CB4528A25484A9A0D24F7C1B9DA662330000D7A19A830E
SHA-512:	82BF1699E68AA967FCF53CCAF52C3C8E6456FCDA45B5A84005378CFFA86EB4D74C21F853347CCC96F5267BA4144B1673C775F5AA57059498B1BF808976CCF2E9
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\2070.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;2070, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.287021331237493
Encrypted:	false
SSDEEP:	768:vCp82n08rhcIBW68gxBxP2Btkfh1f8u8zN0gPeHxPEgzbbFiQcGdJcu:gvdFcIcgxjP2BtEIFPYEgzbkQrz
MD5:	F7FF251DBA730FFEB43B64E612053756
SHA1:	E9C7394356536C0D142E8E0DA60E47F8587C1057
SHA-256:	8F61EBF119415EE011D6C15316F553CCEA437F7A3D2D2B093E4F60CBA33A0D79
SHA-512:	1CA6507CA9DE18DE6120B094CFCC96F4BEA3A029D102DD7B832B9F02A3B22E36A1BAE2C6111560F681B649640329741E3CBB09FB9A82C8395AD926B3BA205C95
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\3084.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Installation Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:51:06 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;3084, Revision Number: {923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{923DF0DD-CDF4-4191-A426-3DC62EA426BD}2014.1101.2121.36608;{E37C3897-91A7-41A2-A7B8-D776B9869AAA}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	5.263389547023545
Encrypted:	false
SSDEEP:	1536:wjui6YFcIcgxjP2BtEpS3x6WxEBJMzXN:waircIcgFO/QUxEf8N
MD5:	B78CBF78438559C01F3E59C8225D66D3
SHA1:	8938B72629715206DAAEAC42C2867E9080A5A4F3
SHA-256:	F6F0BD62DC16489B68C2DAE59E7395D0F7BF73EA5E28A31954AF76220586C837
SHA-512:	443FAD78EA433FD6938396C28A7BFE2BD99EDF866CFFB4DB2C2A47801819E5DAA5C938EC3066897EB8FFCE243C65C7922D1D4D0F93918C0A71CB0258B395E695
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Core-Static-Net4\ccc-core-static.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, MSI Installer, Last Saved By: InstallShield , Number of Characters: 0, Security: 1, Number of Words: 0, Title: Installation Database, Comments: Contact: Your local administrator, Keywords: Installer,MSI,Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Number of Pages: 200, Name of Creating Application: InstallShield DevStudio 9.0, Last Saved Time/Date: Fri Jan 23 10:51:05 2015, Create Time/Date: Fri Jan 23 10:51:05 2015, Last Printed: Fri Jan 23 10:51:05 2015, Revision Number: {1AD13E69-8172-491C-9966-AE530C1922DA}, Code page: 0, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055
Category:	dropped
Size (bytes):	50208256
Entropy (8bit):	7.9836545664468055
Encrypted:	false
SSDEEP:	786432:jS9UKkIfZ91aE4ZR/t49ZToCuSqc7HpnN2+kAbWh+GCjYNxfVbiDW9SWMR8:W9UHQaE4bm9ZoCTPnk3hC4xdbiD67
MD5:	EA3B850952A360AA35A925B9B8718C60
SHA1:	3CA63609706B5F717F002D230128DD728D68E183
SHA-256:	12C7523C855462CC66316FBFD91F051FE2DB4DB065FFC54136B7ADCCD150F11B
SHA-512:	F97FAF0BCF36FFE000DAE0D12C657D169C6ACEB8F08F5CEE4E51E531376D6ECBA95403E1FA2D67DD10CF04838FCC0D06784C2281303DE2347D21D4F64A987462
Malicious:	false
Reputation:	low
Preview:	......................>...................................8........6..................................z.................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6..........^................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...E.......:...;...<...=...>...?...@...A...B...C...D...\...a...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[.......]..._...h...`...d...b...c...e...i...f...g...3...j...k...p...o...m...n.......q.......z...T...t...u...v...w...x...y...S...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\1028.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 950, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield?DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;1028, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	5.796493241553458
Encrypted:	false
SSDEEP:	768:0pnp8E/qDrhcIBW68gxBxP2Btkfh1eRWASZnQbfI5bdaFFG2zFz:+nptSDFcIcgxjP2BtEnQwau2p
MD5:	DAB2BBE043F573485BADBABD259623AE
SHA1:	FDF4178E9F5255DDB268754E8C866E30CF85EA28
SHA-256:	9267263FBDC52CF30FBB4B939B58FF12C1D38AAE0D4016A2E3D2638B8A5B55D9
SHA-512:	C484AC2E2754D034CF40390807FAA05978D969CE4A7800BED4AB5CB17CA7B2EF035E2ECE115C199DB4BFF9F43926BAD69A412652061ACB68FC4D792B213F8F5C
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\1029.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1250, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;1029, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.391304308111171
Encrypted:	false
SSDEEP:	1536:KlIiGkFcIcgxjP2BtEwzb/zcl1V7GZwc1iD0f:KlvG2cIcgFO/3/fZwc1ii
MD5:	5076CBC1A17933F6B60F13EE481965BB
SHA1:	4C3D54471A03154285EA6D2EC9AC4FDD79845C91
SHA-256:	9163F28208CF8B04047990E8CFEB2B766D3F58BF7E2E271CBB88A73B6CA1B767
SHA-512:	7007B648F2AF0EF00A49C1124C8482248BBBBF5102FE2EE194B70A34B2E6DFC692542A40AE6595A4BE09C81BDF1A67462F8E1723F9E4E899CDC178C51A1119CB
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\1030.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;1030, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.325971033054612
Encrypted:	false
SSDEEP:	768:MfV5bmIT7k6rhcIBW68gxBxP2Btkfh1oZwxov/gqTQ90AZ+DEUaTHEdl7DPzLU83:0V5bBFcIcgxjP2BtEsgqTKZ+DEUaTn+
MD5:	EE0C9B28E8B248CE881F2A32E21D500F
SHA1:	9DF2A279DA23A99410BF3459BB142601C98BF1DA
SHA-256:	86B72D5E5B1C3E93D45CE15268D3343781646FF98FBB658AB9C875B3A6EE4F79
SHA-512:	C2C6D35D2C386EEE9555B5AB80AFF3AFA7EA81100593928FE69BF524C0AB99D74F58A54BE3560DFE7F307DB6DE39F80B7F4F9A4B6DFE9E46D338F99A4CC13FA2
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\1031.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;1031, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	5.283220759904321
Encrypted:	false
SSDEEP:	768:PXZLSfy9yfdXMpYbtWTrhcIBW68gxBxP2Btkfh13FhNh0/0R0g0Q0+0m0f20L0N0:ceSbcTFcIcgxjP2BtEVhdPNGfTD
MD5:	AFF4A2583E9E7F3E21657096DA719E2E
SHA1:	D1C8F9F9B5D95751FD867350252A7308A69D62F2
SHA-256:	8F8378A4C86CC3E727D3D5E10D5C8357B93A410732CFD176EBBBACC83B75E4B2
SHA-512:	BCC9A6AD09BAB81CB57ADB92C2AC3ADBAD84D98F8D45240ABB37257D0D8245C7C24EAED22731D100E25A6B647974FD2EA732F0B005C9652B2FDA087BF35B9FDF
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\1032.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1253, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;1032, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	5.775847315600906
Encrypted:	false
SSDEEP:	1536:9HLkdFcIcgxjP2BtEKgCOL7ZJ6RDSTky2JQr6z6OX870j8pl4TzPU7US:9H8cIcgFO/dYkjwR
MD5:	F215DEB5432DC029EB9EFE8110BF63B3
SHA1:	FA463C3648DB1178DE35F69A102CB1E03B8F5884
SHA-256:	8A58D883872DE3CB4A8E66F241B6661A6B7207599B1B77200AB2D59EF79B782D
SHA-512:	9BB1B6D152D07E3856952F09373E7A9391952734802B6A84124EF957FFBF7891C84519DB7D8E0FAE691E20CDE4B88DAC70D1DB96207BE9DF04C6A269F4E7E24F
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\1033.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;1033, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	4.764198159449613
Encrypted:	false
SSDEEP:	384:qer9bIphom7tgoO9bMw3BW6uRqbGJYgiBlPP+hTdKEf4NJRwS4+RdIY3vh8v6olB:qerhcIBW68gxBxP2Btkfh1k
MD5:	A8BC37E37A373662DFC2B1B1975BB449
SHA1:	3DD98CF3BD118ADE9B6F9F2919CC5B6E6CE86EDE
SHA-256:	6F6878484665AAAACD44D74EAD3F455846D3ACA83A84C5E2662FB3F0FDC69706
SHA-512:	D06534474508989203FDFCBE830B60BAEAA6374DB05AC8ED1B1531F6CBD46EBB1E5C512547564BFDC70E5F78D4A7055C48684618DEE2BD461EF7C739F0EE0C0F
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\1034.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;1034, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.274109652398958
Encrypted:	false
SSDEEP:	768:+5DovnnTmrhcIBW68gxBxP2Btkfh14uxMl49SGpB:YEvnCFcIcgxjP2BtE8G
MD5:	082E2F2E1FEB28D91C0CC4239E974BAB
SHA1:	F1EA0BED3F6854B8C0FF48470A37AF301E461624
SHA-256:	2A6FBE973F6CE437683347790C80EC0AD018FBD032E05729308EC2146D47C917
SHA-512:	8D5D85B5F7B8BC38E1648457EC503659CFE0D8D142BDE8561A9CB8E557AB357BA69854675C0BCF05BD00A45C69631441E58ECB14DF7FCCD042DF0ABAC3571F77
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\1035.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;1035, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.365634012322989
Encrypted:	false
SSDEEP:	768:8byIbfCErhcIBW68gxBxP2Btkfh1KccwRrUhTCVvC+G/juDC:mlbvFcIcgxjP2BtEzbUhTCVvCyDC
MD5:	1B4DB7D20C915F49560AAF83590F9669
SHA1:	D5F7941473F440F0059AFEA515ADFA7BA5D3BF69
SHA-256:	95E42834BA84B3905BFED6A74B622EEC4353DC68BB0ED162DB968F0397F69FEC
SHA-512:	AE20BD05DD681FE7D2AABD2F9CF1316D15F09EC8C447C910B18393A0E13287A4DC06B3AA891CCFC90B5347280D528218601764D24873A6B6A4EB4933AE836ACA
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\1036.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;1036, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	5.25412993379412
Encrypted:	false
SSDEEP:	1536:mjuiwbIFcIcgxjP2BtE9Ec16WxEBJMzJOv0ck:maijcIcgFO/MVxEfOTck
MD5:	873DA674552384AB9AFD041C62ABDAD8
SHA1:	5FC8258D86ADA30773108EF638E3799EB3904FD6
SHA-256:	F7E7DA6F8BB0185BC15140A0398AD54DBF45BAB885ECB861F23800410D2B17E6
SHA-512:	88B74BD88691CC3B7F0E5BE5BE14FD4D49095277CC21C79BAA3A2C5878F6625FDB70E61D13B3EA3B27DB51819A8516562EF904358CEB3A88D2E90093D6C9F16F
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\1038.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1250, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;1038, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.458345167396678
Encrypted:	false
SSDEEP:	1536:s4lhqs0aq6UufbSGIqFcIcgxjP2BtEmx6zZ62bsAZ2cuuKSqDc:Blhqs0aq6Usb0EcIcgFO/bx6Ldqw
MD5:	5882A2A6763BB2CF7E05E2A59B79AEAE
SHA1:	77FBC5CBE465BD249B8C9A9FB702E7BBDA70C7ED
SHA-256:	BE0FF0516FF8720171C15CB9C9AE44A4C8068228ABC7421FC9EE789FF2028A17
SHA-512:	5B55A93A67D8F8600BE6F9B560BAAF7DF3D0E891BA7B6A4A10963E5BC4F6A90AA92B7146BBD6FFD72EE4991E5FAD840C54023D9CF24FC1419EE6EF580EB8CA28
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\1040.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;1040, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	5.225319271617352
Encrypted:	false
SSDEEP:	768:cVB0Kzj2OcsOp2XQfkmrhcIBW68gxBxP2Btkfh1QDBxwBDkG51KKFAwC2:cLvqO3SFcIcgxjP2BtEJFy2
MD5:	9F15A0BE68324D18712518D9A8E45291
SHA1:	31C798AD4A6EEE5B935ACDBCE0F4F32AFC941DB3
SHA-256:	A872BAF4F85EE31A6BDA7184F34192ADC86D07C8160991CA5C89ECB97F065F7A
SHA-512:	63A1F403DEFB7EC4D352BBA8E2EF7C2535011DB5D0727A622B73EF39B5B234204846D1E4E69C8EBA141DC6A4D199347D01E7B2A2A2FE2DA12CD21684D18742DE
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\1041.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 932, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;1041, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.9234202187905085
Encrypted:	false
SSDEEP:	768:FFBIvvsKs5ofrhcIBW68gxBxP2Btkfh1AsCpiwgnXEmEJXVssIxJX:7BEsKrFcIcgxjP2BtE7qbgXEvXVQX
MD5:	B473EE03C45FA642C2E00389B5B05D33
SHA1:	7DDEA82A03E05B026317DA3820A8D1117A345623
SHA-256:	23251A153266E29774207E21B82BCB309CAFD55D04351B4C57FCFA1486DCFEBB
SHA-512:	E19706BAB08B76F27AC1222DC4DC7352DF34E1E68F4C37E900797E1B503DE301374938DC0A2FC21E7A31740C3297BB6BB63844BE7732423E84CA05E848D8B5D1
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\1042.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 949, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield?DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;1042, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.938278095564085
Encrypted:	false
SSDEEP:	1536:2p9RlkFcIcgxjP2BtEQgOYhwAbPndz20bJH:2p9ScIcgFO/90F
MD5:	2BF79C24EDA441B815F0F8789E73A0DA
SHA1:	75F0FA6B94A622B18A543E7B72A286B38614F7D4
SHA-256:	FBDF0C1E2DD2A02E2217F4FD9B0082F57650B0A16C10D06EC2DD6C2D369B426D
SHA-512:	4A05113EC4FDE7C83793F25A3919DBF64BB33288F0C2102C7C8ABD8FB5962D6AAA08F0BD653A7E3A165E1E79238D50E08CDBD712FB012369664912BF95BAA9F6
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\1043.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;1043, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.313091722498775
Encrypted:	false
SSDEEP:	1536:BTfLFcIcgxjP2BtE2mK/6OfSWey66o0Mf5:BTJcIcgFO/XT/xf9ey66Y5
MD5:	B6DBA67103A99AE1E77956898397E54F
SHA1:	E467B9605620EF9E12F6D061ECA8A939BE9AF2A3
SHA-256:	797318CFD9A68611910AFBAFD0B7A658EC72DC2E28D5A2CDDB812A4AF3BCE954
SHA-512:	A17014D6FF3385353F0F5C3143ABEB5D94058A4752319179097E68BCED02DF4CC7CE000109FD40420BCF41C5AFB3D6925D02E2C051981472FA99FA31EA83A701
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\1044.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;1044, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.33121503656642
Encrypted:	false
SSDEEP:	3072:El6cIcgFO/BU7wSIHcMpoC+1GxKS+b2e:ElF1gFO/i7nIHc0DIGxKS+bl
MD5:	E8450C9BAF683304CF90851C1E046C79
SHA1:	8916E367EA988749E5060D68754C109296982140
SHA-256:	1ADDF6F70E96CD557D102A0C16B7A8D4DAA1D04E325096CEDE94FA4FDD292F76
SHA-512:	5566BF737B09DF49E1F053CE2187B1BC578F604B51381B0EC73CEC7FB64AEB7BE43C280D39374B6CAAE5289CBE75D6EA0952F6E99211432A049A0D5E39C17556
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\1045.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1250, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;1045, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.382009238925545
Encrypted:	false
SSDEEP:	768:4p6Ya7sAHINZqbrsJrhcIBW68gxBxP2Btkfh1NWP+rtDB0770F+s7bA9qZCCD7rh:LYm6FcIcgxjP2BtELmGglK
MD5:	C89CE414F601EF909A6877B06A0E173A
SHA1:	AC94640FE8CD0A0BD5A529B6A4982864DBF4EBC7
SHA-256:	6895F67A5948DBAB0185D4D3ABEFBF3CBC05BEDBAB2102A0ABB3E194B5953657
SHA-512:	F63160B583996452D846EA76BF739C607448FAF0A45C5709D21A8C66D8EDAE31E82DFEE6875F9243C9971F5C945C1C8349CB88DC34FF317BE6FF8BB88A682753
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\1046.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;1046, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.290227077851124
Encrypted:	false
SSDEEP:	768:H7TnGdjTRU+R9gJrhcIBW68gxBxP2Btkfh1P9a7f5GT0DTfISDnjtBAka7zZJZUf:HPnGdPWFcIcgxjP2BtEfzZJZU1
MD5:	4429039C2EA261F72E63D17C12A01FBF
SHA1:	DD39BFAF0457AEB549108F20F5B70FC07D8F4680
SHA-256:	CEE444FC2CEEA7C15CCAC34273AC29408D364B0BA7F3606DB2D9F840682DE920
SHA-512:	E36B587413484E515B10990006441E5F5C3BF0167B55272B69CE58D2AF642A7D0469665CB1DB54D7068BF485B9D25F6F539DFD936AC97B6712A25343A7268DE2
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\1049.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1251, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;1049, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.79217548185309
Encrypted:	false
SSDEEP:	768:Q0SVWqT56LrhcIBW68gxBxP2Btkfh1vxnfICHjNIbjrEZBI:7+hT4LFcIcgxjP2BtEJnfibjr+
MD5:	2897059AA59B632B8E295535B60B99FD
SHA1:	0940C54590085F52CC5292BA51C17ED46AFB9433
SHA-256:	23835835E77594F7DEE384DDE0D87F7390E5D1493BB0CCC5751672F0873553B0
SHA-512:	E202C1F794AC38FEC64A277C2F34CA020A4ED005C6F945847795D08E4227217C3E776BEDFBA0C9E685174720742F4D5FB95922EEC06259517828899DB914D50A
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\1053.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;1053, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.3422201899852375
Encrypted:	false
SSDEEP:	1536:0hLeyXFcIcgxjP2BtE9ipcyf9tCJXmcBBEeK/:09eqcIcgFO/uicJWuQ
MD5:	11EE1EEA11185017C034EB1AA0CF82C5
SHA1:	1C7BEE1FA14708D52E94FD553D54B561C4311BFF
SHA-256:	9045BC59D18E98AE206B073C580AD47AC76F27E7A37D61ED3A4049484AF82DE8
SHA-512:	EDF4F4BEACAC0950084BC3AF1A49BA45050DC4C537AE48FB2CBA74248A511CD0FC0BFF600634E3D0A572FC2A3DA96CBA15EED5C51F547FD2312A1F264528F1B5
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\1054.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 874, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;1054, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.904614682732927
Encrypted:	false
SSDEEP:	768:Ce4nv94jN61rhcIBW68gxBxP2Btkfh1y7XE6n2esGmIEOmd+Gc2eO1Njs:34FBFcIcgxjP2BtEEXoe7mIEt+/O1Nj
MD5:	1EAB90B45806EFE4B68E200FF56F4F03
SHA1:	9121183C33CD4FC1F5C222812A8F34704E33B43A
SHA-256:	2F50FE92D4D60A9D8E2C6427BFE8BF172279AD6731EDCB7FF2370D44DDCFBA2D
SHA-512:	B3E8D087CF9489CD803371B0AB520E521D42E177F22889C5BB9B36622C73DC815C443348636E252B989453FDF83CCCC3AF18D6ECDF688A13FBD1D163457DE0AE
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\1055.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1254, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;1055, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.417810981003338
Encrypted:	false
SSDEEP:	1536:gTz1oIhD6RaDXsB0opFcIcgxjP2BtEodoFWXp6BQm5V+coeQXw:gV3ccIcgFO/84Xp6BQm5V+c4X
MD5:	3B28692A3C84268232F6AB1D058054AF
SHA1:	14978D346698641AA5E56B163D0C2E0C64A8E6D3
SHA-256:	0AFBAFB8B5FECDA0955EA4D9302F76FCDA63149F6B4F6FC02F395E3141923577
SHA-512:	478F92E9FAE73F8EAED4B63E0027982C127C2EBD4C723E443E33326AC1F5719C02CF8E0BE170B74F2E901DBAB27BE60AB5BD67339F0F694465E4D322C3331AE2
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\2052.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 936, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield?DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;2052, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	5.962038889310249
Encrypted:	false
SSDEEP:	1536:GZ2FHV9wFcIcgxjP2BtEkSljDEX+HD9vn3:GZvcIcgFO/6L3
MD5:	E5D38080098812D1B2F95EAD53F4CA7D
SHA1:	B9EAD438FAEB8E2D8DB69134E34B5721BF49CEEF
SHA-256:	C8E8E00CFCBF88BA1D76EC6D2E229BFF3DCA2975099D2DC191BEE0333246288C
SHA-512:	89605B0E47BC1633B91705374603A9B1A13A748D67558E4509F9F78C35BE9701A921841D738CA38A1E850913738698582D2310ACD4320D2A38CAF7EAFB47CF38
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\2070.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;2070, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.280512487009826
Encrypted:	false
SSDEEP:	768:jfp82n9y8rhcIBW68gxBxP2Btkfh1e8u8FT0gPaHxPEgzbDFiQlRfX5QA:Nv9PFcIcgxjP2BtEhFPEEgzbcQffJ
MD5:	33DC6E78517160EA93375D67F5360E03
SHA1:	224A284D112031A248BCD42A26025AE6B6C9D87B
SHA-256:	824718F64B0FE016EF66715F26DB6B5222F85BD1A64797805A7DBA0943C0E4EA
SHA-512:	25DDC40A11D27BC4A92B1B001A1443A84BFCC664433FEAED9307CE3A5E8D4A1F918B910BB5A360778A86518CC501324629C31A0D137B582D143A0855E47D579D
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\3084.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: AMD Fuel Installer (64 bit) , Create Time/Date: Fri Jan 23 10:55:52 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: AMD64;3084, Revision Number: {2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{2B929F37-1505-4C46-8C5C-38483230C155}2014.1101.2121.36608;{53834429-1C61-40DC-93F9-645D0D84E746}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	5.257601421829572
Encrypted:	false
SSDEEP:	1536:gjui6/UFcIcgxjP2BtE6Tjq6WxEBJMzKNvmck:gaincIcgFO/jAxEftYck
MD5:	A4F653705F619A765EDCEDE6765B3116
SHA1:	B5CF8B82A3CF03EF35DF66F32F171E4E19D9E24C
SHA-256:	AA75F75A102B43B38FA01CBE6BBA1CE80E5DD058C044BC87C0BECCB971830485
SHA-512:	EB4B20E7A83F5BA0CBC37F93F5EAC55908A1DA308D3121125167C710ECCD29A09149CF0D58DE24C49D5FE02F5198C06050505D737516FA3BB6BEDD793C41A9B3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel64\ccc-fuel.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, MSI Installer, Last Saved By: InstallShield , Number of Characters: 0, Security: 1, Number of Words: 0, Title: AMD Fuel, Comments: AMD Fuel Installer (64 bit) , Keywords: Installer,MSI,Database, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Number of Pages: 200, Name of Creating Application: InstallShield DevStudio 9.0, Last Saved Time/Date: Fri Jan 23 10:55:52 2015, Create Time/Date: Fri Jan 23 10:55:52 2015, Last Printed: Fri Jan 23 10:55:52 2015, Revision Number: {39298528-A486-4CEF-A4DC-5C6A8DEE9353}, Code page: 0, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055
Category:	dropped
Size (bytes):	3032576
Entropy (8bit):	6.217271397447434
Encrypted:	false
SSDEEP:	24576:BaNavafYywaCItRcjGnFsyEbCvEfRXVwmkOuwPTr/8X4DRSNx8eUxBhzD9dO:BaNav2YydCIzcjG8bBf84TrkXSSnjyO
MD5:	ED513302C6002ED8ACC65D02DFF07738
SHA1:	589E51E71B74164D7DA93E368B8FAA6A77C12495
SHA-256:	D9057FED5C87088855E2CF9E277932E7A0EB80E41F5B1945B61CDDDB1C2870A4
SHA-512:	3B0AB9A721C7EDBE5CBF2CFFD34D30A11FACC29F13FECC63966B9F447A85981F37BF89DDF7BCF497308ED56BF86D35EAF86C12181B76B16F035D0F0E6E7DC61C
Malicious:	false
Reputation:	low
Preview:	......................>.................../...............8...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................^................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...E...f...:...;...<...=...>...?...@...A...B...C...D...\...`...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[.......]..._...e...b...a...c...g...d.......h...3...i...k...j...n...o...m.......p...q...........s...t...u...v...w...x...y...l...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\1028.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 950, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield?DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1028, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	5.795768454683279
Encrypted:	false
SSDEEP:	768:KvnT8E/qDrhcIBW68gxBxP2Btkfh1oRWASZnQbfI5b7aFFG2zFz:2nTtSDFcIcgxjP2BtEFQ2au2p
MD5:	D7CD06532A48F33FAB9ACB11CA4A216F
SHA1:	D27BF79A1E4B8BE9181D4CD614997615FA4D8654
SHA-256:	5C7B630D4926B324CF991E7BA17DD947FCAA8B3E8E5FE94C8F2C64E780A37B0F
SHA-512:	5D736BD9F2FFE6A5CD3426E8124794733C18F1963B8E5D1177D0F967198940A063A6CBBB45E299D0015CF1D94814BEF08E66B42346E9823CE466F74F975BF1CE
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\1029.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1250, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1029, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.391675308812248
Encrypted:	false
SSDEEP:	1536:Zl2iGkFcIcgxjP2BtEPzb/zcl1V7GZwc1id0f:ZlFG2cIcgFO/G/fZwc1iU
MD5:	186C60B86B26F15E153259F03E6B2006
SHA1:	CDE94353681336B537B6D3DD7F59B1C9CA6B098C
SHA-256:	88065A5D7B30E94AE2A146A7FD0EA078F48E5E35313C878C505B85130AB0E087
SHA-512:	E91716E6E4D98927B103A979513E4EB5C7EFB56F07554E1392F61B3D9DC54867E7680A5C8C646C21335C97C764EA8A59B4B11E1F93974B26134E1E964AE5AA91
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\1030.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1030, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.326152579883919
Encrypted:	false
SSDEEP:	768:vlV5hmIT7k6rhcIBW68gxBxP2Btkfh1mZwxov/gqTQ90AZ+DEUaTHEdl7DPzLUu3:dV5hBFcIcgxjP2BtECgqTKZ+DEUaTB+
MD5:	21A553488D6926BCE82CDBEB081E31A4
SHA1:	23F37B39EDA21DC1C1CE70DAA2852B84F5DE8C9F
SHA-256:	8BE41337381FFFC04C43D458EB82D47F8C1269BA14381E01E41F37C7D3C75FCE
SHA-512:	4E65FFE2300581BA0EEB337B35F0C091B96FA89636A67F122EACB1ECBA1F63CF3F5CF133279627A43F46E644D0A01002023716C46CAB33314F665431997BAC22
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\1031.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1031, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	5.283550065804942
Encrypted:	false
SSDEEP:	768:QJZLSfy9yfdXMpGbtWTrhcIBW68gxBxP2Btkfh1lFhNh0/0R0g0Q0+0m0f20L0N+:7ecbcTFcIcgxjP2BtEHhdPFMfTD
MD5:	2DA350C5FB861911101C3B44B714B181
SHA1:	16519A1A06A767BE14D1134CF5B4F8FD71D36AF6
SHA-256:	8F133D9019F757796F4B54910C33C05E974CB5AB0F7F9FBA0366AAC8748B5216
SHA-512:	059C5206AE6648E4C5383A0C2EC021E4DD5811B2DB667A54F92A1E26A526C3C026EA20191F39491103BAF0E140FA012B5DA40EB0B2B2D09BE645EB544CD190AD
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\1032.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1253, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1032, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	5.776500236336977
Encrypted:	false
SSDEEP:	1536:3HLSdFcIcgxjP2BtExgCOL7ZJ6RDSTky2JQr6z6OX870j8pl4TzPU7U4:3HqcIcgFO/OYkjwH
MD5:	767415B74C378459E407622922501C32
SHA1:	EB1A11D8C8B76CAD681190492CE4252C358ED380
SHA-256:	FE0E3C200FCF0E44BC3E252BEBA8E71EC6FB0CF6C37D066D4AE2C4092F78EDA0
SHA-512:	EE7CCB32CEFBFE9FD7D241BB107DA985A8328E1AFD52E13343576FB9428712D2ECA2F90A763598454B5B134C559FBBE7ECC92BB65E38CECB70E513BDE69BF1A0
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\1033.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1033, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	4.7653216897063
Encrypted:	false
SSDEEP:	384:/Cr9bIphom7tgoO9bMw3BW6uRqbGJYgiBlPP+hTdKEf4NJRwS4+RdIY3vh8v6olL:/CrhcIBW68gxBxP2Btkfh1y
MD5:	D7CF3F823EB6DB5F2D7450809B5A6F28
SHA1:	6A7DA5BDDC0CCA7444601424EC18564276133745
SHA-256:	59635947C63B749747B32AB4C3B8D0DC6EC3F8D64C6B3126C8C8B48F6432F7BC
SHA-512:	148474C7A70B09FDCBBA26BFB07D144C0CC9F259A8FA28105A61C7C0903D06BDC0093CE50FFC9176F10C1C31E9443556D8ABBB1C272DFBCE378CAC6366F17292
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\1034.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1034, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.274412525301886
Encrypted:	false
SSDEEP:	768:HXDovnNTmrhcIBW68gxBxP2Btkfh12uxMl49SGpB:3EvNCFcIcgxjP2BtEyG
MD5:	906B393C32E8BDE3B06BECD7B6A2D32F
SHA1:	127089F53BF2D5776AFA291242E5A8C0FB1F89FD
SHA-256:	6F530A009BD08E6432097C44F24303935A892865E54C6E659A15571A26241D02
SHA-512:	040C9F616F528B8F3EB89ABCE7B199279E373F9C71E697AEF29F68B4ED4DED84B51C40DF8C5874AEB2C6B2BC55E79F8BBAEC4B2B612A0A8E5C2883D382E46E7D
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\1035.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1035, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.365950991359746
Encrypted:	false
SSDEEP:	768:q5yIhfCErhcIBW68gxBxP2Btkfh1cccwRrUhTCVvCmGxjuDC:ilhvFcIcgxjP2BtE5bUhTCVvCkDC
MD5:	A23E0F4BB1D14DABF4E7DAB28A2C784A
SHA1:	9093CAF5A8AE37E1CF05D0F9FCAE777E8D6C9323
SHA-256:	631758EB78751C8DB0453DF259001D26F0BD1908CC0C7B7423194CD023841842
SHA-512:	EC14578D71B6CE50DD60D5E5B575667AB91CE0C0B1188E9097617820B935402FB8B072C094144F8FAB3088518739E1BCD0AF2D12AD5CB8B5EC9E1723A3199913
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\1036.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1036, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	5.254440324764148
Encrypted:	false
SSDEEP:	1536:Jjui+bIFcIcgxjP2BtErEc16WxEBJMzJUv0ck:JaixcIcgFO/SVxEfO5ck
MD5:	6CB318FD8FAE4AC25F90D6844B4AA419
SHA1:	0CE3689EFA914B2C333A26F1F96A7E5A744BC84E
SHA-256:	59668F10721AF84DBBD26FBFF9B848F9976D804C9A07F8F190E36B23AF79683A
SHA-512:	809D071585039E603CA96E70A583ABC177D666390A427D0677F92B2DBA558E2FD107CAC81C0C195D1000EEE4A53809BAFE447752758F687486D90883435FCA94
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\1038.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1250, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1038, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.458650451522539
Encrypted:	false
SSDEEP:	1536:Dulhqs0aq6UIfbSGIqFcIcgxjP2BtELx6zZ62bsAZ2cuuKSqDC:alhqs0aq6Umb0EcIcgFO/2x6LdqW
MD5:	2CE6B97DA16265D157A362A659C3A9D2
SHA1:	A8853D2DA0CA5BDC44352F478ECEA38DC547ACB0
SHA-256:	B53943F3895995AE8149B3B9E5F8B6DF22D20B6DB4BB959DC255DF03100F3989
SHA-512:	26F8340CEF6A6B9F11EFA2870568815968E336AE3B58B53F83F634189243EFA6FEF16A1B9165DDA6D5E3085E75DE40CF8AC069C993E68C9CC83ACD726AF2F09A
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\1040.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1040, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	5.225707741974727
Encrypted:	false
SSDEEP:	768:YVb0Kzj2OcaOp2XQfkmrhcIBW68gxBxP2Btkfh1ODBxwBDkG51KKFowk2:YRvqOdSFcIcgxjP2BtE/Fs2
MD5:	60CD9FD503FA93CF87530878DB38EC61
SHA1:	39F919240BA9A68B5D0A40B6B1A673EAEE5AD509
SHA-256:	0A8A12CB0B8B052DA61204A5FFD2A06CDDEFB0D4244B559DE700D1F33BFCB2DE
SHA-512:	1433094A6499D66ED8F5C572748181AAF66D3EDF666083E5210209DB6459CAEB81F4313D3F5711A2D89D81771A6FBD5393CFD917800E87901333D7E048648EEF
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\1041.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 932, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1041, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.923807965813136
Encrypted:	false
SSDEEP:	768:VDBIvvsUs5ofrhcIBW68gxBxP2Btkfh1SsCpiwgnXEmEJXVss4fJX:tBEsUrFcIcgxjP2BtElqbgXEvXVKX
MD5:	E8B6ECCA057B31D7F5F46B5B2901D983
SHA1:	E5F5E1A740CFC20D7F701C7C73C08C437A6D365D
SHA-256:	959556384B2BA2B9DB83B0A45468474ECB4C3E7EEBD8025BFC5A70FFF8498AA1
SHA-512:	B92FA94209ADC749E8590B7EFB63494EBC5330F04627C31A29F370DA30205FFA653F6C931D262C0AB0E327DF7FB38101E44F0DB04E6A910C03BCDB53BFAA469C
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\1042.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 949, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield?DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1042, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.938358153887431
Encrypted:	false
SSDEEP:	1536:op9blkFcIcgxjP2BtECgOYhwAbPndz20uJH:op9AcIcgFO/l0U
MD5:	C314DE64A43E191A4F395BF37E65AC93
SHA1:	AC01B263C8CFF9665DDD4BA9B66DB653286BDD44
SHA-256:	BF8809EC46DCA1C4A145D54588CC31973E21390F0D54F1293CA7ED86B9FC4111
SHA-512:	A5D5761E7DEE6B3250E29EED620D80CCE98DDE41547EABD2274F533FDE88B813273882FFCAE5ECA28BFED20683B8F706EC61D2F1432B4DF0EAE28776096F040A
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\1043.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1043, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.313199164529037
Encrypted:	false
SSDEEP:	1536:KTFLFcIcgxjP2BtE8mK/6OfSWey66I6Mf5:KTHcIcgFO/FT/xf9ey66i5
MD5:	649AC0F70F8670CF74D0DF6CD6FF8A80
SHA1:	67F32710389BE1C866C4748BBF3259AC6F39AD4A
SHA-256:	BFACF70D761C410122E8886D8030FAC0D712F5311A83790FDFF7C60FCC58D385
SHA-512:	DDCD2628C7C9698AD20D288BAF0DA45074DCFC2CA227BED008CC8C9396B784B44D400DCA8ED5791D90C6906BE74C301474C2D6A883234771094B6E0EEBBE172E
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\1044.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1044, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.33162843370805
Encrypted:	false
SSDEEP:	3072:KlccIcgFO//U7wSIHcMpoC+1GxKS+bge:Kl/1gFO/c7nIHc0DIGxKS+b7
MD5:	421AB43E0503ED712360C2DE1CB31AA2
SHA1:	D28659AB6F9574DD778003D7A85AA42608D1003F
SHA-256:	EB95A35BDEBF7BC5F719C47EE4A40FC06170709C7BFFFA92D801CA21231D2190
SHA-512:	55D5E056FD40A94F717D7E56E6C10ED8101C34EFF6A46AD6830A97DF5FC7EEC9276FC9C03AF4468ABE98C10250867B7B4EEB4B422AD286C82B236E416617428B
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\1045.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1250, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1045, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.382371915036318
Encrypted:	false
SSDEEP:	768:G36YaBsAHINZqbrsJrhcIBW68gxBxP2Btkfh1qWP+rtDB0770F+s7bA9qZCCD7rz:7YA6FcIcgxjP2BtEWmm2lK
MD5:	3A85F1A6E5CA7B9F4B5AB0F123F60F0F
SHA1:	31F0438818847E876ACE8D9D78E939C8ED7A705B
SHA-256:	EC59788BDDB523966EC49DF8661150D91285006A770227797DC25EAF240D8048
SHA-512:	723FE35CFAC480F257ABD32CBBB00D7E03C6F69A9DF613B82465553B6C8E34A5526DD25734DA24C55D74D95FA83C331B14B1B3565EC8AE4709A60D84A063A92B
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\1046.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1046, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.2904840987102775
Encrypted:	false
SSDEEP:	768:+7NnGHjTRU+R9gJrhcIBW68gxBxP2Btkfh199a7f5GT0DTfISDnjtBAka7zZJZ2f:+pnGHPWFcIcgxjP2BtEtzZJZ21
MD5:	7F5DC7F0923A1C17A9A16E6EA458C078
SHA1:	33821CFDDBEA0E11D638D2DDE0C504DF8629F6EC
SHA-256:	994CD3949643A8FAFF73FD0D935F11A20518C3C47F7907806AC8CE350430447E
SHA-512:	E9E035EE8210733AC8D72D8049F67673470A188D3E450F9F4F5D7954B857BC922319C3DA405DA9EA290CABEC44AE2C3BBF06349F727A3C19D24C14A66F1E78D8
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\1049.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1251, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1049, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.792608556645554
Encrypted:	false
SSDEEP:	768:TuSVWqZ56LrhcIBW68gxBxP2Btkfh10xnfICHjNIbjrETBI:y+hZ4LFcIcgxjP2BtESnfibjrc
MD5:	21E0E50E347EBFB75C3C9C9CE216C961
SHA1:	F55CADA4AEE31E60D93D39FF25ED7538DFF3CCBC
SHA-256:	8F4D1C337E50AF23DC2B7074DF2794902D4D3D686C633C32D5B63589E732D0BE
SHA-512:	CCB0B94014F9C438876A0ADD9544186A5F9E3882CB27B097F4BB052209FBE74A55A2FA75C6EE99DE939905256F9D7E949CD47E56AFB5B26034BF7477617B6925
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\1053.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1053, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.342585974926374
Encrypted:	false
SSDEEP:	1536:fhLe8XFcIcgxjP2BtEXipcyf9tCJXmGBBEeK/:f9eMcIcgFO/oicJWEQ
MD5:	4244320999A8FDDE6AEDE268A1066C04
SHA1:	A97B40F552DBEB120CA262A61D86CDA5D9678D19
SHA-256:	22610A13944409795B904F9FFE2B6D396C66658B35FC657D82286D2D9322CF24
SHA-512:	A079A3A7F57E7F61E40BCF3CB2A7741292ED389C1D51267ED0A0AEBDB3603C14576D816BC989C7350E1AAE7217837A77F3E763E7280A8633C4E339E46F9D3DD1
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\1054.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 874, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1054, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.905085011814635
Encrypted:	false
SSDEEP:	768:LM4nvn4jN61rhcIBW68gxBxP2Btkfh1t7XE6n2esGmIEOmd+G0oeO1Njs:A4PBFcIcgxjP2BtE5Xoe7mIEt+dO1Nj
MD5:	6A657E131EE5B2CC0A84F97E657B1131
SHA1:	571D137ADA3C858334FC6304212D1F803E766531
SHA-256:	1719130D8B876EC399652EC3C30FF057EE3838E59F00E41D9D61E48F14732466
SHA-512:	897252E967F4B31E25C962AA868BB6F064A0549A298C88E67DAE68F714A5D11472844DA3AF49F8C9DE43649BD6757715A48857C1F8B541A43B31B08BB92B4F06
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\1055.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1254, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;1055, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.418108419919017
Encrypted:	false
SSDEEP:	1536:HTz1o2hD6RaDXsB0opFcIcgxjP2BtEhdoFWXp6BQm5V+coe6Xw:HV1ccIcgFO/l4Xp6BQm5V+ciX
MD5:	50ACFB1C2088BDEB89DE8D13F7C26960
SHA1:	20BFEFB3F786C0AD5E858F53574E3FA514E78247
SHA-256:	624A508153DFB31570B81AF9D820584336B0C5E4AA55318802F3EE7018B41960
SHA-512:	904005C0FE378C19F3EFC5A3B806ACB9C8F476F7F0DA4BD367C6A9815E0BCB7C2EC686C263C68CE248A2A7F03E896E2C524147191E6B13C760CEF235B5E34913
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\2052.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 936, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield?DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;2052, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	5.962650004722955
Encrypted:	false
SSDEEP:	1536:dZ2PHV9wFcIcgxjP2BtEkSljDEX+HD9tn3:dZNcIcgFO/653
MD5:	4D7D619EED3AA98CB8D8F1B04C3D6125
SHA1:	D31D478196C47F0CA167F35FA1A4DBDBC92F13ED
SHA-256:	9D281A84604BB16A1F620E52EE6A5F06A310C88C064E5941485B9095B978B067
SHA-512:	4E4F154B0972DDD08B7E386506329B535A87964976594BA04CB9AF98C4F644F02E845ABD102D42B84928F6744F5ACEB0A8346B1F588D3EF286494BDF9F841AA9
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\2070.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;2070, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.280939915514209
Encrypted:	false
SSDEEP:	768:stp82nny8rhcIBW68gxBxP2Btkfh1g8u8FT0gPaHxPEgzbtFiQlRfX5QA:QvnPFcIcgxjP2BtEzFPEEgzbmQffJ
MD5:	EB1097055C8105C0582142090F884F49
SHA1:	1F75A8B5DD51D7D3CD8CD94D11AF6CD7E1A60D0C
SHA-256:	3BC605A298886491570738CA8F4E0631FED77E520A3D5F6C918D6FF8A09BBD34
SHA-512:	CD695ED12AD294A1E7981465ECF37615C64D7908E8DA5D75C193F89B2E89EF5A25438944EAE91F056B7044E6E1E9F326D15D4A9D2CC7645B60306DD65237AE79
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\3084.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Fuel, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Create Time/Date: Fri Jan 23 10:55:14 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055, Last Saved By: Intel;3084, Revision Number: {ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{ABF1AFC9-5777-49F7-BCA1-F98594FC58FD}2014.1101.2121.36608;{8895A9EF-3A99-4E3B-8AA0-E58AB9217F72}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	5.2579420924938685
Encrypted:	false
SSDEEP:	1536:+jui6lUFcIcgxjP2BtEUTjq6WxEBJMzK3vmck:+ai1cIcgFO/VAxEfteck
MD5:	8FF8BC42DE4AC8D5E31B4E3C1C2F9263
SHA1:	24750B3CD7A7ABA2555772A1D01B235588F3180A
SHA-256:	7E2E34B5C4A2519C2146B073113981D684B2BF5D2BCF4D82A84F0EED7AEB57EE
SHA-512:	564A1EF852E626E103E5E6C46A3E149F214FB26EF3D28FD0DCB4DE017F08582844E7CF2031ECAE9A66A2E2AB9C020E4E8F195373929DDB4F71E3858EBBE663BE
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Fuel\ccc-fuel.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, MSI Installer, Last Saved By: InstallShield , Number of Characters: 0, Security: 1, Number of Words: 0, Title: AMD Fuel, Comments: Contact: Your local administrator, Keywords: Installer,MSI,Database, Subject: AMD Fuel, Author: Advanced Micro Devices, Inc., Number of Pages: 200, Name of Creating Application: InstallShield DevStudio 9.0, Last Saved Time/Date: Fri Jan 23 10:55:13 2015, Create Time/Date: Fri Jan 23 10:55:13 2015, Last Printed: Fri Jan 23 10:55:13 2015, Revision Number: {30C3266B-58D2-431F-B48B-4D7082A78E6A}, Code page: 0, Template: Intel;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1032,1038,1040,1041,1042,1044,1045,1046,2070,1049,1034,1053,1054,1055
Category:	dropped
Size (bytes):	2849280
Entropy (8bit):	6.151827483870407
Encrypted:	false
SSDEEP:	49152:KYCRXXYyDK84E6YPIA4n126VBR1fdNcXucEq7GPvOh:YXYy1TPIV126VBRfNc+cHGPg
MD5:	07C5861653A5A6E1401740525731B7B1
SHA1:	427EE1C7D51ACDA12425A5DDC6470839889E784F
SHA-256:	608AD59E396C17BAD5C56B78DE9ED8E0A81E084B29656B8D0EEFC150B7B54773
SHA-512:	469C5F9B5788E1EE4CABB1A166F20DA9A5DC62BD504A99347F6344D127ADB688F031881B7A815996F5ACB35192094660FA58DDB51E9ECC2D48C6B66FFB082114
Malicious:	false
Reputation:	low
Preview:	......................>...................,...............8...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................^................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...E...f...:...;...<...=...>...?...@...A...B...C...D...\...`...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[.......]..._...e...b...a...c...g...d.......h...3...i...k...j...o...n...m.......q...p...........s...t...u...v...w...x...y...l...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Graphics-Previews-Common\ccc-graphics-previews-common.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, MSI Installer, Last Saved By: InstallShield , Number of Characters: 0, Security: 1, Number of Words: 0, Title: Installation Database, Comments: Contact: Your local administrator, Keywords: Installer,MSI,Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Number of Pages: 200, Name of Creating Application: InstallShield DevStudio 9.0, Last Saved Time/Date: Fri Jan 23 10:56:38 2015, Create Time/Date: Fri Jan 23 10:56:38 2015, Last Printed: Fri Jan 23 10:56:38 2015, Revision Number: {C0C51D86-A31A-473E-BD28-2DECEDA7EA81}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	2263040
Entropy (8bit):	7.856410759462657
Encrypted:	false
SSDEEP:	49152:9my/gYy/G+EbNMhEr3GlRthstcyhoo7PvYL62PzRaIcBqpHveCx:WYyOtIEr3qtO+I7gL1bMIIq/x
MD5:	974D17FECD09B4193D64634EC9559874
SHA1:	D24A38C31BF376D4FB2BB579DAE54B4DF69251F5
SHA-256:	1A4AAB7C22BC6E85BE0BE65EA0D923C991D0FE03249B300B44A15FF4A6D5055F
SHA-512:	41D8D0981464CEAE2E56E5F97B4FADEEAD63C417F15B1A209BD7A822D1BC36F10F1CD9D8B43277272F88F8544707817FD0BF75A04274B4B9AEE85461B2DB5A35
Malicious:	false
Reputation:	low
Preview:	......................>...................#...............8...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................^................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...E...e...:...;...<...=...>...?...@...A...B...C...D...\...`...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[.......]..._...d...c...a...b...\|...f...g...)...h...p...i...j...k...l...m...n...o...q...!..."...s...t...u...v...w.......y...z...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Help\en-us\ccc-help-en-US.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, MSI Installer, Last Saved By: InstallShield , Number of Characters: 0, Security: 1, Number of Words: 0, Title: Installation Database, Comments: Contact: Your local administrator, Keywords: Installer,MSI,Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Number of Pages: 200, Name of Creating Application: InstallShield DevStudio 9.0, Last Saved Time/Date: Fri Jan 23 10:54:22 2015, Create Time/Date: Fri Jan 23 10:54:22 2015, Last Printed: Fri Jan 23 10:54:22 2015, Revision Number: {FFE07C8B-CAAA-452C-A55A-8D6476DBBD79}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	683520
Entropy (8bit):	7.231760984602428
Encrypted:	false
SSDEEP:	12288:uqB9k1w01YymdDW3dSg4R1MuTLX8y6Hg+9HD3j7BfFFORq5EFYcx:uqBa1h1YycDWNSVR60wLH3nhFFb+1x
MD5:	51321EFBF0FE8786020589DAD5331652
SHA1:	E0C6A826521C2986760CFBA66BC8781EED0E64E9
SHA-256:	8F0885C412874D49436FC95090ED314A086F5AF5972D94A869D3BF668E61BE65
SHA-512:	530580854B31AF5D0619F987B4EE3FEA7D32795A6689B06BC6865470D0087650D107778A483DE736F19ACD0729CE09C99F129204E52D33682B954F0E9C2489D4
Malicious:	false
Reputation:	low
Preview:	......................>...................................8...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................^................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...E...e...:...;...<...=...>...?...@...A...B...C...D...\...`...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[.......]..._...d...c...a...b...\|...f...g...(...h...p...i...j...k...l...m...n...o...!... ...r...s...t...u...v.......x...y...z...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\MOM-InstallProxy-Net4\ccc-mom-installproxy.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, MSI Installer, Last Saved By: InstallShield , Number of Characters: 0, Security: 1, Number of Words: 0, Title: CCC-MOM-InstallProxy, Comments: Contact: Your local administrator, Keywords: Installer,MSI,Database, Subject: Catalyst Control Center, Author: Advanced Micro Devices, Inc., Number of Pages: 200, Name of Creating Application: InstallShield DevStudio 9.0, Last Saved Time/Date: Fri Jan 23 10:54:34 2015, Create Time/Date: Fri Jan 23 10:54:34 2015, Last Printed: Fri Jan 23 10:54:34 2015, Revision Number: {D16C46B6-B292-45C9-BFD0-2CFB384033B7}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	775168
Entropy (8bit):	5.919760073655795
Encrypted:	false
SSDEEP:	12288:fBBo1Q08YypAWeYtQL2mXDTefD6jqyP6z:fBBmB8YyK2UDTefc6z
MD5:	3104D18FE7B77F88C3C8FD2E5707E54B
SHA1:	B1A2D4EF89DB8D2F97C00686F2E57D64A4F0C0C5
SHA-256:	606DEFD68E16E48A256EB1C3109D582E2513482CC925A1BE0F8258CF886CC3B6
SHA-512:	68E9F8A4A5AD1E3FD5CD46921E4554ABD2810779061B2C14512058F33B261CAC0A6BA788462A01A65A11CC5CF1E168AB91155F53CEDA7CA506F34CC87DC63CB4
Malicious:	false
Reputation:	low
Preview:	......................>...................................8...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................^................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...E...e...:...;...<...=...>...?...@...A...B...C...D...\...`...O...H...I...J...K...L...M...N...F...P...Q...R...S...T...U...V...W...X...Y...Z...[.......]..._...d...c...a...b.......f...g...(...h...p...i...j...k...l...m...n...o...!... ...r...s...t...u...v.......x...y...z...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Utility-Net4\ccc-utility.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, MSI Installer, Last Saved By: InstallShield , Number of Characters: 0, Security: 1, Number of Words: 0, Title: Installation Database, Comments: Contact: Your local administrator, Keywords: Installer,MSI,Database, Subject: Catalyst Control Center Utility Package, Author: Advanced Micro Devices, Inc., Number of Pages: 200, Name of Creating Application: InstallShield DevStudio 9.0, Last Saved Time/Date: Fri Jan 23 10:54:46 2015, Create Time/Date: Fri Jan 23 10:54:46 2015, Last Printed: Fri Jan 23 10:54:46 2015, Revision Number: {F200E332-B426-4910-9DF7-86364E97615E}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	306688
Entropy (8bit):	5.457143312013699
Encrypted:	false
SSDEEP:	3072:RZjWEjQxZ37IUm0wsgYyfRMvts5aNLRkPrHHvZ+cIcgVO/:7WEjQ73c90yYyfRMvtGv71gVO/
MD5:	3145A7BBEFA77432D6B28EEEFFDF7338
SHA1:	A72017E3FF2F106DAC4426DD341FD763356AAA63
SHA-256:	6135805E46B017ED2B59781C6934B1703CCB3E1E2A99F30CDC9C56D6FA512576
SHA-512:	0D5314969DAD609E8ACA06850783A1E2FBE93D35845CBB25F18856E6E12404738C50C6FE3646564C42395225B860D856734952812C3F99A85E268D44A2FCF79B
Malicious:	false
Reputation:	low
Preview:	......................>...................................8...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................^................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...E...e...:...;...<...=...>...?...@...A...B...C...D...\...`...O...H...I...J...K...L...M...N...F...P...Q...R...S...T...U...V...W...X...Y...Z...[.......]..._...d...c...a...b...{...f...g...(...h...p...i...j...k...l...m...n...o...!... ...r...s...t...u...v.......x...y...z...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CCC2\Utility64-Net4\ccc-utility64.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, MSI Installer, Last Saved By: InstallShield , Number of Characters: 0, Security: 1, Number of Words: 0, Title: Installation Database, Comments: Contact: Your local administrator, Keywords: Installer,MSI,Database, Subject: Catalyst Control Center Utility 64, Author: Advanced Micro Devices, Inc., Number of Pages: 200, Name of Creating Application: InstallShield DevStudio 9.0, Last Saved Time/Date: Fri Jan 23 10:54:57 2015, Create Time/Date: Fri Jan 23 10:54:57 2015, Last Printed: Fri Jan 23 10:54:57 2015, Revision Number: {69D52F6A-D8E6-488A-8540-51CD9411CF70}, Code page: 1252, Template: AMD64;1033
Category:	dropped
Size (bytes):	386560
Entropy (8bit):	5.474383459731726
Encrypted:	false
SSDEEP:	6144:8WET8z160NMoGvYgaFSTOUYy93zvIrKgFO/:r48z160kawYy93
MD5:	2DA0F9FFD853F9ABFC5675E2FE18DB90
SHA1:	4DFD884F7197B9DCB7743C48ED6AE2AF89983714
SHA-256:	903B10566CCE500295D8A4235CACE4F9A1FEE1C100411C710F0A9F945081961D
SHA-512:	74ACF61872AC9DD6002A29E5C47A768E043B4D7512F5A56592D5C40DE8771D59F70B1D0C5E6AB4FCEF88BC685CCE47FDB8B0D8F94D98D04F385E617DB65DEF54
Malicious:	false
Reputation:	low
Preview:	......................>...................................8...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................^................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...E...e...:...;...<...=...>...?...@...A...B...C...D...\...`...O...H...I...J...K...L...M...N...F...P...Q...R...S...T...U...V...W...X...Y...Z...[...V...]..._...d...c...a...b.......f...g...(...h...p...i...j...k...l...m...n...o...!... ...r...s...t...u...v.......x...y...z...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\1028.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 950, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield?DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;1028, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	5.3996315251049865
Encrypted:	false
SSDEEP:	768:aUnGLE/5VRWASZnQBfI5bjFh5VABvmMe3P:5nGIBcQOtVcvmMe
MD5:	52E28E6CAB57F37E7298D9DE227353B7
SHA1:	87EF15A12F89708318C565A35459EB6013A1A4C8
SHA-256:	296A90302B9DF2B4B6A0485FDF9D76314A7DB522420564AD9E9C25694FC66A22
SHA-512:	0E98AE8FE6808E52476C344B82F69DEFA86ABBCD9FE396C1F36319F738238E91BDEAC47905F71814E08617175E39F191A52E98FE15701DF28A1B5E5C74ECD930
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\1029.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1250, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;1029, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.941033555323335
Encrypted:	false
SSDEEP:	768:Pg/XVBPkaTF1lhFsu6xLzCVclLmE9VR+am4woNisGw5m1iDjjFPC+L:+lSG2uQzCVcl1V7oZwc1iDPFa
MD5:	190F5AA874E817746D630A63AB0258E7
SHA1:	B9AAD20807EF0B57CAA093CDCE304E0B9FCAA744
SHA-256:	C4CFCB720C2AC2CA407777C312430E97B2595EAEAFEF95AFCD5B4C733B3EEF3C
SHA-512:	D433EF7E5785305541C0E0A4782E53D2E093FBEBE2B0DC63DE76FB05F33BA55A18CEFEA96D357DB400EB82010BDEB8B24B58187036E352450FE057444BE376E5
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\1030.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;1030, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.705707928127148
Encrypted:	false
SSDEEP:	768:diV5BkITXk8axL/gqTQ90AZ+DEUaTcEdl7DPzLUCbFyiTX1:cV5B2gqTKZ+DEUaTZFy
MD5:	7477FDC5A6CAC5A275F02B73D1C8C9E3
SHA1:	A99B37CFBC4261719B1146991623EBA5DDB888B2
SHA-256:	8499316AEEB1D7F0AB6B495EC4603EB7CD012C4A561FEFF94E98B955C61D4E7D
SHA-512:	BF36E0DC35761A57650C527042D6573EE24AD089F2BE7A3D6C3CB60DEC9A9E4E06DCA1991270170F40070D9CF1C6FEE5E5455F744C77F0C2D4175CA479797E58
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\1031.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;1031, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	4.854597336844931
Encrypted:	false
SSDEEP:	768:TLZLSfy9yfdXMpOEtKXhFh0/0R0g0Q0+0m0f20L0NYj6QUGM9mHmk+DjSMK81/Km:8e0EYXh1PLT0
MD5:	13287A86062E4C3230FB40859E2E7C97
SHA1:	E8121DC846D81E335282DC61556B5EA755A75E47
SHA-256:	A58F6311F9FA7B9C4650BB5B3AD59BCBA161B5C2BEB68C4DCECE7557BD5B84DE
SHA-512:	16CFE22A71D0FE2726066A0920BC6D746D68CAF2A6928403E363E7C5F9CE64E54078F77E182CADBD5615263D27423607951AA33933AC18B9E39130796E83E879
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\1032.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1253, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;1032, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	5.231329980115453
Encrypted:	false
SSDEEP:	1536:sH+j80gjOL7ZJ6RDSTky2JQr6z6OX870j8pl4TzwU7UtVjF:sHihk0wC
MD5:	9FED6CABC4F92A91D74A0648111243C2
SHA1:	D5F9D9502F6DD77059FD656DCF1D868DAC732E20
SHA-256:	8ED60F6FF463E42EBE6B81670B092C67A38B38995E54E6551F3520BA32B50C44
SHA-512:	6F07B659F3201E6065C263C61731A95CFC94E769D7F6604CF82DA4DE86AF3EB80E9C02D4501DB60A049F69C30E64661B01445EEE85CD4E104C7A497EB6E45A9C
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\1033.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;1033, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.409331471492523
Encrypted:	false
SSDEEP:	24:Jgm5q+gPtS+i4qJ4XW+6f5HhWd5r37nC3kVSTGJwkVSTGfRJ1:umx+i9J4mz1UTr3QsKA
MD5:	C772C719322CFA3D17801056C0509384
SHA1:	9F098F44EB68FD9A675419B76E6EFA49DB2DC650
SHA-256:	991EEDF651731A8974BE522666919F5D2B89B4CCDBDC241316297321EB6CCB6B
SHA-512:	64A5B8E9F018AFC9FDDA0EE655F3A971C5560C94CF29E326BBDC3140CCEA649166F112242C2738A8AB335974F789B544818B156F815347B8FA625A853D43F278
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\1034.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;1034, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	4.648879752508549
Encrypted:	false
SSDEEP:	384:cgYPN+Xzvgvn33amm6jowGEx90kx5xtaR2nFTK33MgYDQ71lh9wOlFSJqk6KZrgr:TnDovnvRgFxMl49SGcrsjIo5z
MD5:	273151B8E3CA3847380E0BD6ECD895A7
SHA1:	E2CAF09078ACA064AA9F6C68ADEA2B16F890B1CB
SHA-256:	08558A050E40453CF29A89F671720FED9A70C29E48F70227AB2CC02F1162B823
SHA-512:	6B53AF8FA333119453C9124309CDA03A984DD7D747711495E968B5FD89F72F7B13C4B24B5A844D31E4949AA7DEFF8609BA5B9E29FC8AD5831EAA106CCA39D090
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\1035.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;1035, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.706418593790166
Encrypted:	false
SSDEEP:	768:SDJyIxQotxUwWrUhTHVvCGGndfAf31L6T1ZXkr:GlxfxQUhTHVvCJAf38T1
MD5:	EEB36062978229A21BDF3B1E83BFC4BD
SHA1:	7EC04460CBB6AC579DDF809FC7D4CDBABDCC2F77
SHA-256:	1AC4D7BAE958599839230CE655695B6A171AA20D2D99251359BFB6F30D7AFB51
SHA-512:	919486D57ADB9A5F08AC62908B512902977BC85BDA2706872B140752CD5DFECFB0836655FA6CAB458635707BE281FA5B807E2F2B1C8E17F5B762CE83EBF9E251
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\1036.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;1036, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	4.786230976034954
Encrypted:	false
SSDEEP:	768:2tj6HiM2p/T4cf6DfexEBJMzBOtndTzDMj/gyS:kjuiM2Wcf6WxEBJMz8Xwp
MD5:	21A566806DCD535B71B82632335F3F87
SHA1:	92D77CC859A594556E1CAF50498A90D9C8416593
SHA-256:	E2989B1CFF1C2A41F20E3AF8B0164379BECD55D714E846B17461DF5B41551FC6
SHA-512:	034E15CB5A6C7F799FC949B8128F3A64275827B6681739B23AD3E452935239BEFE6F56D59D1899D7506764FB03E2F2819B0FAC91A62A18B3E61431DD2611324D
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\1038.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1250, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;1038, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	4.90815946927442
Encrypted:	false
SSDEEP:	1536:Llhqs0aq6UBQbEGIkzvzZ62bsAZ2cuuKSqbmcF:Llhqs0aq6U2b6kzvLdq
MD5:	0E926BDDB4A9B71A4EB6961274DEEA60
SHA1:	E4F42C0D8E2278F0C9ACB468BBEDCA2469405637
SHA-256:	5195E3357AB8716C08710186A82856F61114484750227F961A74932E5C5863B8
SHA-512:	AE7DFF1CDDB6594553080205B4C3013234E18CBFB63DEF5C0CCBE20FB559F3A55231F2EA239B7D8C85AF49A6F3E435EB326CFC2F83197047F42C1E2FCE0AE40E
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\1040.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;1040, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	4.734081626911327
Encrypted:	false
SSDEEP:	768:Uzw0Kzj2OFZp2LWfk+VxwBDkG51KKFiwC+d1JN/:U8vqO0F0+d1
MD5:	9659E5E93ACC633B672ED21CBFF7348B
SHA1:	8DD4A436B057B48BC2414202DC33C028C707F161
SHA-256:	E1B14BF2776E082E5952FFA978E43C34D759024D430C18EF46DE81274A9A9B79
SHA-512:	8B063E8415654BF34EB4A7B7E4BFC04B97A50D362A8EEC6290F87DC1B0E6087EC71FEFC51B1D4F697EBFF6F543E5D80D9B04DA6F63B27B348922C08DD56E89E3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\1041.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 932, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;1041, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	5.3340102909465426
Encrypted:	false
SSDEEP:	768:R5BIvvs5sTonuPiwunXEmEJvVssqB2kIK3Exf:LBEs5NkbuXEvvVcIV
MD5:	A63208CDAC045DB8C5AC7461728DBAED
SHA1:	317463D1EA26A5B4DF35F3ED889C8636684B7890
SHA-256:	52CFC0F9C46E0391F17DF078FF08B70B70F66A8D80FB1824580315B83865E0ED
SHA-512:	6AE6782823B6FBCDF8FF2E08C5F66B8FF5CE614184141F824B822819B6473CA61EE1B8849708938A500C11055B588DEF3BDE12225115F2D7748123EDE427C64F
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\1042.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 949, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield?DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;1042, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	5.335888680969404
Encrypted:	false
SSDEEP:	768:ASYo9J3bp4zxHRgOYhwAbPnJnPzHTn6kVzc0UIdMvg5sMl:1p9F6/gOYhwAbPndz20hNCM
MD5:	59805B3813814DFB4DC45B8830689826
SHA1:	1BAD9E2AC26186A03273E00908957105500AF755
SHA-256:	F27A6E113DC6A779F4CAC31163CFC62D4A509B1A9D3064D09A9C93FAF8DF784D
SHA-512:	DB6A55E3815C226B10AFDBA2487320B41BE850AA76B507307774A033FB6C192F499A30EB29E5DB0DF8AAC4A8785C66C4600C98920F84843BD4760F57C9129AC1
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\1043.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;1043, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	4.733124120227565
Encrypted:	false
SSDEEP:	768:XzoKrI7Hr5jmK/6OfSWey66s75yTzGAsjyC:jTwLYK/6OfSWey665Tz6
MD5:	670E244EDDD7C269C9784180CE8EB732
SHA1:	7C039C073B25E146C518D7B1B49C14E22625E32D
SHA-256:	CA87EADD8203563E3E10D0856382CD21906E4A050E94AE6C4511071CC82845B3
SHA-512:	75EBB3C93E83ED0D3E81F408294DE3D8C7B700E667178A09C7BDEF67D209F7C4C002881B0A0CB6818F84BDB97D907C47542B3AB8D5699E880FA81E0CB2DCB391
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\1044.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;1044, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.708265538156921
Encrypted:	false
SSDEEP:	768:9dlucWkirjFMjLgAcLh9XUqEc5YV7Ra14AYpISQLbtbKCtpo43VgXlhtiIGxnKSA:7lu3W/7RaBSIHcMpoC+ZGxKS+bTz
MD5:	3FCA6FB4A9DACB4294A38B3884F602DE
SHA1:	F0E46BA60C139E2338286B1CADEDFA4790FBAF94
SHA-256:	A0A5DAA269B218FA198188187C10CA40EDA56571742BE7091ACEC40BCC8C0E65
SHA-512:	DE9FCCD227A02D343E94CA5DD12728E3C6B3DF86844C73CE8FB3C8DAD76B9536B41EDAF1C4BCC303D59657633FDB0EA3C2AA2A636D76FF3BEBF820F6C85257D4
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\1045.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1250, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;1045, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.954638326244652
Encrypted:	false
SSDEEP:	768:W/6YnRAHI5Zqbrs7v+rtDB0770F+Y7bA9qZCCD7rEE0zmOrOsEIiYQIIsKpWFPzG:nYU4IPsF7a
MD5:	562DBD009BD124CFC6BF387225322A35
SHA1:	C88E98CA46D1C5290C8C671BC2858836DCC034C8
SHA-256:	B97DF40A48F333F726229AADAA0D8C902E0F6C1D868A39517DD726E2D9CD01F3
SHA-512:	3EA80EF568F386566C58FDCB2BE97AC5AA2CB01C3C90F80C8C39DA6C1C4D8AFCD142ADB13D13743482EF9BF75D2EF4F89C7C512071CB5B387A8F0A0E22CB669B
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\1046.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;1046, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	4.650099259802695
Encrypted:	false
SSDEEP:	768:BU5nGYTRW+R9gVa7f5lT0DTfISDnHtSAka7zZJZh8ljmXL:BEnGUGzZJZh8lji
MD5:	12D08B3918E1DFAC8AE1EEAF99C4EF74
SHA1:	E921A1929571C4A2268E1B6F181E52CD8047F82B
SHA-256:	14A69A6E16B9161ACEAF70DA0954D47346C463C02052B7B8703D0ED783478D1B
SHA-512:	F4D0FEDFB3785A24D831339BED45994F3A9D017DD69B7EA69C0BB4EC048890102C29E61A6C1517B0E6E92F59F6B656E1C536B946344108AC4045AB8C2A7A6B91
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\1049.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1251, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;1049, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	5.077775319491566
Encrypted:	false
SSDEEP:	384:75QRulSnVlZapq9vj5Ts6FT1XzgUX4InCHjNHobYr4+S5sK1D1qDvN5KcYtUrgjK:1dSVWqjTvBSICHjNIbjrETgjK
MD5:	1EC4975F25830027E1EC9FC68BE0050F
SHA1:	111CAADB88E697215F10BF78B4A064146C8152B8
SHA-256:	5272E357421B1F9A56663C34EB979D7403FB321E5FD978D8F9F7684DD880A89F
SHA-512:	9AEE36ABF4502B406F694FAA0C154B5D59CB4B473C86CDADB37B256826F0DCC978AFFE0E876698EFB7770DE2090E8FC3373876AE4AC82E45A2751EB713CC6F09
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\1053.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;1053, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.720840961444508
Encrypted:	false
SSDEEP:	768:U8hLe0DtNfnaB5SDcXccyf9cicSisqk63COfF+h3iIfOZM:nhLeZIpcyf9tCJX9EiIfO
MD5:	91A2F7BA0E530975905AAF99A8E782EB
SHA1:	0006FEB1BDD4C5369343F5D4230A12789F029BB8
SHA-256:	C815E74FF29F55CB6E83907C7CFA552787A59A4524462383776B4B95AD9C14B1
SHA-512:	93406C17959CEC28CFEB0C60722CD79283A2409B11077A9A63860C3946621CA33C0769F7976457AC790938A3BAD313AAA72CCA462A57F790F7E280017A06D043
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\1054.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 874, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;1054, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	5.242638186215827
Encrypted:	false
SSDEEP:	768:qU4nsbjF6ptPXE6n2esGmIEOmd+G553yABJ:p4zPXoe7mIEt+wyc
MD5:	8D2746E55A5AF747CA9F181F19B9A3C9
SHA1:	7B7C4D216EFF554B9C3E5391CD7B5224A69D5DF4
SHA-256:	CB091368240AC332F2914BAED458034880209DCB4AFF833CFFFB90106CEAAE6D
SHA-512:	A1186CC4E0740A27FC9A8382162084922A0F66615D17AE81E325AADD9602647FB457752615B28226EF1738E3EF72D85C03289608432D3A43D023522AB24856BD
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\1055.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1254, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;1055, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.796566546924149
Encrypted:	false
SSDEEP:	1536:uTz1oJVD6RaDXsWsoBEoF1Xp6BQm5V+coTd:uV+zHXp6BQm5V+cI
MD5:	BFF1457812E589BA8FE9053D0E8F4115
SHA1:	9E0849BCDCF1AA6F0F5F01787BA520BC55FEA683
SHA-256:	D44D3A9022FE2559A47B7CB325ECEDE3ED145EE7F46B5234F601293B11717B66
SHA-512:	9628BADBEB36EBCAA107321415D80F8FA6B43FC4649D349DE2A886D218CC4DC6FE6332CBC06BA71D763E577CCA23ECF5943B69F7BDE4DF13CF177A02F7CAB6F0
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\2052.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 936, Title: AMD Catalyst Install Manager Installer (64 bit), Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database,AMD,CIM, Comments: Configuration for 64 bit Monet Installer., Create Time/Date: Fri Jan 23 10:47:50 2015, Name of Creating Application: InstallShield?DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045, Last Saved By: AMD64;2052, Revision Number: {B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{B1472BDC-6026-4B1F-96CA-6DB4FA5B6703}8.0.916.0;{AAE88A33-9A83-4A5E-B6D4-CC757954B06E}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.256990699699198
Encrypted:	false
SSDEEP:	768:6JAESrTihmV9OHm2be9DEX+HD9QR15hOeIS1A:oZ2moV9OGl9DEX+HD9iFOe
MD5:	7C06737E263120F9F47690F5E91393D6
SHA1:	3A07E049662543108135BDC880BF320329BD19DB
SHA-256:	48F88A7FDFD8EBDDD6D9809B3DE1B887EE92F11A1B05DFE59A12369116299B7D
SHA-512:	2D371BAACBFDAAA6DA8E7D58F69E6912CC341C1F520A27C0D35BBC399AAC59A9736749334FED624D795A5CD3471A73FD80E079CC667EE3BC5B52A2CA2FE731F7
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\CIM\Win64\ATICatalystInstallManager.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, MSI Installer, Last Saved By: InstallShield , Number of Characters: 0, Security: 1, Number of Words: 0, Title: AMD Catalyst Install Manager Installer (64 bit), Comments: Configuration for 64 bit Monet Installer., Keywords: Installer,MSI,Database,AMD,CIM, Subject: AMD Catalyst Install Manager Installer (64 bit), Author: Advanced Micro Devices, Inc., Number of Pages: 200, Name of Creating Application: InstallShield DevStudio 9.0, Last Saved Time/Date: Fri Jan 23 10:47:49 2015, Create Time/Date: Fri Jan 23 10:47:49 2015, Last Printed: Fri Jan 23 10:47:49 2015, Revision Number: {D5322C40-6842-4327-91A2-EC130739AA82}, Code page: 0, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,1036,1031,1032,1040,1041,1042,1044,1046,1049,1034,1053,1054,1055,1038,1045
Category:	dropped
Size (bytes):	8858624
Entropy (8bit):	7.636735929399011
Encrypted:	false
SSDEEP:	196608:sy6G8SRTKThLBrsiTwKBIfRViwC7tWvdte3lxBA:syFMhBpTwMIcWvdoV
MD5:	887352E50165E9C338C5FBEEFC02A63B
SHA1:	7E26AA533974384683781EB4461502BDBBCF6A1B
SHA-256:	3CA444FF3F9ED79F19643D6FE56988EBDAE755A9B69569F0F4FC855C07531456
SHA-512:	8998B501827ABA261DB626E108BBD5ECB60200CFC546B8A55503058BE902B3BE8A00725EEF26D39351286E34FA0E6252847EBCEABF593BCC78D9FDB7EDB77230
Malicious:	false
Reputation:	low
Preview:	......................>...................................8........6..................................................................................z.......................................................}................................................................................................................................ ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5..........^...(............................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...E.......:...;...<...=...>...?...@...A...B...C...D...\...a...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[.......]..._...g...`...d...b...c...e...h...f...A...i...j...q...k...l...m...n...o...p...!...#...s...t...u...v...w.......y...z...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\DotNet45\DotNet45.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Code page: 1252, Last Printed: Sat Jan 28 00:37:43 2006, Create Time/Date: Sat Jan 28 00:37:43 2006, Name of Creating Application: Windows Installer, Title: Installation Database, Keywords: Install,MSI, Comments: This installer database contains the logic and data required to install <product name>., Template: ;0, Last Saved By: oirshad, Revision Number: {BB6CFE25-908F-4C4C-B70D-0CB045F4F3FD}, Last Saved Time/Date: Sat Feb 4 02:13:12 2006, Number of Pages: 100, Number of Words: 0, Security: 0
Category:	dropped
Size (bytes):	80384
Entropy (8bit):	5.805744646749224
Encrypted:	false
SSDEEP:	1536:7IWSOyULOtHV6A2kcGtSPcGhsWjcdOyK8Ulv:7OrtHUkcySnO5K8Ux
MD5:	03FAA5A5145C95FD2763ED8A9908BAB4
SHA1:	689BDC0AAA66AE7B5B9B3151D3076FF4B5CCC8ED
SHA-256:	4E0853BDD4FB1AA766D5164BCC18E46ACC5D83397B9C0486201064D18D7F80D1
SHA-512:	1430D12E0E5F4FD7DCD25B0980A1FCF05FD3584E7C58D61B4FB845D2B63FEBA0A5C1F567F07EB88453F20375B71FEF14CABF474AF043BA3D44ADB21AC7520E0F
Malicious:	false
Reputation:	low
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\DotNet45\dotnet45\dotnetfx45_full_x86_x64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	50352408
Entropy (8bit):	7.9998563209541595
Encrypted:	true
SSDEEP:	1572864:SkekSjofjyjsUSnSTt2mjN6LIFTtAmriZnS:ckSjobmsUQC0mjN6QbsS
MD5:	D02DC8B69A702A47C083278938C4D2F1
SHA1:	B2FF712CA0947040CA0B8E9BD7436A3C3524BB5D
SHA-256:	A04D40E217B97326D46117D961EC4EDA455E087B90637CB33DD6CC4A2C228D83
SHA-512:	59D9D0A8C2A1321E04E4077FF5D0141EFD8CD0E0DA6F1042648647C8A40D6B0E384AE8A67471706188464BC057A85BF67BDF2009591DD211A067A3D03AAA9EC1
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.]`r.33r.33r.33ih.3s.33U3^3q.33...3s.33...3Y.33...3`.33...3..33r.23..33...3g.33l..3s.33ih.37.33ih.3s.33ih.3s.33ih.3s.33Richr.33................PE..L..."x^O.........."..........^....................@..........................@......k.....@...... ..........................4...........................0>..........................................8Y..@............................................text...Z........................... ..`.data....7..........................@....boxld01............................@..@.rsrc...............................@..@.reloc..j(.......*..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\PRW64\1028.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 950, Title: Problem Report Wizard Installation Database, Subject: AMD Problem Report Wizard (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: This installer database contains the logic and data required to install the Problem Report Wizard, Create Time/Date: Fri Jan 23 10:57:30 2015, Name of Creating Application: InstallShield?DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1040,1041,1042,1044,1045,1046,2070,1034,1053, Last Saved By: AMD64;1028, Revision Number: {D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{E5846BD2-7506-474F-9F0B-2AF75DBA6268}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	5.279419903387879
Encrypted:	false
SSDEEP:	384:9vius6vz/vn9wRb/VrLyi0jBkM/pG/iPxZhQJv2nQywfI5bvpbWVMgTfei5buhPb:lPnvz/vSRWASZnQZfI5bjiFuPyy
MD5:	5D42BB8177E4D5BC53E0D2A9CA44A039
SHA1:	4715D5469F45046DA89AC5FFB024E410B611E346
SHA-256:	0F86204E0BC7836422D23AF7ABD699D8581650B4B8516C972A939F7ED18D6C21
SHA-512:	CFAA1300A5394B11CD502D05D1A7B146B9106935BD0A111F519599B3EACA858FBCDBC678D06E637BF43BE4B43E160C43A44A07941F8B7499FD35FD67712D39B7
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\PRW64\1029.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1250, Title: Problem Report Wizard Installation Database, Subject: AMD Problem Report Wizard (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: This installer database contains the logic and data required to install the Problem Report Wizard, Create Time/Date: Fri Jan 23 10:57:30 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1040,1041,1042,1044,1045,1046,2070,1034,1053, Last Saved By: AMD64;1029, Revision Number: {D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{E5846BD2-7506-474F-9F0B-2AF75DBA6268}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.843684397261717
Encrypted:	false
SSDEEP:	768:Th/XVC2TF4l5+uDz7dpNclLmE9VR+am4woN3sGw5m1iOXM7jdH:JlDcz7nNcl1V7VZwc1id7N
MD5:	EEF6A4FF6FB6A06D6AB2B466A680D57A
SHA1:	A3E8F10144DEC240F5D9A6ADBA944E1E0421153B
SHA-256:	6D1C14A3472DFA6C521132AB9DC745579A1D06DC55549092233418421512FEC6
SHA-512:	C89D61D47E1DAC562E391869D6BD4D937F94422044F1292F81C3A89CFD4F482F592EEAB06387CE05A0A600D33D8782F55312EFC72968E391C285C267246ECD22
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\PRW64\1030.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Problem Report Wizard Installation Database, Subject: AMD Problem Report Wizard (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: This installer database contains the logic and data required to install the Problem Report Wizard, Create Time/Date: Fri Jan 23 10:57:30 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1040,1041,1042,1044,1045,1046,2070,1034,1053, Last Saved By: AMD64;1030, Revision Number: {D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{E5846BD2-7506-474F-9F0B-2AF75DBA6268}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.620632218286602
Encrypted:	false
SSDEEP:	768:V6V55KQkOsPYFv/gqTQ90AZ+DEUaTAEdl7DPzLUc0fmb6Jxw:8V53gqTKZ+DEUaTD0fVG
MD5:	6A2A1AB76EA27A5DA10CF981427D4EDA
SHA1:	C930756150D006EDCF57EC443037485A0A69DE44
SHA-256:	C0371806F42AA1A2A8F7FA57BA37E240F0216703E47A35D2C48997237AA1A287
SHA-512:	205589EFEE76DD7398649342E5354CC03976CF0146BEBA2227A4EB680CA0F5DA2B54025F48A07A8C077F700E2792EE033ACE2CD349C8BDD4290E19ADA61E57DE
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\PRW64\1031.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Problem Report Wizard Installation Database, Subject: AMD Problem Report Wizard (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: This installer database contains the logic and data required to install the Problem Report Wizard, Create Time/Date: Fri Jan 23 10:57:30 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1040,1041,1042,1044,1045,1046,2070,1034,1053, Last Saved By: AMD64;1031, Revision Number: {D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{E5846BD2-7506-474F-9F0B-2AF75DBA6268}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	4.775407180333
Encrypted:	false
SSDEEP:	768:C2ZLSfy9yfdXMpRRUhth0/0R0g0Q0+0m0f20L0NYj6QUGM9mHmk+DjSyK81/KQdV:yepUh9Px3f65Bu
MD5:	DF9EE736B97D8F4DBE80D8FB0667E962
SHA1:	A2111FDE37F908565E494EF6E7848D51FF5881C1
SHA-256:	0C6CBD0A63EEDA3CB35181A3AEEB47F94C456B9E2A6F8E7017A8FABFB540D76D
SHA-512:	42411F54C4EAD80F969707ABB5BE4F976147E606BEAD8F58327C1BFEE03731585411EE2CBE1C887C007F41068093AB4E660BB9CA081798211EC9467F98704AF3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\PRW64\1033.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Problem Report Wizard Installation Database, Subject: AMD Problem Report Wizard (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: This installer database contains the logic and data required to install the Problem Report Wizard, Create Time/Date: Fri Jan 23 10:57:30 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1040,1041,1042,1044,1045,1046,2070,1034,1053, Last Saved By: AMD64;1033, Revision Number: {D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{E5846BD2-7506-474F-9F0B-2AF75DBA6268}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4179088287779251
Encrypted:	false
SSDEEP:	24:Jbm5a+4R3/XtyJ4a7nf1ClhPDengdIdOId:5mm30J4a7UdDN
MD5:	88907A345E94B048F8E7DF8B2F7A3547
SHA1:	74CAB006EFD7994418C4C4EABBF02AF836143E99
SHA-256:	85650B51AC823E531ED63C2BCBE086671799AA06A575F5908A7A89B5FD9B00F0
SHA-512:	D2C8F4B7577C30E4FE828177F73EED13793D2D26D83B567D3C6B1BDBBD20995AC12742D4994635891B3DB7A667D2820EA8C8DABCC868C4D91539E12C018903A2
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\PRW64\1034.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Problem Report Wizard Installation Database, Subject: AMD Problem Report Wizard (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: This installer database contains the logic and data required to install the Problem Report Wizard, Create Time/Date: Fri Jan 23 10:57:30 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1040,1041,1042,1044,1045,1046,2070,1034,1053, Last Saved By: AMD64;1034, Revision Number: {D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{E5846BD2-7506-474F-9F0B-2AF75DBA6268}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.725401986820804
Encrypted:	false
SSDEEP:	384:ii6PN+Xzvgvn3xaJjowwx90kx5xwQ/nF7K3+f7hyd3DwnTwOlFSJqk6KZrgCHF/f:fhDovnSOxMl49SGsgBfj1u
MD5:	90A4272A40B66C37C9B40E43353D9056
SHA1:	7C85487357C1007067477420E28F34D40612F6E4
SHA-256:	D88F1E5643FBBAC13F291889425D399F3DC32CB659CB22B6C94F6FED19A58D32
SHA-512:	63443BD93519945038472E2226A0058AE935F78E555F0741FC26412ECDEFD5F56E30247553C31BA07C05C219C1E0A0AB3B1B99FBE33460114DF7F3FAA2B75067
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\PRW64\1035.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Problem Report Wizard Installation Database, Subject: AMD Problem Report Wizard (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: This installer database contains the logic and data required to install the Problem Report Wizard, Create Time/Date: Fri Jan 23 10:57:30 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1040,1041,1042,1044,1045,1046,2070,1034,1053, Last Saved By: AMD64;1035, Revision Number: {D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{E5846BD2-7506-474F-9F0B-2AF75DBA6268}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.617046399076935
Encrypted:	false
SSDEEP:	384:GyBSFyIDX5TXAdXfcdvHQFDRDEvwsGu7hTvVvCfY98OoBKGMFa9r5/quw:jyyI7RAsvwFrUhTvVvCQGPBKG0a2
MD5:	8A8F2376C34FE68D2CC827C1588AABBF
SHA1:	773D338334FE7BBF9F441BCF8686C511723660B4
SHA-256:	0C6669C620F1AC5CAB695541B341C8815AA0295972A78FA44079FDCCCC17FCAE
SHA-512:	D5BCEE42842116C8E359E4FC8619BBCA031E1E8203DDCA6865894B33117092AF046A62F154CF2365D6E42A1F97B8AB579C525D7240E269462F263E13B067D395
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\PRW64\1036.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Problem Report Wizard Installation Database, Subject: AMD Problem Report Wizard (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: This installer database contains the logic and data required to install the Problem Report Wizard, Create Time/Date: Fri Jan 23 10:57:30 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1040,1041,1042,1044,1045,1046,2070,1034,1053, Last Saved By: AMD64;1036, Revision Number: {D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{E5846BD2-7506-474F-9F0B-2AF75DBA6268}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	4.70292234211513
Encrypted:	false
SSDEEP:	768:mPj6Hiw2umXFl6DfexEBJMzB7tnepLfTIb:ajuiw2vXj6WxEBJMz5Sfkb
MD5:	6173CD6CFD388F1F66A177E5E55BD5B0
SHA1:	6656678797EF8CDE92E3EDC9E0819F11830AFE71
SHA-256:	4D86F29ECD62750D8DEAD931DFBC4C4C0C77B7A07D4078FD84BDE26C2F45918D
SHA-512:	4FC9F67188530941B8F62362FEA036F5E771B40873785A11A32454B862373C888036375A37365425D4EAB265657CB65A6BA22766903FDFF911E254B50D95E7D1
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\PRW64\1040.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Problem Report Wizard Installation Database, Subject: AMD Problem Report Wizard (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: This installer database contains the logic and data required to install the Problem Report Wizard, Create Time/Date: Fri Jan 23 10:57:30 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1040,1041,1042,1044,1045,1046,2070,1034,1053, Last Saved By: AMD64;1040, Revision Number: {D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{E5846BD2-7506-474F-9F0B-2AF75DBA6268}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	4.649171545351485
Encrypted:	false
SSDEEP:	768:p/S0Kzj2OczpWBKfSlxwBDkG51KKFVwX5I3:p6vqOoFCO
MD5:	AABF563521739031B5DCE7EAE36F0D4C
SHA1:	56ED1704FF498581F96F69D20F2A15A8799F3FDE
SHA-256:	74CCE52EF21DC39C547D15F69DCC227CDFA75CEF854C7B2F7CBAEC3F2E2F1F5B
SHA-512:	158C8340B33A354533D01FDD65EBB78AEEB5200BFAB27F7AE2D9853978F68733340A062E99A798612A005E2F5B94FC8ADAD8EDCF0FF8112C96D4938D709F06A1
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\PRW64\1041.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 932, Title: Problem Report Wizard Installation Database, Subject: AMD Problem Report Wizard (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: This installer database contains the logic and data required to install the Problem Report Wizard, Create Time/Date: Fri Jan 23 10:57:30 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1040,1041,1042,1044,1045,1046,2070,1034,1053, Last Saved By: AMD64;1041, Revision Number: {D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{E5846BD2-7506-474F-9F0B-2AF75DBA6268}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	5.447410754063867
Encrypted:	false
SSDEEP:	768:mLBIvvs/moav75RNbnXEmEJTVsseaH+vG:sBEs6lbbXEvTVMG
MD5:	8254EE59B1F302371ECC7CACBF5DB1CC
SHA1:	6BE70758636E961372CA7A364FB0811B61B42BDF
SHA-256:	5AA7132D930D1DE937CBF4E525A242F7EC9DC7B9533FDC846793AC86006103D8
SHA-512:	9781803834C6BE853BBF08999FF57C07FBEAEC5CED8508C8D4A2344AB663B6892AED6F91962C2FE0126E403FDC398116DAC161C35129158215BA1FD7744B2471
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\PRW64\1042.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 949, Title: Problem Report Wizard Installation Database, Subject: AMD Problem Report Wizard (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: This installer database contains the logic and data required to install the Problem Report Wizard, Create Time/Date: Fri Jan 23 10:57:30 2015, Name of Creating Application: InstallShield?DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1040,1041,1042,1044,1045,1046,2070,1034,1053, Last Saved By: AMD64;1042, Revision Number: {D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{E5846BD2-7506-474F-9F0B-2AF75DBA6268}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	5.480160626282197
Encrypted:	false
SSDEEP:	768:pdYo9yKp4L4RgOYhwAbPnJnPzHTn6kVnc0VlUAMv5TT7BZ:rp9+0gOYhwAbPndzm0fU/vBZ
MD5:	C6C1C2EFF75AEADBD8035E5E91E58863
SHA1:	602F9F7E70FBF10637B9B7DF7FB0FDA485E3F548
SHA-256:	9686DD7A241DFBFEEBDE467FFC3DE96A0A0E58F9C84050B9AAC76AF5634995F5
SHA-512:	DDF14A3CC1571A92D4933E04924D8EFFC3E953B6493EBAB67AF36428113950602BABFAE9207FEF012272F2472B4757771B32E4036A1727590517FB9AEFFED7B2
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\PRW64\1043.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Problem Report Wizard Installation Database, Subject: AMD Problem Report Wizard (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: This installer database contains the logic and data required to install the Problem Report Wizard, Create Time/Date: Fri Jan 23 10:57:30 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1040,1041,1042,1044,1045,1046,2070,1034,1053, Last Saved By: AMD64;1043, Revision Number: {D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{E5846BD2-7506-474F-9F0B-2AF75DBA6268}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	4.649531755185308
Encrypted:	false
SSDEEP:	384:w9SKMpKrI+wL+A0LDVDldjgWtf9lEsB/MFAzcBt0zSa5Tey66s7YRkyGAWzs/eM:mjoKrIWd1gWmK/6OfSWey66s7/y4
MD5:	CE9103E08C2ED93B9B7BA72289117F57
SHA1:	AD1A58D20A60DF81C939C33D2E935BB4E3B1ACCC
SHA-256:	08E3D9E94227AD85B97C7A6B6AFCF0B223174F680ADBE644D65806D93B39BDAA
SHA-512:	BE841F8ABDB16DB774E2700DB395ABAE5EC25E5EA7EE29ED43F5620D34E42F8A08631FE829BC5114670C899DAF277E65B5676D99103479796537723141082F48
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\PRW64\1044.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Problem Report Wizard Installation Database, Subject: AMD Problem Report Wizard (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: This installer database contains the logic and data required to install the Problem Report Wizard, Create Time/Date: Fri Jan 23 10:57:30 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1040,1041,1042,1044,1045,1046,2070,1034,1053, Last Saved By: AMD64;1044, Revision Number: {D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{E5846BD2-7506-474F-9F0B-2AF75DBA6268}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.6171184929507
Encrypted:	false
SSDEEP:	768:afl1nirphMjEg9c0f8AqZDRMJYV7Ra14AYpISQLbtbKCtpo43VgXlhtIIGxnKSGq:2lo5B7RaBSIHcMpoC+3GxKS+b99
MD5:	53877F343C7283B093F6738366C9EDE6
SHA1:	FCBB0AFB70EDA0583DBEA27F64B4AB4A10B6071A
SHA-256:	644C05A46E0A5A088292CEFEF3DEACC24E3223BCAC40D48A1E93DEFBC4FD5766
SHA-512:	C25B9C74C740157A8915CF48DC014009BEF387F0FC24CD7D8F9EFDBB585D20AE5B7C0DF2FB302331925D175087F211417C696230FE5C5F995701A24782BC7CD5
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\PRW64\1045.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1250, Title: Problem Report Wizard Installation Database, Subject: AMD Problem Report Wizard (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: This installer database contains the logic and data required to install the Problem Report Wizard, Create Time/Date: Fri Jan 23 10:57:30 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1040,1041,1042,1044,1045,1046,2070,1034,1053, Last Saved By: AMD64;1045, Revision Number: {D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{E5846BD2-7506-474F-9F0B-2AF75DBA6268}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.8631400888985015
Encrypted:	false
SSDEEP:	768:a/6YknHVkZi4r2Ah+rtDh0/50X+y7XA9qZCCD7rEP0zmOrOsEIiYQIMsJNvG6C:jYMvM96
MD5:	7FA0ED8246F53CED79E37170F9AA1290
SHA1:	C552D5B6E21C33D8AACD1A4CDF5DA19E32EB8AB3
SHA-256:	9F454345058AA2E846EC3111A8CD6E0DA74DA8DC6E86A16F4FF8A966B454AE30
SHA-512:	7E2114EF85238C4CADC23155FF617A1F914CC78419DCEF2DE4962C4BD08D30A991391B1954917CD8D8A52772BD04601305976C12431A5DA7754E629CE2F2C94B
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\PRW64\1046.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Problem Report Wizard Installation Database, Subject: AMD Problem Report Wizard (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: This installer database contains the logic and data required to install the Problem Report Wizard, Create Time/Date: Fri Jan 23 10:57:30 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1040,1041,1042,1044,1045,1046,2070,1034,1053, Last Saved By: AMD64;1046, Revision Number: {D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{E5846BD2-7506-474F-9F0B-2AF75DBA6268}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.735313732728259
Encrypted:	false
SSDEEP:	768:RuCnGVtRU+R9gKa7TmpT0DTfISDnjtBAka7zZJZBLl0J:RZnGz5zZJZFlI
MD5:	D657910C27E3F8E467070C31A8FBE6D2
SHA1:	EDE8B03079EEF4D8D1838B9DD51C03BDF0A7A2A3
SHA-256:	C345DA308074C5D16C909382CFAA1ED3B89E44D3F0C9278E2DD12CEC7E7B2F83
SHA-512:	AAA359AF5293FBE1EBE468D7889D538BA5F116F2205952E92DACA7C71E48C7D223BD5AE37C97CFD03574235BB9C8340ABAC2B0E8802F8979E61DB8CF01A08A4E
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\PRW64\1053.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Problem Report Wizard Installation Database, Subject: AMD Problem Report Wizard (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: This installer database contains the logic and data required to install the Problem Report Wizard, Create Time/Date: Fri Jan 23 10:57:30 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1040,1041,1042,1044,1045,1046,2070,1034,1053, Last Saved By: AMD64;1053, Revision Number: {D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{E5846BD2-7506-474F-9F0B-2AF75DBA6268}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.625068445580816
Encrypted:	false
SSDEEP:	768:6YhLe5D5NtnfKVYDcXccyf9cicSisqk63COfszinjfcEfJJ:xhLe2Opcyf9tCJXEWnjf7J
MD5:	DCB3CF7E581884EA1171B2AF7477EA36
SHA1:	675D6DC81FD47047E18AA21183A19EE7425E7909
SHA-256:	696289800685D875AC4FC4FDE455A66DB0BB3B506FF870357DCC2999A2F01E4B
SHA-512:	11360A923C682D4252233CDFC832CE81688D890473825554A04312E306B89886EA1B8EE9952A39AC08A4AC3D1E44B5BFA0F34DBF0C38BBCDE3B80234EBCDC898
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\PRW64\2052.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 936, Title: Problem Report Wizard Installation Database, Subject: AMD Problem Report Wizard (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: This installer database contains the logic and data required to install the Problem Report Wizard, Create Time/Date: Fri Jan 23 10:57:30 2015, Name of Creating Application: InstallShield?DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1040,1041,1042,1044,1045,1046,2070,1034,1053, Last Saved By: AMD64;2052, Revision Number: {D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{E5846BD2-7506-474F-9F0B-2AF75DBA6268}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.139353154012243
Encrypted:	false
SSDEEP:	768:rAAESrTGAV96dom2bemDEX+HD9Mr1dfNrn:0Z2nV9OnlmDEX+HD94Nr
MD5:	8474C5FBF50E90D65929ECEB0797B3D0
SHA1:	8617B1401D526124B0B251D9A91BB8512C5A03EB
SHA-256:	77617A32AE769F9E66EE921322FD0E63DC22E8FA23C78668D350C0C87E5BFB33
SHA-512:	982880B573E6B3D49E7C4BD4B6F3EC155ED0E521B3A88BC3086A7A10E771AC40BF8F0394913BC3B39F398780F4617487A3803E43EF97350DF45E53A0C674497D
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\PRW64\2070.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Problem Report Wizard Installation Database, Subject: AMD Problem Report Wizard (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: This installer database contains the logic and data required to install the Problem Report Wizard, Create Time/Date: Fri Jan 23 10:57:30 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1040,1041,1042,1044,1045,1046,2070,1034,1053, Last Saved By: AMD64;2070, Revision Number: {D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{E5846BD2-7506-474F-9F0B-2AF75DBA6268}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.725420777244114
Encrypted:	false
SSDEEP:	768:gap82ntIu8Oo0gPaH3PEgzbOFiQ51flaUs:LvMFP6EgzbtQXflk
MD5:	CC24513C5AE4AAD094A6AB581312E74A
SHA1:	9A54E79F193AFABC2ED8A1759362E10456E46F86
SHA-256:	792827BFA46D8D22F7B1E0A232EEA715C14694EB5E74216B66232C8B6931ECBD
SHA-512:	23B801833B21060662B0875CE8530F5E6AF4A12127E3A4A7B7D6267A1013F5FD502A5BED2CE76656F7EA702EA9E78C5982B27F3B08E642D0D6F499B8F731E2BD
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\PRW64\3084.mst

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Problem Report Wizard Installation Database, Subject: AMD Problem Report Wizard (64 bit), Author: Advanced Micro Devices, Inc., Keywords: Installer,MSI,Database, Comments: This installer database contains the logic and data required to install the Problem Report Wizard, Create Time/Date: Fri Jan 23 10:57:30 2015, Name of Creating Application: InstallShield DevStudio 9.0, Security: 1, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1040,1041,1042,1044,1045,1046,2070,1034,1053, Last Saved By: AMD64;3084, Revision Number: {D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{D834885F-2615-48F8-9581-C56AB0E82F4B}8.0.916.0;{E5846BD2-7506-474F-9F0B-2AF75DBA6268}, Number of Pages: 200, Number of Characters: 1
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	4.707718909387045
Encrypted:	false
SSDEEP:	768:Yij6Hi6GulEw76DfexEBJMzEtn+Dr7hg:hjui6GEEo6WxEBJMzEMh
MD5:	9C5EE7E26AA6BA9897DC9F9D60345151
SHA1:	10476DDB99051842C37A6FDDA379A003EEFC6028
SHA-256:	D6C01A3E3C8D9D93F057F54BA372CCE51D3C28EE551ECD6B32F855F0BF56EAAB
SHA-512:	88DF9D977DB3FF606EF74BFD819C36459099D65D68D37202964BE2312016B095AAAF35BE601A060D79890646A9C57260CB0AFE8DBF7F0CEEFAAC5154611CE950
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\PRW64\ATIPRW.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, MSI Installer, Last Saved By: InstallShield , Number of Characters: 0, Security: 1, Number of Words: 0, Title: Problem Report Wizard Installation Database, Comments: This installer database contains the logic and data required to install the Problem Report Wizard, Keywords: Installer,MSI,Database, Subject: AMD Problem Report Wizard (64 bit), Author: Advanced Micro Devices, Inc., Number of Pages: 200, Name of Creating Application: InstallShield DevStudio 9.0, Last Saved Time/Date: Fri Jan 23 10:57:30 2015, Create Time/Date: Fri Jan 23 10:57:30 2015, Last Printed: Fri Jan 23 10:57:30 2015, Revision Number: {F467D840-F5AC-4F87-ADD6-C28BB8881B92}, Code page: 0, Template: AMD64;0,1033,2052,1028,1029,1030,1043,1035,3084,1036,1031,1040,1041,1042,1044,1045,1046,2070,1034,1053
Category:	dropped
Size (bytes):	8334848
Entropy (8bit):	7.870643513628342
Encrypted:	false
SSDEEP:	196608:N86BHArUQgTaXnMPosm2ZUWUr8GUmxqOBoFl2H7U:Nv/aX+5JZUWOYmjo87U
MD5:	ED31B62906FADE52C43270039AED9125
SHA1:	37F3A94AF3FBFF4AC8B4970A628BD35AD7D935D9
SHA-256:	00641846E66E4B9A56BE213D74A70324F67E39587417F9ABDFC7E383283DF837
SHA-512:	E749832AA715E82CBBC0E08DC39A9FBC58C1D348F5D20928BCF06ABA6BBE38E5636EEE063477C6BD140C2E79D4B582D00DD81691692EBC4E78811927E19D4D70
Malicious:	false
Reputation:	low
Preview:	......................>...................................8........6..................................................................{........................................................................................................................................................................................................ ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5..........^................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...E...e...:...;...<...=...>...?...@...A...B...C...D...\...`...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...z...]..._...d...c...a...b...I...f...g.......h...k...i...j...........m...n...o...p...q...z...s...t...u...v...w...x...y...l...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vc1064.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Code page: 1252, Last Printed: Sat Jan 28 00:37:43 2006, Create Time/Date: Sat Jan 28 00:37:43 2006, Name of Creating Application: Windows Installer, Title: Installation Database, Keywords: Install,MSI, Comments: This installer database contains the logic and data required to install <product name>., Template: ;0, Last Saved By: oirshad, Revision Number: {BB6CFE25-908F-4C4C-B70D-0CB045F4F3FD}, Last Saved Time/Date: Sat Feb 4 02:13:12 2006, Number of Pages: 100, Number of Words: 0, Security: 0
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	5.786036598551098
Encrypted:	false
SSDEEP:	1536:htcWSOyULOtHV6A2kcGtSPcGhsWjcdOyK8Ulv:TartHUkcySnO5K8Ux
MD5:	5BB3F1D76ADE520111B7B9D68A30C99D
SHA1:	D2C4C5BF8F9A59A348D436A450A80D3DD8D7DF2D
SHA-256:	7885147A37F1C695F772AF63FF07909EFA009800C1EDD783DB14F1BA4D1B51CF
SHA-512:	A9F15327F1B72026540890C1C9551A96BB5CEC067092754CD1EA2E626572DA7590E768F896FCAC19929DF569A79B892068C77B1A9CCF0BC76E6828821E1C1115
Malicious:	false
Reputation:	low
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1028\LocalizedData.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (388), with CRLF line terminators
Category:	dropped
Size (bytes):	30672
Entropy (8bit):	4.293519557838441
Encrypted:	false
SSDEEP:	384:4Y2C7xDsxgg8MPN9AYy50keJzH7o3oDPnv:cxTJz7
MD5:	12DF3535E4C4EF95A8CB03FD509B5874
SHA1:	90B1F87BA02C1C89C159EBF0E1E700892B85DC39
SHA-256:	1C8132747DC33CCDB02345CBE706E65089A88FE32CF040684CA0D72BB9105119
SHA-512:	C6C8887E7023C4C1CBF849EEBD17B6AD68FC14607D1C32C0D384F951E07BFAF6B61E0639F4E5978C9E3E1D52EF8A383B62622018A26FA4066EB620F584030808
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.X.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."....P.[..z._.... .x.6.4. .s^.S..!q.l.[.(W...Ps^.S.N.0"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.I.A.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."....P.[..z._.... .I.A.6.4. .s^.S..!q.l.[.(W...Ps^.S.N.0"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.S.u.p.p.o.r.t.e.d.O.S.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."....P\Omi.\|q}.N/e.c .M.i.c.r.o.s.o.f.t. .V.i.s.u.a.l. .C.+.+. .2.0.1.0. ..SI.ce\|vWY.N.0"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1028\SetupResources.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14168
Entropy (8bit):	5.9724110685335825
Encrypted:	false
SSDEEP:	192:fc2+tUfwZWPl53LmlVlSW1g+/axw0lczWpXEWUQKPnEtObMacxc8hjeyveCXzHbk:hzuwLmlCW1g+/kmzWpXEWULXci2jpv3e
MD5:	7C136B92983CEC25F85336056E45F3E8
SHA1:	0BB527E7004601E920E2AAC467518126E5352618
SHA-256:	F2E8CA58FA8D8E694D04E14404DEC4E8EA5F231D3F2E5C2F915BD7914849EB2B
SHA-512:	06DA50DDB2C5F83E6E4B4313CBDAE14EED227EEC85F94024A185C2D7F535B6A68E79337557727B2B40A39739C66D526968AAEDBCFEF04DAB09DC0426CFBEFBF4
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........................................................@......E.....@.......................................... ..X............ ..X............................................................................................text...G...........................@..@.rsrc.... ... ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1028\eula.rtf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	188446
Entropy (8bit):	4.98936861773382
Encrypted:	false
SSDEEP:	3072:vjB8N7T+SN6FY5PmQlivKawlrIMUkYfkv8CshgJNgRJAoJvIrOJBElrhzxQXK6uG:o7SSN6FYtmQlivKawlrIMUkYfkv8Cs4U
MD5:	129D8E8824B0D545ADC29E571A6E2C02
SHA1:	5A1DDFCD2AE21D96C818D315CB5E263F525A39CD
SHA-256:	83B8268E2874699227F9B1AD3F72A06CBF474EFA3983F5C5EE9BFE415DB98476
SHA-512:	1048F646D5866DC8736DB0A023A65A7E208A5F56774FA8EC5D59E4272A54A9A6E94B01B84293A7EC9F889BAD7865522E783AF30BF61BB9249687DCEAC62066D8
Malicious:	false
Reputation:	low
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch14\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt ?l?r ???fc};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Times};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt ???????????????????????????\'a1\'ec???};}{\f14\fbidi \froman\fcharset136\fprq2{\\panose 02020500000000000000}PMingLiU{\\falt \'b7\'73\'b2\'d3\'a9\'fa\'c5\'e9};}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\fa

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1031\LocalizedData.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (615), with CRLF line terminators
Category:	dropped
Size (bytes):	41628
Entropy (8bit):	3.5773894743757726
Encrypted:	false
SSDEEP:	384:4nh+jpoHHZi8oO0GOJ2+8q6OQzxYJL/ZiITrKv:R03zzOJL/YIy
MD5:	B13FF959ADC5C3E9C4BA4C4A76244464
SHA1:	4DF793626F41B92A5BC7C54757658CE30FDAEEB1
SHA-256:	44945BC0BA4BE653D07F53E736557C51164224C8EC4E4672DFAE1280260BA73B
SHA-512:	DE78542D3BBC4C46871A8AFB50FB408A59A76F6ED67E8BE3CBA8BA41724EA08DF36400E233551B329277A7A0FE6168C5556ABE9D9A735F41B29A941250BFC4D6
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.X.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".D.i.e.s.e.s. .S.e.t.u.p.p.r.o.g.r.a.m.m. .e.r.f.o.r.d.e.r.t. .e.i.n.e. .x.6.4.-.P.l.a.t.t.f.o.r.m... .E.s. .k.a.n.n. .n.i.c.h.t. .a.u.f. .d.e.r. .P.l.a.t.t.f.o.r.m. .i.n.s.t.a.l.l.i.e.r.t. .w.e.r.d.e.n..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.I.A.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".D.i.e.s.e.s. .S.e.t.u.p.p.r.o.g.r.a.m.m. .e.r.f.o.r.d.e.r.t. .e.i.n.e. .I.A.6.4.-.P.l.a.t.t.f.o.r.m... .E.s. .k.a.n.n. .n.i.c.h.t. .a.u.f. .d.e.r. .P.l.a.t.t.f.o.r.m. .i.n.s.t.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1031\SetupResources.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18776
Entropy (8bit):	5.135663555520085
Encrypted:	false
SSDEEP:	384:lQ16m3rhGrcHN/USYvYVA9WKieW8bLXci2jXHU2Ze:lEhCSVYvYVAA+Mi2jXHU2A
MD5:	7C9AE49B3A400C728A55DD1CACC8FFB2
SHA1:	DD3A370F541010AD650F4F6AA42E0CFC68A00E66
SHA-256:	402C796FEBCD78ACE8F1C5975E39193CFF77F891CFF4D32F463F9A9C83806D4A
SHA-512:	D30FE9F78A49C533BE5C00D88B8C2E66A8DFAC6D1EAE94A230CD937F0893F6D4A0EECE59C1D2C3C8126FFA9A9648EC55A94E248CD8C7F9677F45C231F84F221B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........................................................P.......D....@.......................................... ..`+...........2..X............................................................................................text...G...........................@..@.rsrc....0... ...,..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1031\eula.rtf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	163866
Entropy (8bit):	5.029712171633306
Encrypted:	false
SSDEEP:	3072:oiJ+vgRJA8J/snalBEm0OgKXIJR10GZybh2C:aQ
MD5:	117DABB5A055B09B6DB6BCBA8F911073
SHA1:	E8F5D907939400824CC5DADB681852C35CA7BB79
SHA-256:	DAEA9CD8151A2C24A87C3254DEC1DE0463234E44922C8E0AA4E01AB58EC89664
SHA-512:	E995D03998BE9F07F9E9B8566E429D3795ADBDEEEFB2048D6B8877CE15A0ABFCE4FAAEE8DC773250495C15CC35FD0040D81593B51067533836D5F3CF8612D3C4
Malicious:	false
Reputation:	low
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt ?l?r ???fc};}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}..{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Times};}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}..{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt ???????????????????????????\'a1\'ec???};}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\*\falt Calisto MT};}{\f38\fbidi \fswiss\fcharset0\fpr

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1033\LocalizedData.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (565), with CRLF line terminators
Category:	dropped
Size (bytes):	39246
Entropy (8bit):	3.5443015320810485
Encrypted:	false
SSDEEP:	192:4kV2hG9aXQSDpI53/aQS0WAv+VXxwVcPI/tOiQC4+3bpKQVz5FB0zJOkue6Jjfz3:4M2hJAep4tVNx9SJOkR6NXaxu
MD5:	5486FF60B072102EE3231FD743B290A1
SHA1:	D8D8A1D6BF6ADF1095158B3C9B0A296A037632D0
SHA-256:	5CA3ECAA12CA56F955D403CA93C4CB36A7D3DCDEA779FC9BDAA0CDD429DAB706
SHA-512:	AE240EAAC32EDB18FD76982FC01E03BD9C8E40A9EC1B9C42D7EBD225570B7517949E045942DBB9E40E620AA9DCC9FBE0182C6CF207AC0A44D7358AD33BA81472
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.X.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".T.h.i.s. .s.e.t.u.p. .p.r.o.g.r.a.m. .r.e.q.u.i.r.e.s. .a.n. .x.6.4. .p.l.a.t.f.o.r.m... .I.t. .c.a.n.n.o.t. .b.e. .i.n.s.t.a.l.l.e.d. .o.n. .t.h.i.s. .p.l.a.t.f.o.r.m...". ./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.I.A.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".T.h.i.s. .s.e.t.u.p. .p.r.o.g.r.a.m. .r.e.q.u.i.r.e.s. .a.n. .I.A.6.4. .p.l.a.t.f.o.r.m... .I.t. .c.a.n.n.o.t. .b.e. .i.n.s.t.a.l.l.e.d. .o.n. .t.h.i.s. .p.l.a.t.f.o.r.m...". ./.>..... . . . . . .<.T.e.x.t. .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1033\SetupResources.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17240
Entropy (8bit):	5.151474565875158
Encrypted:	false
SSDEEP:	192:byk5nUfwTW7JwWp0eW6jp8M+9HS8bC/TJs7kFkzQKPnEtObMacxc8hjeyveCXZBe:pgoTWp0eWB9ygC/TfFkzLXci2jpv8
MD5:	9547D24AC04B4D0D1DBF84F74F54FAF7
SHA1:	71AF6001C931C3DE7C98DDC337D89AB133FE48BB
SHA-256:	36D0159ED1A7D88000737E920375868765C0A1DD6F5A5ACBB79CF7D97D9E7A34
SHA-512:	8B6048F4185A711567679E2DE4789407077CE5BFE72102D3CB1F23051B8D3E6BFD5886C801D85B4E62F467DD12DA1C79026A4BC20B17F54C693B2F24E499D40F
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........(...............................................P......<f....@.......................................... ...%...........,..X............................................................................................text...G...........................@..@.rsrc....%... ...&..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1033\eula.rtf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	7080
Entropy (8bit):	4.934776172726828
Encrypted:	false
SSDEEP:	192:9fcddvfbS9u6zZ+kodpj4eQ1lhcgi5X90vJqpsSih2:y/fbSZ/odpjmlhcgi5NSkRA2
MD5:	19D028345AADCC05697EEC6D8C5B5874
SHA1:	70BD3D4D51373FB82F0257F28D5F3609BFC82520
SHA-256:	F4FF4EACE31B75176A0806E1693041D546D2599AEC0C77D295BAD09CAC7D9FE7
SHA-512:	9B3DFFEC7C1595197AF69E59094588541558BEF56982475DDDD2C9E3D75FC8B970B384452713632AE20435EC0CAEC6CC4CD8CEC9CD4B4809335FDC9F2CC7B842
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset0 Times New Roman;}{\f2\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2508;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\b\f0\fs20 MICROSOFT SOFTWARE LICENSE TERMS\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\f0 MICROSOFT VISUAL C++ 2010 RUNTIME LIBRARIES\f1\par..\pard\nowidctlpar\sb120\sa120\b0\f0 These license terms are an agreement between Microsoft Corporation (or based on where you live, one of its affiliates) and you. Please read them. They apply to the software named above, which includes the media on which you received it, if any. The terms also apply to any Microsoft\f1\par..\pard\nowidctlpar\fi-360\li360\sb120\sa120\tx360\f2\'b7\tab\f0 updates,\f1\par..\f2\'b7\tab\f0 supplements,\f1\par..\f2\'b7\tab\f0 Internet-based services, and \f1\par..\f2\'b7\tab\f0 support services\f1\par.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1036\LocalizedData.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (619), with CRLF line terminators
Category:	dropped
Size (bytes):	41524
Entropy (8bit):	3.5542569352968996
Encrypted:	false
SSDEEP:	192:4GrYAiJoFb1Z0eQiFaD4EbJeiI5l9MwLnIBknXoFXYnZCoroUnAJJFHq20/kFR/0:4GZwoR1c5ryhnbHIJR0kbG52gjfVv
MD5:	4CE519F7E9754EC03768EDEEDAEED926
SHA1:	213AE458992BF2C5A255991441653C5141F41B89
SHA-256:	BC4CA5AD609F0DD961263715E1F824524C43E73B744E55F90C703B759CAE4D31
SHA-512:	8F2FF08A234D8E2E6BA85DE3CD1C19A0B372D9FCA4FF0FC1BBA7FE7C5A165E933E2AF5F93FC587E9230A066B70FB55D9F58256DB509CC95A3B31D349F860F510
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.X.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".C.e. .p.r.o.g.r.a.m.m.e. .d.'.i.n.s.t.a.l.l.a.t.i.o.n. .r.e.q.u.i.e.r.t. .u.n.e. .p.l.a.t.e.f.o.r.m.e. .x.6.4... .I.l. .n.e. .p.e.u.t. .p.a.s. ...t.r.e. .i.n.s.t.a.l.l... .s.u.r. .c.e.t.t.e. .p.l.a.t.e.f.o.r.m.e..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.I.A.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".C.e. .p.r.o.g.r.a.m.m.e. .d.'.i.n.s.t.a.l.l.a.t.i.o.n. .r.e.q.u.i.e.r.t. .u.n.e. .p.l.a.t.e.f.o.r.m.e. .I.A.6.4... .I.l. .n.e. .p.e.u.t. .p.a.s. ...t.r.e. .i.n.s.t.a.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1036\SetupResources.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18776
Entropy (8bit):	5.112489568342605
Encrypted:	false
SSDEEP:	384:J7Z66AY9li3OoDDkbiWpQeWELXci2jpv8:JffiZDgycMi2jpv8
MD5:	93F57216FE49E7E2A75844EDFCCC2E09
SHA1:	DCCD52787F147E9581D303A444C8EE134AFC61A8
SHA-256:	2506827219B461B7C6C862DAE29C8BFF8CB7F4A6C28D2FF60724CAC70903987D
SHA-512:	EADFFB534C5447C24B50C7DEFA5902F9EB2DCC4CF9AF8F43FA889B3367EA25DFA6EA87FF89C59F1B7BBF7106888F05C7134718021B44337AE5B7D1F808303BB1
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........................................................P......B\|....@.......................................... ...+...........2..X............................................................................................text...G...........................@..@.rsrc....0... ...,..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1036\eula.rtf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	162915
Entropy (8bit):	5.023428742885146
Encrypted:	false
SSDEEP:	3072:Xn6ipERiA7JzI3ilBEBr97dQnKG5zpZ27KN4:KiZ
MD5:	BBBBB0BDA00FDA985BB39FEE5FD04FF8
SHA1:	3053CF30FAD92F133AD3EA7EEFB8C729D323EA00
SHA-256:	3CB591E6801E91FE58E79449F7C99B88C3BA0ACE5D922B4AA0C8F2CDD81854BD
SHA-512:	32CC1B0F033B13D7614F8BD80DE4D3F9D4668632010BCB563E90773FB2F4971D19206C46B0C2B0E55308CA14F4DEAF5EB415DAE5F2C0C4331B5DF0AE44B2F61E
Malicious:	false
Reputation:	low
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff38\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt ?l?r ???fc};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Times};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt ????????????????????????????\'a1\'a7??};}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}..{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma{\\falt ?? ??};}{\f39\fbidi \fswiss\f

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1040\LocalizedData.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (601), with CRLF line terminators
Category:	dropped
Size (bytes):	40320
Entropy (8bit):	3.5296220359665447
Encrypted:	false
SSDEEP:	384:4h9o3CMa9e1yzNZNs4fLCAEJ0o5H/PuRv:9aug8J1u
MD5:	FE6B23186C2D77F7612BF7B1018A9B2A
SHA1:	1528EC7633E998F040D2D4C37AC8A7DC87F99817
SHA-256:	03BBE1A39C6716F07703D20ED7539D8BF13B87870C2C83DDDA5445C82953A80A
SHA-512:	40C9C9F3607CAB24655593FC4766829516DE33F13060BE09F5EE65578824AC600CC1C07FE71CDD48BFF7F52B447FF37C0D161D755A69AC7DB7DF118DA6DB7649
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.X.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".I.l. .p.r.o.g.r.a.m.m.a. .d.i. .i.n.s.t.a.l.l.a.z.i.o.n.e. .r.i.c.h.i.e.d.e. .u.n.a. .p.i.a.t.t.a.f.o.r.m.a. .x.6.4... .I.m.p.o.s.s.i.b.i.l.e. .e.s.e.g.u.i.r.e. .l.'.i.n.s.t.a.l.l.a.z.i.o.n.e. .s.u. .q.u.e.s.t.a. .p.i.a.t.t.a.f.o.r.m.a..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.I.A.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".I.l. .p.r.o.g.r.a.m.m.a. .d.i. .i.n.s.t.a.l.l.a.z.i.o.n.e. .r.i.c.h.i.e.d.e. .u.n.a. .p.i.a.t.t.a.f.o.r.m.a. .I.A.6.4... .I.m.p.o.s.s.i.b.i.l.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1040\SetupResources.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18264
Entropy (8bit):	5.142702232041524
Encrypted:	false
SSDEEP:	384:77n6Tg7AtONBKHno5hWXeWFLXci2jpvz2:7XAbs+ZMi2jpvz2
MD5:	E4860FC5D4C114D5C0781714F3BF041A
SHA1:	864CE88E8AB1DB9AFF6935F9231521B6B72D5974
SHA-256:	6B2D479D2D2B238EC1BA9D14F9A68DC552BC05DCBCC9007C7BB8BE66DEFC643B
SHA-512:	39B0A97C4E83D5CCA1CCCCE494831ADBC18DF1530C02E6A2C13DAE66150F66A7C987A26CECB5587EA71DD530C8BE1E46922FE8C65AE94145D90B0A057C06548D
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........,...............................................P......^.....@.......................................... ...)...........0..X............................................................................................text...G...........................@..@.rsrc....0... ...*..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1040\eula.rtf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	189369
Entropy (8bit):	4.993456059906976
Encrypted:	false
SSDEEP:	3072:8K91dpBgRJA8J/snalBEm0OgKXIJR10GZybh2C:8aK
MD5:	F1602100F6C135AB5D8026E9248BAF02
SHA1:	DEBE92E8761F5320352DCFFE844FB25A10E9EA14
SHA-256:	284A8BBA438DA22A1B4F497B0B4ED1D9886184859527B87FF7350C83F198AB2D
SHA-512:	2A0FBEF3114B54EDB400D913D317A5097801834BEE0FB536B0FF645DD1CA40A1451945AD563119A5BA80F26B51CDA8B23E93BE71D7C82723AFEDE3CBF1DA00C6
Malicious:	false
Reputation:	low
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt ?l?r ???fc};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Times};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt ?????????????????????????????\'a1\'ec?};}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}..{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma{\\falt ?? ??};}{\f39\fbidi \fsw

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1041\LocalizedData.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (440), with CRLF line terminators
Category:	dropped
Size (bytes):	34294
Entropy (8bit):	4.383454074704535
Encrypted:	false
SSDEEP:	192:4O3Oo45AyAYcou3DDn6UrMhsrHZmxqJOXhNCGYHre3iR7v:4O3OoMIYcBCOXJ6koIv
MD5:	6F86B79DBF15E810331DF2CA77F1043A
SHA1:	875ED8498C21F396CC96B638911C23858ECE5B88
SHA-256:	F0F9DD1A9F164F4D2E73B4D23CC5742DA2C39549B9C4DB692283839C5313E04F
SHA-512:	CA233A6BF55E253EBF1E8180A326667438E1124F6559054B87021095EF16FFC6B0C87361E0922087BE4CA9CABD10828BE3B6CC12C4032CB7F2A317FDBD76F818
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.X.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".S0n0.0.0.0.0.0.0 ..0.0.0.0.0o0 .x.6.4. ..0.0.0.0.0.0.0n0.0.0.[a.h0W0f0D0~0Y0.0S0.0o0S0n0.0.0.0.0.0.0.0.0k0o0.0.0.0.0.0.0g0M0~0[0.0.0"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.I.A.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".S0n0.0.0.0.0.0.0 ..0.0.0.0.0o0 .I.A.6.4. ..0.0.0.0.0.0.0n0.0.0.[a.h0W0f0D0~0Y0.0S0.0o0S0n0.0.0.0.0.0.0.0.0k0o0.0.0.0.0.0.0g0M0~0[0.0.0"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.S.u.p.p.o.r.t.e.d.O.S.).". .L.o.c.a.l.i.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1041\SetupResources.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15704
Entropy (8bit):	5.929554826924656
Encrypted:	false
SSDEEP:	192:Cg0rjUfwtW1+/FuZhS5CSJk/lhAW5kEW1QKPnEtObMacxc8hjeyveCXPX:5hC7mS53JkNSW5kEW1LXci2jpvJ
MD5:	278FD7595B580A016705D00BE363612F
SHA1:	89A299A9ABECB624C3606267371B7C07B74B3B26
SHA-256:	B3ECD3AEA74D0D97539C4971C69F87C4B5FE478FC42A4A31F7E1593D1EBA073F
SHA-512:	838D23D35D8D042A208E8FA88487CD1C72DA48F336157D03B9549DD55C75DA60A83F6DD2B3107EB3E5A24F3FAD70AE1629ACC563371711117C3C3E299B59D838
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!........."...............................................@............@.......................................... ..h............&..X............................................................................................text...G...........................@..@.rsrc.... ... ... ..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1041\eula.rtf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	181054
Entropy (8bit):	4.962328655200384
Encrypted:	false
SSDEEP:	3072:7vykJ9MRJAwJjAXetBE1rRbe+KusGWqcJ2V:fJ
MD5:	89D66A0B94450729015D021BC8F859E9
SHA1:	C9AD4C7DCDAFEAD282DAA1C214E7A0EAB567FFD5
SHA-256:	6A1884515CC4378D732F681934658252A4B45D76CE7F53CF8650BE794CC8D390
SHA-512:	336A5B1CBF2F52DF5B151A564C8452826D253F9FC565C865D7BA37B91229996D9AE59603350BD5CD99352ED63D265D8578095560CB7DE67DA7E1AA2135FBF0FB
Malicious:	false
Reputation:	low
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff38\deff0\stshfdbch13\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt ?l?r ???fc};}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}..{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Times};}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}..{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt ??????????????????????????????\'a8\'ac};}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\*\falt Calisto MT};}{\f38\fbidi \fswiss\fcharset0\f

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1042\LocalizedData.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (439), with CRLF line terminators
Category:	dropped
Size (bytes):	32962
Entropy (8bit):	4.366645511984528
Encrypted:	false
SSDEEP:	192:4cxsW0TwUrhmUgEMDQdCAtTN/2JWCTJSIQvPaLWL2K4oH/Drv:4cxszjrxgEMDQdpFN7IJSIQvkQvLH/Pv
MD5:	E87AD0B3BF73F3E76500F28E195F7DC0
SHA1:	716B842F6FBF6C68DC9C4E599C8182BFBB1354DC
SHA-256:	43B351419B73AC266C4B056A9C3A92F6DFA654328163814D17833A837577C070
SHA-512:	D3EA8655D42A2B0938C2189CEEAB25C29939C302C2E2205E05D6059AFC2A9B2039B21C083A7C17DA1CE5EEBDC934FF327A452034E2E715E497BCD6239395774C
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.X.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".t. .$.X. ...\.....D. .....X.$.t. .x.6.4. ......t. .D..i..... .t. ......... .$.X.`. ... ........"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.I.A.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".t. .$.X. ...\.....D. .....X.$.t. .I.A.6.4. ......t. .D..i..... .t. ......... .$.X.`. ... ........"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.S.u.p.p.o.r.t.e.d.O.S.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".t. ..... ........... .M.i.c.r.o.s.o.f.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1042\SetupResources.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15192
Entropy (8bit):	5.9622226182057325
Encrypted:	false
SSDEEP:	192:Hpix6f+jYxzekdPKNS0N7gVCAMWpCeWRQKPnEtObMacxc8hjeyveCXmo+:3ibMj0lgRMWpCeWRLXci2jpv8o+
MD5:	FCFD69EC15A6897A940B0435439BF5FC
SHA1:	6DE41CABDB45294819FC003560F9A2D1E3DB9A7B
SHA-256:	90F377815E3C81FC9AE5F5B277257B82811417CA3FFEACD73BAB530061B3BE45
SHA-512:	4DC3580B372CEE1F4C01569BAEA8CD0A92BC613648DB22FF1855920E47387A151964B295A1126597B44BB0C596E8757B1FCF47CDA010F9BBB15A88F97F41B8BF
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!......... ...............................................@......v.....@.......................................... ...............$..X............................................................................................text...G...........................@..@.rsrc.... ... ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1042\eula.rtf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	351492
Entropy (8bit):	4.844773730829239
Encrypted:	false
SSDEEP:	768:bNK7z5n/OLs3+lAB4HeqyOOZjYCrv1MT2hhO0kN9okLgd80UKdF8K8Zb4ajD/y9m:bI79kaIDUhOhQAUiK/9/MjZr
MD5:	8203E9FC25A5720AFB8C43E8BE10C3B0
SHA1:	FC7D9B452B6D5475FD1EF61B78E8BC6E32F08974
SHA-256:	0EBD62213F41DFFA0BCD939BDC6ABC25096E95112C217FDF27CE661A19AD0866
SHA-512:	F95DCB9C25436AE322C240A0D0ABD9F4904A5AF313CAC5CB8C90C1A5460DAD8E983347AD7540C672046E4210945B053B75313BB6D10B44B2A0BF0024B400E81E
Malicious:	false
Reputation:	low
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch12\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt ?l?r ???fc};}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}..{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Times};}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}..{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}{\f12\fbidi \froman\fcharset129\fprq2{\\panose 02030600000101010101}Batang{\\falt \'b9\'d9\'c5\'c1};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\*\falt ??????????????????????????????\'a1\'a7};}{\f20\fbidi \froman\fcharset129\f

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1049\LocalizedData.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
Category:	dropped
Size (bytes):	40428
Entropy (8bit):	4.233211278958208
Encrypted:	false
SSDEEP:	384:4qwoGD2VLQa0inkyZfrOh+++NA3aJW5cGUT3CT+v:DVVJl
MD5:	1290BE72ED991A3A800A6B2A124073B2
SHA1:	DAC09F9F2CCB3B273893B653F822E3DFC556D498
SHA-256:	6BA9A2E4A6A58F5BB792947990E51BABD9D5151A7057E1A051CB007FEA2EB41C
SHA-512:	C0B8B4421FCB2AABE2C8C8773FD03842E3523BF2B75D6262FD8BD952ADC12C06541BDAE0219E89F9F9F8D79567A4FE4DFF99529366C4A7C5BF66C218431F3217
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.X.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...;.O. .M.B.>.9. .?.@.>.3.@.0.<.<.K. .C.A.B.0.=.>.2.:.8. .B.@.5.1.C.5.B.A.O. .?.;.0.B.D.>.@.<.0. .x.6.4... ...5. .=.5.;.L.7.O. .C.A.B.0.=.>.2.8.B.L. .=.0. .4.0.=.=.C.N. .?.;.0.B.D.>.@.<.C..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.I.A.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=."...;.O. .M.B.>.9. .?.@.>.3.@.0.<.<.K. .C.A.B.0.=.>.2.:.8. .B.@.5.1.C.5.B.A.O. .?.;.0.B.D.>.@.<.0. .I.A.6.4... ...5. .=.5.;.L.7.O. .C.A.B.0.=.>.2.8.B.L. .=.0. .4.0.=.=.C.N. .?.;.0.B.D.>.@.<.C.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1049\SetupResources.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18264
Entropy (8bit):	5.548909804205606
Encrypted:	false
SSDEEP:	192:eRBvnUfwVWBC623DV3SD1tt9WfXHT7nMsmxeW1QKPnEtObMacxc8hjeyveCXgFK1:e/C6+URiD1vwLoPeW1LXci2jpvaFHM
MD5:	7EF74AF6AB5760950A1D233C582099F1
SHA1:	BF79FF66346907446F4F95E1E785A03CA108EB5D
SHA-256:	658398F1B68D49ABD37FC3B438CD564992D4100ED2A0271CBF83173F33400928
SHA-512:	BBBB099AD24F41785706033962ACFC75039F583BEED40A7CDC8EDA366AB2C77F75A5B2792CF6AACB80B39B6B1BB84ECE372BE926FF3F51028FB404D2F6334D78
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........,...............................................P......O.....@.......................................... ..............0..X............................................................................................text...G...........................@..@.rsrc....0... .....................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\1049\eula.rtf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	213363
Entropy (8bit):	4.934134633374225
Encrypted:	false
SSDEEP:	6144:D/fSz7yMsMyN1FyRtXSWS3SoSalsySMDS7SmSJ8SUSPsBa5IqDSySipSAS6ASGS+:pG
MD5:	5B95EFBC01DC97EE9A6C6F64A49AA62D
SHA1:	A99C984A0D5E316FE60D588A3519F2D5C805C1DE
SHA-256:	0CFACFF2B63121AD1D71376E4A3799B93B7E6D278209FE4806CCA0F74830CFC1
SHA-512:	A0B19864E68945A74BCE24C8D5EB0050ABB66C6FF6A53D0482FFA70E93EEE2957608BB9BDE535718D56CD5D7509B4DD7A1786C99BC2120344293234B7A6C2A3B
Malicious:	false
Reputation:	low
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt ?l?r ???fc};}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}..{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Times};}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}..{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt ???????????????????????????????};}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}{\f38\fbidi \fswiss\fcharset0\fprq2{\\p

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\2052\LocalizedData.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (390), with CRLF line terminators
Category:	dropped
Size (bytes):	31138
Entropy (8bit):	4.240036868712424
Encrypted:	false
SSDEEP:	192:4QD7cJwYXzOnyqqgafOAXUmUfMcq0JywXk83GJPupIoxnb/2v:4QD7cJxXC/qgaffXUmUi0JyoknJY9b+v
MD5:	150B5C3D1B452DCCBE8F1313FDA1B18C
SHA1:	7128B6B9E84D69C415808F1D325DD969B17914CC
SHA-256:	6D4EB9DCA1CBCD3C2B39A993133731750B9FDF5988411F4A6DA143B9204C01F2
SHA-512:	A45A1F4F19A27558E08939C7F63894FF5754E6840DB86B8C8C68D400A36FB23179CAFF164D8B839898321030469B56446B5A8EFC5765096DEE5E8A746351E949
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.X.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".dk.[..z.^..Bl.O(u .x.6.4. .s^.S.0.N..(Wdks^.S.N.[.dk.z.^.0"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.I.A.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".dk.[..z.^..Bl.O(u .I.A.6.4. .s^.S.0.N..(Wdks^.S.N.[.dk.z.^.0"./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.U.n.S.u.p.p.o.r.t.e.d.O.S.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".dk.d\O.\|.~.N/e.c .M.i.c.r.o.s.o.f.t. .V.i.s.u.a.l. .C.+.+. .2.0.1.0. .R.e.d.i.s.t.r.i.b.u.t.a.b.l.e..0"./.>..... . . . . . .<.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\2052\SetupResources.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14168
Entropy (8bit):	6.010838262457833
Encrypted:	false
SSDEEP:	192:rsLnUfwVWtTXjuQShyjK7tWUEW5IQKPnEtObMacxc8hjeyveCXMOV:4eCTFhMKZWUEW5ILXci2jpvP
MD5:	407CDB7E1C2C862B486CDE45F863AE6E
SHA1:	308AEEBEB1E1663ACA26CE880191F936D0E4E683
SHA-256:	9DD9D76B4EF71188B09F3D074CD98B2DE6EA741530E4EA19D539AE3F870E8326
SHA-512:	7B4F43FC24EB30C234F2713C493B3C13928C591C77A3017E8DD806A41CCFEDD53B0F748B5072052F8F9AC43236E8320B19D708903E3F06C59C6ED3C12722494E
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........................................................@.......y....@.......................................... ............... ..X............................................................................................text...G...........................@..@.rsrc.... ... ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\2052\eula.rtf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	225202
Entropy (8bit):	4.985888615397263
Encrypted:	false
SSDEEP:	3072:0pvaMOA6EOEGJA7JDnbyiBTmAO3FQ31Rdz5Zq3Kho:6v+Ez0
MD5:	6E5BDDF58163B11C79577B35A87A4424
SHA1:	8AAA1008360F7B255A6A88AD02D3A00DEB8B0AE6
SHA-256:	D4A26E3756437CA8BA132AE3A73AA7A829478A847D6B9AB69A8090515CE9A60A
SHA-512:	21DD9D754C0A3A383F20259E87AA4769D6ECB36753039DCE8B644E16E0ABC3C94B4B850648E0369474C914655140E7F3CC3E808ED27E70892A863F61F8588C6E
Malicious:	false
Reputation:	low
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch31505\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt ?l?r ???fc};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Times};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt ??????????????????????????\'a1\'a7????};}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}..{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma{\\falt ?? ??};}{\f39\fbidi

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\3082\LocalizedData.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (616), with CRLF line terminators
Category:	dropped
Size (bytes):	40912
Entropy (8bit):	3.5296761558263756
Encrypted:	false
SSDEEP:	384:4fcA4U4d+uYWFHO/xGeftjG2QDu7Jr++dP8z3AzOrv:BoZWFu//xWCJi8Pg32Y
MD5:	05A95593C61C744759E52CAF5E13502E
SHA1:	0054833D8A7A395A832E4C188C4D012301DD4090
SHA-256:	1A3E5E49DA88393A71EA00D73FEE7570E40EDB816B72622E39C7FCD09C95EAD1
SHA-512:	00AEE4C02F9D6374560F7D2B826503AAB332E1C4BC3203F88FE82E905471EC43F92F4AF4FC52E46F377E4D297C2BE99DAF94980DF2CE7664C169552800264FD3
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.".>..... . .<.L.o.c.a.l.i.z.e.d.D.a.t.a.>..... . . . .<.L.a.n.g.u.a.g.e.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.X.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".E.s.t.e. .p.r.o.g.r.a.m.a. .d.e. .i.n.s.t.a.l.a.c.i...n. .r.e.q.u.i.e.r.e. .u.n.a. .p.l.a.t.a.f.o.r.m.a. .x.6.4... .N.o. .s.e. .p.u.e.d.e. .i.n.s.t.a.l.a.r. .e.n. .e.s.t.a. .p.l.a.t.a.f.o.r.m.a..."./.>..... . . . . . .<.T.e.x.t. .I.D.=.".#.(.l.o.c...B.l.o.c.k.e.r._.I.A.6.4.).". .L.o.c.a.l.i.z.e.d.T.e.x.t.=.".E.s.t.e. .p.r.o.g.r.a.m.a. .d.e. .i.n.s.t.a.l.a.c.i...n. .r.e.q.u.i.e.r.e. .u.n.a. .p.l.a.t.a.f.o.r.m.a. .I.A.6.4... .N.o. .s.e. .p.u.e.d.e. .i.n.s.t.a.l.a.r. .e.n. .e.s.t.a. .p.l.a.t.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\3082\SetupResources.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18776
Entropy (8bit):	5.182140892959793
Encrypted:	false
SSDEEP:	192:ZikgnUfwVWVCe8b1S2U85ZTYG1lmW+eWaQKPnEtObMacxc8hjXHUz1TrOYL18:Zlv6Lbg2zZTf1lmW+eWaLXci2jXHUx8
MD5:	B057315A8C04DF29B7E4FD2B257B75F4
SHA1:	D674D066DF8D1041599FCBDB3BA113600C67AE93
SHA-256:	51B174AE7EE02D8E84C152D812E35F140A61814F3AECD64E0514C3950060E9FE
SHA-512:	F1CD510182DE7BBF8D45068D1B3F72DE58C7B419EFC9768765DF6C180AB3E2D94F3C058143095A66C05BCB70B589D1A5061E5FEE566282E5DB49FFBDEA3C672F
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............{%......{".....Rich............................PE..L......K.........."!.........................................................P............@.......................................... .. *...........2..X............................................................................................text...G...........................@..@.rsrc....0... ...,..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\3082\eula.rtf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	152458
Entropy (8bit):	5.013297113523102
Encrypted:	false
SSDEEP:	3072:4zkouwFDNSMUYugRJA8J/snalBEm0OgKXIJR10GZybh2U:4zDNIYt
MD5:	A920D4F55EAE5FEBAB1082AB2BCC2439
SHA1:	CBD631427871B620E9C95417788BFCDD1CD0A2A5
SHA-256:	2FFF2122C4D176E074365775227D4208AF48F2F921BE7623EDC315CD345ACF0B
SHA-512:	28135FBD9D940F0DEEC7A059AB2998B034575CC5D6DD31B1BE501B60689860478B0A0AB5183C69B2ACBBB9C1A074BBAA215960B3FACC6A9A3B0170E27E7B2B47
Malicious:	false
Reputation:	low
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt ?l?r ???fc};}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New{\\falt Arial};}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol{\\falt Times};}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings{\\falt Symbol};}{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt ????????????????????????????\'a8\'ac??};}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math{\\falt Calisto MT};}..{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma{\\falt ?? ??};}{\f39\fbidi \fsw

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\DHtmlHeader.html

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	HTML document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	16118
Entropy (8bit):	3.6434775915277604
Encrypted:	false
SSDEEP:	192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
MD5:	CD131D41791A543CC6F6ED1EA5BD257C
SHA1:	F42A2708A0B42A13530D26515274D1FCDBFE8490
SHA-256:	E139AF8858FE90127095AC1C4685BCD849437EF0DF7C416033554703F5D864BB
SHA-512:	A6EE9AF8F8C2C7ACD58DD3C42B8D70C55202B382FFC5A93772AF7BF7D7740C1162BB6D38A4307B1802294A18EB52032D410E128072AF7D4F9D54F415BE020C9A
Malicious:	false
Reputation:	low
Preview:	..<.!.D.O.C.T.Y.P.E. .h.t.m.l. .P.U.B.L.I.C. .".-././.W.3.C././.D.T.D. .X.H.T.M.L. .1...1././.E.N.". .".h.t.t.p.:././.w.w.w...w.3...o.r.g./.T.R./.x.h.t.m.l.1.1./.D.T.D./.x.h.t.m.l.1.1...d.t.d.".>.....<.!.-.-. .T.h.e. .E.x.t.e.n.d.e.d. .C.o.p.y.r.i.g.h.t./.T.r.a.d.e.m.a.r.k. .L.a.n.g.u.a.g.e. .R.e.s.i.d.e.s. .A.t.:. .h.t.t.p.:././.w.w.w...m.i.c.r.o.s.o.f.t...c.o.m./.i.n.f.o./.c.p.y.r.t.I.n.f.r.g...h.t.m. .-.-.>.....<.h.t.m.l. .x.m.l.n.s.=.".h.t.t.p.:././.w.w.w...w.3...o.r.g./.1.9.9.9./.x.h.t.m.l.".>.....<.h.e.a.d.>.......<.m.e.t.a. .h.t.t.p.-.e.q.u.i.v.=.".C.o.n.t.e.n.t.-.T.y.p.e.". .c.o.n.t.e.n.t.=.".t.e.x.t./.h.t.m.l.;. .c.h.a.r.s.e.t.=.u.t.f.-.1.6."./.>.<.b.a.s.e. .t.a.r.g.e.t.=."._.b.l.a.n.k."./.>.......<.s.t.y.l.e. .t.y.p.e.=.".t.e.x.t./.c.s.s.".>.........h.t.m.l.{.o.v.e.r.f.l.o.w.:.s.c.r.o.l.l.}.........b.o.d.y.{.f.o.n.t.-.s.i.z.e.:.1.0.p.t.;.f.o.n.t.-.f.a.m.i.l.y.:.V.e.r.d.a.n.a.;.c.o.l.o.r.:.#.0.0.0.0.0.0.;.b.a.c.k.g.r.o.u.n.d.-.c.o.l.o.r.:.#.F.0.F.0.F.0.}...........h.e.a.d.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\DisplayIcon.ico

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Windows icon resource - 13 icons, 16x16, 16 colors, 4 bits/pixel, 16x16, 8 bits/pixel
Category:	dropped
Size (bytes):	88533
Entropy (8bit):	7.210526848639953
Encrypted:	false
SSDEEP:	1536:xWayqxMQP8ZOs0JOG58d8vo2zYOvvHAj/4/aXj/Nhhg73BVp5vEdb:e/gB4H8vo2no0/aX7C7Dct
MD5:	F9657D290048E169FFABBBB9C7412BE0
SHA1:	E45531D559C38825FBDE6F25A82A638184130754
SHA-256:	B74AD253B9B8F9FCADE725336509143828EE739CC2B24782BE3ECFF26F229160
SHA-512:	8B93E898148EB8A751BC5E4135EFB36E3AC65AF34EAAC4EA401F1236A2973F003F84B5CFD1BBEE5E43208491AA1B63C428B64E52F7591D79329B474361547268
Malicious:	false
Reputation:	low
Preview:	..............(...............h...............h...f... .............. .............. ..........^...00......h....#..00..........n)..00...........8........ .h....T.. .... .....&Y..00.... ..%...i........ ._...v...(....... ....................................................................................................w......x......................x..ww...........h...............................w.....w.x..........x................xwvwg.................................................................(....... ...................................jO:.mS?.qWD.v\I.\|cP..kX..q_..sa..yg..{j...p..nh..pj..uo..\|u..xq..\|r..\|u..rx..zy..\|w.}.y...q...d...y...{......S...]..d..i..r..\|...j..j...y...e...k...l..q...y...~...v...y..s..s..m...m...l...n...k...t...l.............................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\Graphics\Print.ico

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.923507556620034
Encrypted:	false
SSDEEP:	24:dOjNyw2aSGZHJi4U7Wf0mDX+QF7s/AemFAh:MjNyw/0NW9DOp/ANC
MD5:	7E55DDC6D611176E697D01C90A1212CF
SHA1:	E2620DA05B8E4E2360DA579A7BE32C1B225DEB1B
SHA-256:	FF542E32330B123486797B410621E19EAFB39DF3997E14701AFA4C22096520ED
SHA-512:	283D381AA396820B7E15768B20099D67688DA1F6315EC9F7938C2FCC3167777502CDED0D1BEDDF015A34CC4E5D045BCB665FFD28BA2FBB6FAF50FDD38B31D16E
Malicious:	false
Reputation:	low
Preview:	............ .h.......(....... ..... .....@.........................................................................................t?.fR.\|bN.y_K.v\H.rXD.oUA.kQ=.hN:.eK7.cI5.cI5.cI5i.........th<..z............................................cI5.cI5...................................................qXE.cI5.cI5.......~.............................................}eS.kR>.cI5......................................................q`.w^L.cI5..............................z..~n..sb..jX.{bP.t[H..~m..kY.nT@.......................................................{..wf.zaM.......vO.......................q..r`.}cQ.w]J..lZ.......t.x^J...........}Z..................................z`M........{aM...............0..............................jY.{aO...........................................................x^K.x^Kk.....................................................n\.y_L...........................r...............................y_L.x^K&.........................s.............

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\Graphics\Rotate1.ico

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
Category:	dropped
Size (bytes):	894
Entropy (8bit):	2.5118974066097444
Encrypted:	false
SSDEEP:	6:kRKqNllGuv/ll2dL/rK//dlQt0tlWMlMN8Fq/wbD4tNZDlNc367YCm6p+Wvtjlpr:pIGOmDAQt8n+uNbctNZ5w6AsXjKHRp5c
MD5:	26A00597735C5F504CF8B3E7E9A7A4C1
SHA1:	D913CB26128D5CA1E1AC3DAB782DE363C9B89934
SHA-256:	37026C4EA2182D7908B3CF0CEF8A6F72BDDCA5F1CFBC702F35B569AD689CF0AF
SHA-512:	08CEFC5A2B625F261668F70CC9E1536DC4878D332792C751884526E49E7FEE1ECFA6FCCFDDF7BE80910393421CC088C0FD0B0C27C7A7EFF2AE03719E06022FDF
Malicious:	false
Reputation:	low
Preview:	..............h.......(....... .......................................................................................................................................................................................t.r........................................p.nn.l\|.z..........................................g.e.......................................................................................P.N..........................................P.OG.FP.O..........................................?.>...................................................................................................+...........................................3.2%.$+...........................................!. ............{.{.............................................................................................~.~..................................G.......................................G..........

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\Graphics\Rotate2.ico

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
Category:	dropped
Size (bytes):	894
Entropy (8bit):	2.5178766234336925
Encrypted:	false
SSDEEP:	12:pmZX5+9wQaxWbwW3h/7eHzemn0iLHRp5c:Md5EaxWbh/Cnt4
MD5:	8419CAA81F2377E09B7F2F6218E505AE
SHA1:	2CF5AD8C8DA4F1A38AAB433673F4DDDC7AE380E9
SHA-256:	DB89D8A45C369303C04988322B2774D2C7888DA5250B4DAB2846DEEF58A7DE22
SHA-512:	74E504D2C3A8E82925110B7CFB45FDE8A4E6DF53A188E47CF22D664CBB805EBA749D2DB23456FC43A86E57C810BC3D9166E7C72468FBD736DA6A776F8CA015D1
Malicious:	false
Reputation:	low
Preview:	..............h.......(....... ...............................................................................................................................................................................................................................................................................................................................................................................r.p..........................................q.oj.hq.o..........................................b.`...................................................................................................J.I..................\|.\|...y.y...............Q.PC.BF.E..........................................>.=.........".!..........................................2.1".!'.&..........................................".!.....................................G.......................................G..........

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\Graphics\Rotate3.ico

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
Category:	dropped
Size (bytes):	894
Entropy (8bit):	2.5189797450574103
Encrypted:	false
SSDEEP:	12:pPrMIMxPWk3AyORrabBQ+gra2/MXWM4xfQHRp5c:1gxPbXlBQ+gr1ffO4
MD5:	924FD539523541D42DAD43290E6C0DB5
SHA1:	19A161531A2C9DBC443B0F41B97CBDE7375B8983
SHA-256:	02A7FE932029C6FA24D1C7CC06D08A27E84F43A0CBC47B7C43CAC59424B3D1F6
SHA-512:	86A4C5D981370EFA20183CC4A52C221467692E91539AC38C8DEF1CC200140F6F3D9412B6E62FAF08CA6668DF401D8B842C61B1F3C2A4C4570F3B2CEC79C9EE8B
Malicious:	false
Reputation:	low
Preview:	..............h.......(....... .................................................................................................................................................................................................................................................................................................................................................................................................................z.z...{.{...........................................................................................................................................................s.q..........................................y.wl.jl.j...............3.2#."*.)..................f.d.........E.D.........(.'..............................U.TE.DF.E..........................................E.D.....................................G.......................................G..........

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\Graphics\Rotate4.ico

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
Category:	dropped
Size (bytes):	894
Entropy (8bit):	2.5119705312617957
Encrypted:	false
SSDEEP:	6:kRK///FleTxml+SzNaoT9Q0/lHOmMdrYln8OUo/XRWl2XOXFBYpqnHp/p5c:p///FPwxUrMunUofRReFNHRp5c
MD5:	BB55B5086A9DA3097FB216C065D15709
SHA1:	1206C708BD08231961F17DA3D604A8956ADDCCFE
SHA-256:	8D82FF7970C9A67DA8134686560FE3A6C986A160CED9D1CC1392F2BA75C698AB
SHA-512:	DE9226064680DA6696976A4A320E08C41F73D127FBB81BF142048996DF6206DDB1C2FE347C483CC8E0E50A00DAB33DB9261D03F1CD7CA757F5CA7BB84865FCA9
Malicious:	false
Reputation:	low
Preview:	..............h.......(....... .............................................................................................................................................................................................................y.y...\|.\|.............................................................................................................................................................................................................................................,.+".!,.+.........................................(.'......................................................................................=.<..........................................S.RC.BG.F.............................j.h.........H.G..............................y.wj.hi.g..........................................j.h.....................................G.......................................G..........

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\Graphics\Rotate5.ico

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
Category:	dropped
Size (bytes):	894
Entropy (8bit):	2.5083713071878764
Encrypted:	false
SSDEEP:	6:kRKi+Blqkl/QThulVDYa5a//ItEl/aotzauakg//5aM1lkl05Kaag2/JqnHp/p5c:pXBHehqSayIylrtBg/bk4AgzHRp5c
MD5:	3B4861F93B465D724C60670B64FCCFCF
SHA1:	C672D63C62E00E24FBB40DA96A0CC45B7C5EF7F0
SHA-256:	7237051D9AF5DB972A1FECF0B35CD8E9021471740782B0DBF60D3801DC9F5F75
SHA-512:	2E798B0C9E80F639571525F39C2F50838D5244EEDA29B18A1FAE6C15D939D5C8CD29F6785D234B54BDA843A645D1A95C7339707991A81946B51F7E8D5ED40D2C
Malicious:	false
Reputation:	low
Preview:	..............h.......(....... .................................................................................................{.{...~.~.......................................................................................}.}.........................................................).(#."2.1..........................................).(...................................................................................................=.<..........................................N.ME.DN.M..........................................M.L.......................................................................................e.c..........................................z.xl.jm.k........................................r.p........................................................................................................................G.......................................G..........

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\Graphics\Rotate6.ico

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
Category:	dropped
Size (bytes):	894
Entropy (8bit):	2.5043420982993396
Encrypted:	false
SSDEEP:	12:pjs+/hlRwx5REHevtOkslTaGWOpRFkpRHkCHRp5c:tZ/u+HeilBh/F+Rd4
MD5:	70006BF18A39D258012875AEFB92A3D1
SHA1:	B47788F3F8C5C305982EB1D0E91C675EE02C7BEB
SHA-256:	19ABCEDF93D790E19FB3379CB3B46371D3CBFF48FE7E63F4FDCC2AC23A9943E4
SHA-512:	97FDBDD6EFADBFB08161D8546299952470228A042BD2090CD49896BC31CCB7C73DAB8F9DE50CDAF6459F7F5C14206AF7B90016DEEB1220943D61C7324541FE2C
Malicious:	false
Reputation:	low
Preview:	..............h.......(....... .................................................................................................... ............................................$.$ ..0./...........................{.{............ ...........<.;..........................................C.BA.@O.N...............{.{...~.~..................G.F..................................................................................................._.]..........................................n.lg.en.l..........................................p.n...............................................................................................................................................................................................................................................................................................................G.......................................G..........

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\Graphics\Rotate7.ico

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
Category:	dropped
Size (bytes):	894
Entropy (8bit):	2.4948009720290445
Encrypted:	false
SSDEEP:	6:kRKIekllisUriJ2IP+eX8iDml8mS8+hlxllwqlllkg2klHYdpqnHp/p5c:p8os0iieX8iNVHX//x2sHYdoHRp5c
MD5:	FB4DFEBE83F554FAF1A5CEC033A804D9
SHA1:	6C9E509A5D1D1B8D495BBC8F57387E1E7E193333
SHA-256:	4F46A9896DE23A92D2B5F963BCFB3237C3E85DA05B8F7660641B3D1D5AFAAE6F
SHA-512:	3CAEB21177685B9054B64DEC997371C4193458FF8607BCE67E4FBE72C4AF0E6808D344DD0D59D3D0F5CE00E4C2B8A4FFCA0F7D9352B0014B9259D76D7F03D404
Malicious:	false
Reputation:	low
Preview:	..............h.......(....... ....................................................................................................G.F..........................................H.GG.FX.V..............................).(.........G.F.........i.g..................+.*%.$5.4...............n.ln.l{.y.................. .......................u.s............................................................................................................................................................~.~...~.~.................................................................................................................................................................................................................................................................................................................................................G.......................................G..........

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\Graphics\Rotate8.ico

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
Category:	dropped
Size (bytes):	894
Entropy (8bit):	2.513882730304912
Encrypted:	false
SSDEEP:	12:pPv1OuTerb53mpOBfXjQuZfKWpIXE1D6HRp5c:91OEerb53eUQsflpIP4
MD5:	D1C53003264DCE4EFFAF462C807E2D96
SHA1:	92562AD5876A5D0CB35E2D6736B635CB5F5A91D9
SHA-256:	5FB03593071A99C7B3803FE8424520B8B548B031D02F2A86E8F5412AC519723C
SHA-512:	C34F8C05A50DC0DE644D1F9D97696CDB0A1961C7C7E412EB3DF2FD57BBD34199CF802962CA6A4B5445A317D9C7875E86E8E62F6C1DF8CC3415AFC0BD26E285BD
Malicious:	false
Reputation:	low
Preview:	..............h.......(....... ....................................................................................................g.e..........................................g.eg.ew.u..............................F.E.........g.e..............................E.DA.@P.O..........................................:.9......................................................................................&.%.........................................+.* ..+.*..................................................................................................................................................{.{.......................................................................................~.~...{.{..............................................................................................................................................G.......................................G..........

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\Graphics\Save.ico

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.824239610266714
Encrypted:	false
SSDEEP:	24:Br5ckw0Pce/WPv42lPpJ2/BatY9Y4ollEKeKzn:h6kPccWPQS2UtEYFEKeu
MD5:	7D62E82D960A938C98DA02B1D5201BD5
SHA1:	194E96B0440BF8631887E5E9D3CC485F8E90FBF5
SHA-256:	AE041C8764F56FD89277B34982145D16FC59A4754D261C861B19371C3271C6E5
SHA-512:	AB06B2605F0C1F6B71EF69563C0C977D06C6EA84D58EF7F2BAECBA566D6037D1458C2B58E6BFD70DDEF47DCCBDEA6D9C2F2E46DEA67EA9E92457F754D7042F67
Malicious:	false
Reputation:	low
Preview:	............ .h.......(....... ..... .....@........................................................................................klT.de..UV..RS..OP..MM..JJ..GG..DD..AA.x;<.x;<.r99.n67..........kl......D$.G2!...............VMH..>3..=6..91.r99..........op.........q[K.G<4..xh...........s..A5..B<..=5.x;<..........uv...........q[K.....G<4..........tg..KC..ID..B<.}>>..........{\|.............q[K.q[K.q[K.q[K.vbR.}j[..VT..OL..ID..AA...............................yz..qr..kl..]\..VT..PL..DD.....................c`..^V..XK..R?..M4..G(..A...;...]\..VT..GG................fg.................................;...]\..JJ................mn..................................A...gg..MM................vw..................................G(..qr..OP..................................................M4..yz..RS..................................................R?.g33..UV....................................................XK..XY..XY..................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\Graphics\Setup.ico

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Windows icon resource - 12 icons, 16x16, 16 colors, 4 bits/pixel, 16x16, 8 bits/pixel
Category:	dropped
Size (bytes):	36710
Entropy (8bit):	5.3785085024370805
Encrypted:	false
SSDEEP:	384:IXcWz9GU46B4riEzg8CKcqxkk63gBh6wSphnBcI/ObMFp2rOebgcjTQcho:IMWQ2Bf8qqxMQP8pc4XessTJo
MD5:	3D25D679E0FF0B8C94273DCD8B07049D
SHA1:	A517FC5E96BC68A02A44093673EE7E076AD57308
SHA-256:	288E9AD8F0201E45BC187839F15ACA79D6B9F76A7D3C9274C80F5D4A4C219C0F
SHA-512:	3BDE668004CA7E28390862D0AE9903C756C16255BDBB3F7E73A5B093CE6A57A3165D6797B0A643B254493149231ACA7F7F03E0AF15A0CBE28AFF02F0071EC255
Malicious:	false
Reputation:	low
Preview:	..............(...............h...............h...V... .............. .............. ..........N...00......h...."..00..........^)..00...........8........ .h....T.. .... ......Y..00.... ..%...i..(....... ....................................................................................................w......x......................x..ww...........h...............................w.....w.x..........x................xwvwg.................................................................(....... ...................................jO:.mS?.qWD.v\I.\|cP..kX..q_..sa..yg..{j...p..nh..pj..uo..\|u..xq..\|r..\|u..rx..zy..\|w.}.y...q...d...y...{......S...]..d..i..r..\|...j..j...y...e...k...l..q...y...~...v...y..s..s..m...m...l...n...k...t...l..........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\Graphics\SysReqMet.ico

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.038533294442847
Encrypted:	false
SSDEEP:	24:MuoBP5lj49s9NRDe4LakKcTM8cv99uGzMN:MlFH3/Ri4LaN3q
MD5:	661CBD315E9B23BA1CA19EDAB978F478
SHA1:	605685C25D486C89F872296583E1DC2F20465A2B
SHA-256:	8BFC77C6D0F27F3D0625A884E0714698ACC0094A92ADCB6DE46990735AE8F14D
SHA-512:	802CC019F07FD3B78FCEFDC8404B3BEB5D17BFC31BDED90D42325A138762CC9F9EBFD1B170EC4BBCCCF9B99773BD6C8916F2C799C54B22FF6D5EDD9F388A67C6
Malicious:	false
Reputation:	low
Preview:	............ .h.......(....... ..... .....@..........................................M...........S...........................................q.......................z...................................;........q.c.P.K.\|.}............C....................................;.!......................................................Ry,.*w..!.............-.........................................6b..8v................ .+.@............#....................4u..;a..............H.<.........=.C.............................&y..x.e.................$}......................................<.).........\.A............}..................................[.R.}.n.Z.C.y.Y.k.L............. q..............................t.s............r...k.........]{G..............................................y.`.z.h.a.N.e.P...............................................~.q._.J...............................8....................t.p..................?..................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\Graphics\SysReqNotMet.ico

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.854644771288791
Encrypted:	false
SSDEEP:	24:u2iVNINssNQhYMEyfCHWZZ7rTRrbWjcyuE:uDW871fdZ1lbWjME
MD5:	EE2C05CC9D14C29F586D40EB90C610A9
SHA1:	E571D82E81BD61B8FE4C9ECD08869A07918AC00B
SHA-256:	3C9C71950857DDB82BAAB83ED70C496DEE8F20F3BC3216583DC1DDDA68AEFC73
SHA-512:	0F38FE9C97F2518186D5147D2C4A786B352FCECA234410A94CC9D120974FC4BE873E39956E10374DA6E8E546AEA5689E7FA0BEED025687547C430E6CEFFABFFB
Malicious:	false
Reputation:	low
Preview:	............ .h.......(....... ..... .....@....................................../..F..........!....n....d..................................;.............,+..AB..UV..XZ...1.....S......................U.....................EE..\[..rr......NP.....^..............<s.....................!.$)..AC..jj..ww..{{..57.....4........01.................H..........N?8;..[[..ba..`_..TU....L.......bj]^..QP.........:..........)N#&..>=..GG..HI..IJ..EE..!#......24..mm..hh..,.............+N........)(..-.....{-...-,........ SPS..zy..qr....qq......0NCE..33..%%........ZJ...."$..0/../1....?qRU............W}..)A]^..rr..qq..Y[...._z........CE..RQ..AC....8`79.........SU..ab......\|\|..ef....ey...........QZ[..ZZ..=?.....(...d....................pr.....H............IK..jj..fg..,..........]_..................[y.......(..:VQS..{z..ut..ab....'H...........?................\|\|..ef..jk..................$%d....................W....................................*,n.............................HI......................WY

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\Graphics\Thumbs.db

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	3.6041802545422055
Encrypted:	false
SSDEEP:	24:rPg0To0XxDuLHeOWXG4OZ7DAJuLHenX3YgK02sf:rPg7uERAdKRE
MD5:	B8C966F9C351E5A532ACD1F3655081A2
SHA1:	73AFA516DD4BC2823BB594B1054E35A9C67B2554
SHA-256:	67109E74677B525D239F2D2D3B83CC0C082779B3B1D6645F5BABDB6490B95D45
SHA-512:	2AF995FCFBBD1415781CD8CF669C15804289CD3D31B90ED193B49D93D523092106B562335E61F81AD02055D4158548980F67894144AD5F605719940606DA551A
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\Graphics\stop.ico

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 16 colors, 4 bits/pixel, 16x16, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	6.016582854640062
Encrypted:	false
SSDEEP:	96:uC1kqWje1S/f1AXa0w+2ZM4xD02EuZkULqcA0zjrpthQ2Ngms9+LmODclhpjdfLt:JkqAFqroMS9lD9Ngr9+m7bxpXHT5ToYR
MD5:	5DFA8D3ABCF4962D9EC41CFC7C0F75E3
SHA1:	4196B0878C6C66B6FA260AB765A0E79F7AEC0D24
SHA-256:	B499E1B21091B539D4906E45B6FDF490D5445256B72871AECE2F5B2562C11793
SHA-512:	69A13D4348384F134BA93C9A846C6760B342E3A7A2E9DF9C7062088105AC0B77B8A524F179EFB1724C0CE168E01BA8BB46F2D6FAE39CABE32CAB9A34FC293E4A
Malicious:	false
Reputation:	low
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@......................................................................................................wwx...........w....w.........x....x.........x.y.......................p..............x.........q.......p.........q.................xy...........q.......................p.............y..................x.y..............y.y.............yyy.........S........x..........yy.............x.yyyx......................Q.8.........x..............y....qy.p...y.....x.....p........y....9.....y....yy..yx.......y..yyyw..p.....y.yyyyy................x.p........y.yy..........x...x............x.................wwx.....................?...................................................................................................?............(....... ..................................................................................................ww.....w..........xx..x........x....p........xy

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\Graphics\warn.ico

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 16 colors, 4 bits/pixel, 16x16, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	4.3821301214809045
Encrypted:	false
SSDEEP:	192:USAk9ODMuYKFfmiMyT4dvsZQl+g8DnPUmXtDV3EgTtc:r9wM7pyEBlcgssmXpVUgJc
MD5:	B2B1D79591FCA103959806A4BF27D036
SHA1:	481FD13A0B58299C41B3E705CB085C533038CAF5
SHA-256:	FE4D06C318701BF0842D4B87D1BAD284C553BAF7A40987A7451338099D840A11
SHA-512:	5FE232415A39E0055ABB5250B120CCDCD565AB102AA602A3083D4A4705AC6775D45E1EF0C2B787B3252232E9D4673FC3A77AAB19EC79A3FF8B13C4D7094530D2
Malicious:	false
Reputation:	low
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@................................................................................................................................................................wwwww.....wwww...................3333333333338...{....3s.....x...{....0G;.............0.;...7.........33....8.....{...33..............0....7...............8.......{....;.............0.;.............0...8...........4...............wu;.............ww;.............ww;?...........;ww;.............7w................................8.............{...................................................................................................................................................................?...?..................................................?...?.........(....... ........................................................................................................333333;...............8.........;........

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\ParameterInfo.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (314), with CRLF line terminators
Category:	dropped
Size (bytes):	9752
Entropy (8bit):	3.5715293676289863
Encrypted:	false
SSDEEP:	192:gCEIVvHBZC30jzG2aks2G2XVEP2G2KQ6G2nCw+KFl:JFnGMGZeGPGYCrKFl
MD5:	03E01A43300D94A371458E14D5E41781
SHA1:	C5AC3CD50FAE588FF1C258EDAE864040A200653C
SHA-256:	19DE712560E5A25C5D67348996E7D4F95E8E3DB6843086F52CB7209F2098200A
SHA-512:	E271D52264FF979AE429A4053C945D7E7288F41E9FC6C64309F0AB805CEC166C825C2273073C4EF9CA5AB33F00802457B17DF103A06CBC35C54642D146571BBB
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .x.m.l.n.s.:.i.r.o.n.m.a.n.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p./.2.0.0.8./.0.1./.i.m.". .S.e.t.u.p.V.e.r.s.i.o.n.=.".1...0.".>..... . .<.U.I. .D.l.l.=.".S.e.t.u.p.U.i...d.l.l.". .N.a.m.e.=.".M.i.c.r.o.s.o.f.t. .V.i.s.u.a.l. .C.+.+. .2.0.1.0. . .x.6.4. .R.e.d.i.s.t.r.i.b.u.t.a.b.l.e. .S.e.t.u.p.". .V.e.r.s.i.o.n.=.".1.0...0...3.0.3.1.9.". ./.>..... . .<.C.o.n.f.i.g.u.r.a.t.i.o.n.>..... . . . .<.D.i.s.a.b.l.e.d.C.o.m.m.a.n.d.L.i.n.e.S.w.i.t.c.h.e.s.>..... . . . . . .<.C.o.m.m.a.n.d.L.i.n.e.S.w.i.t.c.h. .N.a.m.e.=.".c.r.e.a.t.e.l.a.y.o.u.t.". ./.>..... . . . .<./.D.i.s.a.b.l.e.d.C.o.m.m.a.n.d.L.i.n.e.S.w.i.t.c.h.e.s.>..... . . . .<.U.s.e.r.E.x.p.e.r.i.e.n.c.e.D.a.t.a.C.o.l.l.e.c.t.i.o.n. .P.o.l.i.c.y.=.".U.s.e.r.C.o.n.t.r.o.l.l.e.d.". ./.>..... . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\Setup.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	78152
Entropy (8bit):	6.011592088917562
Encrypted:	false
SSDEEP:	1536:sYNItbBL5NWiiESc0exWZnqxMQP8ZOs0JD9rHUq:sYNAB9NWTZctc/gBJ9oq
MD5:	006F8A615020A4A17F5E63801485DF46
SHA1:	78C82A80EBF9C8BF0C996DD8BC26087679F77FEA
SHA-256:	D273460AA4D42F0B5764383E2AB852AB9AF6FECB3ED866F1783869F2F155D8BE
SHA-512:	C603ED6F3611EB7049A43A190ED223445A9F7BD5651100A825917198B50C70011E950FA968D3019439AFA0A416752517B1C181EE9445E02DA3904F4E4B73CE76
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.................j.}.....].v.....h.w.....\.H...v.e.\|.......B.....h.~.....Y.\|.....].~.....m.~.....l.~.....k.~...Rich............PE..L......K.........."......f...........+............@..........................P............@...... ..................pu..x...Tp..<.......................H....@...... ................................(..@............................................text....e.......f.................. ..`.data................j..............@....rsrc................v..............@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\SetupEngine.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	807256
Entropy (8bit):	6.357664904941565
Encrypted:	false
SSDEEP:	24576:GS62nlYAqK/AitUgiuVQk/oifPNJIkjbSTzR8NmsBJj:GS62nlYAltBjPNJIkHST18QsBJ
MD5:	84C1DAF5F30FF99895ECAB3A55354BCF
SHA1:	7E25BA36BCC7DEED89F3C9568016DDB3156C9C5A
SHA-256:	7A0D281FA802D615EA1207BD2E9EBB98F3B74F9833BBA3CB964BA7C7E0FB67FD
SHA-512:	E4FB7E4D39F094463FDCDC4895AB2EA500EB51A32B6909CEC80A526BBF34D5C0EB98F47EE256C0F0865BF3169374937F047BF5C4D6762779C8CA3332B4103BE3
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................&......&.......R.....z.....O.....{......B...........O.....~.....J.....K.....L....Rich...........................PE..L......K.........."!................Y...............................................;.....@.....................................h....................:..X...............................................@............................................text............................... ..`.data...8...........................@....rsrc................f..............@..@.reloc...............p..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\SetupUi.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	295248
Entropy (8bit):	6.262127887617593
Encrypted:	false
SSDEEP:	3072:/LTVUK59JN+C0iy4Ww8oBcPFIOrvHvr8QDZHAAKWiIHT6llN1QkvQZaiionv5y/y:HOoMFrz8ygAKWiiIyKf73w
MD5:	EB881E3DDDC84B20BD92ABCEC444455F
SHA1:	E2C32B1C86D4F70E39DE65E9EBC4F361B24FF4A1
SHA-256:	11565D97287C01D22AD2E46C78D8A822FA3E6524561D4C02DFC87E8D346C44E7
SHA-512:	5750CEC73B36A3F19BFB055F880F3B6498A7AE589017333F6272D26F1C72C6F475A3308826268A098372BBB096B43FBD1E06E93EECC0A81046668228BC179A75
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............I...I...I..bI...I..WI...I..cI..I..ZI...I...IG..I..WI...I..fI...I..RI...I..SI...I..TI...IRich...I................PE..L......K.........."!................................................................yq....@..........................................P...............j..P....`..0?..................................`z..@............................................text............................... ..`.data....Q.......4..................@....rsrc........P......................@..@.reloc...T...`...V..................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\SetupUi.xsd

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (335), with CRLF line terminators
Category:	dropped
Size (bytes):	30120
Entropy (8bit):	4.990211039591874
Encrypted:	false
SSDEEP:	768:hlzLm8eYhsPs05F8/ET/chT+cxcW8G2P4oeTMC:1wchT+cxcDm
MD5:	2FADD9E618EFF8175F2A6E8B95C0CACC
SHA1:	9AB1710A217D15B192188B19467932D947B0A4F8
SHA-256:	222211E8F512EDF97D78BC93E1F271C922D5E91FA899E092B4A096776A704093
SHA-512:	A3A934A8572FF9208D38CF381649BD83DE227C44B735489FD2A9DC5A636EAD9BB62459C9460EE53F61F0587A494877CD3A3C2611997BE563F3137F8236FFC4CA
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema".. xmlns="http://schemas.microsoft.com/SetupUI/2008/01/imui".. xmlns:imui="http://schemas.microsoft.com/SetupUI/2008/01/imui".. targetNamespace="http://schemas.microsoft.com/SetupUI/2008/01/imui".. elementFormDefault="qualified"..attributeFormDefault="unqualified"..>.... <xs:annotation>.. <xs:documentation>.. Copyright (c) Microsoft Corporation. All rights reserved... Schema for describing DevDiv "Setup UI Info".. </xs:documentation>.. </xs:annotation>.... <xs:element name="SetupUI">.. <xs:annotation>.. <xs:documentation>specifies UI dll, and lists of MSIs MSPs and EXEs</xs:documentation>.. </xs:annotation>.. <xs:complexType>.. <xs:sequence>.. <xs:choice>.. <xs:element ref="UI" minOccurs="1" maxOccurs="1"></xs:element>.. <xs:element ref="Strings" minOccurs="1" maxOccurs="1"></xs:element>..

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\SplashScreen.bmp

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PC bitmap, Windows 3.x format, 200 x 200 x 8, image size 40000, resolution 3779 x 3779 px/m, cbSize 41078, bits offset 1078
Category:	dropped
Size (bytes):	41078
Entropy (8bit):	0.3169962482036715
Encrypted:	false
SSDEEP:	24:SgrNa0EfB4elU+jB+rQXJH4+Cs77hIfVHCv4ToqIzgPc8wcKHL+3:3pa0e4YjB5vAHk4E7zgPcDc53
MD5:	43B254D97B4FB6F9974AD3F935762C55
SHA1:	F94D150C94064893DAED0E5BBD348998CA9D4E62
SHA-256:	91A21EBA9F5E1674919EE3B36EFA99714CFB919491423D888CB56C0F25845969
SHA-512:	46527C88F0AED25D89833B9BE280F5E25FFCEAE6BC0653054C8B6D8EBE34EBA58818A0A02A72BD29279310186AC26D522BBF34191FBDE279A269FC9DA5840ACC
Malicious:	false
Reputation:	low
Preview:	BMv.......6...(...................@.......................{7...>...h?..D...N...K..........xE..._#..q..T...X...Q...[..._...c...j....>.!....f...v...r...."..v....0....... ..........4..I.........[...}..............j.............................................................................................................i......................@>1.......................................................o...u...u...z...z...~............................................................................................................................................................................{...~.................................................................................................................yw`......................................................................................................................................................//'...........................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\Strings.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	14246
Entropy (8bit):	3.70170676934679
Encrypted:	false
SSDEEP:	384:VAZo71GHY3vqaqMnYfHHVXIHjfBHwnwXCa+F:VAB
MD5:	332ADF643747297B9BFA9527EAEFE084
SHA1:	670F933D778ECA39938A515A39106551185205E9
SHA-256:	E49545FEEAE22198728AD04236E31E02035AF7CC4D68E10CBECFFD08669CBECA
SHA-512:	BEA95CE35C4C37B4B2E36CC1E81FC297CC4A8E17B93F10423A02B015DDB593064541B5EB7003560FBEEE512ED52869A113A6FB439C1133AF01F884A0DB0344B0
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p.U.I. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p.U.I./.2.0.0.8./.0.1./.i.m.u.i.". ..... . . . . . . . . .x.m.l.n.s.:.i.m.u.i.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p.U.I./.2.0.0.8./.0.1./.i.m.u.i.". .>..... . .<.S.t.r.i.n.g.s.>..... . . . .<.!.-.-. .R.e.f.l.e.c.t.i.v.e. .p.r.o.p.e.r.t.y. .p.a.g.e. .-.-.>..... . . . .<.I.D.S._.C.A.P.T.I.O.N._.F.O.R.M.A.T._.1.S.>.#.(.l.o.c...i.d.s._.c.a.p.t.i.o.n._.f.o.r.m.a.t._.1.s.).<./.I.D.S._.C.A.P.T.I.O.N._.F.O.R.M.A.T._.1.S.>..... . . . .<.I.D.S._.I.S._.R.E.A.L.L.Y._.C.A.N.C.E.L.>.#.(.l.o.c...i.d.s._.i.s._.r.e.a.l.l.y._.c.a.n.c.e.l.).<./.I.D.S._.I.S._.R.E.A.L.L.Y._.C.A.N.C.E.L.>......... . . . .<.!.-.-. .S.y.s.t.e.m. .R.e.q.u.i.r.e.m.e.n.t.s. .p.a.g.e. .-.-.>..... . . . .<.S.Y.S.R.E.Q.P.A.G.E._.R.E.Q.U.I.R.E.D._.A.N.D._.A.V.A.I.L.A.B.L.E._.D.I.S.K._.S.P.A.C.E.>.#.(.l.o.c...s.y.s.r.e.q.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\UiInfo.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	36342
Entropy (8bit):	3.0937266645670003
Encrypted:	false
SSDEEP:	768:S4UR0d5v0SguJQvFQXvDINJh6Fmhvk71sO0Nep3UL9Eu+dOtOcOdOjT5fuPkfuS:S4UR0d5v0QYQLIN/6Fmhvk71sO0Nep3q
MD5:	812F8D2E53F076366FA3A214BB4CF558
SHA1:	35AE734CFB99BB139906B5F4E8EFBF950762F6F0
SHA-256:	0D36A884A8381778BEA71F5F9F0FC60CACADEBD3F814679CB13414B8E7DBC283
SHA-512:	1DCC3EF8C390CA49FBCD50C02ACCD8CC5700DB3594428E2129F79FEB81E4CBBEEF1B4A10628B2CD66EDF31A69ED39CA2F4E252AD8AA13D2F793FCA5B9A1EAF23
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p.U.I. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p.U.I./.2.0.0.8./.0.1./.i.m.u.i.". .x.m.l.n.s.:.i.m.u.i.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.S.e.t.u.p.U.I./.2.0.0.8./.0.1./.i.m.u.i.". .>..... . .<.U.I.>......... . . . .<.R.e.s.o.u.r.c.e.D.l.l.>.S.e.t.u.p.R.e.s.o.u.r.c.e.s...d.l.l.<./.R.e.s.o.u.r.c.e.D.l.l.>..... . . . .<.S.p.l.a.s.h.S.c.r.e.e.n.>..... . . . . . .<.H.i.d.e./.>..... . . . .<./.S.p.l.a.s.h.S.c.r.e.e.n.>......... . . . .<.L.C.I.D.H.i.n.t.s.>..... . . . . . .<.L.C.I.D.H.i.n.t.>..... . . . . . . . .<.R.e.g.K.e.y.>.H.K.C.U.\.S.o.f.t.w.a.r.e.\.M.i.c.r.o.s.o.f.t.\.V.i.s.u.a.l.S.t.u.d.i.o.\.9...0.\.G.e.n.e.r.a.l.<./.R.e.g.K.e.y.>..... . . . . . . . .<.R.e.g.V.a.l.u.e.N.a.m.e.>.U.I.L.a.n.g.u.a.g.e._.f.a.k.e.<./.R.e.g.V.a.l.u.e.N.a.m.e.>..... . . . . . .<./.L.C.I.D.H.i.n.t.>..... . . . . . .<.L.C.I.D.H.i.n.t.>..... . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\header.bmp

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PC bitmap, Windows 3.x format, 49 x 49 x 24, image size 7254, resolution 2834 x 2834 px/m, cbSize 7308, bits offset 54
Category:	dropped
Size (bytes):	7308
Entropy (8bit):	3.7864255453272464
Encrypted:	false
SSDEEP:	48:9L9GXidTgX2bqxIS0SRosEYYgJSIf4pKTg7pDdEAeObh8EWu:R/Y2bq10Q/EY1sK8M4bb
MD5:	3AD1A8C3B96993BCDF45244BE2C00EEF
SHA1:	308F98E199F74A43D325115A8E7072D5F2C6202D
SHA-256:	133B86A4F1C67A159167489FDAEAB765BFA1050C23A7AE6D5C517188FB45F94A
SHA-512:	133442C4A65269F817675ADF01ADCF622E509AA7EC7583BCA8CD9A7EB6018D2AAB56066054F75657038EFB947CD3B3E5DC4FE7F0863C8B3B1770A8FA4FE2E658
Malicious:	false
Reputation:	low
Preview:	BM........6...(...1...1...........V.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\sqmapi.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144416
Entropy (8bit):	6.7404750879679485
Encrypted:	false
SSDEEP:	3072:uochw/MFWrJjKOMxRSepuBaqn/NlnBh2Lx0JVzx1wWobn1ek8F7HncO5hK9YSHlN:zDFB47UhXBh2yJ5HcOSSSHZqG
MD5:	3F0363B40376047EFF6A9B97D633B750
SHA1:	4EAF6650ECA5CE931EE771181B04263C536A948B
SHA-256:	BD6395A58F55A8B1F4063E813CE7438F695B9B086BB965D8AC44E7A97D35A93C
SHA-512:	537BE86E2F171E0B2B9F462AC7F62C4342BEB5D00B68451228F28677D26A525014758672466AD15ED1FD073BE38142DAE478DF67718908EAE9E6266359E1F9E8
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................................................................Rich...................PE..L....IE...........!.........$.....................l.........................@......R.....@.........................D.......$...d....................... (... ......P...8............................\..@.......t.......D............................text............................... ..`.data...............................@....rsrc...............................@..@.reloc....... ......................@..Ba.IE8....IEC....IEP....IEZ.....IEe....IEP...........msvcrt.dll.ADVAPI32.dll.ntdll.DLL.USER32.dll.KERNEL32.dll...............................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\vc_red.cab

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Microsoft Cabinet archive data, 4823925 bytes, 19 files, at 0x44 +A "F_CENTRAL_atl100_x64" +A "F_CENTRAL_mfc100_x64", flags 0x4, number 1, extra bytes 20 in head, 439 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	4829869
Entropy (8bit):	7.999861791193514
Encrypted:	true
SSDEEP:	98304:ULaxrwQE3xM5HwcIqZZSPlG9Z27TinTCc/1oQv/ZhU8:UL0rwQEhyHwcIUYSoi+ctf/LU8
MD5:	96253C1D1B54044A8640E9932DFCA0B9
SHA1:	CC7E1D06D63D4A2C6502AD450E3C3B3458EE0A44
SHA-256:	50EEC49FAD75C67968F75E53BA21AEDF22BB11271F5CE8DE37AA48955697C6CE
SHA-512:	82D75BA90E44D74DC94C7D246D5B6594F2F773E9748F235585F05A065F476A4CB690DD2B78BEB5EF8B661F9FE826585B5CCA2B3AA80E7506B8CD2B76D5AD770E
Malicious:	false
Reputation:	low
Preview:	MSCF....u.I.....D...........................u.I.8...........[.......Hk........r<.L .F_CENTRAL_atl100_x64.H.S.Hk....r<.L .F_CENTRAL_mfc100_x64.P....>V...r<.L .F_CENTRAL_mfc100chs_x64.P.....V...r<.L .F_CENTRAL_mfc100cht_x64.P...0YW...r<.L .F_CENTRAL_mfc100deu_x64.P....TX...r<.L .F_CENTRAL_mfc100enu_x64.P....+Y...r<.L .F_CENTRAL_mfc100esn_x64.P... %Z...r<.L .F_CENTRAL_mfc100fra_x64.P...p [...r<.L .F_CENTRAL_mfc100ita_x64.P.....\...r<.L .F_CENTRAL_mfc100jpn_x64.P.....\...r<.L .F_CENTRAL_mfc100kor_x64.P...`h]...r<.L .F_CENTRAL_mfc100rus_x64.PET..U^...r<.L .F_CENTRAL_mfc100u_x64.Pe........r<.L .F_CENTRAL_mfcm100_x64.Pe..P.....r<.L .F_CENTRAL_mfcm100u_x64.PE...e....r<.L .F_CENTRAL_msvcp100_x64.P.......r<.L .F_CENTRAL_msvcr100_x64.P...@L....r<.L .F_CENTRAL_vcomp100_x64.P....+....s<.6 .FL_msdia71_dll_2_60035_amd64_ln.3643236F_FC70_11D3_A536_0090278A1BB8.@.].J=..[........."..$..N...Z..{..........r.=.C.......@@....Tx...6.....;.a*..a....g.\|.....Y.y....P.........}...m..9{.9...i...ygw[...B.M6

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\vc_red.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2010 x64 Redistributable, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319., Template: x64;0, Revision Number: {4DB491B7-9632-4543-AC91-D4B80F6DBE17}, Create Time/Date: Fri Mar 19 15:50:42 2010, Last Saved Time/Date: Fri Mar 19 15:50:42 2010, Number of Pages: 200, Name of Creating Application: Windows Installer XML (3.5.0626.0), Security: 2, Number of Words: 2
Category:	dropped
Size (bytes):	168960
Entropy (8bit):	6.262629898297588
Encrypted:	false
SSDEEP:	3072:POTbkSoT5jvtXSH/+rzTPe9oPxM5DNmHWVcqelSxbfS695:mTwSoT5jdSGP2f5hB
MD5:	93BB8E3E96A206B39175345111D452E2
SHA1:	3D4D02D0240E2651E14947772498C1AF73EDFBC8
SHA-256:	392710654BDC1DAAD76240584ED3C375D7C42821D8CB8B38867F9A13DB72392B
SHA-512:	B7C77F793379A1E55818E66D7C205508E25AB08D93029D29FA7E6886D6C0942BB914479D6BD4039CC48CC2F34A55E6D6888266166E540F919F5218DC4AF9F302
Malicious:	false
Reputation:	low
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC10RTx64\vcredist_x64\watermark.bmp

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 628 x 24, image size 308978, resolution 2834 x 2834 px/m, cbSize 309032, bits offset 54
Category:	dropped
Size (bytes):	309032
Entropy (8bit):	6.583379857106919
Encrypted:	false
SSDEEP:	3072:yUDLmozgtuVYKKKvwUbKh5+/uWLspp2e1jSaMsb1bIZU0g0WQbO//QGVYBtGKQgc:yUDLmozvygKjzbIGgBZBkUfDfc
MD5:	1A5CAAFACFC8C7766E404D019249CF67
SHA1:	35D4878DB63059A0F25899F4BE00B41F430389BF
SHA-256:	2E87D5742413254DB10F7BD0762B6CDB98FF9C46CA9ACDDFD9B1C2E5418638F2
SHA-512:	202C13DED002D234117F08B18CA80D603246E6A166E18BA422E30D394ADA7E47153DD3CCE9728AFFE97128FDD797FE6302C74DC6882317E2BA254C8A6DB80F46
Malicious:	false
Reputation:	low
Preview:	BM(.......6...(.......t.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC12RTx86\vc1232.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Code page: 1252, Last Printed: Sat Jan 28 00:37:43 2006, Create Time/Date: Sat Jan 28 00:37:43 2006, Name of Creating Application: Windows Installer, Title: Installation Database, Keywords: Install,MSI, Comments: This installer database contains the logic and data required to install <product name>., Template: ;0, Last Saved By: oirshad, Revision Number: {BB6CFE25-908F-4C4C-B70D-0CB045F4F3FD}, Last Saved Time/Date: Sat Feb 4 02:13:12 2006, Number of Pages: 100, Number of Words: 0, Security: 0
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	5.791294039215872
Encrypted:	false
SSDEEP:	1536:F63WSOyULOtHV6A2kcGtSPcGhsWjcdOyK8Ulv:MlrtHUkcySnO5K8Ux
MD5:	5A74D75FFFE6897C1B8BE46EA4EB607B
SHA1:	7C83E8CF5D7299E6C32DA4CD00DB065774A282FC
SHA-256:	7CFF6C692995E9FB12F9431F8B3F39D405DD343A6D8F90CA08211CC7210E3F2D
SHA-512:	ECB16E89BCF8A0673F84EE59FDF0A3A583EFEA5C3D5F96418D5B23C88F45631576D4ED05A15E9838A8B889AE9D69B4DB069CD7E54FA0DB114521503BCA2FD70B
Malicious:	false
Reputation:	low
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Apps\VC12RTx86\vcredist_x86\vcredist_x86.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6526024
Entropy (8bit):	7.989349621312113
Encrypted:	false
SSDEEP:	98304:Bk0hw5ZzAKry9Zlq6ugCoa6iAOEpCVpKR9MuECixz5M/QsfRCreQ3Mt101DjuRka:qssOlFbVaLC5iXufI6QJDK6An
MD5:	2B6889AC60E866FCCA633EF0DDC50DF5
SHA1:	407951838EF622BBFD2E359F0019453DC9A124ED
SHA-256:	C493561785AB2A970D4560B5F5E3B38BC10A08C30C38399A5E230EE0A7BCC81F
SHA-512:	CE4BEF9AAE277E30FAD8053E5EC78F6B47F416D22FB43D3BC01CC4B7213928120294F5D7BDF9E414352E49B1B6AA2A512E079ACF131FCC9AAE127F69F941263C
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0..t...t...t...}.n.]...}...g...}.i.....}.y.k...t...8.....A.7.....p.u...t.}.u.....w.u...Richt...........PE..L......O............................kG............@.................................e.c...@.....................................,....@..H1..........pVc..=..................................(D.......C..@............................................text............................... ..`.data...\|...........................@....wixburn8.... ......................@..@.tls.........0......................@....rsrc...H1...@...2..................@..@.reloc..8A.......B...*..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amd_opencl32.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	58880
Entropy (8bit):	6.124547379620245
Encrypted:	false
SSDEEP:	768:RAFkqrQb80gXE9f9of7hbjbYcCETzNO+TpNKjEWWIQ79+KPKPCwDA1rRT9HZSj9:Ik1b82FslPqKPKsT98
MD5:	6CBC787F233C579CD19656A5D0A2BC0B
SHA1:	622B02B0E824D0DE58BE45A79D1B10F98F0E81F1
SHA-256:	D7EC49EDA35848EA9D604A7503EE58A2FCFFE89C58638961AFE11115C5B3526F
SHA-512:	84CA58A4C3F8B9726EF40ACFFB7F1EEE743F5274D89E822AE382068E426395DBE16CE133B4359C63241F32C3945B55DE9E6267FCF25888600224483BBB785C33
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S#.2M..2M..2M.}....2M.}....2M.}....2M.d...2M.d...2M..2L..2M....2M....2M....2M....2M.Rich.2M.........PE..L.....UT...........!.........t......\>.......................................0............@.............................1.......<....... .................... ..`...`...8..............................@............................................text...`........................... ..`.rdata..A5.......6..................@..@.data...\|+..........................@....rsrc... ...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amd_opencl64.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65024
Entropy (8bit):	5.7326738785791065
Encrypted:	false
SSDEEP:	1536:ZnuvH+Z7yTJ3Kr4pPZR1mNMOVmakVKnVPKsTGssr:ZuvKyTJ3KkpPZR1mN9IKnVPKsTI
MD5:	2C0D85F23B533BEA4D6123FA4B96A1C1
SHA1:	6ABB272269504ED6DFC2E1F564DAB5CE38953069
SHA-256:	C8367E0E05AFF41670D0B6FB03964304E24B22956728076F130F650E7C7F350C
SHA-512:	750E5DD8E421FFBB642281D82C38115E3D943A11CE1141CF2D8C2D709038B95D828A518984E7B7426ED8AE7CC363A10F97A17B7CA9F4670CD5E6404453E625CC
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........T..T..T....T.F....U......V.\...,U.U...,P.Q..T.....s.U.W..s.Q.U..s.R.U..s.W.U..RichT..................PE..d.....UT.........." ................p7.......................................`............`.............................................1...L...<....@.. ....0...............P..........8...........................P...................@............................text............................... ..`.rdata..!?.......@..................@..@.data....5..........................@....pdata.......0......................@..@.rsrc... ....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdave32.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 90112 bytes
Category:	dropped
Size (bytes):	39386
Entropy (8bit):	7.658658886319167
Encrypted:	false
SSDEEP:	768:FsE/y/ycLd5aOA7kDkRiHXunNt8xGUFTnm6nnnnnpjLS9UPK9S:qEsyKqkDkR5z8xGuTnDnnnnnpPSyPKw
MD5:	435AEEA4686E7C8280B5A1BEE64948D8
SHA1:	C54831845ABF7470A6043690C70436E9CA940073
SHA-256:	CC3EDBB01C01E8A27326196FD1B0FB35C59F0F7218C95B989FA737107A8B4AA8
SHA-512:	C230A57B415C8786EB6F9760B83745B4B785E6C8BABBC22E2F557CEDCD35894EB0C852B8A71D212EC71BA24AE9408EE0BB727064A869D3E01B312C514936DF7A
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.`...MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$....;.1.Z.}bt.u..b.}.w.b.}..b.u..l..b.u..b....b.u...W.b.........=...Richt....PE..L.....UT......!........U...\|.......=......... .s............@2.....E...P.....X..<.......p.. .(.q.......?.....8q..........P........text............ ..`..rdata..+..........;@..#..,....."......rsr.c.. .i.....2.>-& reloT p.%~..&..:f-..B...-.-.-.-.-.-..=.=/=?=O=_=o=.=..=.=.=.=.=.=U...j.j.j.j?..M...0..0..RP.3RPj..E..@.1........]..5.(D.....'F.0.S.].W..t...}..t...}...t..}...t..{...u._....[]....Vj..G......Ga!....-..........tG.u.........u...F...F....F....s.....s....@}.H@...j..@..3..w.^_...kB^_0AjC(E.:F.E...t'..M...t ..x..t..A....H..@...j....3.]....fB.Q.GM.Pu..!T..@..@.b.C..?Q.M2]BU.K].[];\.{].];\"...].]<\.].].\....m.m,l.<mLm<[r...nm~m>Y.km.m.\.....m.m.j.m.}.\1.+};}.\2.\}l}.,l.}.}.\.}.}.\.R..}.}l\..+..}.K.[..\B..~....j.....k....\5@......k.<.L..\|k.;E........S.3.VW9].......9].......9]............

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdave64.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 95744 bytes
Category:	dropped
Size (bytes):	43647
Entropy (8bit):	7.709529213620081
Encrypted:	false
SSDEEP:	768:z8vAR/EcHkBCReUjdLizXPR6X4Icucn8WZyo7Ga7AVZTBLB:z8YVEcHsChxuzfRYcJ3ZyohEVZ
MD5:	0A7045BFA245AF881A72D4E9F86EBE83
SHA1:	664456EE6B03519A2F40CDD23A70FE3FC30C1AA4
SHA-256:	A80FC9537F69A4FDF0F0A2FE49CFB65958C0270A7AD7D0F4702D80D9FEF99AE6
SHA-512:	461EC6C0884D07546B85CC435CBF3C412286D40BC2B2013C7CF748C3C600CD0FA121B8F545C0AB153C2E4AA2B31403D6348F96074F79BA4EF43BC2CAC2809C39
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.v...MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$.........}.t.".`..}.wa..}.b..u..; d..u......a..u...W\|...e..f..=c..Richt....PE..d.....UT$." .......).....A...........g..... ............`2....D.I...0...X..............( ....x.......\|..0....8....@.n....w........otext........B... ..`..rdata...-.............#..6..>..r..D......p.#,........XN-6 .rsrc..\|.y......fv-.!elo.. ....."n.-..B...-.-.=.='=7=.G=W=g=w=.=.=.=.=h.=.=.5......6.H.l$.H.t.$.H.\|$ A.VH..0I...I..L..H...H..t.H...t.M..t..M"@.H.y..wu.............H.\$@.A.@....I.@.!..[.I@.{.H,@RH.C[B..C...CI!..H......M...H..H...L.F..V..A. ......>,@.L......@.A..3.H._.......1.H..M@H.l$HH..t$PH.\|$.XH..0A^.U..@(!A-&A(5@...t!.BB.H..I.!A.H..4.B.@..@(.<B.R..@X!@:D.@X.V7@t[&AV+AQ.A.3..D$ ..H.D$8QQ@H.OT$8LWRIP(\|B.RP0.PH.T$ .E3.E3..P...L$0....E...R......T ]0Ub&A]+AX.I.x5PBX..Q]a].q].].\.7.].].R.@.BX...].].].m.m(m.8m8]HR.emum.m.m.m.P.`.<B.....I@Ax0.I@.m.a...te&A`+A[S3..p.a .a(.i..rA..@.@

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amde31a.dat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	157224
Entropy (8bit):	6.6553971410084936
Encrypted:	false
SSDEEP:	1536:JkcIf4qSvnN/IHOh0/Ve+U/qjuip/XJhopNK5vLOPPCMk+lqub5b/UQnJtSpR8GO:JtrRlcegsfyn/6qT+lq85SgM1C+2
MD5:	E21AEB56788D25AEFDB7C9C705CF93C6
SHA1:	5E697A67167A952DC8F88542887BF80BE7E3CE49
SHA-256:	4B556822A1E7835669FDE7366349C92B2C1EACE5456DC35681A8C90CF16F96D1
SHA-512:	8B0761703C09384D358C49F7B6A68146345B6B8FF51D0B9F36479ED8CDD7B0EE7559F892F68488B45B6A1B1852E5F245056CA8AC7DFEAA9379A301281852C8A4
Malicious:	false
Reputation:	low
Preview:	.v.t\|...e...0..6.....)...................................B...I.......i....................................(f...4................................................................................................................................................I..I .I0.I.4.....a...a...a/...=!.`.................................. ..0...5....................................................I.....I .I0.I@.IP.I`.Ip.I.4......................................... ..p..0..@..P..`..p...5.....................................I.....I .I0.I@@IPPI``IppI..I..I..I..I.4............................. .....0..@K.P[.`k.p{..............5............................................... ..I..H.. ..h...................0 .......................................... ... .L...v...s..sC.s..s.2... .".@2..v...s..s..s .s02... .L...v...s..sC.s..s.2..0 .". 2..v..rs.rs.rs rs02..0 ..%@U.....@cPZ3@cPZ3@cPZ3.D....@cP. .. .. .Z3..@cPZ3@cPZ3@cPZ3@cP. .....@.PZ3@.PZ3@.PZ3.D@.PZ3.$@.PZ3..@.PZ3.$@.PZ3..@.P0 .<. ....................... .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdh264enc32.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	261120
Entropy (8bit):	6.303992643247696
Encrypted:	false
SSDEEP:	6144:a8xdWqmrLvqJEAb2QwPNNErIFtrRNG6qDYWpM:/Szrj3ErIFtNNG9E
MD5:	C899368EA10FBBE8979B466BD0FFC8CB
SHA1:	A100E40721BD8EC115470CDC31565BA1B75043C2
SHA-256:	BE1FD215E5C7A95F7640237B92F1575471EBB168F07DDAF177FEBA08F6D9F7FF
SHA-512:	60F6E6EFDF64609037E448620B1AEC856FB6601F64A027D6B4E2300BFF6CB0A548D93ACB668839B371FF72B031FB97FD333D678054CA8C48084781DA86A2D8CD
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L*...K..K..K...[..K...o.cK.....K.....K.....K..K.}K..D...K...n.1K...^..K..._..K...X..K.Rich.K.........PE..L.....UT...........!.........H...............................................@......Cv......................................<....................................'..0................................p..@............................................text............................... ..`.rdata..............................@..@.data....;..........................@....rsrc...............................@..@.reloc...8.......:..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdh264enc64.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	290816
Entropy (8bit):	6.02602569408195
Encrypted:	false
SSDEEP:	6144:Fm+HBGGJPtrwCNIZciNTYPY9Mk6zwnV3mv:c+HAGJqKIZcdW
MD5:	9B19D9899C579F9F195E6AF8BAC12ADF
SHA1:	17563C00D2009299001A1AF344E5630BE8E9ED74
SHA-256:	C5E1AB851EEC5FFEA4DC417C8393BD71DA5F890FE40045CD6DA295BF08619A7C
SHA-512:	80D83A6BB52ED9F933091DAB06810C294B6543ECB1FD847524AEA0A7634CC152739702CCFBC8E2849F2CD560A5F3F8B897FB159553F4F2B8F7B44B21BC56A75E
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........n........................'.....?.i.....?.w.....?.r..............................".......#.......$.....Rich............................PE..d.....UT.........." ................................................................2[...............................................'...........................(..............\|...p................................................................................text............................... ..`.rdata...(.........................@..@.data....H...0...$..................@....pdata...(..........4..............@..@.rsrc................^..............@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdhcp32.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 118096 bytes
Category:	dropped
Size (bytes):	93795
Entropy (8bit):	7.7222946272556765
Encrypted:	false
SSDEEP:	1536:RDwwWSasmWbSrlj14u8a9lzD0X+LvHOcyA5tbtfv/SqgYs1Q54n42+ri3SN:RDjWHsmcSTbcX+DH7yAzhfbgY7o+riCN
MD5:	BA3861226AD3E60B0F69602A7D8E34B2
SHA1:	85C50392754B98D51F30CE17D7DA81138023F6DD
SHA-256:	B6BAEBAE49D4578BFD7F620BA75605B1A97394754E8761CF2D5A752763AC42D6
SHA-512:	4909A131D1F193F143A5A0FC046BB2E58392093B7E8351FB21D5866A7A2AC4A2A4139FAFAD27E402867AC32D783EF0F7D2BDE505F6D015078458FBBD10585233
Malicious:	false
Reputation:	low
Preview:	SZDD..'3AlP....MZ......}.............@...................!..L.!Th.is progr.am canno.t be run. in DOS .mode.....$..........Pt...[P..}.YP.}.ZP..u..$_P..Z.P.u........P.u.+.-.P.u...[....^....]..X...Richt...P.E..L......UT.....!.........6.-...\N.....z............0...-.....,.-.....Q........R..,....d....x........P.e........`...8L....p...!.$..\|.....text..C.......... ....rdata..+B9..:......;@..#.\.e........&-...r.src..\|.y.....4"relod ........v-..B...-.-.-.-.-.=..=/=?=O=_=o=.=.=..=.=.=.=.=U..]......3.0..M.V............;.................s.}..dt....^].....E.^..@......@..p.?A..EB..EB.`>B ...?A$..?A(..n?A,..?A0PhB.<.oB@0oBD`vaBP.oBT..?A...>BX@.?A`m..B\ .B4@vB[8.oBH.aBL`A.3.2A.-.0C.8...u.......].U...t...}..t...u...R.u...P.P..0.?..]...B.4.S3.9].u...B[]...E..VW...w...$.<a@.......A...........CP.IQ#NPL.a@.]R..dR..u.^R.0.....1....ts....tn...t.9.].tdj4..2.@. P.PA.M...E....M. .r..z...Z,.J0..t....~.f...B..P@..Q...E$S....0.. P_^@P.D-.S....YC.b..X..ev@,alv@sv@.*v@.v@.v@.v@.5.U..P&.}...t .R..

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdhcp64.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 128384 bytes
Category:	dropped
Size (bytes):	98444
Entropy (8bit):	7.733797491789351
Encrypted:	false
SSDEEP:	3072:penLQAVLCBZoD8I4jNJ0p/1JBp9P7WSqE:InLbeJIcNup/PL9TWJE
MD5:	2F4C41145A13DCC0CFF20ECBA5E6052F
SHA1:	131F5A28685BB638BB29C82DA1005C49E9A50D33
SHA-256:	741AE5507F7F19004908FDE480AFFDB5669EB11424FEB4295C7B8F26992DCA8A
SHA-512:	4BFA4BEA8C6A10E98B79DDCAAF64C3699FD7F0CBB369000E4EB3BA4C30566F75662A3F6DB3A733D1CCDCA66B697713C363B98A3BD3A5423E55CA8FE5CD6B62BA
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}.............@....................!..L.!T.his prog.ram cann.ot be ru.n in DOS. mode.....$...,...M.t.q....}....}...}.u.h......w...u......M..u.I:wp..u......w..........=...Richt....PE..d......UT....". ........N-...t......<..%.......8.s.05......4.. -.%.Y.X.-. ....R.....dN-...x..4...........}.....5.....8\|....`..........X5......otext..}."........ ...rd.ata..rK....L......@.N#...".-....=.>-...p#...4.......D*rsCrc........-..!elo. .....7..-.B...-.=..=/=?=O=_=o=.=.=..=.=.=.=.=.....7H..H;...= ..8-.H.A...@..B'-.A...5!t.....H....8.H.B.R0@...7@.0@.?C..0@.?C(0@..J5B00@r5.7@80@+G.5B@0@\..7@.H0@...7@P0@FU.5BX0@.kCp0@..kCx0@..A....A..w.B..V.C...B..C.?C. 0@p...@..C.H.C..0@.. .@..CUv.C`0@.kCh0@U..C..C..C...3......0...(H..u.......H..(..M..t.M...t..@.P(.m.^Q.v@..[U~.6.l$ AVPP. 3.D..TQ..YS.l$H^P A.^.A...H..\$0H.\|$@....iP...t...P..P.._.........A..S.....P.iP!.P.".P..P...@.w...8....`@..P...H.t$8....ta....t\H.t$P....t.H..t.M.....H...HdP4H.L$.XD.0.X...x.@.h,H.{H05a.H..7

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdhdl32.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 123392 bytes
Category:	dropped
Size (bytes):	72966
Entropy (8bit):	7.734681663223839
Encrypted:	false
SSDEEP:	1536:MzY9hK8Y2wnNrfeLHxpryz1KEK/SAScOSTDKCaUVX3z0rRQoOj8S7PK+m:FcxNrmjxpryz1KP/19lzh3IrRGTDm
MD5:	3C4140D7C13EE39F9E7F8B4CEA71B568
SHA1:	EA20B8C76F60ECE001DA00E40B61B8AF098194E3
SHA-256:	9120DF3C6163DBB032E86047930A654A74ED7AC51567A1C89C141738A5A1AE46
SHA-512:	EC797B2AC9BCCFAAF18A88035EBD0E83509FD414718B82AABE48B0404CD0459582F2A5CCC15AA102017CCDF0A1E1361956089F7A63A97C2A2BC783C948177CBB
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$...0.5t..}ft..w8fh}.w:f.}.9f,u..M<fsu..f.'..9fuu.St.8..=..;..Ri.cht...PE...L....UT......!......`......+.".....p............. ... ......@......\|A......Y.....P.. .........q.s.8q..........X.......te.xt..._?...5..)....rdata...)G..H..d....@..#..-........-..._reloc..%~.3.&..>-.B...-..-.-.-.-.-.-.-.=..='=7=G=W=g=w=.=..=.=.=.=.=.5U...QV.u.2...E...t\j...E.P.E.......p.....zuRW.u...*...........t7W.A..C..u..O...I....f....I..v.f.6@.W.i.@$@..._^..]..E.\F]B.sI.0S.VW.}.2.3..=@.......W.)TB.6@........r._.^..[]._^...@yG..lS..].VWS.z. .S..j.W..}......j.L.E.j.P....@.].].......u..E......E.......}...u.W.FLSP..D. @E..e....E..E....(.E.Eu..@....E.6S.....u.... @..@..GLPwS...PW.Z ......._^[.oM~D.1..r..hP..:.u....t..P.:Q..u..........u.3........6@S..F.......wC.$.$.....E.^.......@.S...X.A.X....R^2..a.B.......`..`...Pt].T..].].Z+..S..t.Ht.\.c.Q....V..e..B{E]..MPyG.....A].j......@.3Bt.h..<`

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdhdl64.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 134656 bytes
Category:	dropped
Size (bytes):	78119
Entropy (8bit):	7.727791992563634
Encrypted:	false
SSDEEP:	1536:QirGbhuP/muna2kT9ewUs2Gs1PNMnX41WEPlnqKzZdYEPPlvex7Nq/2P:QiyQP/HnOAwq1Fp1JlntRd5/2P
MD5:	47111D196A691E71FDB8E2DCF65D31B3
SHA1:	5EBDF4B15B051A09BFC0E7CBE169050A8FB0441E
SHA-256:	03AD210A575A74ACCE99DD29041490A41FB57E2B33477E98F9AC09CA0AAB0C08
SHA-512:	DF6D4CC0D160075AC91A5C1882E34717DD0A22D833EBB3574D398CC37A9A21D2411A7FDCADAF048A2B39CB67BBB66CB7FF082F76D1DDA4FAB1C6E215B931B3A4
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$...&.. b..}st..~As~}.w@s4}.Csju..DEseu..s.6..@scu.E}.A..D..B..Ri.cht...PE...d....UT....." ......h.......ph..........g........`.......`....9.8....@...Y.......P..0......P.....0...8.....'................text..[.f7...-... '...rdata....j..l..l......[@..#.............-...p..#\|.y.@".F-. r.eloc. ............B...-.-..-.-.-.=.='=7=G=.W=g=w=.=.=.=.=.=..=$&SH.. H...H........H.L$03...D$0......o....zuh...@H.\|$8.....@..H...tG.BH.......@..u.0O..........H..[.H.I.f.C.f@@.H.....'B"@..H... [.lBsC2..sC.@H.\$..H.t$.W.3..3.H.=.......D(A.H...'A@@....H......_r.H.\5At\|C._x@.EqC_.A.Dl.$..A. A AT.AVAWH.....D...A...M....... E..3.H...L...M..3..D.BL.A@..=...@@...@D....@(DP.(L$.PI.OLD...I..A...gP.F@TP`XQpgPG ?....$...kQ.0.zQ@E.wH... .d$,.k3..A .@ L!@.0D.@8H.D$.$.P<.....I.W`S..... Ie@.. L...$.Q..I.[. I.k(I.s.0I.{8I..?A_A^A\.B.h..B.D.H..\q..)@..t..@@_..O...tE...t.7`...u.L....q@.B.B.....Il..Il..

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdhsars.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 5120 bytes
Category:	dropped
Size (bytes):	1212
Entropy (8bit):	7.169192508524743
Encrypted:	false
SSDEEP:	24:WM/FK6/yJtnLxNYY18u5WebFnhSjVM3C8bJ/GqnkyoaPfmn9TNiUeFX:WAK64hFuYmub7SJJ8dGqnkyFm9UUeFX
MD5:	C4D10A6F9F588EDE5BC769FB0331CA83
SHA1:	C0CB7A662E24F905160D59D96C6E8E22FB9CDD5D
SHA-256:	1A16D55EF65EA64AE1B803AAC9734DC1EB9F0CB4F4E3F73E201B0E687CF56CBD
SHA-512:	153376818A0E200352D48C455F8B17B72ACEFE1EDEE280EC98F70B95397064EF44E75FAEE61EDB0F4805189D15EE926C5BD77631E6F78A200BDF3733583BB01C
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$....-..L\|}.t......}.=...Richt......PE..L....".UT...._.!..........................0.......@.........)......).M.].m.}...>...rsrc..<..................}... .............X. ..pH.-. !.--. .......U$.^-U$,.......v'x...Qh.... "v((.#.........(.%.;.p. ..@.-.(....-.=,:...0<0...#f...K=[=..=~=2=]0.B3. ]=.=h=.=.=.1..=.M.M.=>M.=.=lM.\|M,M.MRM_M.M.M.M..M>1.M.M0]@].]5:7...pW..\|P"]..].]O]C2.6p].].]8.].m.a..P$`.c..].]MmQ`y. .s..fmmb..~`.$m4mDm.l. .M.k.#..c.i.m.m.m+}.m.m..i.@.}.}.};}r}W].h}{}.}.}.}.}.}.}.O{.m.m...^Y+..>.N.^.n.~..1.p...............;........:........f..j........../...O...o..c..-..Z......<0..........]x......R...-..]J.r...z................2.r.:.M.J.B......Z.......9.2....lc.{.......e...........'..7.G.W.g.w............................. > .r . !..?..........?....!..!..!..?...1.....< ......A..A..>A......Q.....`..!...!.&.(.(..-.M57B0...M57.S.........'..W

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdhsasc.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4335616
Entropy (8bit):	6.197464974866078
Encrypted:	false
SSDEEP:	49152:J1Hv1HRRTDaVFjuGD2WI0baShth2K9kDd04GqHrsRSq:5HnMz/bnhth2KyLt
MD5:	B9DE9AE79DFE101B71B80FE6370588B5
SHA1:	4BC29911E17101302DD7C0DC7B083B271F9E1CCF
SHA-256:	F144DB3C345E17E7D091D3F8F3D0DB9E57231FA0445CDD364C6955965765E470
SHA-512:	C47753A16D72ADF8BBACC54E0C4E8E457BD382D4C815014743342F0C41F34AE6BC090232DD74E2C10E60F48CB49B02209DFD46E0A6898E04C833C40495621017
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M..C,..C,..C,.....B,......,.....m,.....,.....@,..C,...,.....B,..d...&,..d...`,..d...B,..d...B,..d...B,..RichC,..........................PE..L...h.UT...........!......"..v!....... ......."...............................D...........@...........................<.....$.<.(.....?.(.....................?.......".8............................`;.@.............".,............................text....."......."................. ..`.rdata........".......".............@..@.data...d.....<.......<.............@....rsrc...(.....?......t=.............@..@.reloc........?......z=.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdhsasc64.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5316608
Entropy (8bit):	5.88835296270331
Encrypted:	false
SSDEEP:	49152:BL9ORGgXazfAzwJXty02hAfsrI6wp1DUNW4yRB:KhY0hAfskaA
MD5:	793D190F103C69E5D2CF49B1721D1744
SHA1:	12C06D33BF3B926884E5317C1902F9A1030429E5
SHA-256:	E4B4EA0069612CDC087EA045A636037DFD69F0E9A86C056B90725F36D72474C7
SHA-512:	0642094A24E4E4C12C7A5ED49E6161CC3EF7C3ABB8A4D03069314456D253A8031FFD148FE97F279FDA5B371D4A809FBB40F22E43530364767127C3E246465EB4
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.. ..\|s..\|s..\|s...s..\|s.f.s^.\|s.f.s..\|s.f.s..\|s.\.s..\|s..}sC.\|s.\.s..\|s2e.sp.\|s2e.s6.\|s2e.s..\|s2e.s..\|s2e.s..\|sRich..\|s........PE..d...j.UT.........." .....`(...*.....pG&.......................................S...........`...........................................K.......K.(.....P.(.... O.`_............P.p...ps(.8...........................@.H..............p(.h............................text....^(......`(................. ..`.rdata....#..p(...#..d(.............@..@.data.........L.......K.............@....pdata..`_... O..`....L.............@..@.rsrc...(.....P......2N.............@..@.reloc........P......8N.............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdhwdecoder_32.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	6.202911183869799
Encrypted:	false
SSDEEP:	3072:x3nIGBrt7fWwYGhXM77AePrGynXjoqEou47s3db9Nv5thVus/9v14M7+U5jyj3pb:JI0trXYkM/A6rGuXjOO7Owm
MD5:	0E8F25A3517BB4FFB8CF74557B7C3D76
SHA1:	F243C8364E5027DEC14B0C5C1C4874D6DE81F414
SHA-256:	266E0B4E75BCE32890D017B54831137685229D3E8A0C4BD46D66FBA6A403635E
SHA-512:	AB3C2259AFFFD251C013ECB9F40B2707F3360D010AD4C7C8E5ED1D16C33E78852FCD88D8AB34D368627C37F426C13339FA2447C83C4029B43624D95B0C3A777A
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.yv..v..v..m.\c..m.h.....~p....\|u..v.......{y.....w..m.iL..m.Yw..m.Xw..m._w..Richv..................PE..L....UT...........!................;*.......................................P......:A......................................T...........0.................... ..`.......................................@............................................text...P........................... ..`.rdata..k...........................@..@.data....D.......&..................@....rsrc...0...........................@..@.reloc..$'... ...(..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdhwdecoder_64.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	232960
Entropy (8bit):	6.001657656144944
Encrypted:	false
SSDEEP:	3072:CG9LweTbFAd4qyJVjEuE3cIpqTTU3fmOqbgqduMK00ZK4M7+W0P19/s8uSWh5nHl:CP+bC4qyJVjEueqTTUPmOqbvdrk+y
MD5:	A7EFF55588A2D7972BD6FF1BFDA388E5
SHA1:	95C300CF009A90E7165E9D37456F031985CC1E43
SHA-256:	D3C31BBDEBE77A79475B0C5F3E8D4898041DFAD9D0CFD6733028C4C8B0615FA4
SHA-512:	8CBE04D1DBC26497129EB7CD7C5F8EE4BA762E58C6D87A199A8812FF18655E1596C731B1C25ED1B49541280F27348FBF2AA2C1471938DEB21AC449460960D50F
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:%..Tv..Tv..Tv...v..Tv...v..Tv...v..TvT..v..TvT..v..Tv..Uv..TvT..v..Tv..9v..Tv...v..Tv...v..Tv...v..Tv...v..TvRich..Tv........................PE..d....UT.........." .....8...R......\i...............................................................................................I.......>..........0.......P...............h....S...............................................P..8............................text...J7.......8.................. ..`.rdata..{....P.......<..............@..@.data...PP...P.......8..............@....pdata..P............f..............@..@.rsrc...0...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdicdxx.da_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, t is last character of original name, original size: 765851 bytes
Category:	dropped
Size (bytes):	125663
Entropy (8bit):	7.150345197575926
Encrypted:	false
SSDEEP:	3072:GEFUN+YWuPKczm7ND3vcLqvN2wGUAT7pALN:GFNvWuScQx0LMNbGVAp
MD5:	7813612C544334233ECFDA856DC95768
SHA1:	31C612DC8DA36BE514433C8C279E362B5CD771B2
SHA-256:	CA85F03C045ACF8D5258F3F07C2520C39BDE43E918FD6686F3BF741C5A1DBA54
SHA-512:	CD38A9C5866C2AAD62CA8A224235F4E95C99D61ABC3D8265F80E7EB4C9594AC8B891BB80E03F47D208E747FE1725243C02AE6B5EB24B34358EC5DFDBE3F6037C
Malicious:	false
Reputation:	low
Preview:	SZDD..'3At.....1.0,Driv.er Insta.llation,.MSI ASIC. IDs,ATI. Technol.ogies..c,.2014 Sep.temb..24 .6:36:54,.6.10.14._47,1,.._...936,11,I.2.,EngNam.e,Market.ing i.DID.0,V..0,SS...V~.Proi.F.GL,VBID,.RE..N.Las1.M0/0SC/Q.aso5oPvz.xoU+ig2q.eajuPIi/.dmPUjLGm.WRJys1QI.YgkmB2gR.4se2fK4/.QxGgEhQA.GDYf/LXI.nd30AASm.Was+YPa1.+fzfRsaK.F+Xl77Eu.8j5bmom3.6HZ0rc2C.Sx120XFZ.JYwtWlcw./+CFFau6.hyvpJ5mR.0Cpov5Ph.0+XClXnX.NTQI4mea.VUzf7nJw.K/P1bDu9.szFM+eeh.oPrl/Se2.JhZ1cg2n.l0aajgRz.+ONy3jBF.3GVb4nSo.DwR2....................-..=.M.].m.}........0x1304.!0.02. 0."IKh.GKVD/KzD.Dea8mppn.p2oVd7Wq.4WYDfD7i.LX2.......-.-.(-8-H-X-h-x-.-.-.-.#.!2..wqu.rx3o9OmQ.HIDqD3Po.u7akr.-.=.=.#=3=C=S=c=s=.=.=..=.=...=.=.M.M!M.1MAMQMaMqM.M.M.M..M.M.M.#5.-.-.-..-.]"]2]B]R]b]r]..].].].].].].=3..Mno5n3xY.JX9X3dar.WIL5C6bF.Pipb&m6mFmVm.fmvm.m.m.m.m.m.m..m.M.}$}4}D}T}d}.t}.}.}.}.}.}.}.}..}.m. 6.].].m.m.B.R.b.r.........@.......m4...!.+z5NV7X.etebnqWJ.ijblDku5.iW.g.w.....................E..U.e.u...................%...3.07..

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdkfd.sy_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, s is last character of original name, original size: 218824 bytes
Category:	dropped
Size (bytes):	127719
Entropy (8bit):	7.703500247864977
Encrypted:	false
SSDEEP:	3072:rtmkytJmMQcwSN0q8zR7Sl2TXsi/RhRCVuKaOaFE3LGUeb:LyXJ7N0NxRqwOuUG/b
MD5:	DD0D0407F04B1A79B45052972B57C38C
SHA1:	B1976D453FB1DAB63E5EE635FC07BFD3DBE21B7E
SHA-256:	FBC5474BB4F8B1F1000AAF134A0AAD676774C10EB8FD6C5D100D256487AD6987
SHA-512:	E1E9AFD83017BE7F0E4C680C4091E57C35165063A451293EDE14CA765F3F7F657045C5E12436393D98EF1669C663C987670E45D682EF59E5A474E6807570E035
Malicious:	false
Reputation:	low
Preview:	SZDD..'3As.V...MZ......}.............@....................!..L.!T.his prog.ram cann.ot be ru.n in DOS. mode.....$..f.."....t..S7..#}.(.!u....Y.%..[.....\. }...)..-..^.'u...}.u..j4........".p...j=+..Richt....PE..d......UT....".......z............ ..-........).8..........0..).`-.....\.a.o...<...<...... "......X/..8.........P.. ....8...................t.ext...w..x...M... ..h_.OSSVC...%......~.-& .IODEV...%!......>-& ~S ICE..-.!.....f-& PRO6- ..$ ..-.....-& MEMMG.R.....-..!..B..(FADDR.'.....V.....-v& CIx!.q`...-.b..F.=& LO.GGER.......W...=.h.r.data..S.......V;..H.j3..\|%.`...r4.;.c.pj3.....0)...=.HPAG...'..WZ!..X...;R$ `.1x!PI1.......=.DTOP.).!!......M.D.. (......!.1IM..BBG...`...!xH2rM.@PMCS9A.p>D.M.GD.!....1.M.`INEI...9A!.AA..M....rsrc!!......h....:B..relo$P..4...206].B...]..].].].].].].]L..D$.L.L$. SWH..8A......H...H..._\.....x$L.L$.`H.D$hE3..H..H..H..` .>[.0...8_[.H..t....Ae.Xd.mH....e.H..H.....?`!m1`..H..8cT?i.t?.3.f..QlXf..T$8M.....-..a..........H.D$(.M.J.E3.E..B(A.B$

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdkmpfd.cbz

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	8206
Entropy (8bit):	7.252541060494056
Encrypted:	false
SSDEEP:	192:/NwiyUs2kiEC88RVcdh+3Ef5KYpBjSAaDFFhqc:/JT84C+3Ef5dpBjhgFFh5
MD5:	7C3A015B05BA6140056E54A9E2522285
SHA1:	F93EA62D02BCA8EAFB1149A1A05F2C04189358A9
SHA-256:	A2BEC72688A0526403813D99ACDDFB68E5F0D550F8ABA5E2AEFF77FF63403681
SHA-512:	0EBF74A83ED4B712B1F98590FE86DE1090D14571ACF846D0992C89D86D29F495D5DA706AB7210BFB61581576604CD28D547C9E33B1AC1F7BDF0F3976F6292D54
Malicious:	false
Reputation:	low
Preview:	0. ...*.H..........0......1.0...+......0.....+.....7......0...0...+.....7.....}....c.I.z....5..131215055803Z0...+.....7.....0..B0....R1.7.1.6.4.1.3.A.8.D.1.B.1.F.2.5.B.B.9.4.7.8.4.8.F.8.5.6.3.3.C.A.6.0.E.3.1.0.1.1...1..A0<..+.....7...1.0,...F.i.l.e........a.m.d.k.m.p.f.d...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........A:...%..xH.V3.`...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R8.F.C.9.0.7.D.F.3.5.7.4.4.D.9.C.8.4.C.7.C.3.6.3.7.9.1.8.3.8.5.4.9.6.F.B.7.9.2.1...1..I0<..+.....7...1.0,...F.i.l.e........a.m.d.k.m.p.f.d...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+............5tM....cy.8T..y!0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......&0.."0J..+.....7....<0:.&.Q.u.a.l.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdkmpfd.csz

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	8206
Entropy (8bit):	7.252541060494056
Encrypted:	false
SSDEEP:	192:/NwiyUs2kiEC88RVcdh+3Ef5KYpBjSAaDFFhqc:/JT84C+3Ef5dpBjhgFFh5
MD5:	7C3A015B05BA6140056E54A9E2522285
SHA1:	F93EA62D02BCA8EAFB1149A1A05F2C04189358A9
SHA-256:	A2BEC72688A0526403813D99ACDDFB68E5F0D550F8ABA5E2AEFF77FF63403681
SHA-512:	0EBF74A83ED4B712B1F98590FE86DE1090D14571ACF846D0992C89D86D29F495D5DA706AB7210BFB61581576604CD28D547C9E33B1AC1F7BDF0F3976F6292D54
Malicious:	false
Reputation:	low
Preview:	0. ...*.H..........0......1.0...+......0.....+.....7......0...0...+.....7.....}....c.I.z....5..131215055803Z0...+.....7.....0..B0....R1.7.1.6.4.1.3.A.8.D.1.B.1.F.2.5.B.B.9.4.7.8.4.8.F.8.5.6.3.3.C.A.6.0.E.3.1.0.1.1...1..A0<..+.....7...1.0,...F.i.l.e........a.m.d.k.m.p.f.d...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........A:...%..xH.V3.`...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R8.F.C.9.0.7.D.F.3.5.7.4.4.D.9.C.8.4.C.7.C.3.6.3.7.9.1.8.3.8.5.4.9.6.F.B.7.9.2.1...1..I0<..+.....7...1.0,...F.i.l.e........a.m.d.k.m.p.f.d...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+............5tM....cy.8T..y!0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......&0.."0J..+.....7....<0:.&.Q.u.a.l.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdkmpfd.ibz

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1988
Entropy (8bit):	5.586066176637161
Encrypted:	false
SSDEEP:	48:HgDKwhDQnj698joVfuVXPgYVeDYgHwuMgHygH0Fj71n:HgDKqDQOcvIMN3n
MD5:	510D1A4050E0FEE8E58D59D5A97C91D6
SHA1:	1716413A8D1B1F25BB947848F85633CA60E31011
SHA-256:	E08507BEDFA5A4F86642C2504FE826BDF3296E5F2AF4492238619C187D9F2128
SHA-512:	F6ED78C5B7CA9EF2599AC66424D608FC5A2C78F89D375F3131D109D004A11EF2A20806A6DDE6B8490EB5CFBDD4B9E7083C8492952F6A9DEBDE94243D4C58842C
Malicious:	false
Reputation:	low
Preview:	;..; Copyright (c) 2011 AMD..;....[Version]..Signature="$WINDOWS NT$"..Class=System..ClassGuid={4D36E97D-E325-11CE-BFC1-08002BE10318}..Provider=%AMD%....DriverVer=11/21/2013, 13.30.0.0002....CatalogFile=amdkmpfd.cat....;[ClassInstall32]..;AddReg=system_class_addreg....;[system_class_addreg]..;HKR,,,,%SystemClassName%..;HKR,,Icon,,"-27"....[DestinationDirs]..Drivers_Dir = 12....[SourceDisksNames.x86]..1 = %DISK_NAME%,,,""....[SourceDisksNames.amd64]..1 = %DISK_NAME%,,,""......[SourceDisksFiles]..amdkmpfd.sys = 1,,....[ControlFlags]..ExcludeFromSelect=*....[Manufacturer]..%AMD%=AMD_KMPFD,NTAMD64....[AMD_KMPFD.NTAMD64]..%PCI\AMDPCIE.DeviceDesc%=AMDKMPFD_Install, ACPI\PNP0A03..%PCI\AMDPCIE.DeviceDesc%=AMDKMPFD_Install, ACPI\PNP0A08....[AMDKMPFD_Install]..Include = machine.inf....; The function driver..Needs = PCI_DRV_ROOT...; Install section for the function driver....CopyFiles=Drivers_Dir..;Reboot....[Drivers_Dir]..amdkmpfd.sys,,,2....[AMDKMPFD_Install.HW]..AddReg = AMDKMPFD_Filter_Reg.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdkmpfd.isz

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1988
Entropy (8bit):	5.586066176637161
Encrypted:	false
SSDEEP:	48:HgDKwhDQnj698joVfuVXPgYVeDYgHwuMgHygH0Fj71n:HgDKqDQOcvIMN3n
MD5:	510D1A4050E0FEE8E58D59D5A97C91D6
SHA1:	1716413A8D1B1F25BB947848F85633CA60E31011
SHA-256:	E08507BEDFA5A4F86642C2504FE826BDF3296E5F2AF4492238619C187D9F2128
SHA-512:	F6ED78C5B7CA9EF2599AC66424D608FC5A2C78F89D375F3131D109D004A11EF2A20806A6DDE6B8490EB5CFBDD4B9E7083C8492952F6A9DEBDE94243D4C58842C
Malicious:	false
Reputation:	low
Preview:	;..; Copyright (c) 2011 AMD..;....[Version]..Signature="$WINDOWS NT$"..Class=System..ClassGuid={4D36E97D-E325-11CE-BFC1-08002BE10318}..Provider=%AMD%....DriverVer=11/21/2013, 13.30.0.0002....CatalogFile=amdkmpfd.cat....;[ClassInstall32]..;AddReg=system_class_addreg....;[system_class_addreg]..;HKR,,,,%SystemClassName%..;HKR,,Icon,,"-27"....[DestinationDirs]..Drivers_Dir = 12....[SourceDisksNames.x86]..1 = %DISK_NAME%,,,""....[SourceDisksNames.amd64]..1 = %DISK_NAME%,,,""......[SourceDisksFiles]..amdkmpfd.sys = 1,,....[ControlFlags]..ExcludeFromSelect=*....[Manufacturer]..%AMD%=AMD_KMPFD,NTAMD64....[AMD_KMPFD.NTAMD64]..%PCI\AMDPCIE.DeviceDesc%=AMDKMPFD_Install, ACPI\PNP0A03..%PCI\AMDPCIE.DeviceDesc%=AMDKMPFD_Install, ACPI\PNP0A08....[AMDKMPFD_Install]..Include = machine.inf....; The function driver..Needs = PCI_DRV_ROOT...; Install section for the function driver....CopyFiles=Drivers_Dir..;Reboot....[Drivers_Dir]..amdkmpfd.sys,,,2....[AMDKMPFD_Install.HW]..AddReg = AMDKMPFD_Filter_Reg.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdkmpfd.sbz

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36608
Entropy (8bit):	6.192988437024238
Encrypted:	false
SSDEEP:	384:W7TF9ipSqnGAbe+6+wWgNo2CCn+2k3/cjU7doSEeT2cGhOicvzXIu9QP9+iUdYHj:aZcwqn6vQEYq8riDZ3um64
MD5:	E567B9B867D6E360F92549C7A895B84D
SHA1:	7DE4820D6EC90B4FC4EDCBF82C61E2354F386035
SHA-256:	6BBAC1035AC0336F09FDFBA69BCB3BD64B687191FFCF112889E12E8C779D0F08
SHA-512:	A5E4F44847A9902A687F145A1DC5C018D8C6F6187174766A9DB50840E26E72168B6F32D68258C8DFFDEB56E48A111E1A383593447864A8C086B9130770C1C736
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._....}.V.}.V.}.V.}.V6}.V.FV.}.V.@V.}.V.CV.}.V<.BV.}.V<.DV.}.V<.AV.}.VRich.}.V........................PE..d...^.R.........."......P... ............................................................`.................................................\...<....................r..........l...pa..8...........................0d...............`..p............................text...yC.......D.................. ..h.rdata..D....`.......H..............@..H.data........p.......V..............@....pdata...............X..............@..HPAGE.................`.............. ..`INIT.................d.............. ....rsrc................l..............@..B.reloc..4............p..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdkmpfd.ssz

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36608
Entropy (8bit):	6.192988437024238
Encrypted:	false
SSDEEP:	384:W7TF9ipSqnGAbe+6+wWgNo2CCn+2k3/cjU7doSEeT2cGhOicvzXIu9QP9+iUdYHj:aZcwqn6vQEYq8riDZ3um64
MD5:	E567B9B867D6E360F92549C7A895B84D
SHA1:	7DE4820D6EC90B4FC4EDCBF82C61E2354F386035
SHA-256:	6BBAC1035AC0336F09FDFBA69BCB3BD64B687191FFCF112889E12E8C779D0F08
SHA-512:	A5E4F44847A9902A687F145A1DC5C018D8C6F6187174766A9DB50840E26E72168B6F32D68258C8DFFDEB56E48A111E1A383593447864A8C086B9130770C1C736
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._....}.V.}.V.}.V.}.V6}.V.FV.}.V.@V.}.V.CV.}.V<.BV.}.V<.DV.}.V<.AV.}.VRich.}.V........................PE..d...^.R.........."......P... ............................................................`.................................................\...<....................r..........l...pa..8...........................0d...............`..p............................text...yC.......D.................. ..h.rdata..D....`.......H..............@..H.data........p.......V..............@....pdata...............X..............@..HPAGE.................`.............. ..`INIT.................d.............. ....rsrc................l..............@..B.reloc..4............p..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdmftdecoder_32.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	6.331596221965768
Encrypted:	false
SSDEEP:	1536:EZ4oz9Mj9x6hNNhQ9HIomvUcP27W/LTNOs+y4H3PBo24qb9ZNBg7NNbqEYHwzkrG:ELKENXQGomvUcP27W/LTNOs+yqu24QfP
MD5:	567FFAA59319C58A9143EF08A4801BD8
SHA1:	CC57751D602C584A91C079CA73B4EFB1651B8FB5
SHA-256:	0934AD643B87900E04B1241B96F14C90468C94A28918C97150D9F6251201CF07
SHA-512:	6DCA5A925EEDD10511128BEFA813898714035FE8A7474A8F47E9730EBB51B87C4BA0D5D10E974FA2B878EDD9F2D4EBB84760CF97E5977537F35B4668E2FF21B6
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h...,s.X,s.X,s.X%..X-s.X%..X/s.X2!.X.s.X.<.X-s.X2!.X(s.X2!.X s.X%..X9s.X,s~Xrs.X.PcX-s.X2!.X$s.X2!.X-s.X2!.X-s.X2!.X-s.XRich,s.X................PE..L....UT...........!.........`...............0......................................8................................c.......Y..................................h....1...............................L..@............0...............................text...%........................... ..`.rdata..L4...0...6... ..............@..@.data........p.......V..............@....rsrc................h..............@..@.reloc...............p..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdmftdecoder_64.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	121344
Entropy (8bit):	6.009326562893297
Encrypted:	false
SSDEEP:	3072:1DIJrjkWuNAu4ff0ZhRdvBipsOVZL1UI1QOlxAgfR:1DIJfNoofshRdvBiprVxQOlxA
MD5:	F7A320DFDF0B0FBB8D0AB38B349F8D53
SHA1:	517749D89AD6636D5BA22EE7305D2718C5CEC17F
SHA-256:	8DFF119BF17FD8524320D57D01E649DA307156D8264AFBFCA769813385F4D548
SHA-512:	3560EE317527D4D5B6094E6E82CD1823958403FF3F6E18E7F23D25E7BC3C67BF9041035E51BB642FCABB1B755207BC3F880941D23778359384331173192BEEAD
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>f.._..._..._...'..._...'..._...'..._......._..q...._......._......._......._...'..._..._.._...e.._......._......._......._......._..Rich._..........PE..d....UT.........." .....F...........K....................................... .......t......................................................`........................................c...............................................`..(............................text...(E.......F.................. ..`.rdata..\|]...`...^...J..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdmftvideodecoder_32.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	109832
Entropy (8bit):	6.472734402984442
Encrypted:	false
SSDEEP:	3072:mOqvHCh1U6RDZxdx45D+Udfb21goM5flZYHhoIRt8u435YMsOyl+3o6N:rw0Dxd2dzPtyHhoIfhXOylWNN
MD5:	B8026C05A843BBCF6F7C2296CE5543E9
SHA1:	C1F10FC06D96A213E5741498E6BFEE99B9854256
SHA-256:	6729B12550F118A2C05CCF057514F965F35EDF526047B180CB136606B1EE22DC
SHA-512:	D42E20D53005D05B18C0860E6AC61A82F392EBC7E85F5CC5F7FCD58A88AF6446D515453E22DDF4A9D0F739C67339E1F1BD58EBE908A78ACEE38B53B1E4CB5240
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........7N.wdN.wdN.wdG..dO.wdG..dK.wdP..dL.wd..dO.wdP..dJ.wdP..dB.wdG..d[.wdN.vd*.wd..kdO.wd..(dO.wdP..dF.wdP..dO.wdP..dO.wdRichN.wd........PE..L....UT...........!.........r.......#.......0.......................................`...............................z......$p.......................................2..............................Pc..@............0...............................text...U........................... ..`.rdata..AK...0...L..."..............@..@.data...t............n..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdmftvideodecoder_64.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	132528
Entropy (8bit):	6.179058393030989
Encrypted:	false
SSDEEP:	3072:a9v/eD0SsVVrHbsRtcp9SjVmS9I1jOlqPpm:apmopVLbswaNuOlqPI
MD5:	5B256F7F5A9D83E7783067807D595881
SHA1:	48E1716E3455623BDFA8998165F2081985188069
SHA-256:	6C1CCF4EF57C0C7EF22BF95D93EA1DB0904FE67DBA3802F0A85B9A29AA02B1C1
SHA-512:	9DD4047953F5341466F2E07FDB5EAF1F31928BDA1FD301761DAEFB7DDBF29C0FE37B18DFD7EF24A5D73FB5DD55ED9BDDF5A8ECAEA112BB69D028CFF1FDC4CD02
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................R.....Y.....V.....B....3.G.....D.....R.....U.....B..................[......[.....C.....@....Rich............PE..d....UT.........." .....L...........Q.......................................0.......'..............................................@.......X...................L............ .......c...............................................`..X............................text....K.......L.................. ..`.rdata...o...`...p...P..............@..@.data...............................@....pdata..L...........................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdmiracast.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 418304 bytes
Category:	dropped
Size (bytes):	237219
Entropy (8bit):	7.736023641149734
Encrypted:	false
SSDEEP:	6144:T33MlL6lZcNJeLT5xJeImQZ7bMI6j3bBcqppOp:glLEVnJeIfZxyBc4Op
MD5:	FDA4B384EDE63CB42710619E6C5568C1
SHA1:	299998172A9AA4B555972EA8011C1FD6E4D852FF
SHA-256:	78F312FC14213D78EFFDC03DEBDFE277CD6B5CE73B8CB65921AC2A810115B8F0
SHA-512:	E5E2A7E4ABCD8496601271345411093A4245900992D99FDDF03A48630E0D3CEA7C4851DB2A407B706478026215AB8AFBCC21C68B22638A2AB3DFC29031194FEE
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.b...MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$...?#..{B.}.t.....zu.....>..........vu...w..pu...u._\...f......\....Rich.t.....PE..d......UT....." ............................".....(....(...".`....I.H........_.....{.x.....;............8.....U..=p.....H=...>...text........... ..`..rdata...Y9.....:.....v..@..#..U......,u.N 1+.c.p.#.....<....0.7'reloco...........D~-.B...-.-.-..-.=.='=7=G=W=g=.w=.=.=.=.=.=.=4&.SH.. H.=.Z!(......H...............H...u....H.. .[..N H......@..&B..H....0..../A.4F.>B./A.V4F. ?A./A.4FU.hBr/A.4F.hBU]/A.4F.hBH/AU.4F.hB3/A.4FU.hB./A.4F.hB]..A.=ah@.:@.h@u.7@..........D3...C..PH.\$..W.0@.P..3..H.L$01Q H...H.D$8?P.(H..t.H...tz.?Hue..:.u`........@H.d.$4.L.8Q.T.$0L..H...D$0..{P.....Q ....................DDP....P..H.\$.P.@@_.....Y...Y.Q..0(..=..P.u..@..P..V.P.....P..HlP0.@.PH....PH..t..H.\|PHi....H.H...@(2.S(.S.P...8e..UH.t$.%Q0.I..H..H.......E3.3..3.E3......a.C..@tP.H.C.L..L...>Q(qa.Q.....

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdmmcl.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 37888 bytes
Category:	dropped
Size (bytes):	19220
Entropy (8bit):	7.732998793487288
Encrypted:	false
SSDEEP:	384:uPsinGeSVK0rp9ck7JLjLnaWDdd/9UhY1aFrQ1f8GZ65ElhZdcUWZTdByt7i:waVTrp9c+9aEgX+R7wKiZbf
MD5:	C686573318D675491291E4C8AB32B2D8
SHA1:	1F410A2DC25401C69799B296CF52B7B7E9EE5B75
SHA-256:	662EA35E7B8633B58A4633F56CA167264379AE6C19BF6EAA262E3F1995F2753B
SHA-512:	5C510D572702D25A6230169CDF074AC5A8FFF54832CD4F142DF30D21E7F46C78CDCB156CB5880066B2BB494D782E7E36883A3773E4A63295A8F2798099095BCC
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}.............@....................!..L.!T.his prog.ram cann.ot be ru.n in DOS. mode.....$...A..../.t.]...u.}......}.....u..R...u....u.e.}..........W............Richt.....P.E..L......UT.....!......l..(V...r........=.$.......8.s........@-..%.%.Y.#.0...M.........................3.8........).......text...'k"...M... ...`.rdat_a....&.....p....@..#.t...2....-....rsrc.......7..V-> relo.l V.........~-.B...-.-.-.-..=.='=7=G=W=g=w=..=.=.=.=.=.=.5U...Q.E..E...-....]......G.1j.h......E.P...@.........u..E...1..,@...E...0..H.Bj.h..y..d.......-......3..E.P.E.{d....\......j...`~@3.n5..D.Ay@6C..E.P.M.Q..D..@...t'..<~@....T,@.@..DH.@..B...-..h3.....X~@...AR..FM.@....9P.A.BP.! .B.T~@...A.t.....Q.t.....A.u.{C..@..^...A.E.C...hL.@.DoNP..@.RcQ.t#...QR..cQ......A.{C.A.X..}Bu".0.@.Q;...A..>.Z9Q:.UG.C.. .R.Q.L.R.Q.t.oj....Q...T?....4~@.Q..a..!UG...Q.s.$.B)a..H.R.5a.S.5a.....Fb.b,.dXa.c,R.a..A..8.Bya...D.R.a?d.aJa.b.b.0.d.a.B.}A...(~@.KJ?.A.a..M.d....Y..M.3...\.2.BI.1.M..E

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdmmcl6.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 48128 bytes
Category:	dropped
Size (bytes):	20859
Entropy (8bit):	7.756122922019209
Encrypted:	false
SSDEEP:	384:/GY4S/36byNV7Xe/dFGS1AhghskdpoeHVUocKA/Wn+Jv7IGAuRmeC:/EK3rNs/SgzpV8KA/Wn+99Ri
MD5:	2D4911100A1950F8DC26AFEFE0ABBB5B
SHA1:	DB03A3203B79C492489EEAE83E3527958DC0223A
SHA-256:	4684F4F404E228DADE5484BB82A79D00CCF4E060934BCC2B719691027B0CBC08
SHA-512:	9BB812D3E14A9FDDD41E952770F9E9982AB6C6A4F2F3D0F12E4F2D30CA00F48B14CE44AD1567D55E5CBC7FF66749E66B41051AFB571E459C18D25DD6C4F4E94B
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}.............@...................!..L.!Th.is progr.am canno.t be run. in DOS .mode.....$..7.?&s..Qut..`.uq.u....ur}.....u.}..uv.u.h8.upu.P.uEu.....T.c.u{.....T.c......Ric.ht...PE..d......UT....." ....k....2..d........-..........0.+........`-...Q.P.%. ................H...................8.......p.....$......t7ext.......E... ..`.r.data...............@]."#.@.....{..6-...p"#..../..^-F rsCrc....../...-..!elo. $....X"y..,B...-.=.=.'=7=G=W=g=w=.=.=.=.=.=.=.5L.D.$..T$.H..L$.H.....D$(..$.$.?H......I.5.8A.1!H..b.....L$@.../5 ..u..D.$ $...EA....F@.@8.K..L..0 .2H.7.....H.$........H..r....3.H..$.t..OE..B..$....=-..F.N3 L.$..A..$...A.E.O...o..t.E@P..Ar.Ex.@.@P..-...:>...0(6A(..^.S8.SL...S0H.\|$(..t.9Q0.t.0\|.$8.CC..@.YgH.T(P.E#S-BY.5 .F.R.S`9Q.`.t.[Q06A`.....ANB.AMC.A^:P .u'.A..D...B.Q{K.XUQ9TS@H.A.Qx.Qx.Q.X9QX.t..QX.H..D7@X..0D_$h..HE@h..JATL.Q0.A5!H.@.;b.0H9QH.RIa.h]H.a.$.JA..A.la&e8.tF.Q8..Qp.Qp.Q@9Q@(Qd.P.g@fc.mf.a....@ .0T.F.M..RTH...BH3o...z....A..A.7.@

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdocl.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28772352
Entropy (8bit):	6.356470338697182
Encrypted:	false
SSDEEP:	786432:4xvGVzx+WQ2BuSk//QPONpKGSV9c01rfO2RNEGqwlWFQTO45YVpFGsqP8K+bOY9f:TVzx+fSk//QPONpFSV9c01rfO2RNEGqe
MD5:	8FB64B9D0EB2857D6FCDBF3B68A1E82D
SHA1:	880CDC18C857DEAACADDD6D20EEC587EE998FC27
SHA-256:	A868E2D616528DE77C9FE40B25EA33B3F1428FC178118668184E0D3E898DDDD0
SHA-512:	BE91085DF9AB48E9FCDE18E5738F1C9954BA9B49AAC8F4E3BD628BFB3672A3A733200D27B7B42ACF3B0367A82577F997099F2A400544E857D8C8FE1A0AAA9BD8
Malicious:	false
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......?>\|.{_..{_..{_.....t_.....7_.....#_.....k^.....z_...)..z_.....h_..{_..q^..\..._..\...L_..\..y_..\...\..\..z_..\..z_..\..z_..Rich{_..................PE..L....UT...........!.....N...v...............`............................................@..........................l..!....W..................................P....p..8...................D.\|......\|.@............`...............................text....L.......N.................. ..`.rdata...)...`......R..............@..@.data...............\|..............@....tls................................@....rsrc...............................@..@.reloc...Y(......Z(.................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdocl64.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33870336
Entropy (8bit):	6.311914342045445
Encrypted:	false
SSDEEP:	393216:9fytButWoTcv16tjdthiIdYGgt0bHhY3C2oxTVr:Ts8t2iV
MD5:	B952BB12279486D4AFFC635D39776278
SHA1:	1747E117498B6532A89BC97E75AB87C6DD372EC5
SHA-256:	6A3DDE204CFE14D0A5AAEDACCD3686AA3551AC7D7A032879FAD698A20FA5B9CD
SHA-512:	87B8C969A978719EAF8BB24D3E83F257F3219556F05A73B89958400A12A7CF919A69CE9866070C61988C6BA5D8E6A0A1A04DF74B3C1B12FD1C7D1F98292E1945
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.,.~.B.~.B.~.B.....p.B..t..^.B..t..'.B..t..h.B..N....B......B..N..m.B.~.C.p.B.Yw...B.Yw..I.B.Yw..z.B.Yw....B.Yw....B.Yw....B.Yw....B.Rich~.B.........PE..d.....UT.........." ......................................................................`.................................................~...................................... ..8...................8...(.......................`............................text............................... ..`.rdata............................@..@.data...H........`..................@....pdata.............................@..@.tls................................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdocl_as32.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	995342
Entropy (8bit):	5.993041480169951
Encrypted:	false
SSDEEP:	12288:zV35Ka2MH0B4EsJub+6mvrsC5Hs6G7R5zETbW2mlz0N9lWKu7BPxVx1Mz/3abkus:F5KbrRQrsC5gl5zETbgR0NPW3Ugx6pF
MD5:	56B986D13C74903FE27B71BA85C76037
SHA1:	36DC372998FC32F313A537D5818292765CF43553
SHA-256:	9F9F6CD67F1610962868786B373F79829CBAE4062E2AB98FCF060E6021F6B6A5
SHA-512:	A2A9444AFBB3FF292BF73A7760B6A33A3E30ED69A0DDE85A904CF6FD15733F62DEAF1A36DA4482198EFE3CF31746B73EA0F00DF85589EEF7B318C76AA9D584E7
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......M.0...................,......`.............@.........................................................................P..D............................................................p.......................................................text...............................`.P`.data...T...........................@.`..rdata.. @.......B..................@.`@/4......,....P......................@.0..bss....H....`........................`..idata..D....P....... ..............@.0..CRT.........`.......,..............@.0..tls.... ....p......................@.0.................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdocl_as64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1187342
Entropy (8bit):	6.050268696423314
Encrypted:	false
SSDEEP:	24576:IeT40iQHdkD9w+SBU81gQCSXUmwf7ty09:00iQ9a9w3U8qCdT0
MD5:	ECC9D68F5BEF5CD67BE2D2F758661980
SHA1:	D307B46B948DE1C9998C3B95D11029640A2D1893
SHA-256:	AFA31C4E550F5E408B009E840A653682534A7F427B5E5624E00126E28DA3FE92
SHA-512:	11EC0D8A5F8A80BDC639B7436B7B9F6CF631080900207F0A72DB8E9C68E83A152DE91BA9911E8EF7E3F3FD330EE6CD233FDEB57F082FBE4D28C135ED9C30AC4F
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..M.................>..........`........P....@..........................`...............................................0...............................................................P.......................................................text...L<.......>..................`.P`.data...t ...P..."...B..............@.`..rdata.. ............d..............@.`@/4......p....0......................@.0..bss.........@........................`..idata.......0......................@.0..CRT.........@......................@.0..tls.... ....P......................@.0.................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdocl_ld32.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	798734
Entropy (8bit):	6.5715560684606125
Encrypted:	false
SSDEEP:	12288:QZRcr4UtRhQfq6N66+o1L9sOcO9V3YzrZ1yvTlD5NlHvMXdtjkmv2pVqRm:gcr42Cy56+csjO9urZ1AptHejkm+/qRm
MD5:	28F4F5BAC73505F71B8AEC95B7FBE1DD
SHA1:	E8B915C408F674267575F28401DF18DBA745A5B6
SHA-256:	8FC0EA32DE84B4224C65A64A57023521BA952B67FB022BE8E905062821C2D595
SHA-512:	A9B7F2CB9F16AE64AC241FE934AC072C87E1539AAC8FB1E9F8FCA89B1835D6F7D677A152BA26F1A45CF18CF5D8BDE08FCCD9F06887B5567B055522E47062B94B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......M.0...................,...Z..`.............@.............................................................................X....................................................................................................................text...T...........................`.P`.data...t...........................@.`..rdata.. 9.......:..................@.`@/4......,....@......................@.0..bss....<X...P........................`..idata..X............ ..............@.0..CRT.................,..............@.0..tls.... ...........................@.0.................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdocl_ld64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1061902
Entropy (8bit):	6.547834043135214
Encrypted:	false
SSDEEP:	24576:aH4N+5oLL0F3sEIcKBJK8BpYyhGsOa/IDQyxUM8a2eZjL:aH4N3UFxIPA8ByyhTwM/M/XZH
MD5:	DD3E0FE46F9AB3F9A339F4DD3B2B2E4C
SHA1:	0E588225A6910502DE93D5B9695A85F5251AD0E4
SHA-256:	605902C1B04B0D414D92C1BEE39A472D9FB4471C22CD195BFB83F2D0BD2F64C6
SHA-512:	B6854E6EFA4AA4C0191AECF2B53626A0A04EB5BCF21805D79A80A14BB58F320EF65616A10B1FCE5853D24E79D7FE80162FF02B908226CB18BE2F907274957B00
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......M.4...................0...Z..`.............@.................................&................................................................................................................................................................text...............................`.P`.data....#.......$..................@.`..rdata..`7.......8..................@.`@/4......p....P......."..............@.0..bss.....Y...`........................`..idata...............$..............@.0..CRT.................0..............@.0..tls.... ............2..............@.0.................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdpcom32.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 71704 bytes
Category:	dropped
Size (bytes):	41405
Entropy (8bit):	7.72855368635325
Encrypted:	false
SSDEEP:	768:Y2KWk37Hq3Jmchk1L8KHpyByXfIBqPLgbf9yRnfdk3xSDpz4MpTJM25RbCz814U1:nKWkrYvGlyQABqPLPRVk3IDV4gJX5R0A
MD5:	D6B6CCA839C8DDAAB8016E6B0A98A4B9
SHA1:	4AB08DAB8E73C0F6CD3803E60A8CE872552A9B62
SHA-256:	E9E82892B4C53E4711864D86123027B6069F7E745732B06053358032C13917CF
SHA-512:	FA8697209571BEDEB6854360241C31DE351ABAF4E56EB69D29BB9EFE4226770C861A2A1B6F8F20172125574806E61DFFF93BA09F652C47BA9BDF3F7310771289
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$.....Ir.y'}!t.,..!.}.w.!.}..!.u..5..!.u.&!....!.u..W.!......=..Richt....PE..L....UT......!...........<.....z............ ..@....q.....1.....E.C.......,.........(.f......T....p...8$.........,........text............ ...`.rdataZ.....0......@]..#..+...-......-...rs.rc..l.......>-& reloT \|.%~..&...f-..B...-.-.-.-.-.-..=.=/=?=O=_=o=.=..=.=.=.=.=.=.W7..A...Aa!.0...3E..A..2.G....0}..0..3.....f..A$.1A,1A41A<1AD.1AL1AT.....WEU..V...N ...A..t....Q.P..F,B.N.oI%B..N.oI.B.N.....lL...E...t.V..(........^]....XH.....yH..c@W.}..@.....t$..WD$....o@.sC.~....P.W..P.........D$...y......_^..]....h.b.....@...@.\|.$..........~ ..V u...F.j....Rj.j.j.h.NV12fP.j..P.Q....$R.......@.01@D.$.{P .V.R.j.jR%d.....T$$..dR.R?AD$DAD$D:.@L.2D$(...@..#P0.@4kQ..Shp.@u@,.QA.Q.F.P..vP.Q0..QM..u....9Q.G.3G..Q....G..A...G..G..........@#Q.P..0.P@f..D$i@aPuP${PH.HP.jp..$....D$d.0j.Pwf..j`.b].Q.L..$.!

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amdpcom64.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 78432 bytes
Category:	dropped
Size (bytes):	45902
Entropy (8bit):	7.7311351667854105
Encrypted:	false
SSDEEP:	768:MBMhcE8wxKpEE2Mc0g8U//zVpfoMEaI+vueQ8R/gGIjfUFc+Lk2T:ZPUpEEVc0TUnzVpfonaI+vA8Bsbq9LkK
MD5:	B49AAFFB31D1208DFDE05F57A5DE521D
SHA1:	B02F7D271A24DA4190D53224603D8DD10BF842B9
SHA-256:	A7D97210F7D5C91DDAFED05546AFF064738929EF50A9F7E675FCB56E463709ED
SHA-512:	7F5DF31464CC4A4782F56B5EE0B07A75938C9F7170217EAED46FDBCBD1D59F2ECA483F7941B909A6BA239CE7A48CEC3043AA310597EDE9E61078EB2A68B72792
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al`2...MZ......}.............@...................!..L.!Th.is progr.am canno.t be run. in DOS .mode.....$..y..8=...kt..21k!.}.0ki}.3k5.u...5k:u...kk..0k<u...1-k9..4..7z..2..Richt......PE..d......UT....." ...........\D...x)............0..p-......,.`B.%.T.Y...@...<.......... 0.@..........`...N..>-.....8.....0........h.-......text.......R... ....rdata.'.\|?..........@."#..6)..z...6-...p"#,.........^-F .rsrc.!0........."..elo.. ....."..-..B...-.=.='=7=G=.W=g=w=.=.=.=.=.=..=.5H.\$.W.H.. ..H..........t..H....1.0...H.\$0H... _...7H.....A.3..H..H.I8H...t.H....P.H.{8H..K0=K0L@(=K(jL@.@..A..=K..@.G.B.1.UVW.ATAVH..$.p...H...-.H.Z.L...9@.I..H..A.-..=A.BCI..^.H..t..H..H...P..@..........y........-...b...L..$.-....0.P.@.....-.L..$.-.M..n83.I9U..u9I.N(H..T$HL.l$=@B@.D$8".>P.0>P(.".E3..D..JP NV1.2.P..@...9m-.9Q3.HJP.!..0D$\.Qd.Ql.Pt%d.@I.VG0..PWPJPT"..JP\iQ.PXB@L...PH..P....A.iQeQ...PX..P..-.9P.@D@...Q..Q...QE..g.@.I.G.H..F.I._ .`...B.H..H....@....u.b...(.H....1..7a.).A..(J..).I..(

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amf-mft-mjpeg-decoder32.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2182144
Entropy (8bit):	6.353544662026041
Encrypted:	false
SSDEEP:	24576:Im/tCcBY8up0j9JwwgfFkYQV9sww8HF8PQk9Jwwg1tdoQK9sww8CvwfQ1:Im/tKrDFkYYF8PotdoSvwfg
MD5:	BF60B178B1ADD42BB5075092BEBA1447
SHA1:	5DB21B306513A67B16F317731548178E22CDAC36
SHA-256:	5F506EDD968C1F9C6163B186C98938A4948DF1FF906B855E17B251081FF0F623
SHA-512:	89BC665087A995CFEAE471D86CB3174772253C3A1EA209AFF0F4AC24A9D2E6F9E83F7C648EB74A6B5388AB893D8DA8DFA07B7A3F9E39FAEC505D9C8606603113
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,R1.M<b.M<b.M<b.;.b.M<bY..b.M<b..b.M<b.M<b.M<b..b.M<b6:.b.M<b6:.b.M<b.M=bVM<b6:.b.M<b..b.M<b..b.M<b..b.M<b..b.M<bRich.M<b........................PE..L.....UT...........!.........b................................................!.....4B"..............................................@!......................P!..6...................................................... ............................text............................... ..`.rdata..............................@..@.data....m.......*..................@....rsrc........@!....... .............@..@.reloc...`...P!..b.... .............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\amf-mft-mjpeg-decoder64.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2227200
Entropy (8bit):	6.319871433680975
Encrypted:	false
SSDEEP:	24576:acI/21sOoDi9JwwgfFkYQz9sww8HF8PQz9Jwwg1tdoQW9sww8CvwfQ:aJ+eOIFkYSF8P/tdoyvwf
MD5:	587CA1E4B71279D914AEDFB0B3DD4550
SHA1:	01D1C7E30B46C2F614DE8EAC8795673E5B7172CC
SHA-256:	CE401E977A930E48D8908C2390F01E9BF0755165848841CAA9D31CFCC19AFFD2
SHA-512:	10CE6D0EAC7E9C3E82DB7D9191F4715468FD4BBC5568F752091D119DB1A6D7079FB1C402BE4EAE9D9BDC84395618298B26E54438CA6B504BAEB450DFC4CB6760
Malicious:	false
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........k............\|y....zDJ.....L.....y.....x.S.........}n.....}l.......t...}k.....}.....I.....H.....O....Rich...........................PE..d....UT.........." .........................................................p"......."..............................................q.......b.......@".......".d8...........P".....@%............................................... ..P............................text............................... ..`.rdata...R... ...T..................@..@.data...0~.......4...h..............@....pdata..d8...."..:....!.............@..@.rsrc........@".......!.............@..@.reloc..*....P".. ....!.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\ati2erec.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 43520 bytes
Category:	dropped
Size (bytes):	12367
Entropy (8bit):	7.6881054885818365
Encrypted:	false
SSDEEP:	384:JmHYLpnhqLfkaqf8i+Uu8lm5/vAozlgVZN4MwF:JmHYLpwLd0u8S3AozlgjUF
MD5:	D316DA148512B3BAEC02E88F93779D37
SHA1:	4F88FB20F0767A627DAB97D2B4638966E5D7C8CA
SHA-256:	48232B240E9C24F9EF93D2DA22B66CDC918DE643F12C37BC3907F52E35562663
SHA-512:	F95006B9EC91C3AA6D7FCC38CC5B35208C2962D129938C706175533790D9E035E6949180E7F3F472C930721234808EA7A6E2FF6585BF8B498BC8E3328A5C1F38
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}.............@.................!...L.!This. program. cannot .be run i.n DOS mo.de....$....-..L...t...c..u.=....f..Ric.ht...PE..L......UT......!.................3...............@..........!.....!.E.U.e..u......rsrc...4........................ .K....8. .... H...-.$h%-. ....?,K&..!......V'...........4..V.S._. E.R. I.O+.N. I. F. ..O.....!.!..$b.!............. t.r.i..n.g. i.l.}e. n.f.o..].."0.4.09.2Ub.0.. +. C.0um10e. t.s..UR.0s.0u. c.0. .0.3 . h.a.. ; o.0d;0 T.0@1c.0rk0 32.s;0a. B1...Z...+6p_0n.yR. a32..Ak0v.2TL1~1M. c. o. %D.0v.2B1,. .1.c.4d... .%.1Us.2i.0t. o. ...r=M.: ?=. .%_..2...8V.0.r;0.G1.00yD2..0..:... .1tJgBn_0l.8`1iW@.hAv1.k0l.0..l+.$. L.0g.B.1.p.0.!g; t.... 2.0.1 .=.=.=..8B.BO.D.!.A.%..A.M.M..0.. P..RdG0c. .9.K...6YB~[fMxM..DJ."V_0r.-..$..T. .1s.0\S.E......!0.#?.......@.9`.j...9`.9``......@Pa.M`..\|..]`@....]`U.]`.e`.]`.]`.... ..@.a........`......`.a4....`.a.R....`.a.....`-..`@....R`.`e..`..`.a... ....".`p.`8L.`.a... .`..`.......`.q.&~ .`.q\|'.`

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atiadlxx.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 1211392 bytes
Category:	dropped
Size (bytes):	662162
Entropy (8bit):	7.750649010901716
Encrypted:	false
SSDEEP:	12288:QmV9jceuO8RIFsiuML+xMNlO5hBuCqWRfkXNhNT/0Qk6xayoacyjM622rlhGiY7b:QE9oJa6sKf0P1/K6kYjM6vrlhGiQJB
MD5:	DAD936AE0354B85550E4EBBA04EA2F76
SHA1:	FF4AD4A178FC99874931284EA2760C64E29D194E
SHA-256:	4159718513990DDA14ECA5292C76D78E72E848EC731C5E060E6A0E5C183C16A3
SHA-512:	CBCF98D82F3E84526F6744FD8B976F0401A20678800311DCFDD84B259A2A9386B726279A030C0B44FB26C7CD4F26E0E4FD6560417E8A82E5F054B03A04C09A2A
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.\|...MZ......}.............@....................!..L.!T.his prog.ram cann.ot be ru.n in DOS. mode.....$..}Kw.9...t.0R..}:u.....8u................7u...}......"u..........W..1........=..Richt....PE..d....UT....". ...............\|......-.+....9...@..p...:..`-.-.a.`.5.`........t.....4.P..h...p..@...`.........8....(...(............."......t7ext..E...-....U... ...rd.ata..{.................@.2#.........&..vf I+.c.p2#.......!.n-V tls..."@.R.=..f. q-rsCrc.......h.-.V relo. ..4..,.l.-.B../=.?=O=_=o=.=.=.=.=..=.=.=...y..........$...(...t...Y...t..@....0....^..(...(...%G.9..#.=.M.M..H..\$.WH.. .3.H...A(...@.AP@..A.`..A....D.....9H.y.^.@..y..@ .@.0.@8.y@f..yT.@.@X.@p........H..}.".3.A.."...[..3.H......@..C...C..C..@..u..C......of....S@".@....0, .@8.4S., ..D+Q.k{h.@ HR.(SSU0SS8SS.SSPSS.X+R\$0H... _$CpGH..H...H..u.H..../...P.X...RX.~..eH..%X.1....PH...H..G.....Q.P..H..H.G.H..D.d.R.H.....Z@S.S..l.1.W.W.Q.C.R..S..P.H..C..P..Q.0`...Q[$DpG....=-.f .P.4.u.,3.E3.D...3

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atiadlxy.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 901120 bytes
Category:	dropped
Size (bytes):	487132
Entropy (8bit):	7.76703983744652
Encrypted:	false
SSDEEP:	12288:QpDI4ikzDaSfUa507UtWJRzcPpUB8wAb7fvP0uu:QfaQUc0n1EpW8NfX0uu
MD5:	E81F22016AB3B44FED62341E1E683609
SHA1:	DFE04CA2E2F6B2A53E3CFB718DE3509186D75A2B
SHA-256:	1C007C950B784E024B964D5009070CE767D1C3A4E8E6FF65F00067F4527D4BA1
SHA-512:	9DADA2D5B04B70F6D6D27B59EB45179D012E560CF3C66CE5D65C12C929399AA9A5CDEC570BDC788DA28CE9275A228E76613D112A48E9E4364A8B45881F20BE38
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}.............@....................!..L.!T.his prog.ram cann.ot be ru.n in DOS. mode.....$..........Ct..nC}.u.}oC.u..'."C.. C...#CDu.>0}=..>0&C.u.w.CS..#C.u._.."C...'.....$..!..Ri.cht...PE...L.....UT......!...........................#.%........8......2.@.-.%.%.Y.#.p..............-.. ..h\|....0..4c......8............x....)...5......tex.t......%...M.... ..`.rd.ata...]5..).^5.......@...#............N 1+..t.ls...+.J...L.V-f rsr.........N~-> relo....m...n..R..-.B...-.-.=.=./=?=O=_=o=.=.=.=.=.=.=.=U...M.........y.............@U..f.(..t....Y...t.:.@..@....0.@.^....]..E...].0@M.4E.HD.=.M.M M0M.@MV..h.5..{..5.j.P.8...FM..F..C...C]..F...@.F...@..C. .A(.8.f.F,.Ah..F0.C8..B....FD.CLD.@.F.T.A.....3...X....U\GV`GVdGVhGTw.lGQ.pGT...xGPf..\|.GP.........Q..R..RL.@..F<..8.Q.<..R@.R2Q.PH.R4.RT.RX.@..^.GFOAV.u.W.....u..p.....@0....F0P....d...P.....`.G.M........~..G..D5.R.._....^].....Z.u.....2.g..b.C..-.)dF..R.*b.P.CbPAE..@....=\....u8.j.j..`...Yt.`.B.x.f\|.d...l......

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atiapfxx.blb

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	625448
Entropy (8bit):	3.546949479549327
Encrypted:	false
SSDEEP:	3072:P4QmSyzoxZUxIBgU6r7KZKEjEXLJ+W9B3HYAiRKQRIssQ9vZHDLNZZZZZZKYlYpj:/sW6r7KZKEh5wqKpzD+P38
MD5:	AAD9A86E6015F06152591AEE23C40F31
SHA1:	13CFCF795D3DC9E9884F1C4E0E188D1162BAD3EE
SHA-256:	70C10417C1CD64F3D4D86EA0FC316E9D4D9E5325E9E69AFDCE33D562F5FEB512
SHA-512:	3F32B374E599E220C891948F9E4EB0C578E378BDDB500CD336A787E27FA31636C1197FF2FF49954C4A0E33BE35DABF217036EB892941EC992ABE138DF6C5561E
Malicious:	false
Reputation:	low
Preview:	BWJE....e.~.R.}Xv]o.&.!;..jF...,...........S...S.......g.......%......./..."W..Q...........\I.......... ....... .P.r.o.f.i.l.e............s.c.r........G.a.m.e._.w.i.n.6.4._.b.a.n.k.r.e.l.e.a.s.e...e.x.e....G.a.m.e._.w.i.n.6.4._.b.e.t.a...e.x.e..........G.a.m.e._.w.i.n.6.4._.f.i.n.a.l...e.x.e........G.a.m.e._.w.i.n.6.4._.p.r.o.f.i.l.e...e.x.e....G.a.m.e._.w.i.n.6.4._.r.e.l.e.a.s.e...e.x.e....X.G.a.m.e...e.x.e......\.3.d.s.M.a.x.8........\.B.i.n.3.2....\.B.i.o.s.h.o.c.k. .I.n.f.i.n.i.t.e.\..........\.B.i.o.s.h.o.c.k.3.\..........\.B.n.S.\.b.i.n........\.C.y.b.e.r.L.i.n.k..\........\.D.i.s.n.e.y.-.P.i.x.a.r. .B.r.a.v.e..........\.M.a.b.i.n.o.g.i......\.P.a.t.h. .o.f. .E.x.i.l.e....\.S.B.K.X......\.T.r.o.p.i.c.s.\......\.W.a.r.g.a.m.e. .E.u.r.o.p.e.a.n. .E.s.c.a.l.a.t.i.o.n.\......\.g.t.a.5.\....\.l.i.o.n.h.e.a.r.t. .-. .k.i.n.g.'.s. .c.r.u.s.a.d.e.........0.......0.......0.,.0.x.2.0.0.0.,.0.,.0.x.2.0.0.0.,.....0.,.0.x.7.6.0.0.0.,.0.,.0.......0.,.0.x.8.f.0.0.0.,.0.,.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atiapfxx.ex_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, e is last character of original name, original size: 367104 bytes
Category:	dropped
Size (bytes):	208258
Entropy (8bit):	7.76527911205203
Encrypted:	false
SSDEEP:	3072:oPN6eXxzLR4uRGhWCHJ1T6/58x1xetEfTbk0h+dG4detanEughnLTn2K:oPceXx3KuAWCvT6mxe+n4lbEugJTn1
MD5:	8AE8A333DCC9D612F3EC9FE2D6FD6328
SHA1:	E3E7ACFABA1BEEF77B1D72C5C74569985FC93D55
SHA-256:	6105D9CCF956DE16642F67303C1D6B976C440925A656FB51A10CF614EF290772
SHA-512:	C4A8D3D1F4966C006977696F6C9908620D8A677A1E4B0BEF96A2A24014881213092EA37EB8051415693922BC95A7074318272240CF720A0BA6999FFC2AAB2B61
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Ae.....MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$....9-..XC}Yt.-..Y.}.w.Y.}..YYu... .Y.u...w.Y.u.4......XBY....Y..u.............Rich.t...PE..L......UT...................a.............2.....(..p(........@.....I.\|S...$...(................&....3.8y.~...............tex.t..........=.... ..`.rd.ata......................#.8...............rscrc..t.q.....y.F-. relo\ .\l....*6.f q+.B...-.-.-.-.-.=..='=7=G=W=g=w=.=..=.=.=.=.=.5U....u..;.......]......J.0V.u......t.P....0.(.^.=.C...,.E.SVW.h..C.j.j..P....2........C.0..F@P......u%h$NBF@S@s..[@dJ.....=.a@h@N@V.....u..hXN@..3...._^[..]..h..C.E....@..A..Mh...B..fE..B...@.\.Mj.h...@.....^.@.h4..@5.]..u..0...A....Q.t.h4...@..3.U.@KP..#Q. C..D7MGMBW@..0^MnM~@..2..J.M.Jj C.M.L.D.]h.#P.A.Q..h.#Q..m.]!S....l8T.DW..A.ecZZ.ecnV.]PG...].]~@. B.J.D.].J:em.m.B.#}.h4.D..E\.A...?mOm"R.q}.uQ.8UbqDQ.IR..A...sZZ..sn\.mPG!.Ip.m.m~@[Ir.m..}.H..J}4}.A.c.hlOP.A..E."OQ....}!S....x....w.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atibtmon.ex_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, e is last character of original name, original size: 118784 bytes
Category:	dropped
Size (bytes):	71662
Entropy (8bit):	7.683715703630565
Encrypted:	false
SSDEEP:	1536:TqmolzgBSzGUu31dc545mTDuWeyxkwhOrIBso+ImxaIU:ksBSz5u31d08mvKydhBlVea3
MD5:	A3A859635BCF4CAFBB59E84D4579DC3F
SHA1:	C6CDF163AFD3D013B0AA1276F32EAD5C716F0728
SHA-256:	369DE1DB001756073B0301C9861C38CD41A65F81303B2D942E5F71749D904B86
SHA-512:	D41D6CA2470CB9D4BEE3D5FE9FD749F667CBC2315401CB8715EF18FEFE1EB41ED8937A13F9C7AC09BCD3800CEA54CD06B9CB255B9733621DD212958496812893
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Ae.....MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$........z.}.t.i....u.........}vu.=u...u.w.r.........t......Ri.cht.....PE...L...l...J.................V...V..... .............(...............=.J.\|;....h..d......x#..........Z.....9.......text..~..:...\.....`..rdata....S..`......@]..#..2....... <"!+..rsr.c..t.q..0...F-...-.-.-.-.-.-..-.-.=.=-===M=]=.m=}=.=.=.=.=.=.=..=.=.M.M-M=MMM]M.mM}M.M.M.M.M.M.M..M.M.].]-]=]M]]].m]}].].].].].].]..].].m.m-m=mMm]m.mm}m.m.m.m.m.m.m..m.m.}.}-}=}M}]}.m}}}.}.}.}.}.}.}..}.}....-.=.M.]..m.}...................-.=.M.]..m.}...................-.=.M.]..m.}...................-.=.M.]..m.}...................-.=.M.]..m.}..................-.=.M.]..m.}..................-.=.M.]..m.}..................-.=.M.]..m.}...................-.k..d3..q.V3...A!....-.......^.......,D.....A.3...$(D..D$(P.hC...@.A........d .AG.`K...tR..T$(+..............u.L$(.j\Q.H)......X.R.F.\.Q.u...XK.P.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\aticalcl.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 49152 bytes
Category:	dropped
Size (bytes):	28164
Entropy (8bit):	7.703343188869624
Encrypted:	false
SSDEEP:	768:kSVbrG+4M38NqKnPgDP+u7LkpYKTJKg/bfR:j0MMpnPgt0pbKgjfR
MD5:	1165C4D465DD56F3CD5FAC68F190F65D
SHA1:	C81FD5EB82A7B6FEE91FA1F1E2B7430829B4DE3C
SHA-256:	7785DA06A28AEF2F405335D8FD5BE85EE6468B9A3F6CB5E021FAC096A00B4D64
SHA-512:	1CD27C6B34E98956DE19B367E3DC6FF900AE34CBE202B86FE52079330ABBB818D0C4E2965A5BDB444634D8EE61885DA71E44334A5B743E17B64B17E8A3A60ABE
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$......rS.}!t..'R!A}.wP!X}.S!.u...V!Pu..!....S!Ru.t$WN!Q..W..T..=Q..Richt....PE..L....UT......!.....h..t..b.......z..i........N ........@2......A......}.2....(....X5........g..8q...........2......te.x...f....m. ...`.rdat_a..v%..&...l....@..#.\|.-..-....-.?..rsrc..l..i....>-& rel.oT N.).....f-.B...-.-.-.-..-.-.=.=/=?=O=_=.o=.=.=.=.=.=.=.=.U..=@....u9.....t.7j...D.0...t+V...1..3....I.V...(..i....H.0F..8r..^].%L.0.>..]....EG.:.?.=.M.M.G.9G..DM.6...aMqM.M1D..9M.M.1..M.M.MJ.G..G..].6..]..]>].G.Y]i].1.....].].]1D..0]....;o.].].].G...M.].1..m>mNm..G..m.R2..m.m.mJ1D..G.tm.6_.m..m.m.G.dp.M%q.5W4..>s1Ex%Qw.`}0B.%.yq..'.i.)}.1...A}.Q}.}1D.y}.}.1O..}.}...G.)..]....2..=0t...V.5...it.`3.k..............I....u...I..A.......p.....A.........p..A....P...,t.........u.h.......2.^..]..5...h..p..Y...h.$.5....7...s...3.<...E....tL.Hu_8...u%.h..h...u..3..........,.[j\.......>.....,

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\aticalcl64.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 55808 bytes
Category:	dropped
Size (bytes):	31359
Entropy (8bit):	7.7013273619079365
Encrypted:	false
SSDEEP:	768:avOCMpqZpcb6kfRtVW1oj+2Cj8UJgR8zt9/6AYw0p:Spcmk7Yw+2C08vHo
MD5:	644A4132AD34FD683E0436010FD09714
SHA1:	B4EB3580D1F3CF7ED1802A64E1A9BF73B8DC9AA6
SHA-256:	80222EAFA07566BD06CC02FF6473118DDC1CF78DE6A4437F8B2F83E0024199C5
SHA-512:	F1AF4FBA60946AD6466F1527DE57E57153C5220C6570DF8AF0D08A6D376986935004573A74F72A49FEF7E213C1059EA4DABAA2085A87A2900D2C20B10EB29E18
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}.............@...................!..L.!Th.is progr.am canno.t be run. in DOS .mode.....$..0..Jt..t.t.....f.}... }...\|.u..;..wu.u..:....uu.S....v......z.....Richt......PE..d......UT....." ......z.............i...........0..@-....`.-...Q.P.%.......-.....(... ..X......l...0..x>-.....8...._@..........-......text...y....E... ...`.rdatao..X0...2..i~....."#.P.........6-..c.p"#........y.^-F rsrc....../..-.!elMo. ..../..-..B...-.=.='=7=.G=W=g=w=.=.=.=.=..=.=.5H.l$..H.t$ AVH... .=.....I..H..L...uS..~...tj.-.......@..t[H.\.$0H.\|$8.....@.H.=...@3....t.....H...H..G...8r..H.1@H.,@L...H..I..H..l$@H.t$.HH.. A^H'.%..@nG..AxC...A.2VAVA.W.3;.AA..I...D..L....@..Ck.D!#C\zA@/AH...7DM.?F..JMZBH`A.@D..L..A_..I..nAPxB._A^}A..@.C#ZL.H.:..B.GY0...HrcP&MUcP:A^$cPBC..MYIDfMvHiS.M.K@.4..9R..B. .@Y.E.`.PJ.J.`:B.`BD.@.]\F.H.Py@}A.cP.V.@.ec.g9.kR#m3@.57d>?f.cPLm\mb}ATql.C.3..9R..H..uX....@[.D..p.PL.I..p:A..p3._..D..DAh.m..k.H..... .`.Szc.t.MK.q.LI..s.E1s.J.>t..FrDAyqX}.].]-Sa1.`

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\aticaldd.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 14302208 bytes
Category:	dropped
Size (bytes):	8051181
Entropy (8bit):	7.787610007516609
Encrypted:	false
SSDEEP:	196608:4RLkuB2VqXRfwgmT0FcnnIguc6xh2obgyXrOhcRPLACmRuWy:KLSh+VQ6xtXrXLAD4
MD5:	56E05229F697C6A7F951E19027BE1910
SHA1:	242745D850224B16C2DB9D1ED85FCE19AAD83DA7
SHA-256:	8A58E6E4B162E215726D51A7D3DA5E5B534883C06F9144386104B31AE8337FD2
SHA-512:	B9A1F47BE19E079F149D1936827AA504DEB978DBF559E92219F85298FF32B7BB20FC46F93089A8E860BFDF4ADC8008DD96AEB93D43181BC81C313CAD07F50417
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.<...MZ......}.............@....................!..L.!T.his prog.ram cann.ot be ru.n in DOS. mode.....$..\|...8...Gt..>.G}9u..[.G...w.G.u..a.....Guu....G.0u.1.EG...G.X.G...w.G3u..G.u.w.X....X...=...Richt......PE..L....T.UT......!.......[..z...Ym.H......&..{.i4.......NH..P...B.@-..5.5.i.3...}.......x...0.. ]...@...`... .[s.8.....r...:9.TE.X........text...&.5.%... ..`..rdata..W...7..2 .:.......*#.t.M........I....^ A+..r.src!!...G....g-@.relof\| ..H.....H..4.-.B...-.-.-..=.='=7=G=W=g=w=..=.=.=.=.=.=.5U...E.....tMHt,....uX9.x..i.tP.5\|.@.....[iP...A....-..].o...A.....@....@......!F/C9.6Au....=H.dH.0.........$.@...[i..$.....i.D$...@.7H..B....h8.^i.hT.@..(..=iE....$.@.....@.@.@4.@...t..L$.Q.j....@..t_$.....CH.A..].oB.(Vh.`.FE..Mi.....t..E..@...B.}..^_u..E..@d.A.E...A.@hp..E.J.M.Q...9YnB..$..SV..E.W.E."A..E..}.....O......._..O..W...E.P.E..V..D.@.E.o...E."At..E.....%...Q.=...@.{P.E.u.Y.P...}..]W...}..."Arqh{P.P...E.....P.].R.u...O.F.6.P.@..m.+cE..........u.....F...b..E..3.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\aticaldd64.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 15716352 bytes
Category:	dropped
Size (bytes):	8597407
Entropy (8bit):	7.788576574493978
Encrypted:	false
SSDEEP:	196608:7L+C5U1/CTg6y/LcoQDBi+Tdo6MLdxKDcZvIsaMUJsqWBpA3o8M2z0qHgM:e8UCxaQDM+Ro6OKQZQ3MUJsJBSfBHgM
MD5:	2569C19BE74B7E092010A7300F0CA808
SHA1:	91E3417EBBEC158D5ABEAF4AB8E4045175CEC04E
SHA-256:	9EE9D1AA21A98CDE2C6F858133A51D5FD2F927228C38072D3DEAD5786924AE72
SHA-512:	63BC5D3F46DCA866F9FB02C1E39087CCE0421C1FCC63A205F37A5EA54ED2F7517EF808C29E339A2B51970862CB5997353AAA33C502242FFA581A9807D1A21A86
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}.............@....................!..L.!T.his prog.ram cann.ot be ru.n in DOS. mode.....$........t.I\|.}.u.p,u.j..wv..u.i.u...t..u..t...u...?.@..../v.../wh.N..p..u.W.....q..r..=w..Richt....PE..d....UT....". ......h.........P....i'......9...@......:..`-.-.a.`.5.0.....m...x..... ......6....`.......`.h.8\|........../.h.............text......-...U... ....rdata...[&7...(: ........@.2#....N.....J.w..G-..p2#l.....8....o-?@.rsrc)!....?.,.-. el.o. T.=......=.2.-.B...=.=.'=7=G=W=g=w=.=.=.=.=.=.=.5H...(..tE..t.....u`H..=....tV....A....h..H......@..-..0.(..Av.....@....@.......@9.m..@u..@...@.u.....H....O@ G.kA.1H..L$0.....A.D$0Z@..............0...k..O.v@.<..@h.@........@...@.B..A..t.,H.T$83.....@.H.\$. .\$8...\|E .@......A..@ fF.A.WH...0..tA .D$. !A...O.@..E L..$@.R..$H.Q.A:.@.Dk$,)..!At..@.$.......=......Ru.B.Q...~.P.\|o$ .A BrU.VT...P(iRW.PD.@. A...A..s.-.Q.@..<.P..@(.........u.D.....Q.wSA..3....3.A......v0.!A.P..f..D.PA..#.;.t.....U......... r.....FR.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\aticalrt.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 52224 bytes
Category:	dropped
Size (bytes):	29264
Entropy (8bit):	7.700095246988246
Encrypted:	false
SSDEEP:	768:Pbnaf9xXAFya6FEAUjxZAePbqPkiN5WZ4ZwTdXE/eRKTN:PbnU9xXAF7/jVqHNoKZc6Wkx
MD5:	76597A9487F91DB584744B17FB2C653C
SHA1:	7F99192599F0895812C38DFCC2586123E028FAB4
SHA-256:	416EC6A265F8E7E032EC36A16AD716B5EC4719AE35E48DBBB6F96999665A2C78
SHA-512:	7922FFEC1AE250C3036D39826FF337193C8A3EE507DD373658734BFAAAD63BD6947B4C628C407BA53E83415E205ADEC797941FD80C4261BEA603D5E46FCD65FB
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$......rS.}!t..'R!A}.wP!X}.S!.u...V!Pu..!....S!Ru.t$WN!Q..W..T..=Q..Richt....PE..L....UT......!.....r..v... .....z..i........N .. .....@2......A......}......((.y05.r..........8r...........2......t.ext..p....m....`.rdata....'..d.....v..@..#.\|-....-....-....rsrc..l.,. .y.>-& reloT [..~.....f-..B...-.-.-.-.-..-.=.=/=?=O=_=o=..=.=.=.=.=.=.=..=@...u4...9 ..t1j....D.0..t%V....1.3.V...(..i....H.0F..8r..^.%"A......9CU...59....27.H+.G...I..M(B].%=L0E]...9D9AB.7RNC.M.M!KP0M.@J..OM_MoM.FT..G..I@J..M.].]J~GX.G.D]DF?^].n]~]~G\.].]IA. ...].].].D`.].mBIA..m.m>m~GdYm.imIA.~m.m.m~Gh.9].mIA...m.m.mJ.Fl.G.$}DF_>}(N}^}~Gp.G..}.G....}.}.}.Dt.G.@.}TW.}....~Gxy}@I..R^.n.~.~G\|.}....b......F...G...tg....>.~G....i..b~.....~G...m.9r.......F...)..r>.N.^..~G..M...B .........D....YR.......~G..I..R^.n.D~.~G.Y....b.......F.9...yb.....>.~G.y.i..b~.....~G.9...9r.........D...).r.>.N.^.~G

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\aticalrt64.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 62464 bytes
Category:	dropped
Size (bytes):	33882
Entropy (8bit):	7.712380685436246
Encrypted:	false
SSDEEP:	768:s7qmHerV/XW1F9SzArLjX7fdGzK9Kz0b56kRJLMJmlfMh:s7qJQPSzAnjX7fA+9Ky64RMX
MD5:	3A0BB2EC487464AF456B15918C94AA15
SHA1:	F7B1B2FC9FF2AEDE23F12FD4D17BEFDF24AE6D91
SHA-256:	318FA2C159608E3B89A0FB1364D39F5072CD29EB140F9D5C244D90AE09EB5CA0
SHA-512:	9A1F43DE0CAB83CB410DC9C886EBE4CBC0E1CB3D314C2DFF10367F6BA890881B09EDE066E3879C47DB6CACCC1674365BC8C0525D3166C88FA07B364018860ED6
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}.............@...................!..L.!Th.is progr.am canno.t be run. in DOS .mode.....$..0..Jt..t.t.....f.}... }...\|.u..;..wu.u..:....uu.S....v......z.....Richt......PE..d......UT....." ............d......i...........0..P-....`.-...Q.P.%............(.l...0.. ..{....@..x-......8......~......-......otext.......E... ..`..rdata...I6.........."#..P..........6-...p"#..........^-F rsCrcm..../..-n.!elo. ...../..-.B...-.=..='=7=G=W=g=w=.=..=.=.=.=.=.5H...(.=....u.T.~......tV.-.......0..tGH.\.$0H.\|$ .....0.H.=...03...........H....H.G...8r..H..@H..A...(H.%..0...AQA..fFH.l.$.H.t$ A.V.0 .=i.1I...H..L.._uS....Bj.D.R.C[.F8..52"D>*B0A..6MFB.8LBL..H...I..H.l$@.H.t$HQ@ A.^U@..0.G\E.@eC..3...3N.C.E.$'P.M.'P%A.'P-D.X.MEMU@.'P\MfA.@{DC'QH.B....BY.D2>SJ.I..RT.ZR0A..0h].FQH.@.@.A..X .P.pB{D......H...uY.C.SfR.D.-`APW.I.-`.%A.-`3.f...D/`1@H.].I..'H...C.dy-`.S(.feG i.-i.Y =hY.Im.@..#C..`Bhi.'Pxm.m.h..`H.m.m}B..`0f..k.l.`.mO.dX.\|...}%}.kID}T}$e.,.!1ec.;j.. .}I.. %A.. hih-`..}.}.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\aticfx32.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 1117696 bytes
Category:	dropped
Size (bytes):	488861
Entropy (8bit):	7.748158166868192
Encrypted:	false
SSDEEP:	12288:Xtb9LrQ+h+iKXyDXEuZrkOaSoFR6Vhe/I8QMec4BdYnAIuOhWIZnnV:XtbRQqpDXlZ7aBR6VhsI8QXlKvuO1T
MD5:	A0D26414D71D6966D96ABB51D45BAB66
SHA1:	DA95C972181862E17486DA6D75BA763A62D45C61
SHA-256:	DE491B4E552222B628BE0373F6F62CA2B2D7D693E0D480B242D64F6503B8D7B3
SHA-512:	1CCE65CA7759B4DF37FFAE150636977906B8F2A90B329BCA973DD07EBDCF7D9755CB2DF49C91C348917524599B528152659D6870C4DECAEF2BB7333E32D443B6
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$.%..V...8.t.xE..}....}....u.a....u.9......u..F...............Ric.ht...PE..L......UT......!........*....../...... ............(..0.n......@......I...`z.....Dp..d...W........0.....df..".s.8.....f.......G......te.xt-.............^..rdata_..A[...\. ........@..#...X......6.... ,..rsr.c..t.q.....F-. relo\ z-.......NU....B...-.-.-.-.-.=..='=7=G=W=g=w=.=..=.=.=.=.=.5...t.Qj..5`......( ......HU...E....t0H.uCV3.9.2u..Vh.!V..0..@..1..t.......^].....}..u..7D..P..,.@..GA..C.0..B.J.....#.H...3..I.B..H..... .v......@w.3......dA...}@....@...A..KM........C.L....@V..u...........%..U...V..U..V...U..U.R.P............;..G...^..].y.iC.CS.Q..A.W.F....%...@$..H#P..A.PV..B@.~.h....j}..3....$.@.;@..p.......F.........3..w.`.OXV......V....f..._^..[7V..F..3..3.d.M.C..@.P..dA.W.X..@.P..dI.H.P.p..@'....\ k./m.A.VW.}..w...G....._.u$..;@.Z@.8.@.G.;@.P.V.9.._F@.." k.Om.U$g..a.g.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\aticfx64.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 1341736 bytes
Category:	dropped
Size (bytes):	593645
Entropy (8bit):	7.7472006992041464
Encrypted:	false
SSDEEP:	12288:nHZlKHLzGre5ihVSlrlTSUyo4YW5NhDl7ad09OpZqqUSNudMa0jVD0GScunLN:OriKyw1/AxDlLqedMHVD0Gq
MD5:	18F43E773F50EB61979195BE9C2D7468
SHA1:	575CC1436FE0D0D17D005EB82076DC6B529CFB6A
SHA-256:	FCF0A7922F62BE9688BECDBF79C082B3F59B079A9384D2D024FB594E5A427C30
SHA-512:	BC6906D53BB59AB9DA4B811A0058408DB3984D4D12CB39B0B3197DF6AD2D6FEFB06760DCA73C7A9D81EA5D1B695129790D5093BC6B29FE2BE6F0D43A68EEBF02
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al(y...MZ......}.............@...................!..L.!Th.is progr.am canno.t be run. in DOS .mode.....$..e...!....t..[&...}.'.X}.$.(.u..a"..!...V..'. u...X:.S..#.. ...!.~..%..R.icht...PE...d....U.T...." ..o......h...'........-..........0...]....m...`-....Q.P.%. ?......3..d..................D..(5. ....B......8.......=......p........text.............. ...`.rdata.+.00....20.... ....@."#..%..... ..4V 9+...p"#.........^-F rsrcX..........n. .-relo. .#J...h. B..+B....-.=.='=7=G=W=g=.w=.=.=.=.=.=.=.5.H..(..tA...uTH.\$. 3.H9.&....u.E3....!3...4....H....@H...t..$...H...0H..(.M...u.H.....!A.t....O....$.4B.ZB..A.-........w.3...,..0.A.....@..YD.E.$....q@ZC.08D...H.......H......D.D$. D.B..R...A$.T$(H..T$ ...........0;.H'.G.@4@8YB.1..H.t$.W.0.0H.B.H...L.I(L.@H......L...~.@L..Q .A..F.A. .....'PL.GHH..O8H..H....h...@.H....]...@\.$@..H.t$.H4@0_.I.1......3.4BpR...SFpR...X.A..I..P.UHiX.V...].D.A H....RW ..:@.P..EA ..P..5P..9@t.>@.....3... ..-C0.4@ cR.Z&a.].Y(.>m..L...0X.3.I.C.y`.y`.y`.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atidemgy.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 442368 bytes
Category:	dropped
Size (bytes):	170972
Entropy (8bit):	7.838864493248491
Encrypted:	false
SSDEEP:	3072:+97gZgW30f4jUCaNimXqjzpwyKhC16toNX2eYLMAePieyPwbiJaxIULUP7KIAz/C:+eZgbPi9Khk6eNcReTyPwb+eItgz/C
MD5:	B24B0134B07CCE76E59ACE11FD706FDE
SHA1:	564892196E108AEA41F4E49631D8B1CF7880B182
SHA-256:	FAAC64022BEEF5D4E9E60F30CB4EEFD3ACE3FBD1433D75E687597470975A007D
SHA-512:	ADA55BFC040551C5D1F127456506FC14FC374FCAEF35F844BAE20F9DD8B851E6830802F9C84FAC7ECF4BB6B85BCD57F70DB686729FAD6BBD0420F153F64E26A9
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$...PE..L......UT......!......o... ......].....Q.....................`...........%X..S................ ..C....,.9....9.....H9..tex.t........F.?`.rsrc.............@.r.elo.............B9......-.-./-?-O-_-o-.-.-.-..-.-.-.-.-.-.=.=./=?=O=_=o=.=.=.=..=.=.=.=.=.=.M.M./M?MOM_MoM.M.M.M..M.M.M.M.M.M.].]./]?]O]_]o].].].]..].].].].].].m.m./m?mOm_mom.m.m.m..m.m.m.m.m.m.}.}./}?}O}_}o}.}.}.}..}.}.}.}.}.}...../.?.O._.o....................../.?.O._.o....................../.?.O._.o....................../.?.O._.o....................../.?.O._.o....................../.?.O._.o....................../.?.O._.o....................../.?.O._.o.....................\.........._x......P...,.../.B..q.._.M`C6...hi.8~.39.9.Oe..\....\.B.v..c...H...PG.6.........M.....Sy.Af..r._{...".....5....l4..fO.e.Z...<.!8!D.....=.E{}.]...5.}..4......(.....r....}.......}......}....4............

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atidxx32.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 9314448 bytes
Category:	dropped
Size (bytes):	4161459
Entropy (8bit):	7.767174093523934
Encrypted:	false
SSDEEP:	98304:KuqRabLI9oJCR0y3XOLkIy5SqmIqHzV/3+Hj+fAupTpK:KfRasoJK3+LkIk6HgHafpT8
MD5:	53B02F2630DB0A089F2FBB4C276CC4D0
SHA1:	7C86143366701D2909B71C72C2182ECD70757CFE
SHA-256:	FCD44D77A1FC12ADF97304A431E002FAF70BDC3A24F1CD4B3AF52931A6386BF8
SHA-512:	705210CAFD0221980ABBE23F6BF1952C4DA35EDB9B4E4138DD66AD5BBF51F8EAC7F4E6E854EF0C2B5CC716271FDD421062DABB415982C81B2611093930411232
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al. ...MZ......}.............@....................!..L.!T.his prog.ram cann.ot be ru.n in DOS. mode.....$..:h.~~...-t....-.R}..-O}..-}.u....-{u.w.-....-.u..Y..-o...-...........~..F.....Ric.ht...PE..L.....UT......!......FP..=..../N.....`..#..%.......8.......=....@.-.%.%.Y.#...}..!-...}.<...p..H...6..........,....bP..8....\|.\|..".. ....)..-.......text..kAD..%....... '...rdata..W..,'.." J......@..#..I..#.}..(J .}\|/-..tls..5....3.."v Y-.rsrc..........$~-> rel.o. ..........-.B...-.-..=.=/=?=O=_=o=.=..=.=.=.=.=.=U...W.}...t...D..VW.j..p.....`P.....t...@V.d.N.......^_]..3."@.B.0..E...t.P.2..Dl.@(B0B.V....t&Huw..\.........up.....6@.3.^].....@wA.}..u.N....0..to.Q..m@...A....5.1.@.v..@$.@Vj..F.."....@PEC...1.....vB.0S..].V3...._%.@.@uQW..{.Q.s.....jh...u;..F.W......l\|..QQ.V....Q.@.(..._^.C."...@..[].b@.s_^@R.CM.......h.JSdW.y...t.......`.)@;C..H6@.....LD...j..h8OP.d....d..@......SVW.u.....u..F..p..j.....@...v .....b@F8.~...D$..F..........,.....P..\|$...P.pA......P....D$" .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atidxx64.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 10888800 bytes
Category:	dropped
Size (bytes):	4782237
Entropy (8bit):	7.7587673572145235
Encrypted:	false
SSDEEP:	98304:HDlXGj/DZ8V1ij/nzcEgLwmFrFxICBLWEsq1HgGgayak7ki:HDlGj/VcYj/QjLwmxzFBLWEsq1JgMk7j
MD5:	867C10C10FCC7604B951B076B6AF6582
SHA1:	776118287B21D29A56C39B7D48FB1B783240D5AF
SHA-256:	F36FAAD5C1BCBF87C4CADBEE17D9B5627CB509023F4A355B12EF7BB56A1D22CC
SHA-512:	A44B9309C8ED4FC2566208A2927F337327CA3C44BC879F012697C200420DADA64E9E1B1AFE41ED42313AF45A75DE68F97BA53BF538C4E58602A7870DD3CEBE5F
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al`&...MZ......}.............@...................!..L.!Th.is progr.am canno.t be run. in DOS .mode.....$..........t..wj...}.k..}.h..u..Mn..u.......k..u...tj...v.....o..l....2..i..Rich.t...PE..d......UT....." .......^...F..l_.\......-..........0.......l...`.-...Q.P.%.....!-.....<.....H...`...U......`.-.P..,T.....^.8..>....(....=....^.p........text...A........... ....rdata.....4....* ........@."#.H{d......>R 9.V 9+..p"#......V...~ 9-tkls..!....+...r. a-rsrc(M!.......t.-F orelo. .#-....$-...-.B....=/=?=O=_=o=.=..=.=.=.=.=.=@W.H.. H..H...t>H..S.-..L..3..H.I.H.\$.0../.^.H...H..t..D....\.@.H...@H.. _..3.6C.DH.1.L{...0.,...D..%\5 .C@.0(...t6..uO..A .Z........u..^.....@.<@2@ .6@(./C.CM..ku..0.\@...@*.0..A..@.$..B.DH@S.1.A..,..D..@/..S.H.K..+..@u..B..0N .C.....w@..6A[.A/@4.RDA.$..F.@DC..y..t.H...H..H.`..lADJq@.0.+]ED..B.....@~.@.3.H...H.AV.0@H.D$. .....APH..l$XH.t$.`H.\|$h.@H..A.D..P.......@S.,H........@sD.k........H.{..H.../N .P(.P0..DQ.H....P...Q........@:.Q....

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atieclxx.ex_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, e is last character of original name, original size: 623616 bytes
Category:	dropped
Size (bytes):	350727
Entropy (8bit):	7.7504574070507815
Encrypted:	false
SSDEEP:	6144:fE8y8WR1zhcU8HMIIW6x8ukG8mKi41VpG+69PKlK+2pDPHIjl0BY:8Oitx8DdO8zd9p1L/69P+2N+H
MD5:	C356C1CBEFFB4DFC1F4BA0054284C2C0
SHA1:	3B6B9E3E10DB34C906D5F2D313BCDFCC20EA0A6E
SHA-256:	EEFC63D9C9038D43014A3E2DFCF64E855F2C6DCD554EEA436BD71C5F2ED2C4C7
SHA-512:	8081D173D274F7FE9B4EF06A909D728B55FFEE7C176BC96997942093F04469900B173F7F2943A5553FAAC240FCBDFE63DE81DECF14F298C4658EA46C7B5D6A2E
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Ae.....MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$...-./i..}\|t..G.\|]}.w.\|.}..\|bu..}.\|j...\|.pu..\|.u.NDw.\|k...\|F....\|h.....Ri.cht...PE...d.....UT....."........... .....4..................(.g.....".`....I.H.].............p..`....X...............8....pH...>.............text...........=... ....rdata..<YU%....V%..0.v..@..#..Z...:.4..../-..Qp.#.....I!.:..1-rsrc.....r..p~-.!elo. .p.....t.-.B....-.-.=.=/=?=O=._=o=.=.=.=.=.=.=..=L..L+.u..L.A.L+B..M.........EH.\$.H..l$.VWAV.H..0..D....%..H.L$0.D.Ez3...$P..V!.....,@.$...3.A.\|%...EA....#...L$4......3.o3...@.......@..=A%V:.t.]@0.@LID.L.D$0....\|Q....L..KBH.T.@.........tI...$....]@ ."..A..t.L..............K.........E..F..@3....;...o....E..t...5.!.....t.....]...!...$P....k5r.P..!........E..]@...P.A..@r.@L......A .`.@H..:B^PD....fR.....\A[.Q...j.A..@s.@...E..B.....@L...$!AI.[(I..k0I..A^._^.G..3...=. ....DL...I.[.I..s.W.@LAf.o..e.@3.H....\|$`H..... .W.I.K..H.5W...I..K.fA..K..-aC

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atiesrxx.ex_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, e is last character of original name, original size: 239616 bytes
Category:	dropped
Size (bytes):	139591
Entropy (8bit):	7.765919041760457
Encrypted:	false
SSDEEP:	3072:AAnktkkOJ6cqe2A0Oh5+i4WC3iNMgesfOJg6ISyVEnlf:AAnEOJ6cqC0Oh5+aC3kNe0+gAeEnh
MD5:	E1392E8B9B462669372EE1CB37883AC7
SHA1:	6687856F20A582B4CB2B7073965EB91EFA837DC0
SHA-256:	E4F0C69396AFBBFC77ED60A569D24471BF41DDFF20D3395AA7B682DD1383D567
SHA-512:	59ABE28F83658AA02DDCCE770CA47B195EE19E726E11BA51CA2AF6DE720A857A7C47148662E658A28639E8C596C7305FFDD6B4DF67FF13AFC93CA0EC1731CE70
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Ae.....MZ......}.............@...................!..L.!Th.is progr.am canno.t be run. in DOS .mode.....$..I..-.}..~t..[~(.}.Y~.}.Z~i.u..E~...Y..Z~..._~..u..~.u..Z.~...[~...]...X..Ric.ht...PE..d......UT.....".....?......-.....................0..........`....Q.P.e....a........}p.................5...8........>..0..@.......text..>........E... ...`.rdata.g..C-....D-.."......@."#...;........f...:..p"#......!.~^-F rsr!c........-.!.elo. ...../....-.B...-.=.=.'=7=G=W=g=w=.=.=.=.=.=.=.5H...(H.......H..t.L...'......?..0....4...~...0..4.H....B..H..a..0..?.BE&M6@...GHMXB!.4...EH..(H. ..A..08.9............ -...Y.0.A.....@M%..H.{.N.A...h..H....1.@..C?.@.C.@b)...3.8@..@D..B..@A@..u.,.0..B...z..B.%.@D.@....@.`.&z.@..@8...Aef.E....Ae..Bu>.E............-...A...E.-..A....@...E.-.......k..eQ(.A.X.De6xT5. .@..D.).Qx.aP..A6.O.B!.0..R.t...P.$.T.!Q..%.0.D$@.@...P.@..a.D$(..QHE3.H..F-....`..&`@....a ../.At?..@..c..a c..U+.V/.X..Z-.T.P.@..cr.P.c...%a(2f&`P.B.2V.V..W..Z.h....D8.H.....

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atig6pxx.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 75264 bytes
Category:	dropped
Size (bytes):	42981
Entropy (8bit):	7.713841579583713
Encrypted:	false
SSDEEP:	768:LCaAeaqnNojIdZbPQf/TVaIp07Qj5hHch3D0+1pCCUBazLeNe/8U4WNSf:iqXzK/Tje7s5RcV1gCUBazLUe/gsu
MD5:	A393706496BECBB0719FC95625B58533
SHA1:	BE1089862242DC4DBA0DF6BE740D1FEA351AF0D3
SHA-256:	291A59A12E7E6AE1D871D5B061CC1D7C4FF98DB84BE824C387F65FEC307C4880
SHA-512:	13E07BDBC8E3F78285E6EB491C639366C7C1D64354A91EA55915E2B63154605AE9A09D61CE2AB867312F6708E817F108CB1AF5C3F0E9A995A873D71DEFEF12DD
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.&...MZ......}.............@...................!..L.!Th.is progr.am canno.t be run. in DOS .mode.....$....X{...6(t.@X.(..}..(.}..(..u.Yb.(.u.7.(...(.u...[.(.......z.....Richt......PE..d......UT....." .....Y..... V.....y.-.......,..0..........`.B.%.T.Y.......-.l.....N.X......\...p...d-.0...8.....`.........-......text...F.....R... ....data..9...-..........c.p!#..........:...@.rsrQc....N.....^-nn!elot ....k......-.B....-.-.-.-.=.=/=?=.O=_=o=.=.=.=.=.=..=.=......4....;..4..4.5.U.....4$.44.4UB.4.)Dh.4tYE.....iDPiD.)D..)D.)D.)D.)DT..4.)D .D2.DH..DT.D`.Dp.D...D..D..D..D.j.D..D..D....U,!TB!TT!Tj!TU.!T.!T.!T.!T..!T.!T....&.yTByT`yTlyTz.yT.yT.yT.yT..yT.yT.yT.yT.VyT......T(.TU4.T@.TT.Tf.TU~.T..T..T..TU..T..T..T..TU.iD iD4iD@iD).iD.5..4..L.m.f."..."..b.d."....d..".....m.}.....`..!...,.{Y!..T.) T-.w.9"...b"...".bad. al. atioIn.w......v.n...)..\|.n..!.f.\|U..\|..\|..\|..\|-..\|...{.1.Y!.........m.s..c.o.r.e.i....lq...C.orExitPr.ocess..G.etCurren.tPackage.I...ki.r.n>i.l.3.2m...&..@."..u..\...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atig6txx.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 146944 bytes
Category:	dropped
Size (bytes):	85469
Entropy (8bit):	7.731955600302116
Encrypted:	false
SSDEEP:	1536:Hmh5JAX+sO1gd31JgeqOTwS3hCCFpnzLsGitQECxjDOwOEvSfGE4Fj:A5bwd3DgfOT5XHitQfOwtSLG
MD5:	0E30AEA84ECBF7899347134757B5AA7B
SHA1:	047DB94216AD7889EC158F8AD7B4FC055EB6BCED
SHA-256:	C319BA567BEB0678DB7186F71DB930D19098447C39333011237532CD64B623D3
SHA-512:	834AFCA7C8EA14230AC575EC57B4A60ECB97522BBCFE6A3799FA0FC9F12B4164BBB69F875981CC4DB328FD5BE2A3EA5D049A5C24642E4D2EA68531F6BF6B7C7A
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.>...MZ......}.............@...................!..L.!Th.is progr.am canno.t be run. in DOS .mode.....$....Ff...(5t.eD.5..}..5.}..5..u.\|~.5.u.).5...5.u...G.5......z....Richt......PE..d......UT....." .......-.b...8-......-........,.0....-...!.....`-...&.T.Y....0....-.,....d..p..{x...............p....8.....=.........-......otext..I......R... ..`./data..9&.-.q.*.......p!#..........6-.?@.rsrc......./...^-n!elo.t ........4..-.B...-.-.-.-..=.=/=?=O=_=o=.=..=.=.=.=.=.=.......4.5....$..D:.DB.DP.Ddj.Dv.D..D....U.ID..D..D..D..y.DB....ID...D.ID.yD.yD..yD.yD.ID.IDx.ID..4..4..4...4..4..4..4.U.....T..T,.TU<.TL.TZ.Tl.TUz.T..T..T..T...T..T..T.....&.T@.TZ.Tl..T..T..T..T.j.T.T..T....U2.T>.TL.TZ.TUd.Tx.T..T..TU..T..T..T..TU..T..T.yD$yDU0yD<yDJyD\yDUnyD~yD.yD.qDR.5..D.52.4H.49Z.<.e...#..l.h=.c.o.c..f.cH..m...y.s....s..}H}Tx..Z.ah..T>rp2^{..&..up.yt."?.".(<:sx{:sb.ad al. at.ion..RoI.nitializ}e..c.o.m...a.s.e....9l.p.qUni.x..I...Tv....)...U....Tx.1..1.U.1..1..1..1.K..2.....q...$..!m.p.qr.p.y.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atigktxx.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 133632 bytes
Category:	dropped
Size (bytes):	78378
Entropy (8bit):	7.718986823237019
Encrypted:	false
SSDEEP:	1536:+lFq2vWMhzHP9CsrTutuNbZdPS/w8czYh6ER7q1f7sYAq/tGMJ+cQ:+lFq2vWMhJ9rTPN2/daYEE1A4Y6QQ
MD5:	FCE71E53218F8CA133917A045B684B05
SHA1:	0D85C92FACEC61D4DF7FD4F92F36E5568B897ECF
SHA-256:	92602AAB247DB369B5AB5A5F21640CFC84A8675E477BF78B8AA17EBE4D3F994D
SHA-512:	95977A815DA693E98D5EBA7F40E7FF3754FD0014BE664D98E12B9BA638859F3E8A8A8A46E6D7898B1CD4AAFB898836EEB3BD67320FB0EC43A88986076228719E
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$...)..\|m.`}/t..?./C}.w./}}../.u..../fu.a/...../lu.J<W./O........=...Richt....PE..L....UT......!.........l..U.............................f.....@........E..........<....d....x.................8q...H.6....h......otext............. ..`..data...-............r.src..l........-.@.relMo, .7~....>-..B...-.-.-.-.-..-.-.-.=.='=7=G=.W=g=w=.=.=.=.=.=\|.=.5z.....0.........0...0..0..0..0...0..0F.0&.0<..0ZY.JY.v.0^..0:Y.&Y..Y...Y..0..0..0.z.0..1....]@U&]@<]@L]@\]@Up]@.]@.]@.]@U.]@.]@.]@.]@M.]@..J@.@(.@U>.@T.@f.@v.@U..@..@.@.@M.@..J@.@4.@UN.@d.@..@..@U..@..@..@..@5..@..@..@.@U:.@D.@P.@\.@Un.@z.@..@..@U..@..@..@..@Q..QY...X.4..0..0..4..n...M.......>.&...:....M^W....V....oN^W.]......e.1...*.[.....Y .+..7.......z/...bad alS .ation..R.oInitial.iz.Q.c.o..m.b.a.s.P..c.l..RoUnIi.Xm.......% ....=h.% .....Uh.Uh.Uh.Uh.ZUh.Uh..Vg..h(.Qx`.....m.`.a.r.P.iCorEx.itProces.s..GetCu.rrentPac.kageId.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atiglpxx.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 69632 bytes
Category:	dropped
Size (bytes):	40164
Entropy (8bit):	7.703192808105504
Encrypted:	false
SSDEEP:	768:Vry5tWg2pbY5zd0HDwP4qqh7Oh2OV4FtSjgJ3MHWewhCv3YL+RL5FTgTpIh/:8tWg2pc5JEwRcK0SjAmeAvIL+pTgl6
MD5:	C19D9E332E0F4162978949A98FE8FD40
SHA1:	5BC52763780240CBB94B86A58D0492B0FDCF393E
SHA-256:	8C9EA257E294151495238EC16CF97901FFF09858683B66E5B5C0A3CBBD54EFB1
SHA-512:	948539C38D19D3A966B6C9971392C324375F023EC6325108422684FB205A65B6A6B59D431938B58443B1CD6D86EB638ADCE964D193377F80233AB0DA814CFAD0
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$.....A`./}3t..j.3.}.w.3.}..3.u...P.3.u..3....3.u..iW.3......=..Richt....PE..L....UT......!........-`..8H.................p.......6.....@2.....E...`...........=d....X.....o ..$......Lq...P2....T.\|.....text...........v....odata..\.......a.......r.src..l.i.....~.)@.relo, [.(~..*...>-..B...-.-.-.-.-..-.-.-.=.='=7=G=.W=g=w=.=.=.=.=.=..=.......0...0....0..4..W....@..0 .0U..0..@T.0`.0U8Y.$Y..Y...@U..@..@..@..@.@.0t.@....U.U@4U@@U@LU@U\U@tU@.U@.U@U.U@.U@.U@.U@}.U@....0.@UH.@^.@p.@..@U..@..@.@.@_......@:.@UF.@T.@b.@l.@U..@..@..@..@U..@.@.@..@S..R@.@..@6.@UN.@`.@l.@z.@U..@..@..@..@U..@..@..@.Y.)FY...z.0..4...p...x..&...7.L...}.UP.....]XXtU.....].....&~[........'..3...S.......bad. alS atio.n..m.......T% ....X.% ...U..X..X..X..X...X..X...W..Qh.Q `.....m..s.c.o.r..e.`.c.l.`...CorExitP.rocess...GetCurre.ntPackag.eId.k.`r.}n.`l.3.2.h^.S.....a..`.taP........`....`...H.'....a

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atiicdxx.da_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, t is last character of original name, original size: 734861 bytes
Category:	dropped
Size (bytes):	115846
Entropy (8bit):	7.135348520774509
Encrypted:	false
SSDEEP:	3072:oeShgC3T7QtkD8QplpdNzxW03iBKNr4FmHvHtFB0:oFgQcqDVvdJ0hhsFF+
MD5:	156AA76DFD19389969A48F06E9494FDA
SHA1:	3A01BCD4E7814E7B0EEF919066E9166EC63ACA70
SHA-256:	30E5948AC3B04CFE56CBC54EA455E035DB843F49EA56FCAFAA127EE4319BD000
SHA-512:	53CE7857A8AEF8866FC18269DEB625EBC901EECE6F2FDF6BDA905CA2DC52FC1B2EA8894796BF39F91D3FE5B686048DFA67047BF50E7A7E50EDF38A937C2DF711
Malicious:	false
Reputation:	low
Preview:	SZDD..'3At.6...1.0,Driv.er Insta.llation,.MSI ASIC. IDs,ATI. Technol.ogies..c,.2014 Apr.il 1 5:2.1:18,6.1.0.14.47,.1,.._..865.,<.Item,E.ngName,M.arketing. d.DID0,V^..0,SS..Vy..x.1,..1.......Prod.BusS.peed,WDM.DrvStrea.m,ChipTy.pe ,FGL,.AGPTrans.fer,MemD.etec..1,L.as1M0/0S.C/Qaso5o.PvzxoU+i.g2qeajuP.Ii/dmPUj.LGmWRJys.1QIYgkmB.2gR4se2f.K4/QxGgE.hQAGDYf/.LXInd30A.ASmWas+Y.Pa1+fzfR.saKF+Xl7.7Eu8j5bm.om36HZ0r.c2CSx120.XFZJYwtW.lcw/+CFF.au6hyvpJ.5mR0Cpov.5Ph0+XCl.XnXNTQI4.meaVUzf7.nJwK/P1b.Du9szFM+.eehoPrl/.Se2JhZ1c.g2nl0aaj.gRz+ONy3.jBF3GVb4.nSoDwR2............-.=..M.].m.}................0x130]4.!002. 0.=..2IKhGKVD./KzDDea8.mppnp2oV.d7Wq4WYD.fD7iLX2.-.(-8-H-X-h-x-.-.-.-.-.-.-.-1,NWONE. 6.41/B.,2..wqurx.3o9OmQHI.DqD3Pou7.akrC=S=c=s=.=..=.=.=.=.=.=.=.M...?MOM_MoM.M.M.M..M.M.M.M.M.M.].]./].#5.-Vm.=,=<=.p].].].].].].].]..].m.m m0m.M,K3.?]no5n3xY.JX9X3dar.WIL5C6bF.Pipb.m.m.m.m..m.m.m.}.}$}4}D}.T}6].}.}.}.}.}.}..}.... .0.@.P.`..p.`}. +AMm]mmm}m..m.........!..1.A.Q.a.q...m}/H.4....+z5NV.7X..bn

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atikmdag.sy_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, s is last character of original name, original size: 16756736 bytes
Category:	dropped
Size (bytes):	9920737
Entropy (8bit):	7.762547224738548
Encrypted:	false
SSDEEP:	196608:V5SrZE+tKsJqKKQGFYF3Sc1K5nOcLF/5iCQYkNeLDoK5JMt0qZKfGyHhMoAdxHJ1:VoVEUKDlmhSc1KVOQcpYkNenoK4aGK+r
MD5:	BE696398B05D8CE6C00174DAE9FECFF8
SHA1:	33D6C705E9096497F3EF4517129537D40B5466AF
SHA-256:	0033682AF802755C2EAEB7330CD265E8C0294BDBD5C6300D1A235E2DC0807166
SHA-512:	0EF119CE1624E9FE592167B754B0658FC938653E19B2B0D62426C8E7F82A8DF6DA1AD3B0D0CE709AE931A9108FB0C05EC59A57D9D5B7B29BDA5A5A2DA75977FD
Malicious:	false
Reputation:	low
Preview:	SZDD..'3As.....MZ......}.............@....................!..L.!T.his prog.ram cann.ot be ru.n in DOS. mode.....$...X./B.9s\|t.KA.\|}Au..N.\|Du...\|Cu.r\|]....\|G.....w.\|J...\|Yu..e..\|28...w\|.<...\|F.....e....Ri.cht...PE...d.:...UT....."........S.....`.......-...%...n.).8............x.....`-...".].a.o......<.....{ .....0.Z.......(.....5..8....p.......0.........tex.t.._../.. M.~.. ..._w.#eb. . 5.... ~.,.rdata..[3....4Z .>+.....R#.`.W...1...R..9D. i+..pR#..o.........-.H.$.........#..-(y$..'... (....-..HPAGE_CO.M.l." ....n"0.. .+`.3A.IA.........../=?3DA.L.P.......Rr0t..;7ISR........>!....=?2DC40{........=.55.3 .4..=.560U...0.0.....=n.580."0.@.0......M.G..P..09!.FM.510;..A`>D.nM~F1......0......M.A-.*...7#..M>4?PPLe"." .@.$.P..M>5PC`.25.P._ 5...h.]?2..d.1..3..7]?6....k..VP.zP...=..HU4..........P..].R_.IEG........1>.].TLN..F.... .1.].U.BTH{.!.P......].TNI."P........&m.UT.N.^.!F``"...Om.TSIp.!@.rGcpvm.UCI.....`.....m.UK.V8.............m.TIL.......B....<.m.TVI.....p...Z.}.fZ........

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atikmpag.sy_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, s is last character of original name, original size: 581120 bytes
Category:	dropped
Size (bytes):	277170
Entropy (8bit):	7.709690249908194
Encrypted:	false
SSDEEP:	6144:VjuBJ150t8FGbShblQyIUS/855Ie0GickvUXRvAE:puBO8/hblaV8rIY7XRvAE
MD5:	B2C2D5BD3F5D27906872D13460CB2FAF
SHA1:	8E06A3FD14EF4F1EF3619C2F1C5DF2C65F7400CC
SHA-256:	098D2912EA7DC4886D496D7B1CD304D2986CB6F4247580C4686F57DD819CD6B7
SHA-512:	4BD5D4EA4C047072928545262C603F3714807FD17CC89062FECB8393F22B0F035255FEE46168D9326CD799B607A5F7E2ED91348BD5EAB4A83D3A2B716D149110
Malicious:	false
Reputation:	low
Preview:	SZDD..'3As.....MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$.......}.t......u.."^..u...}.u.N.Z.....A....\..N.w_....B.....X....]..Ri.cht...PE...d.....UT....."..............T_..........~........'.v..0........`.....N.Q._.......<...........L/.......0#...8.....V...... ..(.......NON_PAGE....!.I.....h.otext.................`$......."$..+<!..data..o.......V.....+....pi#......0..H...+@I[NI.........!x.+..b.rs.rc~......!.,..relo. VY...Z....-.B...?=O=_=o=.=.=.=.=.=.=.=.5H.\.$.H.t$.U.WAVH.l$..H....I...I..L..M........M..w.....I. ,@.!.H..H.M....F.. 9B<6.....@.v..8@..I....%?A.....AA.....?BU.jAA.........NA.(...=.f.......SA..w.gC/.....H..e..AwA@Ew..S@E3.H.D.$8H..].@H.d$04@..\.$(E3.H.L.$ .Cv.@LB....!.EwH.xh..u.H..~...1Hh.B... ...L.E.A..".2Hp.T..PHw....E...+S.1..T.+S..D3.:.P..E...cW.A.H.M.PE..A0..D$(..D$. 1.....JCx...@.P.PMw...P..VAL...L..~...f~.R.........L..$.C[ I..s(I..A^._]...2...J..T.5t.....d...d..d..d..d.V.d.....Ad4AdUNAdfAd.Ad.A

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atimpc32.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 71704 bytes
Category:	dropped
Size (bytes):	41407
Entropy (8bit):	7.728108568362597
Encrypted:	false
SSDEEP:	768:M2KWk37Hq3Jmchk1L8KHpyByXfIBqPLgbf9yRnfdk3YrejV07qoxYVq6Z91cO2ja:DKWkrYvGlyQABqPLPRVk3Yrep1o2c+c+
MD5:	CF5A4ABF6FC8FA5573235AFCD8274E8D
SHA1:	30461407860BD431747F25B0A4B783DEE7B8D3A8
SHA-256:	D6E69A774CF8078D7E5E401CE50F88F25B921B71E5CAD5EE01D3A0292965C88B
SHA-512:	93003AA3F88069874971381CD8085FC5C446FF4905707B4C190A9C796904B007EEF99535FAF052E352856CD96F4E45D60DD98847DD8359B51851363A444ADDDA
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$.....Ir.y'}!t.,..!.}.w.!.}..!.u..5..!.u.&!....!.u..W.!......=..Richt....PE..L....UT......!...........<.....z............ ..@....+.....1.....E.C.......,.........(.f......T....p...8$.........,........text............ ...`.rdataZ.....0......@]..#..+...-......-...rs.rc..l.......>-& reloT \|.%~..&...f-..B...-.-.-.-.-.-..=.=/=?=O=_=o=.=..=.=.=.=.=.=.W7..A...Aa!.0...3E..A..2.G....0}..0..3.....f..A$.1A,1A41A<1AD.1AL1AT.....WEU..V...N ...A..t....Q.P..F,B.N.oI%B..N.oI.B.N.....lL...E...t.V..(........^]....XH.....yH..c@W.}..@.....t$..WD$....o@.sC.~....P.W..P.........D$...y......_^..]....h.b.....@...@.\|.$..........~ ..V u...F.j....Rj.j.j.h.NV12fP.j..P.Q....$R.......@.01@D.$.{P .V.R.j.jR%d.....T$$..dR.R?AD$DAD$D:.@L.2D$(...@..#P0.@4kQ..Shp.@u@,.QA.Q.F.P..vP.Q0..QM..u....9Q.G.3G..Q....G..A...G..G..........@#Q.P..0.P@f..D$i@aPuP${PH.HP.jp..$....D$d.0j.Pwf..j`.b].Q.L..$.!

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atimpc64.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 78432 bytes
Category:	dropped
Size (bytes):	45913
Entropy (8bit):	7.73006448859567
Encrypted:	false
SSDEEP:	768:mX1OE83SSFv0iWSw7MCiOD3DfNpWwMEi2puvygVf8QY22e7ROY0vkL4oP7:zZ3bJ0iWSw7MUzfNpDs2puvygVM22vYn
MD5:	3836E51A8697B94F91D471E4820EF18E
SHA1:	F9CC0D4960F98E9B89D6306D36BC3DEDEF2AF2E5
SHA-256:	5EF3B1FF412D17A6A04727674D2929676CB51FEF21F87BFBF67EDF01CBFF3475
SHA-512:	EA32FC3C4DF53E1370EE2EA2FBDC0F54028B4B3351AEBE2802B2BF072E56E0B5D1A350450090734D1C179A087C17E1662E0022A1CBF09FFEBF8FF39ECD76FB62
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al`2...MZ......}.............@...................!..L.!Th.is progr.am canno.t be run. in DOS .mode.....$..y..8=...kt..21k!.}.0ki}.3k5.u...5k:u...kk..0k<u...1-k9..4..7z..2..Richt......PE..d......UT....." ...........\D...x)............0..p-...;a..,.`B.%.T.Y...@...<.........{. 0.@.....?....`...N.}.-.....8....0.........h-......tex.t......R.... ...rdataO..\|?.......v..@."#..6)......6-...pX"#.........^-.F rsrc.!0........."..elMo. ....."..-..B...-.=.='=7=.G=W=g=w=.=.=.=.=..=.=.5H.\$..WH.. ..H..........t.H....1..0..H.\$0.H.. _...7.H.....A.3..H..H.I8.H..t.H....P.H.{8HW.K0=K0L@(=K.(L@.@..A...=K.@.G.B.1.UV.WATAVH...$p...H....-.H.Z.L...9@.I..H.W.A.-..=A.BC.I.^.H..t..H..H....P.@..........y........-...b...L..$.-....0.P.@....}.-.L..$.-..M.n83.I9.U.u9I.N(.H.T$HL.l{$@B@.D$8"..>P0>P(.".E3..D..JP NV.12.P..@..s.m-.9Q3.HJP\.!.0D$\.Qd.Q.l.Pt%d.@I..V0..PWPJPT.".JP\iQ.PXB@L...PH..P....A.iQeQ...P.X.P..-.9P.@D@...Q..Q...QE..g.@.I.G..H.F.I._ ..`..B.H..H....@.....ub...(.H.....1..7a..)A..(J...)I..

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atimuixx.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 31232 bytes
Category:	dropped
Size (bytes):	10899
Entropy (8bit):	7.733379793377916
Encrypted:	false
SSDEEP:	192:Kju6xiTX4TjRK/I1PfxK7RSHZTmGi4MbSoSAj1s6srL1mfqNCElf:zYjRKgQkY94BoSq1s6I8m
MD5:	E200CD76E1CC97BE31BB8A3E0350B4C4
SHA1:	EC7C8F2AA4791A5D6A26F8646ED4481BEE6023B4
SHA-256:	FDEA08D989FEB9765CE6FAF08FA36D9C2C5B4B656F8EC2AE907276DE24183477
SHA-512:	28C9305DCE449D472F5EC0D38F5639393B96C6C8F23587359F316B91A9BF19B95371CEE09523819021EA583E0E589EFCA9804B708E3FE413A71B1C245D100558
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.z...MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$.....6...X}.t..F#..u..Y..}.5...F."..}.6........ ..Rich.t.....PE..d......UT....." ......r............................(........>.\|A.......G........hj..0.{..........B...........8......text..7.......:... ...`.data.....#..........p..#\|.y.....-.@..rsrc..t....l....I-relo.\ =!....xn-.B....-.-.-.-.-.=.=.'=7=G=W=g=w=.=.= .=.=.=.=.5la...U..4..4..4..4)P.4...!.......n..\..\..RS.DS..jCz...E..}X.).H..!c:\wo.rkarea\1.4.301\dr.ivers\2d.\dal\eeu.\atimuix.x\build\.wNow64a\.B_. \amd6I4.F0 b.=....!....FH..(....u...).......BH...(.H.IH......@.\|$HH.2..-.+.@...t.H;.t.H...H....Q...Q.AH.L$0H..\$@.......H.\$0....UPD..I3/....`X}UQIP.8cUdUPLYP8L;3.XQ@H..@.@...L#.I.E..H.=G.Q...P5;Z.@....... .B..B4_...t..R..H...1Q..=.=.M.M.....Disabl.eThl@dLib.raryCall.s...Quer.yPerform.anceCoun.ter...Ge.tTicknb...IwaCurren}tIcId..F.h.Process.`..waSystem.TimeAsFi.G`.`.KERNE?L32.dli!.VF.."..P...e..`U..` .`.../.`....F.aDllM

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atio6axx.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 28356608 bytes
Category:	dropped
Size (bytes):	12511921
Entropy (8bit):	7.78709167826872
Encrypted:	false
SSDEEP:	196608:CgYIINu4VAknly7nqLwq4cd1CWKfJjkwWOOyyHFm/9YPm3z10drbvePJQFtMwq2I:CgYVAHAwMd8WIjkwWOOyaM99SXywM
MD5:	26675E1498A80252DAD237250DAD3230
SHA1:	1F0B8C6F3D30EC21C4C2F9DD8F033AD8164BC2C9
SHA-256:	934BE447F0F6926E291E4FD9D741B2A6A146B99C4B3BA3B5D5F025BFBA9B56A2
SHA-512:	466F558F0A3C3AFBCBC9353B804BD513FEE82966FE8055BDB64A63F6F89DE0EAE03A00F6703F7475B9B850D34E00E3AD983FB833AA1CADC9E56604B511F789CA
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}.............@....................!..L.!T.his prog.ram cann.ot be ru.n in DOS. mode.....$....\....2.t..K....}...}...}5u..q...u...H.............u.3..(............Richt......PE..d....UT....". .....Fc...PW....\7......i..%........8........2.`-.%.X.\|X.-..n...8..V.........H....^........\|..?.0.c.8.....x.}.(.....}....pc.........text&......%....M.... ..`."1.'...!!.$....-..!2......0..$.>-&$3....Y!@.$(f-&$4...h%.P.....8..-& rdata.o........ .J.+..@..#............F.... .+..p..$.......=@_.TEXTASM?}.5......5..../= .tls\|...0.....4...\|.W=..rsCrc...v08.~~=.. relo.0r.....,....=..B..H.\$.H..t$.H.\|$..AVH.. 3..I..H..L...H.9H.y..0y.M.....H...H..@.8<.u.H.S...J...H...~...D......I..H...D..H.v..H;.\|.I...H.t$8H..\|$@....H..\$0I..H... A^..vF..7W.C.@H..H.9y.t.H....+.\.H.;.H.{.0{.H9.~.t.H.>H...H...1.ZC.gBoA_uG.2.B.H.y.f@..@t...A..\.3..H..H.C.0C...DY.B.MvD@S..H.D..MoA[uCH..A.H..u....H....H/..tr.1..C.0.0H.Y.P.@.@l.\@..@..H.....H...<...+Ak.H..H....4@;..s.H+......HDA.D.-..Pr..S.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atiodcli.ex_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, e is last character of original name, original size: 51200 bytes
Category:	dropped
Size (bytes):	29592
Entropy (8bit):	7.673985570808678
Encrypted:	false
SSDEEP:	768:SrIzVuCAJ31upMYuhAWrPbHDSczehiKzN:eIwhJqh8PzDScChiIN
MD5:	7D37BE8F501966DA15B5190C5D8F47C3
SHA1:	FA7A444BBA39784B1B900E2A7F6526DACFED40C7
SHA-256:	D646FC374AF5394D0A6668128D4994C42CCDE17475B13DF133142A2F75483BB8
SHA-512:	F4BFB39C12DF309C70A79E031EC10E93C85D343BDFACAF6C0B42BEB408EC9296BD9A83DE7DEF8AA03823D9935A25D180D855407F59B23DB15B6921FE580D6387
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Ae.....MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$........}.t.\|....u.w.S......w.......u...............Rich.t...PE..d......?J.....#.......x..L.......$............... ..........8.8.M.....{.(...........4....p..#...........".\|.....text....v........ ...`.rdatag...l.......\|....@..#.dU3.........-....p.#\|...x....%)rsrc..,t.q......n-....-.-.-.-.-.=.=%=.5=E=U=e=u=.=.=.=.=.=.=.7H..H...8..H.p..H.x ..H...H.L$1A....3..D$0....B....#...A...........0..H...<........H........E3.E3...(AH..H.D$. ...../CL...5@....u.oH......\..........G.....~iH..~..p.f.H..O.H..Q\|A.0d....u..H..H.T$0.H+....H......D...u.D.\|A..C...@.6.......@A..H..u..L..ps@H.t..@.=G.......uWA...Q.A.;.t0..@.+@.~.......+P.....w...0P....2..#s@.8.u..3.H..$X.1o..$P.1...1..I.S.H..@..A.@.ff.LA..C..S..w.t>.A...Q...t.D...tV...I0P..B0P7Ptw\......+P..@..Wu.3..A.C.A..R.d....Z."..M.]..Q.6.m.&.....`.@...x@....H...C....@RjH..(H...H.\$@H...u.RQia..(..H.\|$H....1...H;=..i.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atiode.ex_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, e is last character of original name, original size: 332800 bytes
Category:	dropped
Size (bytes):	102873
Entropy (8bit):	7.679196100520769
Encrypted:	false
SSDEEP:	3072:blKNm0MY/4iAnDbXJDrJq26dCN04hOhRUu:sNm0b/4f3Vb14RZ
MD5:	B83525663020A80549D127B78E39C88F
SHA1:	64FEA1E60F34380C477531AEE48A2A47F4E7CF9D
SHA-256:	22B01A05745479AC0CE3AAF671D3B57D2BB0ED10D797678FE4D868B0E8DBD050
SHA-512:	389B807E78F2B1F92AE8C779671C7BC7587001F542F01F48A32E241DC1B3BF047BBA96EBE8DD7132C027CCF8827575FDDC56CC7FC7856346C28386A5CEFFA13B
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Ae.....MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$.......i.}.t....u.........u6......u.w......u._uf.......Richt.....P.E..d......xL....#.......B..{.......j..I...........$.:......_........H.H.].....{.d......:.?....d......d.........`....(......t7ext..,@......... ...rda?ta.............F......@...#.$.....,r.........p.#.......).V-> r.src.........-...2+...-.-.-.-..=.='=7=G=W=g=w=..=.=.=.=.=.=.5H.SH.. H...H...e..._..R...0..0.H..LZ..0v..C..C@.Bb.Ck..C4.BN.A....!.@'.B..@....@......@.k..\A..@3.YB.H.. [H.%..Y...J.0hw.y..@.$.GB.t$`.5..A.\|$X.=..A...t.H....~.0.......o3......YD}..@H.T$pEB....Q....A...\A_.@..({...BA..&\A.i.@...]S.@Hg.D$.".P8.....P0....D...o@.SX...P.P....@ ....@D.L$p.eAA...A.P. ...J`....XU@D$p.C.H..@H...@H..D..h.j.I(.0..2.P.B..A....P..U..S..S..R..SU..S..R..ST.SU..R..S(.S..R.k.S.c.Bu.RW..S.)ci.RC.Q...d.Pv@(.U.0.s.....0.1.\A.!.P.0n`.......Q..RC.E.3.H..$0fb.C.L..$(...A.Q..a.a....WU@K..`.a.a..a....a..eL..L$ .a .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atioglxx.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 23627264 bytes
Category:	dropped
Size (bytes):	10306787
Entropy (8bit):	7.802559159418908
Encrypted:	false
SSDEEP:	196608:ssEIoOVXE4wqljN+yLN2P8A6qXMoZLPGt6l+dKUYLWmx+PiEVd:MGXEYP2P8A6qcoZrYdKlXUiEv
MD5:	5F1744D672FB252325ED9DDDBEF2606D
SHA1:	9C9B5389C43223753847708C58C005AEADBF4E5F
SHA-256:	A31A674C74765223D3EB750653C5AE41FC3C49D7CCA6511698CF60FEBA23B4BB
SHA-512:	EB3C5455D6DD2540962D95DF751CD28276B4449BF088E3599CCB70E8ADF0AE1690B62B4925BF100F67B112469341F77F67E2AC49B5CB19041F90F1060DF291DC
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al..h..MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$....Z...;.}.t......}.w...}...&u.......u...........9.....u...=............R.icht...PE...L...o.U}T.....!......2..F>...N.,..... .3....i.........(...q....".@......I..K...M..(....L.....c..H=.y..c.......-3.8y......I.....'.I..............text...........u. ...`..1..V................_2........$y..-.$3....!.....!.F-.$4.+.~9!.f$.n-. .rdata..8+..... ........@..#..N....M......L..-._TEXTAoSM....pa. ....X.- .tlus.....pc.$...tZ.=..rsCrc..t.q.'.v6=.. reloL0.... ..... \|^=..B...=.=.=.=.5U.....V.E..P..... .6jj.h...;.u..u...KE-..5T..bj.5P.@RP..x.@...E...F..E..F...V..FM...F. ..F.....^..]....xTH.0@V...(...F=..F.....x..u.3.P..5%.K@]......P.&.GTI]C.SV.u...Wo.}.....CqC.CxB........N....I....F..u.+..F.P....L"..3...~.............B....;.\|.._.....^..[PC..0f@.~..t...6...,.....iExBoD@}B...@....0.HVPR.ZWUK#Y`0]lG.u..VP.k\.1y.@..3......@.XUPiM....GR.MY)..A.A.cT..WZJ.}A..C..U.Cz 4g}T.QhM.SNCjTAf#Yc.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atipblag.dat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3917
Entropy (8bit):	4.937108695367359
Encrypted:	false
SSDEEP:	96:SEb8eyWpyMx/y+tILlOIRMR+bkC8FoMf75M:KET/tQBe9pFoMf75M
MD5:	64A0869F18560CD529120ADE00155C3E
SHA1:	D0C2A07441364C2B3F0043CB1CFEE79DB2C5D53D
SHA-256:	2668B62D6BD44E8E583D5D887AA37755401BF04EDEDF62D3B46C880865B592BD
SHA-512:	9AB117A9AC0539A938911C6E0D060863DE61B434F5BCA152940322DCDC1BAC9F7FCEB359D0F8251D7C393BE34BBD146058B1BD4D9F8F1904DFFCBFBFDE438585
Malicious:	false
Reputation:	low
Preview:	3DMark06.exe..3DMark2001.exe..3DMark2001SE.exe..3DMark03.exe..3DMark05.exe..hl2.exe..Speed2.exe..WoW.exe..FEAR.exe..FEARspdemo.exe..speed.exe..speedDemo.exe..FEARXP.exe..CoJ.exe..RelicCOH.exe..XR_3DA.exe..wic.exe..iw3sp.exe..iw3mp.exe..hellgate.exe..Crysis.exe..chess.exe..FreeCell.exe..Hearts.exe..InkBall.exe..Mahjong.exe..Minesweeper.exe..PurblePlace.exe..Solitaire.exe..SpiderSolitaire.exe..hl.exe..SupremeCommander.exe..wmplayer.exe..Acer Arcade Deluxe.exe..HPDVDSmart.exe..HPiTV.exe..HPTV.exe..HPMediaSmartWebcam.exe..HPTouchSmartVideo.exe..mfpmp.exe..iexplore.exe..SoftDMA.exe..CLNetworkPlayer.exe..NetworkPlayer.exe..NetTVViewer.exe..PowerDVD.exe..PowerDVD8.exe..PowerDVD9.exe..PowerDVD10.exe..PowerDVD11.exe..PowerDVDCinema.exe..PowerDVDCinema9.exe..PowerCinemaMovie.exe..Touch Portal.exe..TVEnhance.exe..HPTouchSmartMusic.exe..HPTouchSmartPhoto.exe..HPTouchSmartWebcam.exe..HPMediaSmartPhoto.exe..HPMediaSmartvideo.exe..PDR.exe..PDR7.exe..PDR8.exe..PDR9.exe..PDR10.exe..YouCam.exe..Dell

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atisamu32.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 80896 bytes
Category:	dropped
Size (bytes):	46579
Entropy (8bit):	7.694232749521293
Encrypted:	false
SSDEEP:	768:H11hdlVOvTH4vp0H60AhP1tcn8lbquVzgx88MNasHnc9pAvQi:NlvpOAhN2n8nVzgxAHna07
MD5:	050CE2CECC6F89721F2660DEDF3807FF
SHA1:	951911E014D5352C13C7C066192DBE4C11D232D9
SHA-256:	7C6B635BBB35557791C86D283A7671EF0DDD580F17A20A7494C26177700A1CB3
SHA-512:	4E29F7D9E6D33831603742CEEA89F87EE4D1A4A9960B96E4F5202B36A9BE81321DF3BDAC54747D7375F7550E65907987B3138F754F43839ED9D1FB57E892993C
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.<...MZ......}.............@...................!..L.!Th.is progr.am canno.t be run. in DOS .mode.....$.....&...dut....u..}..u.}..u..u...u.u.e.u....u.u.....u......z.....Richt......PE..L......UT......!...........J&.......)..........0...-....?..,.@B.....U.......7.....{.(..................O...8........!.,-......te.xt............ ..`.rd.ata...B...D......@..#..<...&..&-....rsrc..\|.N..0.i.(-.relo.d .2...4....v-..!.-.-.-.-.-..=.="=2=B=R=b=r=..=.=.=.=.=.=.:U...E...t.H.8(uC.W..f..@..A.z.A..A .@.. ...@.pE .@...."A..(B...(@...]....3.>A.HD9B...GF.0W.}....u..G._]....Vj,......j...........tiS.oF.P.0..F....F..Ct..F.~........h@...O-.....u.[.7^nBr.@....A....@.V......@...[.C^...nB^E..gG.rH..@.El..M.M.@-..F...Vh@..M..A..L.6.J..GVGYG.M....u..A..oAWP.W-..C_AV.u...i@F.I^>A.@...@...2.I....@3..R[E.j.h....d...d.%..Q..}..SW....E..@...........V.w..V....@j$......A.t<....."@A7SA.CA..iaU..A..gc.gc....Y ...3..Z`....h@.P....u....G....P.R..E..G`..@.}..u.Yj4...S.E...E....0.W......A.`...w(.@,.E..

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atisamu64.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 89088 bytes
Category:	dropped
Size (bytes):	51243
Entropy (8bit):	7.709684516697586
Encrypted:	false
SSDEEP:	768:QJngOvYFNAhTE7ZG77P/Ve2JCiFLrZR335+NVZs9Kb/9GpnzizYkAoFSzDwU:iPvYFYTE7w7HVe20iFXZR3gPN7AoO/
MD5:	BB838CF9D207D55A3F1A2A7FE8A78114
SHA1:	EC77B19811631E79375462A7B40E3FC74E42DDBD
SHA-256:	46417EBC3EDCB321A63201663D564DE20E92D258F4931C641DDAA2EB9BABBF31
SHA-512:	2C4A702BE254E3FF8B544EA47FF8808FA6107DBEF46E161504FA3846BD1FB9E0D5A495C41C93A78B4A8391E4745ADB28F36FA0A00CC8D926C61AE2D839CC670A
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.\...MZ......}.............@...................!..L.!Th.is progr.am canno.t be run. in DOS .mode.....$...~......t.>.....}....}....u.'....u.........u............z.....Richt......PE..d.....UT....." ...........t...x)............0...-.......,.`B.%.T.Y...0.=..7...4...(...........................8\|...............h-......otext........R... ..`..rdata..g-]...^.......;@."#..9..-.....$".....pX"#........:^-.F rsrc......r/.H.-.!elo. ......"N.-.B....-.=.='=7=G=W=.g=w=.=.=.=.=.=.=..5H..tP.9.PuK3.H.A...08.0@.0HHw..M...A...J.0..@.-..0 .@.."C(.@..C0.>"..3...HD?C.HE..H.t$..WH.. H...H..H..u...B.H.t$@.H.. _.H..\$0H.l$8.3.MPH....Y H..H...tTH.H H?.(H.h..@.0.hH.@."......A.H....c-.....u._H...#.A ...H.K ....B...r..@...-...H..A..@xJ.b@H.\|$ AV.fAI..H..L...M.@.A.@.wD.\|$H}AA^>.MI.(.F.@.D.W.M.C....n.?..L..I.CA...L]...C[.P.A....M.X8XYE..u...A...-....@SfC..Q.<.P}A[......AY..a.B...C>.Px.0.b.PWAVAeA.0H.D$ ..s...A.@l$``A.hL..H.....@...".p@.[...!...@..`.NG.#.PH...3.A*.@J.]..@..Y.@Y.0UY.PYePYhPY.@.Y

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atitmm64.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 190976 bytes
Category:	dropped
Size (bytes):	111165
Entropy (8bit):	7.732782304313372
Encrypted:	false
SSDEEP:	3072:b5MQ20C20fNsWIehP3x3qM395DmI5hxr97wQkFV:dMQ50cE539IMhxr977kn
MD5:	CB87498A19E25DCD89F5E872B1D76AFC
SHA1:	B89E136EBECCBE5E2CE1D61AB80024EA9FE6E36E
SHA-256:	B130A74874B534908406F994C1C00DB51EEABA57FBC807533035DC33C3ED754A
SHA-512:	60F769F033AFD6C6F703E54C921123D14D992D772DED8D2B1FC448E5E1AE532E17ADE42C22FA9F23C817A5D76E512C6CE844292AC0492B53F1DAE2F4A1E0F3AD
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}.............@....................!..L.!T.his prog.ram cann.ot be ru.n in DOS. mode.....$..%.,2a..Bat....a.4}..ah}..a.I}..acu..Ew.alu.Ca...}...F\|.ad..W.a`.........Richt.....P.E..d......UT...." .......-.NT-.............%.......8...p....2.`-.%.Y.\|X.-.`...-..........{.."...l!...`..L..0....8....W................otext....W....M... ~..rd.at....P...b.........@.#W..j..5.......@,..p*#......"..f-N rscrc..........-.!elo. ..8........-..B...-.=.=/=?=O=._=o=.=.=.=.=.=.=..=E3.D..H.......A..Qf. ..F...I.@3...JH..l$.H.t$ .AVH.. I...L..H..M...u...@...H.l$@H..t$HH.. A.^.H.\$0H........H...H.\|$8I...........ls@..H........@.!.3..H.O.H.G..A4@G .@(.@0..G8H.......3.3.H...H.o@.......J@......@...~.......@..x..G8..@..H..L..I...H.....At..L......PA..P(H.w@SG...H.fA^C(F....w...IA..NB.zD......"K.M..@S<AH....2-.)Q^@[v"GH...H.."C..VH...A...E..t.H.........C...[.S.PrA.......@.P.P.7....@..P..V3...U.A.@A4@Az.@A.@A0.A.A....P.Q.Q.`.S.;A..m.A0.V.E..\.].m.m.m.T.@.P..4@.HmH.C.K`C.@.G.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atiu9p64.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 118096 bytes
Category:	dropped
Size (bytes):	68532
Entropy (8bit):	7.711220825433236
Encrypted:	false
SSDEEP:	1536:kXI343W1xJyTF1GZAQ/PgljNIADfQT5Q6JrtxXDw7:k4aW1LyHtYgJzWQ6JnX4
MD5:	839E357516DD56A48753903C45627445
SHA1:	10A65C65DA545E2C411D2DF68375118A9C32AB3D
SHA-256:	D57D9B46FDDA2B7B009B08200BEA549BCBC08000AAE27997762B47DAEC8A589D
SHA-512:	8D012D09A9BDBD9C38C2EAAB504D902806374A49E4DF1EF0B99F96241C14EED1AE0BCE9F0DECF77F9CB9FA2AB413AF1133D00F67851F13150454FCAFAC344F37
Malicious:	false
Reputation:	low
Preview:	SZDD..'3AlP....MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$........m}At.W8.A.}.w.A.}..A.u..N..A.u.lA....A.u..;W.A.........=...Richt....PE..d....UT$." ......v...U^...........~..........r.............`......F.I...@......{...P(...h..........r..........0....8....P>................otext...t.......B... ..`..data..6..!....z......p.#..........&-.@.rsrcp..\|.y......N-n^!elod d...k....v-.B....-.-.-.-.-.=.=/=.?=O=_=o=.=.=.=.=X.=.=.=.~...4I..4.5.i.(...U..4..4..D..DU..4..4..4..4.....aD$aD:.aDJaD`aDnaD..aD.aD.aD.aD.aD.aD.....D&..D6.DD.DZ.Dp..D..D..D..D.j.D..D..D...U.1T.1TH1TZ1TUt1T.1T.1T.1T..1T.1T... ..T,.T:.TH.TR..Tf.Tz.T..T...T..T..T.T.T.T..T..D...D&.D2.DJ.Db..Dt.D..D..D...D..D..D..D0T.D.5L.46.4^.L.m.e.......6.c.".c.'.c.m.X..c.e.cx(@.m.}.w.....!..k.2.{...H?FPm3.w.?..........cbad a}l. ation.w.}.....v.5 .....\|.5 ..x..\|...\|..\|..\|..\|...\|...{.1.Hq......!m.s.c..o.r.ei....d.lq...C.orExitPr.ocess..G.etCurren.tPackage.Id..ki.r.n.i.l.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atiu9pag.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 100032 bytes
Category:	dropped
Size (bytes):	59705
Entropy (8bit):	7.707183584733149
Encrypted:	false
SSDEEP:	1536:HpUzKinh7jaK85dRgVq5k2C/FPkPwXCCDNdo4Sao4:Hy+ihHaH5+qoCWbSao4
MD5:	93643249EB8FD2A5E24D54FA29B9AF1B
SHA1:	5B56A6678D85E7FC88EC010F778935CBCA5C9239
SHA-256:	24C0EE440F35165EA6160E0E2129A2D6C0374029AEC4D080B44C335DF74A08BC
SHA-512:	AA6CDFC7D66DF6B2B59F722619475F7E5E4F5328A1642C01DB6BB555A1ACA2DA9587910C3A414E2AA382B2C063CB4286D53E43279737AB200831034EEBA11A60
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$.....<D..R}.t..0...}.w...}....u.......u.S.......u..3W..........=...Richt....PE..L....UT......!.........`..v....................'.....................M....8......0...P..p..h}...n...............3.8....h5.....P2......tex.t...(........... ...data....,.........?..rsrc..u..q.'...<.-.@..relo4 .j....!BF-.B....-.-.-.-.-.-.-.-..=.=/=?=O=_=o=.=..=.=.=.=.=.=.2....0..0...a..7..:.0,.0...@.a...0..0..3...!@.!@<.!@H!@^!@n!@..!@.!@.!@.!@..!@.!@.4....U@$U@:U@JU@Z.U@rU@.U@.U@..U@.U@.U@.U@..U@.5..4.@J..@\.@h.@..@...@..@.@.@...@.6..2.@>..@L.@Z.@d.@x..@..@..@..@..@.@.@.@..@..@..@".A.@UR.@d.@p.@~.@U..@..@..@..@E..@,a.m..0Z.0...4<Y................T.......?/)....ZWtY...%..^.....5)~[...$6.Pa!...6..........bad .al[ ationK..u.......- .....X.- ......X..X..X..X.Z.X..X...W.Qh.Q `.....m.s..c.o.r.e..`..d.l.`...CorExit.Process...GetCurr.entPacka.geId.k.`r..n.`l.3.2..h..(null..P(.`u.b.SA 0....

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atiumd64.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 8295784 bytes
Category:	dropped
Size (bytes):	4051015
Entropy (8bit):	7.767122956494542
Encrypted:	false
SSDEEP:	49152:N49QIaMgFQnB5/f+MfEaznD+Iu5S59r5FUiJ30foHgIdEQIT67jnVJdaw0Fi5LhW:NrIatKj7q/SjPZJ1AIfXJu+LBw0TJry
MD5:	610E7F61818639D12D48166A12E55FEF
SHA1:	F45E78749DB07EA895004B8E01211921C4E95E07
SHA-256:	539DBAB7788648BFE69066376D78DE3B821242B1DC137D6EE78920C9BB509F3A
SHA-512:	8F9DE9ABE90C4EC47738CA22B080E26ABBA0CA9B506C25A085CA4169B80DF47F9BC355EE783F1B3C9F30A56282292951B60AEDB36E5411C58662EFFC8BB2C744
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Alh.~..MZ......}.............@....................!..L.!T.his prog.ram cann.ot be ru.n in DOS. mode.....$..O........t.._$..&}.%.w}.&.}.u..e ..u.w.....%..u..,\$...&.]...9...!..."..'..Rich.t...PE..d......UT....." .......S............-.....s....8..P~....M...`-.%.Y.\|X....\t.....Qt.<..p{.. 8..x.t.5..}.h.(.{...%...3S..8......n.=...0S.@........text.......!....... ...`.rdata...m-!....b2 .......@.#W..3..`. ...9F.!B..p#.......5.(. A-r.src!!8.........z.-. elof. ..5.....5....-.B...-.=.=./=?=O=_=o=.=.=.=.=.=.=.=H.\$..H.t$.WH... I..H...,..........tU.@.......-..S....-..5....Q..=.E. ..........!.S.H...Dx.H@.... S....H.\$0H..t$8H.. ._...n1@.........3..H9..M@uJ.~@.AAE3.3..3.....G@....MA..t#..B.......C...D..B...O.......ujH....7@........dM@..rAu.N.).@YM_.MN.@....@.@.M@....B'.D.....#M@L..3.?H...pA`B..EfB.RZ.<.@H....CNA.3.Ao.p..B@..GA..A.\|UP@....Q.H..+AH....H......1......1...H.K.H.C..H.W.H...H...........,..(.H.....1...Q..)A..(J...)I..(B..PU..P..P..P..PU..P..P..P..P...P..P.H..u..P

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atiumd6a.ca_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, p is last character of original name, original size: 3437632 bytes
Category:	dropped
Size (bytes):	3866560
Entropy (8bit):	7.592605282390384
Encrypted:	false
SSDEEP:	98304:UL2G2ZgH+bO4ZKgXiq8G70jjsqjgUIVpjgjNFL0keBc8Wa7I6xjM:K2G2ZtOVjsK8VQTeW16xjM
MD5:	EEECD20578EC16F068301C001204B9A9
SHA1:	8B16D9BDDF4233CFA5EF2823DE75090563D2E3C8
SHA-256:	9BABD80BB5FC3C912A6C018F2E60E136F056DBFE657A6DD3617A43973B2E40CC
SHA-512:	8F7A1B37C45F7395C23DE8574FEB1264897A444EFFAD6F9F898AF7F7B2B76E83330F34CBF1D5E43671B58515EB95917CCAA70B857361B921BD437F42AA16F827
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Ap@t4.. .......}...0...$...,.....%.E.........5..t.#....%B.:8.........P.@....\.[p.^.Fm..........eL....0.....{.R...j.\......Wm9%....P.r..]e.G.'./...REc.T........:i...J.?.......o.rE.......t......(P#..+.z......=.)..Z.\|.h...^..T.."...e....4......-.{p:$........v8@.5{.H.!....FM.4C.7.....g.K.X..(..M.k..Q0..........XW.E..T...... ]r.mc.......8.b.`+...n....h..}.."6....xn..........@tc....{N."...>z..K...c.(....h.6$.JlV...!.......t)4..a.3....9.......k.....?.h.t....:.vEm.Z...,...M.K.M..........Q<..~........V....@..c.x.\u...Ig.....ib......Q...%'h..[^..z......m..1...C.b9.sZ....?^<"...Hy........(..G......m..-..G....Q..R.3&..+....[.\9......8.....$?.Yg.`...0..D.../../r.c..JBq.^.....p........aH.....DV......[.....\n..O..h..@...a......wZ..$.g....M."...0em?..w.l...B-s[..o...!-.Q.x..8....z'g_.~.....;.B-..m..!...3...{M...+....8......9X....>R....G .$.bD......U..a..+J.m.2.d.....O...5.lrx...!.U.......@.10.[F......M.>Ka........L.g...U.Z.....Z.l+.....`..h.rf.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atiumd6a.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 8045488 bytes
Category:	dropped
Size (bytes):	4469744
Entropy (8bit):	7.725352020479979
Encrypted:	false
SSDEEP:	98304:tuMGF5Ef7x4eIU0oUB0eByhWFL/FW8pppEZKpnvoGvV40nRA:6yNIU1syhmZOKpF4MA
MD5:	0573119DC2C540AA2F0690654B965635
SHA1:	B92A40D5FFDAD32E71059A36AAA6A83D9AD42A01
SHA-256:	E5A8C384CEB7A31D0F3F60162ECBEE07B561B48EDA2BB258DA894DF58A7B4C9B
SHA-512:	686831185CED7236C0B226D37CBD0539BC7ECB31919ED82EC7B90C1E9EB8DB4A4A3C58C5C3A1AB390418C7AA635EFF22E3C8E5A1B047C68F77F9337A42EEB6D6
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al..z..MZ......}.............@...................!..L.!Th.is progr.am canno.t be run. in DOS .mode.....$....7G...Y.t.......}...q}....u..:...u.X..[.....u.......u..X4{.................Ri.cht...PE...d....UT....." ...^..&..x.....<,.........0.w.p{..."{...`-.....U.Y.....D....uD..P..y.p0...w...-..y......`y........&.8..... 3B......&..R......t7ext............ ...rda.ta.......b* .......@."#....2...D....1?.V 9+.c.p"#......-.. v_-@.rsr.c>.0........~ .-relo. XY.-.....-..-..B...-.=.='=7=.G=W=g=w=.=.=.=.=..=.=.5H.\$..H.t$.WH... I..H..}."......-..;.t..B.;.....-...H..\$0H.t$.@H.. _....v~$........-.......Qv..........A..kSv...u..E3.3.3......&V@TZ@H...=Z@..H...4qA..t......7Z@..5.ZA.u.aF.k@H...t@..B.xD....B.@.....Rv......@U..MF.F..B..@j.B..I..@..#M.....I@.....1....@.A.H....P .....@3.@#..[...@u..@.3U.../..@.....A...AQ.@IUEZRUP[W..gR>.Q+. xX.RU.I@^T..S.I@L..3..H....\|$.@%K..P.@.......1.UH.l$..H..@-.H._.L..H.A...oL..(.bI.}@..Pv.M..H.$P-.I.EI..@t@.)`}@.Ba..E.I..0.a....Bc.Ba<`Mb.I t@

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atiumdag.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 7028336 bytes
Category:	dropped
Size (bytes):	3515600
Entropy (8bit):	7.771177145720063
Encrypted:	false
SSDEEP:	49152:A7nrB95/6cR98Zgi5hBHGz3IUKRVWfbxgEF6S1ReewNNaF5g5ARCWSPDoWtn/uSB:K9vchUu6fhFa0bgAR29n/CRiq5q
MD5:	56A5D8653B2C296191DCB739BB9847D6
SHA1:	D60A9C3A5BE88B1A402A5F12C995DDA8318A6F3B
SHA-256:	ACC803BA6F7D079421A897DF5ADD4D70E428FB80B28F4C65A5B6E293504ADE9E
SHA-512:	D87B4CFB28C71E0711DBE4E4AAC61F05A7D82280281621C4ACE68B8F6A141B2CAA52FDF2ACDCA95BAEF41951B680A09E545B58D5916240194A917919AA8299B8
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Alp>k..MZ......}.............@...................!..L.!Th.is progr.am canno.t be run. in DOS .mode.....$....k..l...t.C....}...}....u.Z...u........u...."............R.icht...PE...L...y.U.T.....!.......F..<&h.`...................0....j...k..@.-.....Q....a.......a.<...e. 8....j..p...e.dx....F.8..N...n_..!..-.\|.....text............... ....rdata.......... ..".....@..#..U.... l...<!~*..rsrc.!l0.y......dO-.@.relod .[....... .n .y+B...-.-.-.-.-..=.=/=?=O=_=o=.=..=.=.=.=.=.=U.....SV.U....M.W3..3.3.3.....\|.I.....3...H..3L........;.r..03..;.s.....3..7_^...[..]..BJ..0.E.V............$..`....u.j...u..;.E.............8".x@.........P-.e...&.A..g..eU.{@...A.Z.A.^].....u...u&.iG.@.C.@VVq@;.5.A...wA.BwVj.q@....@.....GlA.qA...@.=..A..t.)....F..{5..@P...!P..DlA.qAo.B.E.U.'.\|'..i@Hi@..5h,....@5...@..u...M...$.Q...t]hTS.JB.E...-..........P@...t....C...v..E.W.{.......@.,.C\|_.E.......@..t........^3.=B^..<EV..P<.>..t/...,...9.....$.Q...`........t../!......a....^.}..QA

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atiumdva.ca_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, p is last character of original name, original size: 3471376 bytes
Category:	dropped
Size (bytes):	3904546
Entropy (8bit):	7.592585181211427
Encrypted:	false
SSDEEP:	98304:qNvLA0b99ziKPMnjuDKl6bsBa+lXHq/X4ibnmit3JEYAAapyU1b39:ALv9ziYsuuIt4Xq/X4iLmiRIBUwbt
MD5:	598DFCAF399C71EBEB53B4C4466CEA0B
SHA1:	F21F1A4A353C6573DACCE388152C030BA9914C8F
SHA-256:	0CF7AC3966B23B3A32EA798865F39A2CF58BFBDF967821BC61B196213374F044
SHA-512:	914C922C2AF0CEB58BA0DE714BDA65AE1ABA366E308C6646EF3E79B2FC98946987B242EDF2AE0D3436DAA181E4AAAA254E06C82E1979DE67DBB9DE2A37363E0D
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Ap..4.. .......}...0...$...,.....U.E.........(5..t.#....$B.:...&......P.@~.....V].^.Fm.......x..HL....0.....{.R...G._......Wl9%.0..}.u..]e.G.&./.T._hc&T........:i...g.5.......o.rE.,......t......(P#@.&.z......=.)..Z...e..._..T.."..e.....4......-.{p:...X.....v8@)2{...,.....FM.4C.....t.j.K.X..(..M...Q...........XW.E.......s. ]r.mc. ...`.5.b?`+...n....h..p.."6....xn..8......@tc....I."\...zg.K...c.(T.....;..lV...!..F.....y.4..a.3.....9H..3...k.....?.h....).vEm.Z..I,....@$KUM.......f..Q...S.........V.......N...\u..."g..\|..Dbw.....Q...%'h..Vs..z......m..1.4..n..9.sZ....X^<"h..ey{.......(..G........-..G..W.Q. ._.3.~.+......\9D....!?.....$?.^g.......D.../../r.c..JBq.^.....p........aH.....DV......[.....\n..O..h..@...a......wZ..$.g....M."...0em?..w.l...B-s[..o...!-.QG..8...z.'g_.~.....;.B-.m...*!..3....{M..+.....8......9X....>R...G ..$.bD......U..a.+.J.m.2d......O..5..lrx..!..U......@..10.[F.......M>K.a........L.g..U..Z....Z..l+....`...h.rf..

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atiumdva.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 7208104 bytes
Category:	dropped
Size (bytes):	4141369
Entropy (8bit):	7.708366533746616
Encrypted:	false
SSDEEP:	98304:MphDznU0zuXEswIA3u8dDSdgUTSr1gx782CBUuR/CZc:MpZlzubMDSFSO7s4Zc
MD5:	0E9531C0F78B91BB16809EEAC68AF2EC
SHA1:	4ADE113125BC63EB29486C40613514C73ACBA80D
SHA-256:	942CB218A185B53012CC9D10B7E32E6562D21404B69B3910107EAA02CC545E87
SHA-512:	93A70D4F388F4098F61C723B60981367EE93C50EE08323209BB64E2E4298A821ED5F507E6FA4FEC449B722488377FA6F71BAF1C9827F56AA5657213D5E49A7FE
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al..m..MZ......}.............@....................!..L.!T.his prog.ram cann.ot be ru.n in DOS. mode.....$..`..)$...zt..Gsz..}.qz.}.rz}.u..}wz#u.w.z...rz%u...Dsz.u....z'..oz.....v..u..p..R.icht.....PE...L.....UT.....!......J!....M...).m.....-.-......@...]n...Rn..@-....-.,.e.+..":.....4.:.P...k.hH...Bm......k......`b!.8..N....:..1..-.\|.....text....H..-....... .n..rdata..._../..* N.2.....@."#.8..1..0:..../...V 9+...rsrc............j_-@.orelot z0.....2....-.B....-.-.-.-.=.=/=.?=O=_=o=.=.=.=.=..=.=.=U..E......@..!..@...2....E...@>k....p.@....].....)C.2....~.B.....".M. D.(A.0.u...U..u..M...u..u.........]...(E.E`B,fB(._u$.u c@Qo@.lB...8@.. g].((C.1U.l@.....%H)H.D.-..M.C.@...A.../C..5.D@.6.D..* "Mb@.f@.B=.xA.]...I`B..fB../.xA.4YD[]..A..o[.0G...iAgA.C0.@.IrA$.xA$..g].,T].S..L]D<Z.AO. .\.j?....m.i."/m.[.#.Om.[.%om.].Q&.].A.@.lB.oD{E+xA.]...M.aA.Y...0xA.g]..(@.j.3.m/...J.IA2x.`B .M.@eD.....u.;.r@.G..3.........lJ@l@..A.k$Q.A .1.`\|r.....M..d.J@.q..h.rtY)@..Q.ME.A.0,..@@..r.p.r...r

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atiuxp64.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 144328 bytes
Category:	dropped
Size (bytes):	81886
Entropy (8bit):	7.717114241043895
Encrypted:	false
SSDEEP:	1536:brhTigr6TQ2z2FloMWY3TyyVEQAqDSlvTXkXVRVOuDU3HusudvRaBW9/o:/1ilD+WY3TlCT0FRVvqHCRM
MD5:	F1D323B55E93D3651A95D10F53C2BBFB
SHA1:	989E65BFBB31107719A5EBF5913CBA83A847E6FA
SHA-256:	5FED1563A9C17E9A87C40610A1A8427210C4DDDF86ABCF3F3A7E43C5DC2B52CA
SHA-512:	D2CE02EE31560906347E8B6CEB77C4269FF4FB9D19202C5E15334A7128629A84165343EE7039D132E8D30587A72DB3AD1365F62E23C6489AEC0364694106B183
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.3...MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$...6>.pr_.}#t...J#Y}.wK#.}.H#{u...N#uu..#....K#su.U.WV#~..O..L..=I..Richt....PE..d....UT....". ..........l......................'...`%...'.....`......N.\|Q... ...........P....{p.m......................0....8....@O........%......t7ext...........J... 7..da[ta..9.....a...y......p.#...........-.?@.rsrc.......'.&...d#elo.l ..........~-.B...-.-.-.-..=.='=7=G=W=g=w=..=.=.=.=.=.=.5p..2.\.4~.4.5...2...D..2..!D..D..D..4...4..4..4..4.Z.4..4..2."yDU8yDFyDdyDzyDU.yD.yD.yD.yD..yD.yD.yD..2...D2.DH.DZ..Dj.Dx.D..D...D..D..D..D.U.2. AT2ATLATUfAT\|AT.AT.AT.AT.AT.AT..TrD.T .T*.T>.TUR.TZ.Th.T\|.TU..T..T..T.TU.T.T.T..TU..D".D:.DL.DUZ.Dj.D\|.D..D...D..D.q..9$..4..46.L.m.e..+....:.cHCf.c8H.c.m.8.c....c..m.}.x.....b-A...C.{....8\|.8D.w.P....... ".cb.ad al. at'ion.w......v)....)..\|.......v..\|..\|..\|.j.\|..\|..\|...{I.1.Hq.........m.s.c.o.wr.ei...d.....CorExit.Process...GetCurr.entPacka.geId..ki.r..n

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\atiuxpag.dl_

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Compress archive data, SZDD variant, l is last character of original name, original size: 126848 bytes
Category:	dropped
Size (bytes):	74717
Entropy (8bit):	7.718943739167495
Encrypted:	false
SSDEEP:	1536:FzzWW3mWivr7jbippa5yhkr2RyjsRJlQZE4oE23JakAk3wmhB6Bpc0nmVwh:sci/OavVsRf1nN3wmhzBwh
MD5:	40759335108F0B8B7B369D31B3DDC823
SHA1:	326CCE0B31D15BE0950818138D18176EEA66D2BA
SHA-256:	C413A9F83E00CCBAE9742FF5D3CE2FE04CE95597043EA45A30900D92B66AF59E
SHA-512:	2F66934830907173169E934989EDAC122A88A7F2FB3B04FB6FF45F519D6C54A52E9CB2DD6A82B4620FC885DC55C09183AF5E53A8CF4B8625A837AB99FCB69CB5
Malicious:	false
Reputation:	low
Preview:	SZDD..'3Al.....MZ......}............@..................!...L.!Thi.s progra.m cannot. be run .in DOS m.ode....$....>...P}.t.T...}.w..}....u..M%..u.Q......u...W..........=...Richt....PE..L....UT......!..........h...................'....... .....gL...@.........E...............P......p.............(.......8.....=.....P*......t.ext.............. ..`.d.ata..8/.............rs.rc..l.i........-.@.relmo, .0~..2....>-.B...-.-.-..-.-.-.-.-.=.='=.7=G=W=g=w=.=.=.=.=.=.=.5,......0:.0...Y.\.Y.......@h.Y.xY.X.0f.0z..0..0..0..0...0..0..0..0..... A@6A@F.A@\A@rA@.A@..A@.A@.A@.A@..A@.A@......u@4u@Fu@Vu@d.u@.u@.u@.u@.ju@.u@.u@..v@..@8.@R.@h.@...@..@..@..@..@.@.@..@....0.@4.@@.@R..@^.@p.@z.@...@..@..@..@..@..@..@..@..Y.$Y.:Y.JY..(Y....@..@..@;].....N...........M.........K...O.ZWtY......_..T>.Pa!.X......P..T.>............bad al.S ation...m.......% .....X.% .....X...X..X..X..X...X...W.Qh.Q `......m.s.c..o.r.e.`...d.l.`..C.orExitPr.ocess..G.etCurren.tPackage.Id.k.`r.n.`l.3` .g..?(null).`.`.u.b.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\ativce02.dat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	82128
Entropy (8bit):	7.248460016873514
Encrypted:	false
SSDEEP:	1536:8MpH/KK3PAlGuti5R7ylz0zrJf5BHcdBsHw1SmpT1R2D:86iK3LR7qIzrxc/sH3Y6
MD5:	DE78F78604554B0F6C5449D5474578EC
SHA1:	412F6A293C6320711F9E588DD8267F47B836513E
SHA-256:	8999D7E807D0AA9F5E99168EE3F61803796FE272CEC177FCBAA5FACC145D8F2E
SHA-512:	6D2B773A62B041D5C4E0C812A5E71BA94FB5203A85A89712B9378FD59092E1E15DF6D34C0EBFCD5E0B99CDBBB91AD2C18B637B256867C0F2B5ED38F9EE7A1C12
Malicious:	false
Reputation:	low
Preview:	.@...#...................1..FWVH..................................................................................................................................................................................................................................I..I .I0.I.4.....a...a...a/...A..`.................................. ..0...5....................................................I.....I .I0.I@.IP.I`.Ip.I.4......................................... ..p..0..@..P..`..p...5.....................................I.....I .I0.I@@IPPI``IppI..I..I..I..I.4............................. .....0..@K.P[.`k.p{..............5............................................... ..I..H.. ..h...................0 .......................................... ... .L...v...s..sC.s..s.2... .".@2..v...s..s..s .s02... .L...v...s..sC.s..s.2..0 .". 2..v..rs.rs.rs rs02..0 ..%@U.....@cPZ3@cPZ3@cPZ3.D....@cP. .. .. .Z3..@cPZ3@cPZ3@cPZ3@cP. .....@.PZ3@.PZ3@.PZ3.D@.PZ3.$@.PZ3..@.PZ3.$@.PZ3..@.P0 .<. ....................... .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\ativce03.dat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	158928
Entropy (8bit):	6.673331736582503
Encrypted:	false
SSDEEP:	1536:4kcIf4qSvnN/IHOh0/Ve+U/qjuip/XJhopNK5vLOPPCMk+lqub5b/UQnJtSpR8GL:4trRlcegsfyn/6qT+lq85SgM1C+D
MD5:	9F21B884ACCE17577F732A991CD162AF
SHA1:	E1CB9995CDF1649183D1A41187394292286A0FE5
SHA-256:	3AF78319DDBFF80E731DA0ECAE411C42D4915A70A0DF9E721DA9676FB4414174
SHA-512:	4FAB4958BD88C993E793F5F5F565468DC3C89DF6D2654CB8196F78757D679A129BF9F51C7E8C23CB1D868A59C673FC9928289A4F59F98980232D5E7D39C035DD
Malicious:	false
Reputation:	low
Preview:	.l...)...............9:..]..FWVH..................................................................................................................................................................................................................................I..I .I0.I.4.....a...a...a/...=!.`.................................. ..0...5....................................................I.....I .I0.I@.IP.I`.Ip.I.4......................................... ..p..0..@..P..`..p...5.....................................I.....I .I0.I@@IPPI``IppI..I..I..I..I.4............................. .....0..@K.P[.`k.p{..............5............................................... ..I..H.. ..h...................0 .......................................... ... .L...v...s..sC.s..s.2... .".@2..v...s..s..s .s02... .L...v...s..sC.s..s.2..0 .". 2..v..rs.rs.rs rs02..0 ..%@U.....@cPZ3@cPZ3@cPZ3.D....@cP. .. .. .Z3..@cPZ3@cPZ3@cPZ3@cP. .....@.PZ3@.PZ3@.PZ3.D@.PZ3.$@.PZ3..@.PZ3.$@.PZ3..@.P0 .<. ....................... .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\ativvaxy_cik.dat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	234164
Entropy (8bit):	7.999212686141942
Encrypted:	true
SSDEEP:	6144:wOjhajMswd2QUdEQDfuiMxzH92a+sx+Wu9nr:wOMoVUOQDWVxLNonr
MD5:	B84E305D4E56C994967851F2CF6BDBB5
SHA1:	FC0339DE2CE7F94A3871B087F1805E72E06CF8DA
SHA-256:	D93D3FF79B59BACDE1EB79853ABC8E987EDFA14139617A9DCB8AAC528BFD8E4B
SHA-512:	0ADF1E6D634EFB6B69ED57F262CF5E0DFAC997E02DF0D7B381EFEDE4CD7009FA76245095F5037FBEEEBAE5D00FCA41743B56C449B9FAB6292DA74E3AE75D4CF3
Malicious:	false
Reputation:	low
Preview:	.7...x;Z6Z..=G..e.....`.)iws....j...]CWjW...w....x..l-\|..q..=a.....m...}.....g<M.SC..+.(qs8..DxQ..K.L.+y..:..Y.8..n;_.....8y.....Go.O.......V .~..k........E...f....:s.g..q.,{...'.7.>....3..T...4.F....vku....d...8.L...,A2..]....32-?I./..M[...........I........#]....s..M\[&.t...q.....+v..G....\|.t....P.N..~'}.(..6u..UX<8.q..2....g.I.t..1(....{.].....i)...^y..\..]h......v..Ti....*r.wzn..k.X#Nt..<.R...(0..h....+V...+....g..W.(.kZj .....4G.l.`...=.iSAf....S.&.x....^...&.h%....g@. .7.Xe...d.b./.^..&E3.E..c....e.).I.^.=D..2r./'!.2..AI..>.....C. ...l.d.qd.,u.f.^<...Kf..~.Yr..P...L..Ni...4=.%........@.#.,...Q.b...Yb.....^?`..1,.&&..;.!.....f.3m.TS....g..BC..D.......{)0c.xG.......H/WDK'.k.R......&.wh..W&.'....p...\|..5>.O?EZt4t...YDt....O!....a..Cw.3.a...+.....<o..p.%...l....V...T..C....eBTQ...Z.Vi.......-P......b....a.-.a...Y....yA.....".8N.....r..Q..o%..1Z....w..M.5&..qYf.bce....b6.i....{..'.).".....}.$-..b.Au.#Y.....q....z....S..."].'(

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\ativvaxy_cik_nd.dat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	232752
Entropy (8bit):	7.168399481124617
Encrypted:	false
SSDEEP:	3072:RdnLACdl6Te9fD4RHFCJAMyqZxrkYbNvFDMcltuglnbxtIoLyTJnH7CuoVNrIBF0:RFTWMDZlZbN3lt9nNCk0nbCuonIBF0
MD5:	BF121C92EB46F38E3AE080A32C73E453
SHA1:	5110EF4866E4801BDA81D82E0D8EDBCD7B694FF2
SHA-256:	704CBA22D7FE5161B7D00EBECA4CD8645A533A149146B9EB6A699C178037EC24
SHA-512:	1E6D310857409FBF24E73A569B15AEC38968EBEE2B7B83A314C0AB6907BB1A2F5B2B1E02ACA66A3FC3CCDE01D4AE4E96208363DE0C904ABDE5AE1BD79F91688A
Malicious:	false
Reputation:	low
Preview:	0....}...............$*..~..FWVH..................................................................................................................................................................................................................................I..I .I0.I.4.....a...a...a/......`.................................. ..0...5....................................................I.....I .I0.I@.IP.I`.Ip.I.4......................................... ..p..0..@..P..`..p...5.....................................I.....I .I0.I@@IPPI``IppI..I..I..I..I.4............................. .....0..@K.P[.`k.p{..............5............................................... ..I..H.. ..h...................0 .......................................... ... .L...v...s..sC.s..s.2... .".@2..v...s..s..s .s02... .L...v...s..sC.s..s.2..0 .". 2..v..rs.rs.rs rs02..0 ..%@U.....@cPZ3@cPZ3@cPZ3.D....@cP. .. .. .Z3..@cPZ3@cPZ3@cPZ3@cP. .....@.PZ3@.PZ3@.PZ3.D@.PZ3.$@.PZ3..@.PZ3.$@.PZ3..@.P0 .<. ....................... .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\ativvaxy_cz_nd.dat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	290080
Entropy (8bit):	7.222315374973192
Encrypted:	false
SSDEEP:	6144:tKNlX45YROtnOpBCNFdE47cMILrEbyO1gYjBf6Mqwd:0k2JsNFdE4gMQOFgYjBf6Jwd
MD5:	F4D88CAA7A24A9712FE2C1BBA6A1157D
SHA1:	BFC3450021E66DDA64CECA35290A4134953CFA27
SHA-256:	4DF2AB06DA686DD16CE5E72C6934955523C5B65715DB4CA62776914D8CCBB8C0
SHA-512:	B9305F74B83EAE6417CB87921947F2FDAE9EEC1F698C1875A2DAA0C86D4D7740404C0427FEA29154F80DF19E1AF5DC541A751F1FC02D0D1AFB6854F9B64A5540
Malicious:	false
Reputation:	low
Preview:	....""""3333DDDD.....c....................................X$..B..(m.#...................................... m.. .................................................................................................................................................I..I .I0.I.4.....a...a...a/...!..`.................................. ..0...5....................................................I.....I .I0.I@.IP.I`.Ip.I.4......................................... ..p..0..@..P..`..p...5.....................................I.....I .I0.I@@IPPI``IppI..I..I..I..I.4............................. .....0..@K.P[.`k.p{..............5............................................... ..I..H.. ..h...................0 .......................................... ... .L...v...s..sC.s..s.2... .".@2..v...s..s..s .s02... .L...v...s..sC.s..s.2..0 .". 2..v..rs.rs.rs rs02..0 ..%@U.....@cPZ3@cPZ3@cPZ3.D....@cP. .. .. .Z3..@cPZ3@cPZ3@cPZ3@cP. .....@.PZ3@.PZ3@.PZ3.D@.PZ3.$@.PZ3..@.PZ3.$@.PZ3..@.P0 .<. ....................... .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\ativvaxy_vi.dat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	322868
Entropy (8bit):	7.999376707559301
Encrypted:	true
SSDEEP:	6144:NB/1uF6v/wYUbUmSRcdUZxEfA0Rf9Ebj64BqpGM1wHm:NBdus/UImvdEEfLl/Pp1wG
MD5:	08F891562BCE188E1FDA279AE75812CF
SHA1:	5DC5F228C0850F219506BB494B6B576E780471AA
SHA-256:	08EC9FAE605140476D25ACA2708328B334194F98F7CB026EB288B78D77FB368C
SHA-512:	98E32EA0FD4CDA7E284E00FDD58D55E363DC6178F8E595D32226B48D9441D3AA07E373D4DF0D66E0B41BA880ADFB52D82B1912BE09FBE832488EE18DF6669570
Malicious:	false
Reputation:	low
Preview:	....CE.EFK...'......C.e.n...o...g...1.?:.U....7i.T....rh.\..q....`.9Ub.e..P....u..P.....R.7&...%../..s_U.ak..+....v[F.Q.8t.."=...l...b....;.....P..9..z}M.n...E..k..#8Q.....C.-.%6V.....k..H:.zw..^x.Le...A.Z?..@I..X.s.........K..d;.R..z...o..:..ciJ......Q..WF..[......t..k.......b1....w..g.......ev......U...c+.......s.3}o.u..$.......m.Q.RT.F....A...O...v..8+-G......u.F.4..v.8~...!...V_.D.N...?D.N...+B.7L;\|+.K..sk......~..;g....'9....t..f=..t3./........-........w......lf57...R........Dz.$.]..Td.2.F..>.....X..).<...T.MsGk.'C...i.K..............bh.f.P..(..F.q..........0...l-....p...[...+........3.\.H...z.&.M......1Tl...."z4..4.+W.m?.......&@!. ^%.........b.>{0+..2=.....1-%.,'m]..;.ri.O..ut..?7~.K*.#.r#.@..E.0.w......Nj...N.8!....pR....He....;....S.,.g.=.$%.. =...?(....>D........zK...H....r.aX"e.Cl.w}....n.s.=...W....>.......Zg.....?76fM.t..$......)\......B..A..J...1.....Xt.5.....s]-c.s'.....0. 9P.^......`..\|._...C.......5..s.....

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\ativvaxy_vi_nd.dat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	321200
Entropy (8bit):	7.271772253824337
Encrypted:	false
SSDEEP:	6144:0mpTGualYB/96qNPiwQUnasl5vJbKWo9AisK1lsrDnPw:fp79kqNPz3XvpKXgK1lk7Pw
MD5:	B43DD8D415AAFFFDD885451CCDEA283B
SHA1:	08842FD158549287061D063091D5496E11E7C578
SHA-256:	9D3FBBE3140177A9682C07B483C3FF21A46F002FB2CABF614E28D72DA4AF47B2
SHA-512:	450B20B50E56FB8A12828D676C46B6AF74A9F155A5A1C3262C1E779CE9659AFAAC414717934CC8866D0F1B7DC951929F3571CD061958FD522C52DA51585CB9D0
Malicious:	false
Reputation:	low
Preview:	.....................64.....FWVH..................................................................................................................................................................................................................................I..I .I0.I.4.....a...a...a/.....`.................................. ..0...5....................................................I.....I .I0.I@.IP.I`.Ip.I.4......................................... ..p..0..@..P..`..p...5.....................................I.....I .I0.I@@IPPI``IppI..I..I..I..I.4............................. .....0..@K.P[.`k.p{..............5............................................... ..I..H.. ..h...................0 .......................................... ... .L...v...s..sC.s..s.2... .".@2..v...s..s..s .s02... .L...v...s..sC.s..s.2..0 .". 2..v..rs.rs.rs rs02..0 ..%@U.....@cPZ3@cPZ3@cPZ3.D....@cP. .. .. .Z3..@cPZ3@cPZ3@cPZ3@cP. .....@.PZ3@.PZ3@.PZ3.D@.PZ3.$@.PZ3..@.PZ3.$@.PZ3..@.P0 .<. ....................... .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\ativvsva.dat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	157144
Entropy (8bit):	7.999702862464333
Encrypted:	true
SSDEEP:	3072:CudGf3Hh8/mFP4gA3D0iKWX0DmCWiAOlXRIHN9X0fPpuVo6/LMX5p:pof3GIwgA3pKWxC2HN9k3UukgX5p
MD5:	7C163EDE63854539828F5B2C1BC529FD
SHA1:	25925B9572C3822AACAD4DEC563000FBD81BD80A
SHA-256:	E698410E1B8E5B2875AA8B4D01FE6E4F0BF354F40D92925C4E3503D7FD1EC208
SHA-512:	FB08224433447AAA9D8B475497DFC21B97CAF7CBB4455071E7C37CA642DA4A74E6C166F854FF2C6CD7A222BF11314883345E0A87F3D47C0102C164491A301D4D
Malicious:	false
Reputation:	low
Preview:	...{.voF....s.{.H......r.........>.u:..K+(i!..4..2...G5...ji.;.....[./....>.~#s.o...`...Q..YB.G.4.\|.%....y.....,.lPV...`......T$...Y).H.S...}.<..s.-.d0b.U..&F$.P7..{(.6...k........#...N.y?x..t..m......a.!..HK.U}uv..hI..Y...J=Q.;..H,1.r....%%...Z.......E...o.....c.z......n.Cz.7tkbl.]..NV..?...0J@@!.uj.>......1...I..%~=..g........R...~..:o{.d`.&.Ro[.C..4c..%..7.W/b..d..J.......>...85.2m_.....&......A.s.v2d..\U...G...8\|J.)....p./...Y.c....S..W......K.,..'W.?\......3..w...h'0Y.eTJ..~;..-.....9...n'.}.Q...b.p....B..dw...$.X.N...y.LK.{..l@..]..!N4.L?.Tv0(..".........(...]I.s....}...1.qf...F.e.p~...pY:.a.o.RM..C..C4A.n%.C..5x......(....A..Lk............ ..~U>...hsr..e...Vf).G.^.8Z.;)..e.N....2..Ag....5.8..c.);...p..........6w.D`h.y.Z...K...<s..-.M3.g.]...[...!..NV...0.B.Z.....6..._...{..-l..W].3.O.h.@...1..."..+..<U.tq....g.......[E(..zR.O.\|...C....N.p7.%a..OR+.yC.".5.W.&......"...L..+w.`......t.......h4J..it.\......tP..e.=.VDrGG..q88..

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\ativvsvl.dat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	204952
Entropy (8bit):	7.999733700797861
Encrypted:	true
SSDEEP:	6144:bOKCcQwQbQzzKbvQmWEWgWS1uzIoQ2DBm2QcCLC6kfjg:irjwQEz2wgmIoQQLQcsYfjg
MD5:	219D7091DD1D93728392337FE9C7ADD6
SHA1:	1F8C3CA1F70CEB68696B69FD3D04725B666A01BD
SHA-256:	F35A4644D926183D38815207E338E7919CBDD2B1BDB8164074E47B74EA1CF150
SHA-512:	B3D9D94C5264A87594B5BE763D87B91C5EC7E71EE44DCA3C2470C13F09D404E95511682E3BB744DB3094A8D5C6344BF7019BD777BC7B7233237C289E8F3DCF73
Malicious:	false
Reputation:	low
Preview:	...{.voF....s.{.H......r........^-.u:..K+(i!..4..2...G5...js.;....._./.y..>O~#s%o...`...Q...B.G\|4.\|R%..(.y.......lP.....`.U...+.T$...Y.H......<.Xs.--d0b.U...F$.7...(.6Z..k0.............y?...t].m.3.....a...H..U}.v.`hI.6Y...J=Q.;...,1.....c.%%8..Z.............e..c;.z......n.Bz.7Jkbl.]..NV..?...0J@.!.u..>.k...A.1...I..%~.......n...C..R.....~...o{.`.&pRo[FC..4c..%....W/...ds.J.I.....>...8.2m....v.&.L...!..A.s.v.d...U..yG..N8\|J$)....p......c.{..SQ.W.'....K...'..?\~...T.3.w...h'0.Y.e.J...;..W-..,..9...n..}.....\.p....B..dw....X.....LK\{.2l@..]...N4..?.T.0(._"..5......(...]......b.}.8..1..qf...e.~..dpY::a.o.RM..C..4A..%.Cg.5x=.....(.......L...j...@...... .~U.....sr.me..CVf).G.^.8Z..)...N.p..2E.Ag....5......);r..pH...........w.Dah.y.Z...K..!<s..-.M..g.......E.F..4&.NV.....B.....{.6P..['.4..e...c..U.;.Q.v[^..!9...".....<..tq...V.g.,.....E[..i..O.....Z.].&a.P.n)..}...R+.C."[5.W1&.............+.....Y..XH% f;...9.....\.a...7tP..e.=.VDr.h... 7.o.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\clinfo.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	235008
Entropy (8bit):	6.120632492086597
Encrypted:	false
SSDEEP:	3072:g3TKlbqSorJhbJzBOFxs6j5rTIiAfozD+7558i1g7R+a6rs8T7iK3:gWqSoNzsZrTIfvlD18RsiA
MD5:	C1FD406584F14394F6F28749815B2F60
SHA1:	41139894034F9C852C777BA0B47633B4DD4BD656
SHA-256:	BCABC8E9E7EE5120AE04D410AC90E51FC2C1E8655BADF552D4D25B71D0F2D0E5
SHA-512:	E6DC29B224ADABC0A844E2BFA090F7108D7F9EFB5DDFC4E387A835233FEA6D51017EFEF3589FE100CA77B7782BEB5D25979F09BD1C38DA8E7C1E11ED420FE3A1
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............iE..iE..iE3+.E..iE3+.E..iE3+.EA.iE..E..iE..E..iE.(.E..iE..hE..iE.(.E..iE.(.E..iERich..iE........PE..d...%.UT.........."......r...J.......H.........@..........................................`..................................................S..<................ ..............d.......8............................................................................text....q.......r.................. ..`.rdata...............v..............@..@.data....K...`..."...D..............@....pdata... ......."...f..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\coinst_14.30.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	837632
Entropy (8bit):	5.646562696156846
Encrypted:	false
SSDEEP:	12288:MGpX24CbXmiiFSiE1i4OGiBHrTNTK0DCcP/VYcY8fAJldZrnk3yi067GZyKrCtX:MGpXIbXVdJkCC9
MD5:	F3D1F90A8017B1F2DB102AE27DBE901A
SHA1:	A235A88A7F041F34370FCD654A0F7CA00A1916C2
SHA-256:	1836E7EB33D351D0E85A8029A07D1D79BE8C02BCE90D9CBC39B4B3104712DA9B
SHA-512:	152489F71A16ADCA66F54FAD3D29C03DD9CFEA2D39E4AB0C0009A5A9323E03E1D7D6599E048F48C70874D4EE42688F71AAAEDA9C03FC39DCC748BE6FEF922463
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u..............<......gv......<......<......<`......g`.........}...D......D......D..............D......Rich............PE..d...4.UT.........." .....N...................................................@............`.........................................p...]....................p...c........... .......o..8...........................p...p...........@...`............................text..."L.......N.................. ..`.rdata......`.......R..............@..@.data....v.......:..................@....pdata...n...p...p..................@..@.idata...!......."..................@....rsrc...............................@..@.reloc..(.... ......................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\kapp_ci.sbin

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	46128
Entropy (8bit):	7.981906473993986
Encrypted:	false
SSDEEP:	768:guAR5fLwLZljv2EAKxTvzMaxPMV3b/2EQ4B+uxPzMi57DcHVjwxY4yb/I8VyOZe9:gu06ljv9TlzmVddPz3DkjwxY424O3u
MD5:	986E8368E77849AE7A9117A198E909DC
SHA1:	181EE9FB3AFDD9A84F6028B4B30837DB7E330EAE
SHA-256:	ADFB8114BB0675CEF18EB6E4637F2A10928A7E3E8376147FCE07AD0503FA7DE9
SHA-512:	1D47CDE00BD4850042D5CA14136F9CFA81088F6A15F3ECC83BA1EE2B24357C63C8B91C4B18173CC9F70EBBF8B799F86E7273A6FA30ECE6961A164F026C11E7EC
Malicious:	false
Reputation:	low
Preview:	0...................../.....FWVH................................................................................................................................................................................................................................J...%+.t....z......tl.t.....;.c%XK.].v........M...V..g........_>..Y.b......e..'...77.......S....Ql.=...p10..~#...~.O..46].^.ycP...\+..k.(yw.F.X.j0..g....Yc).7.<.<..?.J.?..=..o.....R.~../,.(...:5.~.,[.D.c7k....dk.......n.W....U.>%e.`...&..{c..]cS....'...6.....x..0tZ(.tF.....^'.K1&`&.G......0c..\3..c.`-[F....0.#..l.+E..@_.U.Ya....=.^..[..../o.(...A.jX!.E...).eZr;.kK.T...5...6JF4...[PmQ).T.].Af...1....J.Q.....4..DaR:..\4V..MV./`..P.$+...aw.E..a.C..._...FO?.?Rh.g.u...4&......`...D..K/2...H.c..:....WT..^...c....l...[.....O.C7..JmI.W.......`...@Sh.h...F.Q..,.........+f...j...&..t.+..].Z1..boW2.}:..j.ogq(.......W.`....v-'Gn.G*N.."..L..@C.t.#&.]/...]u.uc..3rN)..._g7.{s.V3.....@.V.X..[lUe0.^.e.o.(...t.uw?-..F.%..X.d".C.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\kapp_si.sbin

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	41936
Entropy (8bit):	7.993420426858011
Encrypted:	true
SSDEEP:	768:1JBfhqjXEUQOMmv2nel1sxbFE1FmOglZxTwxS26LamlypLg5jMy9wX:1JBfwj9ZyelmxbFNfhTwxpWawypwwX
MD5:	24F1E613442735A149F72705A91E1F4F
SHA1:	87E68795AF655CF42A869B59BE19F5643C2A2444
SHA-256:	3CAC784A81DA8A24D693BA6DE7CE72CAAE665DD65EA3E46C205287A7C69326DB
SHA-512:	1962085EA52689301EC2281B68F26C9008D326CE861C5EB2FA3C3156D4B7BDECDCDD73DDA80CA92EFCBDA82F825AC9CA5D0171EBEB8BDF32EE791B393B603F6C
Malicious:	false
Reputation:	low
Preview:	.0G.G.$!..9....?...................................................O.i2h..........................................................wsV...k..................@.}.[...l.b...........................................................................................+.<]..../\9..%.G.=./...\JD.[8.$.x..n..C..f.Ej7@{_)wkEs;...x ...0..T.0..M..y..EW..?.>......kvsa.)...-Tj..o.0....MS..K.#.9.O.....>S..ap.~^1.........E........b...R...........p......}.I`..V....J....f...R......ET.v.T;...%1.....Y....I.G..o....zg?c.G#....g3.r=......:..r..K...(?..g..Q~.....w.@....:j..\|5...#1...b..\...5..x.1pDu.R. ).HT.c.....[.;../nY.. #.4..9~s2.o...n_..4:KS...QVD.2.......r.+2 ........W..c\|.....%i..#.7.(........\.~.U.\.../...uA4..H.Ru...sG.."u./....f..St...d.....@FB.D(...j..i.-.I..=..Er..C).s.j.....$....eA....1.l.....c...y:9.JI......T.;..q`....t..Y.i.k\L..=.......0x.G.....d......P...t.@.x...F...K...xs.(a..s.IJ...G..%L.t..5.5..........{*e......J(Hr..t_..U...,...,h}.l7...}Xu..z.a.w..4a

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\mcl32.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	6.131857006174195
Encrypted:	false
SSDEEP:	768:65ZAuEgxLQ8Hy5Qye97cvU1ssjtwO90tDDK7cv0tGLCnaiGYmjbs9tcPm6TRHcPM:TfGy7sMpwwO9qDGvG+npf7KomVyw7kjc
MD5:	BBB0BC56F91CED56617026FBE243324A
SHA1:	A195EDD1C22DF6AF1214EDA161D125DAF03ABE16
SHA-256:	A0DEF5E3593C3F301DE2AC6F2611AC76F03E847B76DF1F74D8AC8D89BB792C69
SHA-512:	FF96586AAACBC99EDB4149B639B4CC3131A75C857F099FD6534EE7D36448C2FE959AA345B7F69D6943FCF1E22974732EDB14A83B52D9E103902EA9E16759E74D
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..9n.jn.jn.j..bjl.j..djo.j..gje.j..fjj.jn.jC.j...je.jI-zji.jI-cjo.jI-`jo.jI-ejo.jRichn.j........PE..L...yc;R...........!.........2...........................................................@............................................(..............................8..............................@............................................text...3........................... ..`.rdata..M...........................@..@.data...............................@....rsrc...(...........................@..@.reloc..D...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\mcl64.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	5.8079247882845
Encrypted:	false
SSDEEP:	1536:liVrW1ixKO/W1j3Mxo8FycLbNOJWjKRTJ7c9:otW1ixKOogx1RLROJWjKRTJ7s
MD5:	57F686A6950F946C9D2AB0894145A91B
SHA1:	340AA611495857F90280A602B5112141F826BDA9
SHA-256:	2CEB0A7D438197FD51C0E60E6457F06259C65B1AD86CDD925FDAB9C5D8AA1A88
SHA-512:	7D80B8E7B0773159FE95D41F75D0837BF4ABB09FAEC919EBF79B9850B9775A926614F6D74E4409236C12604A07B67EDFBA25AB2535D63AAF3FEC489DB254AAA0
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........MW..,9L.,9L.,9Lo..L.,9L5..L.,9Lo..L.,9Lo..L.,9Lo..L.,9L.,8L.,9LW[.L.,9L...L.,9L...L.,9L...L.,9L...L.,9LRich.,9L........................PE..d...}c;R.........." .........^......d........................................@............`.........................................P.......<........ ..0.......@............0.........8...............................p............................................text............................... ..`.rdata...8.......:..................@..@.data...............................@....pdata..@...........................@..@.rsrc...0.... ......................@..@.reloc..J....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\openvideo.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83456
Entropy (8bit):	6.158111505349563
Encrypted:	false
SSDEEP:	768:zR/3cEv+BZ0+0HpjylVmR70lzElZG6o1nY3fhRbYZHzEntUoojYz4ZeD6p2crlUV:xco6rWyk5oG35SAtUH+eEjrVuI
MD5:	4F57A9CBF09F776344E8CA1F858222AD
SHA1:	56073CAC52CF435AFD2146ED076632E001F02387
SHA-256:	2EC9E07B788A2AD4318F6FF7E1DA213B70D76DBB1F678C3F4135CC5458ECABA5
SHA-512:	978CC04D22FE2F9BDEBCCEF67B93BC8FE84E8ECFDCF09EEB768E8C3CD44632BBD3AD6A60E9687B9185005C02780BCB9C5063A62A14BDE1F2C5F3697D3E1ADD3E
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................%.]....%.^....%._....<2[..........<2^......_......Z......Y......\....Rich...................PE..L.....UT...........!................lS....................................................@.......................... ..........(....`..0....................p......`...8...............................@............................................text............................... ..`.rdata...S.......T..................@..@.data........0......................@....rsrc...0....`.......$..............@..@.reloc..,....p.......*..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\openvideo64.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98816
Entropy (8bit):	5.8937939062664055
Encrypted:	false
SSDEEP:	3072:dzz+IteBjKEIJGbFT+awmz1jvbRvy+Fuzv1MHR:dzz+fBuqbFTmmdTR68H
MD5:	BCCB601CD859A3900244AA9A9D119DBB
SHA1:	9C96E35D487D2B68FE27F80CC1B5C5FE80211D61
SHA-256:	CCF927E2DB3554D2FBCF93845DB0D1E6CEEEE8BF4431A09A385E48B13164AC2D
SHA-512:	0DFCF917F433F6FA46693D4A2E814CCB3D6B7C7CE25CDA2F59222A25F8B955222A0D2C3EED1B23C0E029617FDCFAF34DF4C42ABC7BBEA74EC8D9ACA107E5A8A1
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ..DA.FDA.FDA.F.."F.A.F..!FMA.F..#FlA.F..'FGA.FDA.F.A.F.."FEA.Fc.#FGA.Fc.&FEA.Fc.%FEA.Fc. FEA.FRichDA.F........PE..d... .UT.........." .................Z....................................................`..........................................\.......T..(.......0...............................8............................=..................0............................text...?........................... ..`.rdata...o.......p..................@..@.data...0;...`.......L..............@....pdata...............d..............@..@.rsrc...0............t..............@..@.reloc..$............z..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\ovdecode.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73216
Entropy (8bit):	6.060329034496325
Encrypted:	false
SSDEEP:	768:d1hDUBoenw2i7XZKvoF1XQWalTE00u7vznbfoubYnmYE4B0MErj2cylUCvNKMWQN:tkn6VK08bQzLB0ME+cy++zEz2geBs
MD5:	44007CD0AED41634058192B8AC92B781
SHA1:	485A9EBC59AE3F1D15CAC4E6AD7CE121CF97305B
SHA-256:	A86A6664DEBB72B5C1F592A7050D1297109206EB013676E0F7830CBFF6776870
SHA-512:	53347AF796D980A68597B4D6FB24E61A25ABA774567125470585017043A8692B7FC4F49C690FE0587E434091507CBDF8635A4C0187B349F49ED6B7BC0D44615A
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?.E.Q.E.Q.E.Q..p..H.Q..p....Q..p..b.Q..J..F.Q.E.P...Q..J..D.Q.bs..G.Q.bs..D.Q.bs..D.Q.bs..D.Q.RichE.Q.........................PE..L.....UT...........!.................:.......................................`............@.............................H.......(....0..(....................@......`...8...........................P...@............................................text.............................. ..`.rdata...H.......J..................@..@.data....-..........................@....rsrc...(....0......................@..@.reloc..B....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\ovdecode64.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	86528
Entropy (8bit):	5.774649901939724
Encrypted:	false
SSDEEP:	1536:uXaWonfsxdEgKaTP1kXhtgMBIsAMN++TTCp1cixtZVB9pp/1dtBl51hdJFxtZVBn:uXaWonfudQaTP1kXhtgMiQ++T01cixt/
MD5:	AC8403840A1B163ACA103B9A94348036
SHA1:	8AE3B6E580ABE9BD3AC3D1BE4E741A09A0A8C5EA
SHA-256:	BE141641EDB646331FC7B9DA3AA8F8077071B91CC2CD107D83587D063D265660
SHA-512:	24760490D6EE430DF1D4ADCCC3AD16BBE5846C0EF8371BF03C92F1FBA809F2AE1BECC5645C72DB95F57D861B8B6697D1DB1B94E72F93AEF35FEFEFD25AB6406F
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I...(.C.(.C.(.Cl.cC.(.Cl.`C.(.Cl.bC.(.Cu.fC.(.C.(.C.(.Cu.cC.(.C..bC.(.C..gC.(.C..dC.(.C..aC.(.CRich.(.C................PE..d.....UT.........." .................;....................................................`........................................../..J....(..(.......(.......................T.......8...........................P...................0............................text............................... ..`.rdata..:a.......b..................@..@.data....9...@....... ..............@....pdata...............6..............@..@.rsrc...(............D..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\samu_krnl_ci.sbin

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	140240
Entropy (8bit):	7.9982556795163635
Encrypted:	true
SSDEEP:	3072:cCjsJB+RfEhCqHz0mJYa5PUX06AK9n+/FCkNEwyEbNu1R:8/+5a4mJYq8X919n6A8pyEB0R
MD5:	534611F1C8EAA4FF960EB0043EA03B04
SHA1:	DC8C55F6DA5A448595AF8D6D3E87BE1823610FEB
SHA-256:	41F8BDE125374995650CEAC052F74E988F76825408B3EA9ED375784D104AEE28
SHA-512:	A490231AC2AF76B7AC0F3E0DED67195C66B309BB72276FC87D3B43AF4412B078ED65AE09B4E31A93A4FA60F0EEFFA92A954282FD493738837FCF4E2A38445701
Malicious:	false
Reputation:	low
Preview:	.......A....p.......................................................u...~.........................................................................................................................................................................O.i2P........6....0..Q^.P..j..l.p...[c.&...V..U..?cS....lu.f..E..K.N\...._8....=.E..y.y... &...M..<C......J..0..$.....b.C..!.......qR.......0.J]...C\.6.7...N ...yB....q.6.2.GKyFY....d%....f...J.}..i?...a.!..H.z......r-.>.$...s..u......vvD...`.......>..........\....T.g.-..B...v..<.L.i@.o.Y.N.9..q....../.y.,.$.F6kG..G.P^."W.7..UX.)P.s(..`..@..:..,...;-.....4........4.Z......sVr]##..i!.$Ch.$..-..+..cj...9k=..}..;.a].._...)...rU.m...J4..3..?.(*.,,..q.;N.J..>.FR.w...L.7xR[..O...r.C.3...1.....Q.y...:.n^..PJ.:...F..F.<`.5..h.@...].dK.........F .eO...X.S..=h.........P...r.7.....o.........P...-.d....C..Q.b\..IkN4......Edp..}.FB....h.&.@....gv....wJ....=6.d....et...?.........q..,.5.0...!S#..&..4S.n....Q8..U.V....4.K..xD

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\B177481\samu_krnl_isv_ci.sbin

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	138832
Entropy (8bit):	7.998305548435526
Encrypted:	true
SSDEEP:	3072:B1YXSH+n3pUMcY5qkCvQKrj1GvOKUmrEkGqGRR:B1WDljC5RQR3rYRR
MD5:	A769B352B827590EA4CCAC16E6269E33
SHA1:	893BFAA0FD06527CE2FF43E677FF42D94BD62852
SHA-256:	BC0D7254D90BA333871B0854E8234AD7DB67E404FB1E1318A1A75F239E59A243
SHA-512:	91025C44A12C1CD76149F73332873016D01F75C7E0F5F2CE7EAA3F713B1A19EF23884C756A0E55D1DF85FDF5B9C6060F792976BDAB1DBD206C3E638C655B8FB2
Malicious:	false
Reputation:	low
Preview:	.K.W.9%..(m..S.@....................................................=.F.=.F........................@.......X......................................................................................................................................O.i2P........[.mU.Ia..U....:......25..T....Z...w8.....v.u6.c..-.!.Y9.E=.CB;4x..P.w...1........5.....%Q`s.;....z#C.W+..)_.`Z....+.eY...W.%P\|..<k..........l.O..`?1.O.C15rE).?H..uOI8.G.....nj.U...~.X....@.I..9....3.v.3.T.2...3.......i.q-0o...]...[.\|...&@.}...G]...\|j.....`.....l.....fIyR.~Q9..,.{.X.L..;....k.S............\|qj.!.f.......-.O.o...I.^. 8`....8j3uy.,..Q.4.+.i...:.ld..\|$}..4d3.a.+O.W.>.b}..I9c...a..O.?..c_na.wu..!p(.NxC.w....6..>U.MV.J@..2..`[...T.9F.?')..iEn....".%}.B.M#t...O.\|.q..<..k..CvZJ..Wo...7LV\....k.>.N.._.KJ...s.<.....c... ...hj.xr...7...ICyvm........F..?..mx..+.....P .....F.L.1.l+1lfT......g..U...z.../..u.Hyw`D.pRD.)!.....ut..h.......E..~.]s.b..Q..u....z.aG..7....B..:.j..3*.z..?....xi4......}

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\C7179650.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	49863
Entropy (8bit):	5.604480593468996
Encrypted:	false
SSDEEP:	768:AHwwNNo+D6SuQXB7y6nE5iGg7e7dip+te:+wwNNxu4BG6eiGgq7wp+te
MD5:	1A05ECCEAEA78D273174C42C11007240
SHA1:	E29B05554E40976582F888E8C35AF633979493FA
SHA-256:	FB0F8943D284830025664C34E053C515270242072D4C642BC8CC1E487C8DA0E8
SHA-512:	B0D943C79E1A0E55989356A72CB2809036FB45647F5340A58E93A479E78AD0A9F97C4E72781044A7C7AD5C66420B5B77C3C57733CFDE800E3AF1B9D87D36699B
Malicious:	false
Reputation:	low
Preview:	;-----------------------------------------------..;----------1501231043-14.301.1010-141101a-179650C..; AMD display information file..;..; Installation INF for the AMD display driver...; Copyright(C) AMD 2007-2014..;-----------------------------------------------..; PX - PX Proxy mode..; PR - PX Proxy Ready....[Version]..Signature="$Windows NT$"..Provider=%ATI%..ClassGUID={4D36E968-E325-11CE-BFC1-08002BE10318}..Class=Display..DriverVer=11/01/2014, 14.301.1010.0000..;;LayoutFile=layout.inf..CatalogFile=C7179650.CAT....[SignatureAttributes]..atiumd64.dll=SignatureAttributes.PETrust..atiumd6a.dll=SignatureAttributes.PETrust..atiumdag.dll=SignatureAttributes.PETrust..atiumdva.dll=SignatureAttributes.PETrust..amdhcp32.dll=SignatureAttributes.PETrust..amdhcp64.dll=SignatureAttributes.PETrust....[SignatureAttributes.PETrust]..PETrust=true....[DestinationDirs]..DefaultDestDir = 11..R300.OGL = 10 ; Windows..R300.Miniport = 12 ; drivers..R300.Display = 11 ; system32..R300.DXX

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\C7179650.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Code page: 1252, Last Printed: Tue Jan 24 19:54:29 2006, Create Time/Date: Tue Jan 24 19:54:29 2006, Name of Creating Application: Windows Installer, Title: Installation Database, Keywords: Install,MSI, Comments: This installer database contains the logic and data required to install <product name>., Template: ;0, Last Saved By: oirshad, Revision Number: {CD760339-CB7C-4BA9-BEA5-DD3F433ED05B}, Last Saved Time/Date: Sat Feb 4 00:27:09 2006, Number of Pages: 100, Number of Words: 0, Security: 0
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.849403799285212
Encrypted:	false
SSDEEP:	1536:yFBSOyULOtHV6A2kcGtSPcGhsWjcdOyK8Ulv:y8rtHUkcySnO5K8Ux
MD5:	917399AE045D0BE1439FC61F33CD3789
SHA1:	0BB1D87EBB1B20EAA5C874C6CCBA5F3D6321203F
SHA-256:	9245A0EA9B075301D21CF9630F7EBF3038A22A2921A59655073818C28B8A7520
SHA-512:	62DC7AEF57548E99EE244B9658BB91FD72D26A324A9A907D9CC5ABFFD559C867C177C0A3C62B28A1DB7D529608ABD35D16DBCF533D2A3F46AF2E48EBBEDB39FE
Malicious:	false
Reputation:	low
Preview:	......................>...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!............................................................................................................... ...".......#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\CU179650.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	368123
Entropy (8bit):	7.556497968636486
Encrypted:	false
SSDEEP:	6144:HnWVqjA7+7Ndk2KejMxPVHd1fqX0wCyAZNKgo8HNfTTRf4gNd6A+l35OGD/1tIHO:HDjASdkejMxPVHdQE/bxo8tfvRQod6AS
MD5:	B0D9F83BDC8EF31CA8C2D6D88B3CF3E9
SHA1:	140AD73A0396986A924720BDEA392AB44BFEA90A
SHA-256:	FEA7DDB18392B2ACA776B44784260D34B751DE3AB7F0DF332C18B915FF2EB21F
SHA-512:	913F136E9E8C34C75DFFEAD812D911963FAECE3E825F57C7EB5B6B5BFF343957BF6182B7FCFD8B67DE0D2BC8DE4D10B48D5C34CE8BB43C0D110E7F31B69DD161
Malicious:	false
Reputation:	low
Preview:	0......*.H...........0.......1.0...+......0......+.....7.......0....0...+.....7.....osx.E..I...`..5...150126065703Z0...+.....7.....0...}0....R0.3.0.1.6.0.5.9.3.E.6.9.1.A.9.F.E.7.2.6.9.3.D.B.A.8.6.9.6.0.E.5.A.D.E.6.4.8.5.C...1...00..+.....7...1"0 ...P.E.T.r.u.s.t.e.d........1...0<..+.....7...1.0,...F.i.l.e........a.t.i.m.p.c.6.4...d.l.l...0>..+.....7...100....O.S.A.t.t.r........2.:.6...1.,.2.:.6...3...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0.....+.....7...1...0...0..^..+.....7...0..N.......F...B.......$f.....`....,1..(0..$..+.....7...1.............$.'...6.8....d.......b....k....<.Q`........+..w'E.xO.5L.C....nY.$..'$^.!.U..F....v8(.{..4.."Q4..h.... ...;....@.D..g7pB.h.........S....T..N..t.B.UA.3"...d.`...d....H.....G.4.Vu{]..t..(v@.0.jE/@...#;.;.".......n...Y4....K..)Sb.7....z...f.@...q......P.?......+..ZE.2+.&...H.........m.j..D..#..8x-.t....Ab..}..i.B.`...n.!......,`b.KN.].z(.U.....W......1.......m.L=.A..I......

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\CU179650.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	50384
Entropy (8bit):	5.604670913079025
Encrypted:	false
SSDEEP:	768:AVMe+Q6+D6SuQXB7OunE5SgyRkR5e7AGp+t6J:0Me+Qfu4BiueSgyRkRo7Tp+t6J
MD5:	B58DF2F80F1B9475C69FA58A45212F03
SHA1:	6BD0E17C9B98DB1BE4AD55A29451A0F2A970012A
SHA-256:	8CAB915CD6D3794679AD300D2931F0A938C26C3A9CE21A48FCB641DEB6959027
SHA-512:	4180EFDB5D8C11B4E46532D02B211D23DCC804F108DDC5AE07419011653AA3367CF47EAF26F2D65DCFA9D91F605F7B8EC1019BE72C6794ED12197F354582A4B3
Malicious:	false
Reputation:	low
Preview:	;-----------------------------------------------..;----------1501231043-14.301.1010-141101a-179650C..; AMD display information file..;..; Installation INF for the AMD display driver...; Copyright(C) AMD 2007-2014..;-----------------------------------------------..; PX - PX Proxy mode..; PR - PX Proxy Ready....[Version]..Signature="$Windows NT$"..Provider=%ATI%..ClassGUID={4D36E968-E325-11CE-BFC1-08002BE10318}..Class=Display..DriverVer=11/01/2014, 14.301.1010.0000..;;LayoutFile=layout.inf..CatalogFile=CU179650.CAT....[SignatureAttributes]..atimpc32.dll=SignatureAttributes.PETrust..amdpcom32.dll=SignatureAttributes.PETrust..atimpc64.dll=SignatureAttributes.PETrust..amdpcom64.dll=SignatureAttributes.PETrust..atiumd64.dll=SignatureAttributes.PETrust..atiumd6a.dll=SignatureAttributes.PETrust..atiumdag.dll=SignatureAttributes.PETrust..atidxx32.dll=SignatureAttributes.PETrust..aticfx32.dll=SignatureAttributes.PETrust..atiu9pag.dll=SignatureAttributes.PETrust..atiuxpag.dll=SignatureAttributes.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\CU179650.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Code page: 1252, Last Printed: Tue Jan 24 19:54:29 2006, Create Time/Date: Tue Jan 24 19:54:29 2006, Name of Creating Application: Windows Installer, Title: Installation Database, Keywords: Install,MSI, Comments: This installer database contains the logic and data required to install <product name>., Template: ;0, Last Saved By: oirshad, Revision Number: {CD760339-CB7C-4BA9-BEA5-DD3F433ED05B}, Last Saved Time/Date: Sat Feb 4 00:27:09 2006, Number of Pages: 100, Number of Words: 0, Security: 0
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.849555247501633
Encrypted:	false
SSDEEP:	1536:YZcSOyULOtHV6A2kcGtSPcGhsWjcdOyK8Ulv:Y9rtHUkcySnO5K8Ux
MD5:	8281F3575911BAF4915D5C7102C43072
SHA1:	7805FEFAD3577F062E918DA37108BFC0E8EB51AC
SHA-256:	69F25C2263BDCA0F11EE698E096A0F5B4E184A04EB01016736F1ED2F1D3128B7
SHA-512:	266AF021EA483DEBC1611C945E79CF8DEA369DC33D72A6C098CCCCFC989E633432399010E30C28F3447F16BD2DBD11761411AACA04321F04F09F6813B27408B1
Malicious:	false
Reputation:	low
Preview:	......................>...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!............................................................................................................... ...".......#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\Display\WB6A_INF\c7179650.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	368598
Entropy (8bit):	7.55457283004504
Encrypted:	false
SSDEEP:	6144:9nWVqjA7+7Ndk2KejMxPVHd1fEX0wCyAZNKvo8HNhTTRf4gNd6A+l3FOGD/1tIHw:NDjASdkejMxPVHduE/b0o8thvRQod6AG
MD5:	8FD523C1705D90AEF00AB664DB8AC360
SHA1:	A96F6512FC1DD6CCEFB85C4EE1D231B63A7010C4
SHA-256:	2C6D6C9C05F54C3746F03879D06E9E188BC152C8BE2EA6B8CA72E44C61630A84
SHA-512:	ED4BE937A0B0CDEEBAB65DE79F02D91EED952CE8E131A1279CF87B2096FDB4484637E86445E16434410C828793C68206FEA31D8899586419CFF7FA18928A0DE1
Malicious:	false
Reputation:	low
Preview:	0......*.H...........0.......1.0...+......0......+.....7......~0...y0...+.....7.....$t.!..]F.`.z.`...150126065701Z0...+.....7.....0...X0....R0.3.0.1.6.0.5.9.3.E.6.9.1.A.9.F.E.7.2.6.9.3.D.B.A.8.6.9.6.0.E.5.A.D.E.6.4.8.5.C...1...00..+.....7...1"0 ...P.E.T.r.u.s.t.e.d........1...0<..+.....7...1.0,...F.i.l.e........a.t.i.m.p.c.6.4...d.l.l...0>..+.....7...100....O.S.A.t.t.r........2.:.6...1.,.2.:.6...3...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0.....+.....7...1...0...0..^..+.....7...0..N.......F...B.......$f.....`....,1..(0..$..+.....7...1.............$.'...6.8....d.......b....k....<.Q`........+..w'E.xO.5L.C....nY.$..'$^.!.U..F....v8(.{..4.."Q4..h.... ...;....@.D..g7pB.h.........S....T..N..t.B.UA.3"...d.`...d....H.....G.4.Vu{]..t..(v@.0.jE/@...#;.;.".......n...Y4....K..)Sb.7....z...f.@...q......P.?......+..ZE.2+.&...H.........m.j..D..#..8x-.t....Ab..}..i.B.`...n.!......,`b.KN.].z(.U.....W......1.......m.L=.A..I......

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\W764A\atihdw76.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	12470
Entropy (8bit):	6.926708453767215
Encrypted:	false
SSDEEP:	384:h4RssBNAJqWnco6lG9ZfC+3Ef5dpBjhvSUI:h45qt6lG9Jt3SzvSUI
MD5:	DF47424E3DCFD8FC9DF36D529B83482B
SHA1:	F2656EEEF111259053298672D081E380DC244825
SHA-256:	0867A29034DDF825547C2A00333A65632260DA40C408BBB832A778F7E7FDFD07
SHA-512:	6F2A565DF05C6339EC9892985E79945471ACE51CFCFD2F49B11DE012E019E7C8D26BFF0BC650FBDFD36753DB1770F1D81F346C328E4BE79FE430F4893DA57C57
Malicious:	false
Reputation:	low
Preview:	0.0...*.H........0.0.0....1.0...+......0..r..+.....7.....c0.._0...+.....7........u..WO.3..$.....140626193505Z0...+.....7.....0..G0..u.R8.4.A.A.E.3.4.6.7.B.D.C.F.1.D.0.F.A.3.B.C.A.2.1.8.F.C.2.A.2.0.F.0.4.B.C.F.7.9.D...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...1...0<..+.....7...1.0,...F.i.l.e........a.t.i.h.d.w.7.6...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........F{....;.!.......0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RA.7.B.0.9.9.5.3.A.9.A.0.E.7.5.8.5.F.D.8.A.D.B.5.D.D.C.8.B.A.0.6.3.B.A.2.2.7.2.A...1..902..+.....7...1$0"...O.S.A.t.t.r........2.:.6...1...04..+.....7...1&0$...D.R.M.L.e.v.e.l........1.3.0.0...0<..+.....7...1.0,...F.i.l.e........a.t.i.h.d.w.7.6...s.y.s...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0..)..+.....7...1...0...0.....+.....7...0.....................$f.....`.....1...0.....+.....7...1..............^.k...\"...~_.~....

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\W764A\atihdw76.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	51422
Entropy (8bit):	5.438223094901296
Encrypted:	false
SSDEEP:	1536:pt7R7VzBrhfVvBPtf1bpLqLRLG/507RvzxD9rlnJ7h7V7d/Jjhrd7t3BhvJDAnsS:pt7R7VzBrhfVvBPtf1bpLqLRLG/507R6
MD5:	70F95B3AA4E27BDB1231D88D6993C6F7
SHA1:	84AAE3467BDCF1D0FA3BCA218FC2A20F04BCF79D
SHA-256:	48E29CA1EE6B4BDD06EB79A50E19F0C4E21334D09000D7E4A19B35E81304A833
SHA-512:	B7C701C02D05D4C00DE95B11CABD8182C6DEC543D5350F2FBD88F1D7CFB4D00079644A7DF0C3BE3D3B6EE32992CED6E9FF037540727E3FBCCC1BC8A986A2D378
Malicious:	false
Reputation:	low
Preview:	;------------------------------------------------------------------------------..; AMD HD Audio Information file : AtihdW76.inf..;..; Copyright (c) 2011 Advanced Micro Devices, Inc. All rights reserved ..;------------------------------------------------------------------------------....[Version]..Signature="$Windows NT$"..Class=MEDIA..ClassGuid={4d36e96c-e325-11ce-bfc1-08002be10318}..Provider=%AMD%..CatalogFile=AtihdW76.cat..DriverVer=06/20/2014,7.12.0.7719....[DestinationDirs]..DefaultDestDir = 10..HDAudioInstall.CopyList = 10,system32\drivers..SfxFx.CopyList=11 ; %windir%\system32....[SourceDisksNames]..1 = %DiskId1%..222=%DiskDescription%,,,....[SourceDisksFiles]..DelayAPO.dll=222..AtihdW76.sys = 1....[Manufacturer]..%AMD%=AMD,NTamd64.6.1,NTamd64.6.0,NTamd64.6.2,NTamd64.6.3....[SignatureAttributes]..AtihdW76.sys=SignatureAttributes.DRM..DelayAPO.dll=SignatureAttributes.PETrust....[SignatureAttributes.DRM]..DRMLevel=1300....[SignatureAttributes.PETrust]..PETrust=true....[ControlF

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\W764A\atihdw76.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Code page: 1252, Last Printed: Sat Jan 28 00:37:43 2006, Create Time/Date: Sat Jan 28 00:37:43 2006, Name of Creating Application: Windows Installer, Title: Installation Database, Keywords: Install,MSI, Comments: This installer database contains the logic and data required to install <product name>., Template: ;0, Last Saved By: oirshad, Revision Number: {BB6CFE25-908F-4C4C-B70D-0CB045F4F3FD}, Last Saved Time/Date: Sat Feb 4 02:13:12 2006, Number of Pages: 100, Number of Words: 0, Security: 0
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	5.834680707684787
Encrypted:	false
SSDEEP:	1536:n5WSOyULOtHV6A2kcGtSPcGhsWjcdOyK8Ulvk:nDrtHUkcySnO5K8Ux
MD5:	19C32869FFC1B206E856BCDA22AF6F75
SHA1:	2F9FAA424864466A84E3F1917AEA14CEA881AA44
SHA-256:	299F47891B124AC3864A3C3BB39260B8532E06EEAEB433B72852C71569F222C4
SHA-512:	2996DC1AA5D15DAE3220945B2D1A41E310D1ECA4F8631490E799A3C4E995ADACA2E8E5B6F68AC2CB9BF1980DF43981730BDCF9987605687870EF289B9F169A40
Malicious:	false
Reputation:	low
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\W764A\atihdw76.sys

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	94720
Entropy (8bit):	6.047125243725864
Encrypted:	false
SSDEEP:	1536:R+copWIwPt9YlB3/tIMp0obe6y4gdnoUyCUZhObZhjeb/bHjJSEMA8fJsIr:R+5pWIwPt9S/tI+e6CnoHOdWxMA8fJsa
MD5:	33497249626E7787AA5CEA99B226CCA6
SHA1:	EB737CE79C7AC13BA2D6B3B6577BFDB5E6189767
SHA-256:	EF6213B79F83334CD95E4A58A4FE64190AA3FEFF590E41C4BF302FC4A8F6D6D6
SHA-512:	9550E9E9A9EAABA666FCFBE8547903FB9213EAF65B3BD1B2CCAF039AF4A975A2399F574FF30B3DDDFCDC7D16BFF1A143912F0764006712D196B1248624A13581
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............x...x...x......x...y...x......x......x......x......x......x......x.Rich..x.................PE..d....?.S.........."......0...>..............................................................................................................4...<...............P....................................................................................................text...f\.......^.................. ..hCODE.....)...p...*...b.............. ..h.rdata..............................@..H.data...h...........................@....pdata..P...........................@..HPAGE....>........................... ..`INIT.................b.............. ....rsrc................j..............@..B.reloc...............n..............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\W764A\delayapo.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	110080
Entropy (8bit):	5.836989429375318
Encrypted:	false
SSDEEP:	1536:U68vW43okSTg2E45ipUlCN8VonisHjF+kJpDJmKR:z9oZShXipGCUkisHjF+kDVD
MD5:	AF9E67E0477EA7AFE4113DBF1E3DF869
SHA1:	72D07909E0502594884EA441934A028D24472730
SHA-256:	02141EF63018A8963CC68A742464345F875F0FFE76036AD36B6C1D90C4C0A4E6
SHA-512:	7A2DE2FC8AF7AA549ACF1342CA80A3F80ED80F823CBC97C41378B4E62397260FE7881ADF3DE5FF5FB18D9C224EF7806AA195ADF24691FDC5B3BAAA1C3845DFA8
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L}Q.".Q.".Q.".X...S.".X...R.".X...^.".Q.#.+.".X...^.".X...Z.".X...P.".X...P.".X...P.".RichQ.".........................PE..d....?.S.........." .........................................................0............@.........................................`........u..........h3................... ......`................................................................................text............................... ..`RT_CODE.0........................... ..`RT_BSS...................................rdata...s.......t..................@..@.data................R..............@....pdata...............Z..............@..@RT_CONSTh............l..............@..@RT_DATA.X............p..............@....rsrc...h3.......4...v..............@..@.reloc....... ......................@..B........................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\WB64A\AtihdWB6.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	69766
Entropy (8bit):	5.435905602274475
Encrypted:	false
SSDEEP:	1536:7QGUakC4ekqYm4WciAO0i8yAOM6wnt7R7VzBrhfVvBPtf1bpLqLRLx/577RvzxDi:7QGUakC4ekqYm4WciAO0i8yAOM6wnt7D
MD5:	83F769D263FEF38BD5546C09D2BA01EC
SHA1:	B0269714390DB06AD11BCC01998B6DCFB82F10EF
SHA-256:	3C54C4A038374CC683804CFBEF746E81233011E8C97F3CCEDEF824A05B2EADD6
SHA-512:	A5127AFC74415190F4F699A751A860759C443983FF0946C2E6D4E14E33C4D5817D3DE036649FCA51BB40E9027BF84BFF6EEF282FCB7B001ECF8B14844E092906
Malicious:	false
Reputation:	low
Preview:	;------------------------------------------------------------------------------..; AMD HD Audio Information file : AtihdWB6.inf..;..; Copyright (c) 2011 Advanced Micro Devices, Inc. All rights reserved ..;------------------------------------------------------------------------------....[Version]..Signature="$Windows NT$"..Class=MEDIA..ClassGuid={4d36e96c-e325-11ce-bfc1-08002be10318}..Provider=%AMD%..CatalogFile=AtihdWB6.cat..DriverVer=02/21/2014,9.0.0.9905....[DestinationDirs]..DefaultDestDir = 10..HDAudioInstall.CopyList = 10,system32\drivers..SfxFx.CopyList=11 ; %windir%\system32....[SourceDisksNames]..1 = %DiskId1%..222=%DiskDescription%....[SourceDisksFiles]..DelayAPO.dll=222..AtihdWB6.sys = 1..amdacpksl.sys = 1....[Manufacturer]..%AMD%=AMD,NTamd64.6.3,NTamd64.6.0,NTamd64.6.1,NTamd64.6.2....[SignatureAttributes]..AtihdWB6.sys=SignatureAttributes.DRM..DelayAPO.dll=SignatureAttributes.PETrust....[SignatureAttributes.DRM]..DRMLevel=1300....[SignatureAttributes.PETrust]..PETrust=tr

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\WB64A\AtihdWB6.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Code page: 1252, Last Printed: Sat Jan 28 00:37:43 2006, Create Time/Date: Sat Jan 28 00:37:43 2006, Name of Creating Application: Windows Installer, Title: Installation Database, Keywords: Install,MSI, Comments: This installer database contains the logic and data required to install <product name>., Template: ;0, Last Saved By: oirshad, Revision Number: {BB6CFE25-908F-4C4C-B70D-0CB045F4F3FD}, Last Saved Time/Date: Sat Feb 4 02:13:12 2006, Number of Pages: 100, Number of Words: 0, Security: 0
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	5.825744351767597
Encrypted:	false
SSDEEP:	1536:O5WSOyULOtHV6A2kcGtSPcGhsWjcdOyK8Ulv6:ODrtHUkcySnO5K8Ux
MD5:	B225EFDEEFB9FDE3D8675D35831C192D
SHA1:	735ACD6DCCD4348CC66975DD3EA79ECC5D0353B8
SHA-256:	6F1B3D427F95CE3838D1C27B9BCED1496E441E6E61BADEAB7E7B85FA1138BB1C
SHA-512:	E6C9D33DFBC3A4DBF8438B254988EC9039A328E9AB1F4BFC8804546E0702EEDCC629BAFB2D653252B9762B4EBD92675B3D89A132388F372967A437D7275999C6
Malicious:	false
Reputation:	low
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\WB64A\amdacpksl.sys

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	142848
Entropy (8bit):	6.020502196395215
Encrypted:	false
SSDEEP:	3072:hSWFZQbVieVdB9G1Y89MDaPh0yMxJBFe71Jpw/kXw3jjjjjjjjwWleGy:hxFZQBlVdB9BZaqbFFAHHWl
MD5:	8E5AB0F06E24D2AC20558D1B53FCA471
SHA1:	23A316AA5498D4D0DE02C378A41009C8C6B94A65
SHA-256:	DCEFB6A8E7DC21BE75C06F092275209DD5F17D69789F633A277128EBE278106E
SHA-512:	ED3A45AC559926BD9571B16E65AA28C5E22D2FD47A2A2E8E0F8ABB5E576C1F6E064CBCD3FA054538A404AB8CB6A1C7B0339F2FB644BACF575ABE0F3E68A3FB87
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........)#A.GpA.GpA.Gp...pC.Gp...pD.GpA.Fpr.Gp...pC.Gpf_.pQ.Gpf_.p@.Gpf_.p@.Gpf_.p@.GpRichA.Gp........................PE..d....@.S.........."..........l......h@.........@.............................p............`.................................................4...<....P.......0..t............`..........8...........................0...p............................................text...V........................... ..`.rdata...L.......N..................@..@.data........ ......................@....pdata..t....0......................@..@INIT.........@....... .............. ..b.rsrc........P......."..............@..B.reloc.......`.......&..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\WB64A\atihdwb6.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	16747
Entropy (8bit):	7.098753530957191
Encrypted:	false
SSDEEP:	384:Ok+3CkLVkT5mDex3lfl52DrC9FRMzlRQams:ek0CxVfl0nC5MHQVs
MD5:	1EC6821AF7F1A8945C8E6BE594F4F4D7
SHA1:	83CD2DAB4BA4A6A0AB3D1AF018E92290B3B9C0F5
SHA-256:	9EF1D5BB1E5722A907AD47028A9131C5BBC829CADADA33A1E6798ADD47CF176D
SHA-512:	FB4906474A9E085AE2E0D4A6F50D5FB756922AAE54F5FEC3539DC7079D776BDE3FB810C62D1B6E23F44C02496B3D03FC672A02000424722C28BD5B9842EB8121
Malicious:	false
Reputation:	low
Preview:	0.Ag...H........AX0.AT...1.0...`.H.e......0.....+.....7......0...0...+.....7.....dH..:..F..........140717003508Z0...+.....7.....0..z0..e. ....4..0.m...p..eZ....}.G...1..?0...+.....7...1...00..+.....7...1"0 ...P.E.T.r.u.s.t.e.d........1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...3...0<..+.....7...1.0,...F.i.l.e........d.e.l.a.y.a.p.o...d.l.l...0.....+.....7...1..u0..q0..:..+.....7...0........."...........$f.....`.....1...0.....+.....7...1...........nr.`s...N8r6...F..=1.-.6 ..-........o.....Y.....a....x..N....E}.......vP..S..WY...!.hF?..}l..X.....$.. .I..&.J...Gy@(#......J^A.H..4...E....X$I,8L.o.&..y...$.?Y......D..!".R.....2J.....I....I..i!...[.T..O..$..B{.......b..>.......H.r...d..[......$<ajp..C8.)/..#..H..Q.<A.t....H..(.. ..T....[gM.....G./A.......V...p....nl....^`..W...-...~/F.....5M.n.<.G.....Z[Dn.*g..\|r...a.........d..../..G...D....L..8...........-..a."......M.%.BY...g3V.7...&....Q%m..G...25..2x.W.../...D.I {.:v......._!Y.T..q.4L.Cr....jDS.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\WB64A\atihdwb6.sys

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	223232
Entropy (8bit):	5.223588732297656
Encrypted:	false
SSDEEP:	3072:w69Sb+tueFL5z03OM0tAl6APHSY5Y6KF:VhtRFSyAP1d
MD5:	8523AA8BD207F937E8C047F8713D4788
SHA1:	241266F919183C1A0D20542B1012659FC7E40F6B
SHA-256:	EB131C38F51DEDCE2445648CAAE7B7F04F0009EB823A77D1D08B2E9CA8EC9B7D
SHA-512:	09E2A38B14319C522CF5D4800A83AC4CA5FB40F9DA721D09BF16E567A56CDA5CCB9DF887888192F360756250864F71BEDC3980465CD1236AA4AF5D87D5868BF2
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z...`.y.`.y.`.y9.my.`.y.ky.`.y.hy.`.y.wy.`.y.my.`.y.`.y(`.y9.iy.`.y9.oy.`.y9.jy.`.yRich.`.y................PE..d... @.S.........."......Z...........m.........@..........................................`.....................................................P...............\......................8............................................................................text....c.......d.................. ..hCODE....S.......,...h.............. ..h.rdata..l...........................@..H.data...............................@....pdata..\...........................@..HPAGE....N........................... ..`INIT.................T.............. ....rsrc................\..............@..B.reloc...............`..............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\WDM\HDMI\WB64A\delayapo.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	110080
Entropy (8bit):	5.837154716850523
Encrypted:	false
SSDEEP:	1536:t68vW43okSTg2E45ipUlCNUVonbsHjF1kJpDJmKR:U9oZShXipGCUkbsHjF1kDVD
MD5:	438D60AAD42ACEA7351A0FB74597D78D
SHA1:	2A86C9A9A23F073FBA80C6DB992260C3CBF644B3
SHA-256:	293223A9EF495992E256C8A99E0237565CBCC9671EF5B0473E09899DCE0FE327
SHA-512:	5AD82D351CAA8EF3307BA7D2F2A484FE3E3268BD2BEB862E3E141DFFB2F90266FBC79875CB539C99DE4BD6C3690F0D356D009D54E4546AF4597D61A92DFBE777
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L}Q.".Q.".Q.".X...S.".X...R.".X...^.".Q.#.+.".X...^.".X...Z.".X...P.".X...P.".X...P.".RichQ.".........................PE..d....?.S.........." .........................................................0............@.........................................`........u..........h3................... ......`................................................................................text............................... ..`RT_CODE.0........................... ..`RT_BSS...................................rdata...s.......t..................@..@.data................R..............@....pdata...............Z..............@..@RT_CONSTh............l..............@..@RT_DATA.X............p..............@....rsrc...h3.......4...v..............@..@.reloc....... ......................@..B........................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmafd\WB64A\amdkmafd.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	9999
Entropy (8bit):	7.193626115737803
Encrypted:	false
SSDEEP:	192:SIy8tZGsiyKsFWQFeeiqnajc6ddlP63fkY:SKt0UFRelYadVsZ
MD5:	95AE0F0FA2E55AA3F5952FD23A3A36BD
SHA1:	D7AB83B7BCE71058213DA2279C58F0176B1DBFE2
SHA-256:	984EC4A394FB6B3FAD58DA894A4B86D0FB705AE5D0BB52CDCD7C1525F8E4CBB6
SHA-512:	C0471A508CB66D8647130E0EA219C8B65224C04FE1E1408452BC4455CED7C2EF22010223D6AFA280649DE70EBB2A97C8DB75A7B7295E91F3E8C05B042082FB60
Malicious:	false
Reputation:	low
Preview:	0.'....H........&.0.&....1.0...`.H.e......0..<..+.....7.....-0..)0...+.....7......\|?.s.H...wk....130815202803Z0...+.....7.....0..P0.....r9O.'e.....48a..g..1..0...+.....7...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...3...0<..+.....7...1.0,...F.i.l.e........a.m.d.k.m.a.f.d...i.n.f...0.... ..CA....Qw.`<.H..."=}.I2.:?I2Yr.1..0...+.....7...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...3...0<..+.....7...1.0,...F.i.l.e........a.m.d.k.m.a.f.d...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..CA....Qw.`<.H..."=}.I2.:?I2Yr.0.... ..?..J...........^.E_E.....&.1..0...+.....7...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...3...0<..+.....7...1.0,...F.i.l.e........a.m.d.k.m.a.f.d...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..?..J...........^.E_E.*....&.0.....u.b).?.P.2...K....1..0...+.....7...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...3...0<..+.....7...1.0,...F.i.l.e........a.m.d.k.m.a.f.d...s.y.s.......0...0J..+.....7

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmafd\WB64A\amdkmafd.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	5.580993490925898
Encrypted:	false
SSDEEP:	48:QvuDDKwhDQWK/N3T8/9FKHABipgHwuMgHygHcyQ71n:QGDDKqDQ5N5IMNJn
MD5:	DED2DAEF5C2E2B58D67A968F9558FF7C
SHA1:	8C72394F18276592DC15F403343861E70C67ECD1
SHA-256:	9DF93FB1CE4AA205F602A48893E0DCEEC85EE48AAE455F45902A83EDCEF72684
SHA-512:	B6968A8AAA1038A9658792762DBAC8B58386036B7B56D26E9C3EC877A5072F6B23737A62E5E916C13256941CFFA7DC9BEE83A1A1FFFBA64CE84CBE1669E69DE6
Malicious:	false
Reputation:	low
Preview:	;..; Copyright (c) 2012 AMD..;....[Version]..Signature="$WINDOWS NT$"..Class=System..ClassGuid={4D36E97D-E325-11CE-BFC1-08002BE10318}..Provider=%AMD%....DriverVer=08/15/2013, 9.002.0.0000....CatalogFile=amdkmafd.cat....;[ClassInstall32]..;AddReg=system_class_addreg....;[system_class_addreg]..;HKR,,,,%SystemClassName%..;HKR,,Icon,,"-27"....[DestinationDirs]..Drivers_Dir = 12....[SourceDisksNames.x86]..1 = %DISK_NAME%,,,""....[SourceDisksNames.amd64]..1 = %DISK_NAME%,,,""......[SourceDisksFiles]..amdkmafd.sys = 1,,....[ControlFlags]..ExcludeFromSelect=*....[Manufacturer]..%AMD%=AMD_KMAFD,NTAMD64....[AMD_KMAFD.NTAMD64]..%PCI\AMDPCIE.DeviceDesc%=AMDKMAFD_Install, PCI\VEN_1002&CC_0403..%PCI\AMDPCIE.DeviceDesc%=AMDKMAFD_Install, PCI\VEN_1002&CC_040300....[AMDKMAFD_Install]..Include = hdaudbus.inf....; The function driver..Needs = HDAudio_Device.NT...; Install section for the function driver....CopyFiles=Drivers_Dir..;Reboot....[Drivers_Dir]..amdkmafd.sys,,,2....[AMDKMAFD_Install.HW]..AddRe

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmafd\WB64A\amdkmafd.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Tue Jan 24 19:54:29 2006, Create Time/Date: Tue Jan 24 19:54:29 2006, Name of Creating Application: Windows Installer, Title: Installation Database, Keywords: Install,MSI, Comments: This installer database contains the logic and data required to install <product name>., Template: ;0, Last Saved By: sgudimel, Revision Number: {CD760339-CB7C-4BA9-BEA5-DD3F433ED05B}, Last Saved Time/Date: Tue Sep 4 06:21:47 2012, Number of Pages: 100, Number of Words: 0, Security: 0
Category:	dropped
Size (bytes):	79872
Entropy (8bit):	5.790472899775124
Encrypted:	false
SSDEEP:	1536:O58SOyULOtHV6A2kcGt4PcGhsWjcdoywhVlv:O1rtHUkcy4nOzwhVx
MD5:	41991FC1336C1D42B873390FA9BDBE04
SHA1:	517F2222FF18B2E0629B0444636CBA71F838BF20
SHA-256:	C8978954FDCD0BE6BD63B3BE98EFB0D03DC892A63C6E5A47FBEEA836B89BC8FE
SHA-512:	153D6A116FBBBBB57F7360ED1DE2DC6F6413F10E513C66ABCA48936438112C98E6897AE23525CA248CCD01C5DC041F85AAE7C1FEBC0F62FEF7C9B2CFD51725F3
Malicious:	false
Reputation:	low
Preview:	......................>...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!............................................................................................................... ...".......#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmafd\WB64A\amdkmafd.sys

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21160
Entropy (8bit):	6.168261674022423
Encrypted:	false
SSDEEP:	384:c7J29i40rlYxzZ0uNS0Kh3mirILu1M6j0wzbCMdc:c89i4Gl00bIIILWMmtbCf
MD5:	F2FF8C1B41B3784EDBD5C6D5397F403C
SHA1:	97B966073D81BD5A116EFB02BF90B2E298359A97
SHA-256:	104873700D2BDF4812DC48200B4609F46A63E7A50594A0599100EF1438863708
SHA-512:	A098384FD7EB99B547D311592E0E64CC21A2616ADF33CFEDF76F0A451E28100856F1C5F21A42CB8D10E39C6D29AECFA223BB7B0E93E42A9745D77F4C14EFB64C
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........MU..,;.,;.,;.O[..,;.O[..,;..F.,;..V.,;..@.,;.,:.,;.O[..,;.O[..,;.O[..,;.Rich.,;.........................PE..d...*`^P.........."......"...........p..............................................k.......................................................Tq..<............P..<....8.............. 1...............................1..p............0...............................text............................... ..h.rdata.......0......................@..H.data........@......."..............@....pdata..<....P.......$..............@..HPAGE.........`.......(.............. ..`INIT.........p.......,.............. ....rsrc................2..............@..B.reloc..<............6..............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmpfd\W764A\amdkmpfd.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	8178
Entropy (8bit):	7.252138843972094
Encrypted:	false
SSDEEP:	192:kFoCa72suZeRTVcdh+3Ef5KYpBjSAcJCgUB3Vn:a5CuZOTC+3Ef5dpBjhcIg03Vn
MD5:	FBF8E6401AD6C13C870FCB5CC9E8F946
SHA1:	E47F3E6052E70604F9664916A4F8C46AB25EF344
SHA-256:	3E42AEFA14E80089F2219D710AD8BA9B4A54535371381F63836C14993CD3B995
SHA-512:	D1D6B758F18D31933A56792B955E794B35DFBDC02B426A24A7D8629A0938A982271135D34B7F600EDC8A60466FE095A49CACE9ECC62F253453F307333EA3BBB5
Malicious:	false
Reputation:	low
Preview:	0.....*.H..........0......1.0...+......0.....+.....7......0...0...+.....7.......G:y.~M..i.q....140106215809Z0...+.....7.....0...0..}.R6.9.7.1.A.1.5.7.0.8.4.C.6.C.A.3.0.E.E.D.F.E.A.C.A.9.7.E.6.5.B.6.B.6.1.9.3.2.B.6...1..%02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...1...0<..+.....7...1.0,...F.i.l.e........a.m.d.k.m.p.f.d...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+........iq.W.Ll......~e...2.0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0..u.RB.B.F.5.2.E.6.5.5.5.3.0.C.0.0.5.0.A.5.4.B.7.6.F.B.D.6.1.B.E.0.D.7.8.6.0.9.B.0.0...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...1...0<..+.....7...1.0,...F.i.l.e........a.m.d.k.m.p.f.d...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........eU0...T.o.a..x`..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......R0..N0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmpfd\W764A\amdkmpfd.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1981
Entropy (8bit):	5.590809318923794
Encrypted:	false
SSDEEP:	48:HpDKwhDQnj6OoVfuVXPgYVeDYgHwuMgHygH0Fj71n:HpDKqDQOOvIMN3n
MD5:	63932BE475368828CC66D6EDB329E9DE
SHA1:	BBF52E655530C0050A54B76FBD61BE0D78609B00
SHA-256:	8EDEED6E0C3EAFE5F0EF32AD755F3ABF0F8024E442D61B086D4BDDF65633895A
SHA-512:	B4B9FD39961254372D723DB022FAD0C6B2984F8FD54513B3AB9E5A22F05297BBFA138CF8B7B23D5C22D4D4A47E4E9379D11001C535DF318A0BE4682433E55AB8
Malicious:	false
Reputation:	low
Preview:	;..; Copyright (c) 2011 AMD..;....[Version]..Signature="$WINDOWS NT$"..Class=System..ClassGuid={4D36E97D-E325-11CE-BFC1-08002BE10318}..Provider=%AMD%....DriverVer=12/12/2013, 13.251.3.0000....CatalogFile=amdkmpfd.cat....;[ClassInstall32]..;AddReg=system_class_addreg....;[system_class_addreg]..;HKR,,,,%SystemClassName%..;HKR,,Icon,,"-27"....[DestinationDirs]..Drivers_Dir = 12....[SourceDisksNames.x86]..1 = %DISK_NAME%,,,""....[SourceDisksNames.amd64]..1 = %DISK_NAME%,,,""......[SourceDisksFiles]..amdkmpfd.sys = 1,,....[ControlFlags]..ExcludeFromSelect=....[Manufacturer]..%AMD%=AMD_KMPFD,NTAMD64....[AMD_KMPFD.NTAMD64]..%PCI\AMDPCIE.DeviceDesc%=AMDKMPFD_Install, pnp0a03..%PCI\AMDPCIE.DeviceDesc%=AMDKMPFD_Install, *pnp0a08....[AMDKMPFD_Install]..Include = machine.inf....; The function driver..Needs = PCI_DRV_ROOT...; Install section for the function driver....CopyFiles=Drivers_Dir..;Reboot....[Drivers_Dir]..amdkmpfd.sys,,,2....[AMDKMPFD_Install.HW]..AddReg = AMDKMPFD_Filter_Reg..Includ

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmpfd\W764A\amdkmpfd.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Code page: 1252, Last Printed: Tue Jan 24 19:54:29 2006, Create Time/Date: Tue Jan 24 19:54:29 2006, Name of Creating Application: Windows Installer, Title: Installation Database, Keywords: Install,MSI, Comments: This installer database contains the logic and data required to install <product name>., Template: ;0, Last Saved By: oirshad, Revision Number: {CD760339-CB7C-4BA9-BEA5-DD3F433ED05B}, Last Saved Time/Date: Sat Feb 4 00:27:09 2006, Number of Pages: 100, Number of Words: 0, Security: 0
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	5.783052960347987
Encrypted:	false
SSDEEP:	1536:ANZSOyULOtHV6A2kcGtcPcGhsWjcd0yFhVlvP:AcrtHUkcycnOXFhVx
MD5:	DF6DEF5D18F64CE84818438C28548852
SHA1:	6150E94DF8016FF044C24238BC2D807ED8CBEEB1
SHA-256:	D3DC7F3FE58A1FE1B7B53DC8A4ACBCCFE35BE48CBD6C173666DBD8B155846575
SHA-512:	B14DF888010D1F50F3B741A901245B41AC4C5F8B6C286CBB27152873CBCD9BD632632B72BBD07B3720E5FAD6423DF3831513CA2EA3DE9C1F99C786C148901F82
Malicious:	false
Reputation:	low
Preview:	......................>...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!............................................................................................................... ...".......#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmpfd\W764A\amdkmpfd.sys

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36608
Entropy (8bit):	6.157278373576717
Encrypted:	false
SSDEEP:	384:moJuYVrSjwAFNhgR/zrGsvLuOt2rzTwMakwMxuk3Xxf6KrHVO2E1z6xk0rooRuDp:mUVJR/fSOtlY3XxKgkGohDGM0numz+
MD5:	EF4680F07516F6D61F6E0BA1D34B3A3A
SHA1:	672DAB4730C9927AFFE9B68CA5D11D2655CFCD2D
SHA-256:	C367B323B26CF56AA6260E41129AE5F2DC97CFD0A9D984D9D5C051BE61ACD247
SHA-512:	8011893B7CDFDEA597DD236A9F9A0613E02B8027825C415505EA3DB0F61609F1FE27FAFE4F5148BE2A80C14FDFBC034ABEFEE1050672A844240D0DD3D8697FDA
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................U......C...........h......h......h.......R......B......G....Rich...........PE..d...@..R.........."......P... .......................................................*......................................................T...<....................r..........l...pa...............................................`..h............................text....B.......D.................. ..h.rdata.......`.......H..............@..H.data........p.......V..............@....pdata...............X..............@..HPAGE.................`.............. ..`INIT.................d.............. ....rsrc................l..............@..B.reloc...............p..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmpfd\WB64A\amdkmpfd.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	9946
Entropy (8bit):	7.207335203566895
Encrypted:	false
SSDEEP:	192:t1ys9yZGsiyKsFWQFa5qnajiApqfDx2HEoXj4S4Wv:X9y0UFRQleAp8x2HEoXjJ4e
MD5:	9E8ADF5708680386BA5209B1BFB26F6B
SHA1:	D1764053BD04D5EC4F2FDBC9A662FA587666D02E
SHA-256:	6066CF344C774437224CD910F23F668758767460F098EF92B4CE269EFA304F6F
SHA-512:	D863B33B21902C8EB96C782B0CC4D7A3CB4F2EC4883FD8B4FFB6982FEB7272AE78A26F3C76B81D8BC82BCF336907AD2C437299BB8E3402B83A058ED5DEB649CA
Malicious:	false
Reputation:	low
Preview:	0.&...*.H........&.0.&....1.0...`.H.e......0.....+.....7......0...0...+.....7......O.78..L._k.......140106215808Z0...+.....7.....0..P0...........\.k".s.......1..0...+.....7...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...3...0<..+.....7...1.0,...F.i.l.e........a.m.d.k.m.p.f.d...s.y.s...0.... .F.....F.I...%......W.H....%1..0...+.....7...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...3...0<..+.....7...1.0,...F.i.l.e........a.m.d.k.m.p.f.d...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .F.....F.I...%......W.H....%0.... ...n.>....2.u_:...$.B...mK..V3.Z1..0...+.....7...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...3...0<..+.....7...1.0,...F.i.l.e........a.m.d.k.m.p.f.d...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ...n.>....2.u_:...$.B...mK..V3.Z0.......eU0...T.o.a..x`..1..0...+.....7...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...3...0<..+.....7...1.0,...F.i.l.e........a.m.d.k.m.p.f.d...i.n.f......Z0..V0J..+.....7

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmpfd\WB64A\amdkmpfd.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1981
Entropy (8bit):	5.590809318923794
Encrypted:	false
SSDEEP:	48:HpDKwhDQnj6OoVfuVXPgYVeDYgHwuMgHygH0Fj71n:HpDKqDQOOvIMN3n
MD5:	63932BE475368828CC66D6EDB329E9DE
SHA1:	BBF52E655530C0050A54B76FBD61BE0D78609B00
SHA-256:	8EDEED6E0C3EAFE5F0EF32AD755F3ABF0F8024E442D61B086D4BDDF65633895A
SHA-512:	B4B9FD39961254372D723DB022FAD0C6B2984F8FD54513B3AB9E5A22F05297BBFA138CF8B7B23D5C22D4D4A47E4E9379D11001C535DF318A0BE4682433E55AB8
Malicious:	false
Reputation:	low
Preview:	;..; Copyright (c) 2011 AMD..;....[Version]..Signature="$WINDOWS NT$"..Class=System..ClassGuid={4D36E97D-E325-11CE-BFC1-08002BE10318}..Provider=%AMD%....DriverVer=12/12/2013, 13.251.3.0000....CatalogFile=amdkmpfd.cat....;[ClassInstall32]..;AddReg=system_class_addreg....;[system_class_addreg]..;HKR,,,,%SystemClassName%..;HKR,,Icon,,"-27"....[DestinationDirs]..Drivers_Dir = 12....[SourceDisksNames.x86]..1 = %DISK_NAME%,,,""....[SourceDisksNames.amd64]..1 = %DISK_NAME%,,,""......[SourceDisksFiles]..amdkmpfd.sys = 1,,....[ControlFlags]..ExcludeFromSelect=....[Manufacturer]..%AMD%=AMD_KMPFD,NTAMD64....[AMD_KMPFD.NTAMD64]..%PCI\AMDPCIE.DeviceDesc%=AMDKMPFD_Install, pnp0a03..%PCI\AMDPCIE.DeviceDesc%=AMDKMPFD_Install, *pnp0a08....[AMDKMPFD_Install]..Include = machine.inf....; The function driver..Needs = PCI_DRV_ROOT...; Install section for the function driver....CopyFiles=Drivers_Dir..;Reboot....[Drivers_Dir]..amdkmpfd.sys,,,2....[AMDKMPFD_Install.HW]..AddReg = AMDKMPFD_Filter_Reg..Includ

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmpfd\WB64A\amdkmpfd.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Code page: 1252, Last Printed: Tue Jan 24 19:54:29 2006, Create Time/Date: Tue Jan 24 19:54:29 2006, Name of Creating Application: Windows Installer, Title: Installation Database, Keywords: Install,MSI, Comments: This installer database contains the logic and data required to install <product name>., Template: ;0, Last Saved By: oirshad, Revision Number: {CD760339-CB7C-4BA9-BEA5-DD3F433ED05B}, Last Saved Time/Date: Sat Feb 4 00:27:09 2006, Number of Pages: 100, Number of Words: 0, Security: 0
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	5.782329678451123
Encrypted:	false
SSDEEP:	1536:z5MZSOyULOtHV6A2kcGtcPcGhsWjcd0yFhVlv:FNrtHUkcycnOXFhVx
MD5:	04867E76359B16A862A8963343EB9A4A
SHA1:	D383374360BF39BB8B15173B732FFA901DDC9108
SHA-256:	9A07C78004034A923C4938E57CDF738CDCDD357BE2D1903E19FA41D98AFAD1DB
SHA-512:	1716AAEF1D7FE76B79567FF321DA415846B84A15F1C5570BD6A13976EA91EBC87A60AC0591919EE501362A854770836F1888F491A76C9EEA022839EF10358751
Malicious:	false
Reputation:	low
Preview:	......................>...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!............................................................................................................... ...".......#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Packages\Drivers\amdkmpfd\WB64A\amdkmpfd.sys

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36608
Entropy (8bit):	6.207395542273645
Encrypted:	false
SSDEEP:	384:W7qQt4bcY+Yc1NFW6LqVT0reMXiiaMRXRO3L6K8l0D8mhRS9NnY4oOQQp99U/kn3:a5ObcBzeSaS9GYYUqSIiumN
MD5:	C04F35935BF6274F5593B78C7B295760
SHA1:	B101EDE947F29A5933C2F918285B7FBD0C810ECA
SHA-256:	29BC36696B3D5C75DEF9C9D96D3C06E5C6D964A00B4D5CD354CB08002E085191
SHA-512:	CFF20C972230E6CA426494900CA6B9BBDE037CB8553892573309BCF281273F94E716B9563BE3879BFAA407E172EFF61429F29105C0C7C68823E4851EFA6091E0
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._....}.V.}.V.}.V.}.V6}.V.FV.}.V.@V.}.V.CV.}.V<.BV.}.V<.DV.}.V<.AV.}.VRich.}.V........................PE..d......R.........."......P... ............................................................`.................................................\...<....................r..........l...pa..8...........................0d...............`..p............................text....C.......D.................. ..h.rdata.......`.......H..............@..H.data........p.......V..............@....pdata...............X..............@..HPAGE.................`.............. ..`INIT.................d.............. ....rsrc................l..............@..B.reloc..4............p..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Setup.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563912
Entropy (8bit):	5.672350366171563
Encrypted:	false
SSDEEP:	6144:mTlO7AnLt1Jwl9NjOGMPBQeTBOAyAdAyAOUyqDdWJBMGEYgGsr:mTlO7o3el9NjeqLy7JB5EYgGsr
MD5:	8BC54A57A35680B3254284207CC37AA0
SHA1:	5CC8CF05CE7675848F6EB36244D16EFFCE32E27C
SHA-256:	D9DE0C068C6F1373A3FA36429A753AD78DA691D851E73BDAC7065C99D179D56D
SHA-512:	12C8FA367BC2D5988AD846A9629C45C6A2AE52E913DE9D12E0D55793FF3C9F8E082493AA171F4BE6733CD62AEE4BC7110B7086F13B147E44382A9BE6CE5B2583
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........`..q3..q3..q3.'.3..q3AA.3..q3AA.3..q3AA.3..q3AA.3..q3..p3..q3s.,3..q3+l.3..q3+l.3..q3...3..q3+l.3..q3Rich..q3........PE..L.....UT..........................................@.......................................@.........................................................\|.......@...\......8............................N..@............................................text...0........................... ..`.rdata..............................@..@.data...$...........................@....rsrc................X..............@..@.reloc..d....@......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\mfc110u.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4456904
Entropy (8bit):	7.072163388390907
Encrypted:	false
SSDEEP:	98304:NqQm8jESwA4kU7Me7EJ+QCPzwqcu/lKFLOAkGkzdnEVomFHKnPjj:b0RIFLOyomFHKnPjj
MD5:	2D79817DD5AEA2A2A4449E72F20491E0
SHA1:	A303CBFD987E96A185C53ADFCF3269783BDD600C
SHA-256:	830A761CD04EF310DEFC1D08D58D37307F75291026879FFB9D91C8A6B8B1E89A
SHA-512:	0496402C0B10A046B17E7B2490C2024BD71ED35D5093FE67FF472E9B6D9023576ECCA2754A2214794ECB70A9B67FBB8678C810A33F00F22B40962BB9B1EC2EF1
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......uv..1...1...1....`t.0....`v.3....`w.9....`u.<.......3.......;.......<.......?...1........`p."..............0.......0.......0...Rich1...........PE..L...?..P.........."!......).........@.........)...............................D.....H.D...@................................X.+......P+...............C..=....@.<.....).8...............................@.............+.X...$.)......................text...E.).......)................. ..`.data................).............@....idata...O....+..P.................@....rsrc........P+......$+.............@..@.reloc..<.....@.......@.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\msvcp110.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	535008
Entropy (8bit):	6.072620448350034
Encrypted:	false
SSDEEP:	12288:FqULIc5nb9rywgfyhUgiW6QR7t5sA3Ooc8sHkC2eRxUH:PLHnhryLfBA3Ooc8sHkC2eRxUH
MD5:	3E29914113EC4B968BA5EB1F6D194A0A
SHA1:	557B67E372E85EB39989CB53CFFD3EF1ADABB9FE
SHA-256:	C8D5572CA8D7624871188F0ACABC3AE60D4C5A4F6782D952B9038DE3BC28B39A
SHA-512:	75078C9EAA5A7AE39408E5DB1CE7DBCE5A3180D1C644BCB5E481B0810B07CB7D001D68D1B4F462CD5355E98951716F041EF570FCC866D289A68EA19B3F500C43
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................7.>...........:.L....:.J....:.H.....:.I.....:.T....:.M....:.N....:.K....Rich...........PE..L......P.........."!.........................0...............................P......[.....@.........................`N..$.......<........................=.......D...................................K..@...............D............................text............................... ..`.data....`...0...2..................@....idata...............N..............@..@.rsrc................j..............@..@.reloc...}.......~...n..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\msvcr110.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	875472
Entropy (8bit):	6.9224404430053434
Encrypted:	false
SSDEEP:	12288:TmCyHcMpK7QdgD+9Tr8r3FmJciMgLFWkA8qTWu+FVlofpJCjNdr12iqwZeq:TmCyHNIQdTryVmCipIkqTWu+Fr
MD5:	4BA25D2CBE1587A841DCFB8C8C4A6EA6
SHA1:	52693D4B5E0B55A929099B680348C3932F2C3C62
SHA-256:	B30160E759115E24425B9BCDF606EF6EBCE4657487525EDE7F1AC40B90FF7E49
SHA-512:	82E86EC67A5C6CDDF2230872F66560F4B0C3E4C1BB672507BBB8446A8D6F62512CBD0475FE23B619DB3A67BB870F4F742761CF1F87D50DB7F14076F54006F6C6
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x._'<.1t<.1t<.1t<.0t..1t...t?.1t.+.t..1t.+.t].1t.+.t..1t.+.t..1t.+.t=.1t.+.t=.1t.+.t=.1tRich<.1t................PE..L......P.........."!.....`..........<........@...............................`......l9....@.........................`...........(........................=.......S..0n..8...........................0...@............................................text....^.......`.................. ..`.data....\...p...N...d..............@....idata..............................@....rsrc...............................@..@.reloc...S.......T..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleBluetoothInstaller64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2376783
Entropy (8bit):	7.987865632015454
Encrypted:	false
SSDEEP:	49152:bkerAC9xDP5x66cC18UgBHNXHo7wLyXpDEHIO0HwuEv:b66NBgBtXoUWGHIO/v
MD5:	7D5B8CE65FDC478E2FB7C3A21CC32044
SHA1:	04929420F14718FE4627DB79A7CDFAEFE5A444D9
SHA-256:	2C2F705252F605F30470E018B2723E36A84FC4F0F6A63B19CFDB99C55DAF8204
SHA-512:	86971EC1A284D9A9031FC8979F5F96BFF97307B3B5DF975EAA823DF1FD2331728997F2DF13B9159752BAD136951B37271FC96428F119894107A653E38C645284
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L...\|.rE.................0...p...............@....@.............................................. .......................................<...........................................................................................................text....0.......................... ..`.data....p...@.......4..............@....idata...............>..............@..@.rsrc....@.......<...N..............@..@................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleCamera64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	1203151
Entropy (8bit):	7.962200732768774
Encrypted:	false
SSDEEP:	24576:KzYXUe0SACdaKLzgNugbbTOnMbra01yVZRsiR0icwRVp:bkerACY6ubynYa7VtFcE
MD5:	3C984EBBA9FCBC639E51C2873F441357
SHA1:	26BEA69CE43A1357E4BB0A40F524F17B0EA74F05
SHA-256:	DCFB6205C54D66BF8A5AD32F5A6B461B3D537C6BEB50A4A3D5F8F2E65C9B0E49
SHA-512:	BA132CB50C7B028F8B1C23E9329FA473D31E0756D4F9B7977ADA643D4FAF2B91864E22CC2965E3F45253191BEF045C53532C3A0FBEE984443C5A18D07AF6A49E
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L...\|.rE.................0...p...............@....@.............................................. .......................................<...........................................................................................................text....0.......................... ..`.data....p...@.......4..............@....idata...............>..............@..@.rsrc....@.......<...N..............@..@................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleDisplayInstaller64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2377599
Entropy (8bit):	7.9878778529218835
Encrypted:	false
SSDEEP:	49152:bkerACOm3e5x66cC18UgBHNXHo7wLyXpDEHIO0HwuEW:zC66NBgBtXoUWGHIO/W
MD5:	6122838B6FDA847B5BA2FA2A141A4805
SHA1:	0C336B2FE2745039AA72BCA4710923B3FDE5C4B2
SHA-256:	E8636D4D505622D9CC3EB3FFDCD3E1CE47D57DF1CC70D72EFEEF9E764F48613B
SHA-512:	D6ACB5E963A235508DF72EBF2723A8468F6737D69E4383F187EB9313936C06ABDCC900D3D4D4E799DDBBD7EA80DF6D6CE89441419B31947D077B39A627F0D7DE
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L...\|.rE.................0...p...............@....@.............................................. .......................................<...........................................................................................................text....0.......................... ..`.data....p...@.......4..............@....idata...............>..............@..@.rsrc....@.......<...N..............@..@................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleKeyboardInstaller64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2381153
Entropy (8bit):	7.98798571761215
Encrypted:	false
SSDEEP:	49152:bkerACbtzOF0OpccC41J1g1o0KIVndyyv5NPnhqg9g:bEF0OqNE1g1PhAILPng
MD5:	2D34AAF81DE41FCFE58C9D00AE9AE38A
SHA1:	76A95080BC23AE0BC1FEA4EF0551D2FC10FC1BFD
SHA-256:	2F9117ED2AE549F21530CECE1717505748B024543411B3DC0B3536326EA56BEC
SHA-512:	7D29CDD49E660778209D6B8FA3D058D8806B55F34F8BFBD52543B7E7B239D758B52D1E20DA85F9557DAA97DFAEC73C72B0AAAE81913F8664E83D2AD480CE86BD
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L...\|.rE.................0...p...............@....@.............................................. .......................................<...........................................................................................................text....0.......................... ..`.data....p...@.......4..............@....idata...............>..............@..@.rsrc....@.......<...N..............@..@................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleMultiTouchTrackPadInstaller64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2388994
Entropy (8bit):	7.988039593180284
Encrypted:	false
SSDEEP:	49152:bkerACbtzOF9OpccC41J1g1o0KIVndyyv5NPnhqg9x:bEF9OqNE1g1PhAILPnx
MD5:	8C87584F38C9FEFE38898388E74F1B80
SHA1:	FF1D301880CD5AA998EE1CA18730B1D10090C735
SHA-256:	FAE8BD3CB1039A2139809C10A9B3994A89228C8C90BA742EAEA147344A54922C
SHA-512:	4A07E9590F096F9BB7DC51023CAD3CA3B1DCEDE6AE63E883CC3AE3AE8F3D30F024FEACB7B20A5EF1610CDF11F2A929EDE0D7C654F902DF233B5D7F17EEA1988C
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L...\|.rE.................0...p...............@....@.............................................. .......................................<...........................................................................................................text....0.......................... ..`.data....p...@.......4..............@....idata...............>..............@..@.rsrc....@.......<...N..............@..@................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleNullDriver64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	495293
Entropy (8bit):	7.846267461786062
Encrypted:	false
SSDEEP:	12288:KtlYXUvyyaT1yZIB6vsbW/vDac6Zc1F+oEC1X2JA+:KzYXUvyvy76uDac6Zlon+
MD5:	D749875862E73CD4E812156698A11ED8
SHA1:	B5009BC4D09BDDD6B5119033015D10751755E6E7
SHA-256:	E5C425C8AADCFFB7E39CFA50CC0423DBB2A38A92616FFD12488CC2ECFAFAA9AD
SHA-512:	9DDE074B95B3227703DD6FB35606544954D40190EFAEACCC4CDB77B5C6BCEB1AF5D08C847BDCCDFEB53EAF835BDD0DED638371317A0A91E29CDFD636EAEBD6A9
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L...\|.rE.................0...p...............@....@.............................................. .......................................<...........................................................................................................text....0.......................... ..`.data....p...@.......4..............@....idata...............>..............@..@.rsrc....@.......<...N..............@..@................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleODDInstaller64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2377024
Entropy (8bit):	7.98786923163073
Encrypted:	false
SSDEEP:	49152:bkerACr9J3RH5DTicCnGUgdH6YIAupby0XcFtz93npXAF1:T3WNpgdavAqm7tz9KF1
MD5:	07F6C1A1A1A88A29F66BF616D61267CB
SHA1:	627C110D6BE7FC11229D305495A288FB34EE37B8
SHA-256:	574903001F28439A7E3A141B8928E584DC7446521EE7487CAD41DFB2434C5BAF
SHA-512:	5E619F9E539194AC40CD191EC61EE94A64467C74E33DB005C526D273D96DDE6E5930A2DABA672EB940B000E1FB509ED860F9021BB65C37165602C995609CCDF3
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L...\|.rE.................0...p...............@....@.............................................. .......................................<...........................................................................................................text....0.......................... ..`.data....p...@.......4..............@....idata...............>..............@..@.rsrc....@.......<...N..............@..@................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleRemoteInstaller64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2382333
Entropy (8bit):	7.987947477906743
Encrypted:	false
SSDEEP:	49152:bkerAChOJ5x66cC18UgBHNXHo7wLyXpDEHIO0HwuE45:hI66NBgBtXoUWGHIO/45
MD5:	4366FFA571FAB8C7B55A544BB6ADC3DB
SHA1:	90BB33D2B930782C3A79DAD80BE851ED6262B5A2
SHA-256:	A4F9726635154823F18FFEA400CDAFB47E002C11107883F17FA28B07EEB680B3
SHA-512:	577BE95627BD26BEE3426D36608C2380B3955597E54DA392EBBAB5E055BC834A674E3091C469588309CD66370711B11912F88AE7CADCBB6263BB28BDEE789952
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L...\|.rE.................0...p...............@....@.............................................. .......................................<...........................................................................................................text....0.......................... ..`.data....p...@.......4..............@....idata...............>..............@..@.rsrc....@.......<...N..............@..@................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleSDCardReader64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2378856
Entropy (8bit):	7.987927567734985
Encrypted:	false
SSDEEP:	49152:bkerACLT3T5DTicCnGUgdH6YIAupby0XcFtz93npXAFF:nNWNpgdavAqm7tz9KFF
MD5:	811E2F32EFEA6ED74496D4F3AB1C9BE2
SHA1:	653DA55BB21D0AD3845D0B7A7C2DEC93AB1204EF
SHA-256:	B6C1A29DA8AF600E734D3294F33E3BC7E995392087E29ADD60671226A372D64A
SHA-512:	60C82D373F8B65C7585B5A96B9052B67236961F96B2A7AC01ED2A3E23A1EBF937A40309E80F90FB73611EF6A30DA621D6E3E64FB51F2BD813E3FB79502BE3B03
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L...\|.rE.................0...p...............@....@.............................................. .......................................<...........................................................................................................text....0.......................... ..`.data....p...@.......4..............@....idata...............>..............@..@.rsrc....@.......<...N..............@..@................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleSoftwareUpdate.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Instalador da Actualizao de Software Apple, Author: Apple Inc., Keywords: Installer,MSI,Database, Comments: Apple Software Update 2.1.3.127, Create Time/Date: Tue Jun 21 23:23:46 2011, Name of Creating Application: Windows Installer XML (3.5.2519.0), Security: 4, Template: Intel;1033,1036,1031,1041,1043,1040,1028,2052,1034,1030,1035,1042,1044,1045,2070,1046,1049,1053, Last Saved By: Intel;1033,1036,1031,1041,1043,1040,1028,2052,1034,1030,1035,1042,1044,1045,2070,1046,1049,1053, Revision Number: {789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}2.1.3.127;{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}2.1.3.127;{58E373E7-C6D5-4691-885F-721D3B317918}, Number of Pages: 200, Number of Characters: 131135
Category:	dropped
Size (bytes):	2321408
Entropy (8bit):	6.538030466322482
Encrypted:	false
SSDEEP:	49152:A+zrHUiMXNd5mll9BxjSsxEH2LUy9jacluLjtNHXplphgukm9Z60hHRBNmL:A+kiKUl1w
MD5:	1B5B97B3F70B8041D106FA29E8CC238B
SHA1:	BCA78827F3152BF46DA055761D00C0BCDB7C9DA0
SHA-256:	7FC8A7936E49C8126925A1F527AFA9F9B3B42746AA59786F3331B13A893325E1
SHA-512:	732B85FC2E59ACA8A69FF528BF6C631FADE26C4327CED2EB0E83D8C67DFDE3F41120913A63939351ADA0F06E3FB170667A605FA9BFC2F34643D0A2999EC0726D
Malicious:	false
Reputation:	low
Preview:	......................>...................$...................................................................................................................................y.......N.......................w.......I...........................................................................................................................................................................................................................................................................................................9....................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleWirelessMouse64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2399345
Entropy (8bit):	7.988088303192142
Encrypted:	false
SSDEEP:	49152:bkerACgSUoO5DTicCnGUgdH6YIAupby0XcFtz93npXAR:gA8WNpgdavAqm7tz9KR
MD5:	7187047C7C59FA10080114AD70F73B90
SHA1:	C11B0ED243B2A28F80ECB6C0C3E148713239C93B
SHA-256:	DFB4980F1ECBBD1AC9C90DB435572480F040D185A84D7E96CB116B03E7F0C584
SHA-512:	B91559A2F6054C0B03310272CB62AF35BACA85B0B783367C9E2B67C1A17AB4FD5D0F7A53497C2DDDEDAE282F349C366A3D7AE22F4619BC2973A3995CD98C37F4
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L...\|.rE.................0...p...............@....@.............................................. .......................................<...........................................................................................................text....0.......................... ..`.data....p...@.......4..............@....idata...............>..............@..@.rsrc....@.......<...N..............@..@................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\AppleWirelessTrackpad64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2400686
Entropy (8bit):	7.9880589119269025
Encrypted:	false
SSDEEP:	49152:bkerAC3dSUyL85DTicCnGUgdH6YIAupby0XcFtz93npXADk:tK2WNpgdavAqm7tz9Ko
MD5:	525E28BB2B6B3E923EF92D2B3A3ECE44
SHA1:	7735583C12ABAD163096FB0136E60C470BB9B9DC
SHA-256:	312F4650A30D3AEAE49098F835923C816BC56F854A6BB1D5A2F6CF8615A6FFDA
SHA-512:	E3FB2548430ACBA182DCDEBD8E63307360F16495A5ADA5E465D1CC3F35229D28D40D3EB05566091D98C2CB85F4E92B488BE337CF508B05B94F8308D33CE5608A
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L...\|.rE.................0...p...............@....@.............................................. .......................................<...........................................................................................................text....0.......................... ..`.data....p...@.......4..............@....idata...............>..............@..@.rsrc....@.......<...N..............@..@................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Apple\BootCamp.msi

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1254, Title: Installation Database, Subject: Boot Camp, Author: Apple Inc., Keywords: Installer,MSI,Database, Comments: Boot Camp 5.1.5769, Create Time/Date: Fri Feb 27 02:57:16 2015, Name of Creating Application: Windows Installer XML (3.0.5419.0), Security: 2, Template: x64;1033,1036,1031,1041,1043,1040,1028,2052,1034,1030,1035,1042,1044,1045,2070,1046,1049,1053,1025,1029,1055,1038, Last Saved By: x64;1033,1036,1031,1041,1043,1040,1028,2052,1034,1030,1035,1042,1044,1045,2070,1046,1049,1053,1025,1029,1055,1038, Revision Number: {FA2B2C2A-EA41-495A-9308-60726125D562}5.1.5769;{FA2B2C2A-EA41-495A-9308-60726125D562}5.1.5769;{50004752-C132-4066-949E-C4E262B489FB}, Number of Pages: 300, Number of Characters: 0
Category:	dropped
Size (bytes):	3915776
Entropy (8bit):	7.189080669222887
Encrypted:	false
SSDEEP:	98304:nY297AZnBBfCqcAJ0w0VObyou0ieN6cxq:YuITfC1JVObS
MD5:	D688BA77828E1163721C17A83A66FEA8
SHA1:	910B9623E58998CCB4B86B181A50B927C090B0A0
SHA-256:	64CAD68C9CCD5DFFE65D25D30F67E96A96EE15ED77754AAAA619794D0E2D283C
SHA-512:	AC4A89BB7C6573B9FB1AF50BC4E3BC6A13411853C5A2560C71B00DA87EDB2DD9F280F048B8FA46E62030A2EC5F58F1779B43860A416CAB7507E8E5056C4BDE1C
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Asix\AsixSetup64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	515168
Entropy (8bit):	7.855044380880122
Encrypted:	false
SSDEEP:	12288:KtlYXUvyyaT1yZI56InThVMIJVBzi7yuIGorQoex9F:KzYXUvyvyo6IT0KVBO7bOc
MD5:	BF613DC8CC38468E817C4A8554C075DD
SHA1:	0CC11683FE1616ACB49BBBB2D5193122F078885B
SHA-256:	32BB81BFF980B48205976E176BC814B58D333E50FDCB127C377E5F298A555D64
SHA-512:	5C8C015F4DE5798CC15BBD799DE48C5FF0B93A2A01FD695A3956EE48FC115DC830FA07063A483AA44215D0DBA80840FBBE484FCCC2438D9807A805814C54EB3A
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L...\|.rE.................0...p...............@....@.............................................. .......................................<...........................................................................................................text....0.......................... ..`.data....p...@.......4..............@....idata...............>..............@..@.rsrc....@.......<...N..............@..@................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Broadcom\BroadcomCardReader64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	540354
Entropy (8bit):	7.865327766114796
Encrypted:	false
SSDEEP:	12288:KtlYXUvyyaT1gTd2j4BzrQF7El3yCE7GCDZLAU:KzYXUvyvadlBglEixn
MD5:	B1ED65AB647D5BB72D647F4D18DB7EEB
SHA1:	37B9A41E9E4F8AFEE192B68FC148FE93EB5F0D6A
SHA-256:	F3BBB0E61C0EA8118ADCF8B2498860CA6F5D3C6D8308A01C60211A1D1040435A
SHA-512:	B8C8E3707B661049B017B0A2F6400533311E7DF807F50C1AF6811AE216C7D6EFB53D33EA3B73CBCB0DC77349B15281E75228B87EEACE0E810BAF98E2F04FD007
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L...\|.rE.................0...p...............@....@.............................................. .......................................<...........................................................................................................text....0.......................... ..`.data....p...@.......4..............@....idata...............>..............@..@.rsrc....@.......<...N..............@..@................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Broadcom\BroadcomComController64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	516048
Entropy (8bit):	7.85539971563582
Encrypted:	false
SSDEEP:	12288:KtlYXUvyyaT1yZINP6W5UBfRH3dzQRnJouLkNA9:KzYXUvyvyU65JpWRnJlLkNA9
MD5:	235238A7240DEF9694119827B4AD3A04
SHA1:	A1C544BF7384022F877EC0A72703FAEAF640207C
SHA-256:	43FB244FE6AAD546A174A26E07E939283F0EC26226330C69BA3410ED14C44F40
SHA-512:	C31FEA8801F326439DF868E576119A3DD1D48F884B3DADDD4E4E9338E1B821D2D035B9D81F1EB6A008F8BE58891161A4B7821A03C4F52F6104CA47196FD37495
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L...\|.rE.................0...p...............@....@.............................................. .......................................<...........................................................................................................text....0.......................... ..`.data....p...@.......4..............@....idata...............>..............@..@.rsrc....@.......<...N..............@..@................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Broadcom\BroadcomEthernet64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	762776
Entropy (8bit):	7.921497922023668
Encrypted:	false
SSDEEP:	12288:KtlYXUe0SqXMNJgCCvMjKFTT0dbWDUFYy4TLzX4QNWnhuQtPce0iUKqJp0ClegLs:KzYXUe0SAClCvMoTTKTYy4TLzfUhumUo
MD5:	C0842C9EB7B0F2CB39DB492D59934DD6
SHA1:	29BFBF22E0CA7CBA38D15BFE080B0EC5C82E11D0
SHA-256:	D7A0BBD8EBAC348CF5B8091566A29DFF33096AAA3C85AEE0188EC3738CAD1F18
SHA-512:	200587D955BA952442F20996559E46E9B8F8747437A5EB920F22E398526765C3AD3C1D0C4B08D34959383AF979F46FEFF8F0439918133090A6EA34A6737ADE03
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L...\|.rE.................0...p...............@....@.............................................. .......................................<...........................................................................................................text....0.......................... ..`.data....p...@.......4..............@....idata...............>..............@..@.rsrc....@.......<...N..............@..@................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Broadcom\BroadcomWirelessWin7x64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	9085736
Entropy (8bit):	7.998638349318578
Encrypted:	true
SSDEEP:	196608:trC/tvroeKdk4Uu+YSm53RIEIeM9ocT9FkSqJkODg8iggnZVzsVTnv2:FClTKJ3FIEIeM9ocLOkOXibZVgVS
MD5:	AB800A6B4C64A0C415B7C3A30CD10EA2
SHA1:	B6FE43BC9FF95EED7D62C9EDBA9F1B74F0C46385
SHA-256:	70F9420D7B91CED77856BBEF617844E4DBF6756B88CD96D93E6CCA3A79C28DE0
SHA-512:	15DDEDE21EFE4B76302AFC88CB40E47DAC498D9C46006AF1CB134CC93CEA78A02D631D5B50A4697F2A7BCE2FAC3B83F42306A3EC0DA109864BF0E9B10AC0E543
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L...\|.rE.................0...p...............@....@.............................................. .......................................<...........................................................................................................text....0.......................... ..`.data....p...@.......4..............@....idata...............>..............@..@.rsrc....@.......<...N..............@..@................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Broadcom\BroadcomWirelessWin8x64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	6669309
Entropy (8bit):	7.997963770823503
Encrypted:	true
SSDEEP:	98304:lr5H2VEp8U5Qm48nZgRPBOa8CNUd3Q1Q5PpjJSboSLZFL8E3UG4p6f1pgmkMDOcm:lr5H2+lQmsRpSCNUdPpjwzNdBN1p3I
MD5:	AB895B020218C45F2E98472F78AD6707
SHA1:	22BC8A6EEC886AC9E610C113CA0EFCFDD7992EC3
SHA-256:	F1FBBE73B3F9483D96DD328B4E742A5ABDE09DB513EBC4995F89D3D928A8CF39
SHA-512:	3AC6745F8CF330F51866CF2AD00154FFEF06E7668E550AFA04AE7173F7A813F27FBEB7CD030FEDCEECFA51D5355CA5A362635EE14453943C1FB8A7732ACD9A7F
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L...\|.rE.................0...p...............@....@.............................................. .......................................<...........................................................................................................text....0.......................... ..`.data....p...@.......4..............@....idata...............>..............@..@.rsrc....@.......<...N..............@..@................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Cirrus\CirrusAudioCS4206x64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	543367
Entropy (8bit):	7.866738178212303
Encrypted:	false
SSDEEP:	12288:KtlYXUvyyaT1yZIoTrTPdzBkJB3GE0FUTSkAxrW6:KzYXUvyvy1PLd1JtaArW6
MD5:	95DDABD33ACF476EF7392334C2BE61FB
SHA1:	8C9E302B07D89E14E91030F253919D8181D70634
SHA-256:	001D12017F50768F45B68EF73B7C945E38F9447F712E952847BF5DD3CD7F766F
SHA-512:	F3F5D01C0EC6288D8ADB85F93A857D140468F11CC4CA694DD35B77B932AEAD626A5586E44D3C2B0413B3F4B3E52F63D77CAF63004564D0F3DBC73AF3F087C500
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L...\|.rE.................0...p...............@....@.............................................. .......................................<...........................................................................................................text....0.......................... ..`.data....p...@.......4..............@....idata...............>..............@..@.rsrc....@.......<...N..............@..@................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Cirrus\CirrusAudioCS4208x64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2128808
Entropy (8bit):	7.985481743889469
Encrypted:	false
SSDEEP:	49152:bkerAC5J39GW/YGyim3kYBvh3UkSqQs8vJN9p1:b9GvGBEpkVqQ9vJNF
MD5:	E63AB94F50174CA2B756DCB89A5B1A2A
SHA1:	C574F827202CC27551B4E7638A58C1417A9E878A
SHA-256:	D1417D4439EE45CB3027DC0210C1229FF95C1BB1478379AAB5C90D58F34FE26F
SHA-512:	ECF47D42899810E6654E5F526B794EF71D1EDB536A1609ABF7E0BDE2BCF3D216CF6384795B768468695F0B5E55CAE56963DDA2317E2951B11085B3DA000E316C
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L...\|.rE.................0...p...............@....@.............................................. .......................................<...........................................................................................................text....0.......................... ..`.data....p...@.......4..............@....idata...............>..............@..@.rsrc....@.......<...N..............@..@................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\2008s4el.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.5140722297867555
Encrypted:	false
SSDEEP:	1536:RIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9a:tL
MD5:	366E6AF60721D868CA6D6A65233847E6
SHA1:	FDB0DDA28D1B27C91C437249C5AC556619153FFF
SHA-256:	3A997E463B1515DB9FA84A82BC524E02E83F334B2172C78D025867BB10F9C6E8
SHA-512:	642BD0B5E392344693ADB62CD3ED3E821B9FC56C41D582082583554762BB6CEF6E5E5F3A2EA694192E1657268BFADC81F889CB5A20D3F63867B157FC3345E653
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.......A]...G._"[!{....130801022911Z0...+.....7.....0...0....R1.6.8.A.5.1.9.C.3.E.7.7.2.1.E.D.8.C.B.1.1.C.2.3.8.2.6.D.1.F.5.6.8.6.6.5.3.7.3.3...1..g0<..+.....7...1.0,...F.i.l.e........2.0.0.8.s.4.e.l...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........Q.>w!..#.m.V.e730b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\2008s4el.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	13344
Entropy (8bit):	3.6521124885605105
Encrypted:	false
SSDEEP:	96:R0w0ZVM/1z+VwB5W8R9aFKS9asma/aV9aFKS9a189aFm9alNalPJCFVWPOHSdaQF:t46tgE3k2kXN5TlaQ2y
MD5:	003C29AF525F1BE1816E92F5E2132AE0
SHA1:	168A519C3E7721ED8CB11C23826D1F5686653733
SHA-256:	FEC58FF9E2883B2688537551AE9C75E1C91FD2E510EFE45EAD71F90A72E04300
SHA-512:	A5E14F7117BA9CE06312E5D59F51A4AED444085EF3E4EFBDED850F9F4F8B10408E13E19DE14851D0CE2E63448EF0093A85A29344C4E35F5BEB363568D2716B25
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .2.0.0.8.s.4.e.l...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3.,. .V.i.s.t.a.,. .2.0.0.8. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .8.2.X.X.X. .M.e.m.o.r.y. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\5000XZVP.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	30228
Entropy (8bit):	3.709737851603046
Encrypted:	false
SSDEEP:	192:WA6tgElKBhKtDKttyCA2rYuAfQfQjbKAuTlaQ2y:5ugENORaQF
MD5:	F594205EAA48374730D217FF55B9B32E
SHA1:	A397B14C91B5C05C9CD099A3A2FD96F8CF9FFBB1
SHA-256:	449E899FDAF74936EA0F14A78915EF71FD10B59F6A3DFF5992952F4640412FE5
SHA-512:	C2FC68DC142C0AF02D035E811EA857217608E83032DA2658304372ACCC4453DE58BED40A687B12C543B7508D24FA6A983F8721AF7F9F5C4DD108DF805DEC5A2A
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .5.0.0.0.X.Z.V.P...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3.,. .2.0.0.8.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .M.e.m.o.r.y. .I./.O. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\5000xzvp.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.514105796217727
Encrypted:	false
SSDEEP:	1536:vIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9i:bT
MD5:	61DEADF6CD5CCE77414F62A8196F3D7C
SHA1:	E46AA1D35F2C6442373F20DC031D9A3090F7F6A2
SHA-256:	5A459F85E89EAD11EECF7B9DA074A872722A3DB7335DEB74F4E64C75806D6443
SHA-512:	F4D15891868497EE93B269CDC2E903442C994761EF0E73A9D2CAA5FBA0C0AF26E525E98A4B65959DA14FBE054ED6149F43810BCFAEE02BD3AFB326F112B720D4
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....}...lON......W...130801022911Z0...+.....7.....0...0....RA.3.9.7.B.1.4.C.9.1.B.5.C.0.5.C.9.C.D.0.9.9.A.3.A.2.F.D.9.6.F.8.C.F.9.F.F.B.B.1...1..g0<..+.....7...1.0,...F.i.l.e........5.0.0.0.x.z.v.p...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........L...\..........0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\5400.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148359
Entropy (8bit):	4.513304123615214
Encrypted:	false
SSDEEP:	1536:6IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9z:42
MD5:	A63FDED6F3287360E7D18B33A309F865
SHA1:	1396F54538E01D7B1512799C5DBC8C03AAA80B69
SHA-256:	85A2219CB766024CA9DBBB7D7F3867327F05AA425D4CB61FB8CA238EE89374D8
SHA-512:	081DAB237ABA9EB32C14D3D0D64459138D3BD989C1BB6BCE72F355298386798FF9B342C2A20B9E8E438C86F8FDDDFED2B5D36A2A59B58CE8D22F7692F02384FA
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........Cr0..Cm...1.0...+......0..(7..+.....7.....('0..("0...+.....7.....UV6...yL..U...$...130801022911Z0...+.....7.....0...0....RC.B.7.1.4.C.E.B.8.2.3.A.3.E.A.4.F.3.0.5.5.A.8.B.2.1.1.F.6.B.F.0.5.5.2.2.B.0.4.3...1.._04..+.....7...1&0$...F.i.l.e........5.4.0.0...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........qL.:>...Z.!.k.U".C0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.0.1.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\5400.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	14814
Entropy (8bit):	3.6764513874510976
Encrypted:	false
SSDEEP:	96:RxWzMVM/1z+VwB5BAv8ULsLPL9AJk9/kt6Tm1IXc3JSmalPJCFVWPOHSdaQ+wMy:2w6tgEP/TlaQ2y
MD5:	54FAFDD58D2209EAEF95DB3B0D0411C2
SHA1:	CB714CEB823A3EA4F3055A8B211F6BF05522B043
SHA-256:	4923D57814E1552EBF56801D53BBBB61D9E65657671E98E979AC7317A9248301
SHA-512:	5418BDB7B4E6592AFBF46E735100E4E26013FF8F1C959A24BA0E39097370D0CE496141444D61FE513556B76D33B5993DDCF4C19C3A21B5EB5A309BC9EFC110DA
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .5.4.0.0...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3.,. .2.0.0.8.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .M.e.m.o.r.y. .I./.O. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\852.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148357
Entropy (8bit):	4.513618857480873
Encrypted:	false
SSDEEP:	1536:oIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/92:Oj
MD5:	85A9D54F2F89439BE6244DE1E2520B6B
SHA1:	A3917340DDF029438D10179582AD49CC438697ED
SHA-256:	C5451E787B300A56BF3E2ADA08C2098AA3A36331B90B16AF7B641E3F4EC414C6
SHA-512:	E65CFD74DEDE260630E9E3FC4E8BC44B5EE92194A86B040DC9543016B26487F8E6B523E6263DB2DB8345226807349148473A31DA8FD3C7D39ECE79C097E3C410
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........Cp0..Ck...1.0...+......0..(5..+.....7.....(%0..( 0...+.....7.....e...%.M..u..$...130801022912Z0...+.....7.....0...0....RC.C.1.D.1.5.0.5.0.A.7.7.B.9.6.4.E.8.C.6.5.F.8.0.5.B.9.5.F.E.F.2.2.2.6.E.A.9.F.2...1..]02..+.....7...1$0"...F.i.l.e........8.5.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.............w.d.._.[..."n..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.0.1.2.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\852.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8336
Entropy (8bit):	3.5686656835273975
Encrypted:	false
SSDEEP:	96:RP7aVM/1z+VwB5TyRmX9XYXzCL7alPJCFVWPOHSdaQ+wMy:g6tgE5No+yTlaQ2y
MD5:	1F30255936AD11839429F852ED490A64
SHA1:	CC1D15050A77B964E8C65F805B95FEF2226EA9F2
SHA-256:	B5ED3E5181C6C9C8D8543D5AE494DD8BF7E5B927FF7E56085948EA7E28874F1C
SHA-512:	A3DBCB4BEF24743AC4D2BA249DC86CC1BABA7E7A72EA808FD94944C63CC266A33776BE316A91AD4441B9668EFA3C3CC77069609F9EEA787BACABE8D4E28752DF
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .8.5.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .X.P. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .8.2.8.5.2./.8.2.8.5.5. .G.M./.G.M.E./.P.M./.G.M.V. .M.e.m.o.r.y. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\855.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148357
Entropy (8bit):	4.513214493747557
Encrypted:	false
SSDEEP:	1536:SIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/93:Ai
MD5:	C7BBF2F50DA66ABC5F0482739384FFC1
SHA1:	322F478CA121684F267F09B81EB2E488F83DB4E4
SHA-256:	A351771712B82866F037654D20E9BA71B6376888B83785A5A3830F01CB39A835
SHA-512:	1926601F6FCC11BE67323140F8BAB865814CE5A8109F75F8022EFDE879BAF367F1E6494B90506A093E0F2F4C0EABDB992AE14132E32E5C0DD3BEEAC88F62E082
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........Cp0..Ck...1.0...+......0..(5..+.....7.....(%0..( 0...+.....7......o".9.M...y..e...130801022912Z0...+.....7.....0...0....R3.3.E.4.C.1.6.5.A.1.7.B.0.7.7.1.8.2.B.A.0.9.C.C.9.8.2.E.F.D.8.3.9.7.2.1.C.B.A.6...1..]02..+.....7...1$0"...F.i.l.e........8.5.5...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........3..e.{.q........!.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.0.1.2.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\855.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7104
Entropy (8bit):	3.484574927811586
Encrypted:	false
SSDEEP:	96:RISSlVM/1z+VwB5ODa3LBalPJCFVWPOHSdaQ+wMy:FW6tgE00YTlaQ2y
MD5:	9F9A4BA648B84C70C8EE55CEBC9FBB98
SHA1:	33E4C165A17B077182BA09CC982EFD839721CBA6
SHA-256:	5B937DD0BF816DD640A11C81CE93275D49F6118C20B68E9E81D0F244BDF7A695
SHA-512:	2D7252E56DEA93463382A1DB33795671477DEDC4FC495BFBCDCBF2DABAFE8478B36FE19E3042E7A0FE14D7A1D836CC57F0195CAC6F91A1F5DC5DEEC391DAEC97
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .8.5.5...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .X.P. .I.N.F. .F.i.l.e. .f.o.r. .O.d.e.m. .M.e.m.o.r.y. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\865.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148357
Entropy (8bit):	4.513581667120178
Encrypted:	false
SSDEEP:	1536:7IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9r:H+
MD5:	77EAB48924367BA439F32249892A6811
SHA1:	C40AB6DCAC0D031024FE110C5A059F39CC04063B
SHA-256:	FE0B176FEDEC43686BE9341C5824DFD4E8BF6EF44ED8DEF01CAB82B517662806
SHA-512:	CBAF42C603DBB78FF1B9EF5B53B124E4581184AA819CA765219121DB8EFD88497BE5936BE3ACBE4A1C88465E8758BFEC2A5EFEA20E333343E47ECB9D050D1FA5
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cp0..Ck...1.0...+......0..(5..+.....7.....(%0..( 0...+.....7........Ic.F..x......130801022912Z0...+.....7.....0...0....R5.3.6.3.C.B.6.4.E.5.D.E.A.B.0.E.E.7.2.6.A.4.8.A.6.C.9.1.9.2.3.9.F.7.F.2.2.A.2.2...1..]02..+.....7...1$0"...F.i.l.e........8.6.5...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........Sc.d....&..l..9.."0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.0.1.2.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\865.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	10614
Entropy (8bit):	3.662493838538038
Encrypted:	false
SSDEEP:	96:RjOGVM/1z+VwB5K4QYXa0L/x6xPLMp63alPJCFVWPOHSdaQ+wMy:L6tgEPXrx04pXTlaQ2y
MD5:	D30CD9AC9AFB716F0D0BF40E3BBCA20E
SHA1:	5363CB64E5DEAB0EE726A48A6C919239F7F22A22
SHA-256:	0FCBD4041E20843E9E163F764533CA170B313656027460692079A2314A55D1F1
SHA-512:	379A1DADFEE2BD66D47DCB5C68B8B81FCC99881B5910F6A07B34CFC0F79D94CBF5F878738C2395309D2D632936990F9A2681ED14BFCB13AC9745B59FC1D65B6B
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .8.6.5...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .I.N.F. .U.p.d.a.t.e. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .8.2.8.6.5. .&. .8.2.8.7.5./.E.7.2.1.0. .&. .8.2.8.4.8. .M.e.m.o.r.y. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\915.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148357
Entropy (8bit):	4.5137646889366785
Encrypted:	false
SSDEEP:	1536:lIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9E:R4V+
MD5:	7CA84847DF62E5EF8C8029D7D85E224A
SHA1:	33EE41154D2A6AE1BE274426B2D96E16F6827C40
SHA-256:	30947493D2D86A867DF5F82E0E5B69BAB7280EB80307DE2F42F37E12C755B661
SHA-512:	030A8D9F2B159F5C1300DB04FA1B83E4D24370F5B96594AF30439C8320295078131A1A6F2006505D1739BD4E5B47DD885F5050C8C57DB4D08F857F6512483EF6
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........Cp0..Ck...1.0...+......0..(5..+.....7.....(%0..( 0...+.....7........V...O...XsZ$'..130801022912Z0...+.....7.....0...0....R7.4.A.B.8.2.A.8.F.B.7.A.5.E.D.E.A.4.2.D.3.4.D.7.A.1.D.F.F.B.A.B.3.9.A.3.2.2.3.8...1..]02..+.....7...1$0"...F.i.l.e........9.1.5...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........t....z^.-4....9."80b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.0.1.2.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\915.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8116
Entropy (8bit):	3.5548819886577627
Encrypted:	false
SSDEEP:	96:RtAIVM/1z+VwB5gYu8BaURALalPJCFVWPOHSdaQ+wMy:h6tgE1fTlaQ2y
MD5:	3671422D8F87A3E66CEECEBA3B069572
SHA1:	74AB82A8FB7A5EDEA42D34D7A1DFFBAB39A32238
SHA-256:	1E7BBEC8E35E3F2644AE11DEEC01BA498A0880BFE8DBB0F8BE63F307FA3B52C0
SHA-512:	021385A8C0FB2F1FFE1AD7ECEB9F0655A44D7A660BC7CE902823132B6FFDA0DF60027E4EC51F00F8C59797DF44532B085DA57A98C2F5A264078E73034320287F
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .9.1.5...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .8.2.X.X.X. .M.e.m.o.r.y. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\915M.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148359
Entropy (8bit):	4.512940040584376
Encrypted:	false
SSDEEP:	1536:QIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9m:G7b
MD5:	D8BE79B8423BF60F64FCEC737DFED232
SHA1:	BEF74E31BC04B7B1F65FBA288FE147709BD64020
SHA-256:	177DE1C6E2727891D021845FDE612896AF49BAA4957118C4549B84BDF91E2B5B
SHA-512:	DFF585604AECA6F829E6362649875CAA0213080DA8010DF05CBCE7E5AABC44912EA118E4AA945771AB5F119CA1FD80EDB29FCBE1EB6FDFBC50C6678AC707A12E
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........Cr0..Cm...1.0...+......0..(7..+.....7.....('0..("0...+.....7.....N&...OSH..!.k.vr..130801022912Z0...+.....7.....0...0....R3.1.7.1.6.C.A.C.8.0.F.C.F.C.9.8.A.8.B.8.9.8.0.7.E.6.E.8.5.3.C.1.F.6.D.C.2.3.E.4...1.._04..+.....7...1&0$...F.i.l.e........9.1.5.m...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........1ql...........S...#.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.0.1.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\915M.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7238
Entropy (8bit):	3.4781590002882985
Encrypted:	false
SSDEEP:	96:RAAdVM/1z+VwB5m8tXvalPJCFVWPOHSdaQ+wMy:h6tgERCTlaQ2y
MD5:	577BC8DF93F38E9F5B4A2DB2763E58C5
SHA1:	31716CAC80FCFC98A8B89807E6E853C1F6DC23E4
SHA-256:	7E69406AB406C7083BC079F0BE46F1110A821A804116FC3AAC98F0664A4677FB
SHA-512:	2B9CA39FDA4B2160CC2238E303CD48AF6A1D2BEBA31A2BD2D390E8117AC357B3379E4E3865CC3BE46EE361C03ACD2A70F431D657391BC89D760CDCB41EE40BC0
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .9.1.5.M...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .8.2.X.X.X. .M.e.m.o.r.y. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\945.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148357
Entropy (8bit):	4.5135564483717605
Encrypted:	false
SSDEEP:	1536:qIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9i:or
MD5:	2E6B3EE0FEECAC4E48745E7BB4094960
SHA1:	98B38784B8C4373499CEBAA03F3F05B6EBE49A7C
SHA-256:	F9AD7C12DEFADD6369E9ED34410D539E3C4DD2606B32EE2F2B9D4B44E344CD3F
SHA-512:	B7EE019EEA15D7912A391EE418DA28F60CD4FFAD85355A7664A9A61B3EC9AE8E329CB923E38368CA9B0B7B7611780C72CB3E225A939B7098BB3F0C67B726AED7
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........Cp0..Ck...1.0...+......0..(5..+.....7.....(%0..( 0...+.....7........{...F.l..o.)U..130801022912Z0...+.....7.....0...0....R6.2.0.7.E.E.B.3.E.D.1.C.7.C.3.B.8.7.0.9.4.8.0.F.9.F.B.5.7.3.C.8.A.D.E.4.F.D.6.8...1..]02..+.....7...1$0"...F.i.l.e........9.4.5...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........b....\|;..H...s...h0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.0.1.2.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\945.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9412
Entropy (8bit):	3.6190395982420553
Encrypted:	false
SSDEEP:	96:RgAtVM/1z+VwB5Fgz8dXhaEX5c63alPJCFVWPOHSdaQ+wMy:h6tgE7gCx/ihTlaQ2y
MD5:	8B44C31ABB003C578AB42D9386568D55
SHA1:	6207EEB3ED1C7C3B8709480F9FB573C8ADE4FD68
SHA-256:	8405E666F4C60686DF2E9342A20E0324BE509AA5337C79931CE4561D5996CE2D
SHA-512:	F360EB60AE2F9F49AAD836B82504D20DF52966C8095EA81B74432EB1557438AADDFC92E5572A54E0BF9523D2F7EF8788603083BE9E21C9F6A7E24719235FF6E8
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .9.4.5...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .8.2.X.X.X. .M.e.m.o.r.y. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\945GM.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8348
Entropy (8bit):	3.577955275674229
Encrypted:	false
SSDEEP:	96:RxEAckVM/1z+VwB5BK18rta5X8taFmX6xalPJCFVWPOHSdaQ+wMy:XCk6tgEPK6tKMtGmKcTlaQ2y
MD5:	86A8DFE65DE146FBC4354CE89C0730D5
SHA1:	FFD5BD6AF8B693FED8D50E12A23F30056D22A864
SHA-256:	FB6709D32198804E7BD8A874A0BDEC196BF73719EFCEE577A89C86BBE309B0C5
SHA-512:	DA0DE5571B94DDDFEC3AB1CF6E52E347B1EB579F4D43D546950ABC03D2D664AE8BAF46B3BFB4AD2973ACFFBBF1EF39AF773D7AD3382979B02DAB300C7156E7CE
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .9.4.5.G.M...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .8.2.X.X.X. .M.e.m.o.r.y. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\945gm.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148361
Entropy (8bit):	4.513716248744963
Encrypted:	false
SSDEEP:	1536:qIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/90:ox
MD5:	B51AF0E68812DD51363A6B9CF5F48708
SHA1:	A96C1C04ECDC51CC40B969013DE5E759EF346EA0
SHA-256:	601081F281BD13CA71D5B953C28FD5FA9C53A832F45167C278DEFD31F85AC587
SHA-512:	2CCBBB61E144ED6706F559125645F19ECDA20064EF1771A217F98AEB54466F9ECD6A8C83ED34BC55DED438B6E8EB7486627D5F0A433B33C0996FC6C45D4E62AC
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........Ct0..Co...1.0...+......0..(9..+.....7.....()0..($0...+.....7...........K..5..}){..130801022912Z0...+.....7.....0...0....RF.F.D.5.B.D.6.A.F.8.B.6.9.3.F.E.D.8.D.5.0.E.1.2.A.2.3.F.3.0.0.5.6.D.2.2.A.8.6.4...1..a06..+.....7...1(0&...F.i.l.e........9.4.5.g.m...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........j.........?0.m".d0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.0.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\965g.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148359
Entropy (8bit):	4.513442850763544
Encrypted:	false
SSDEEP:	1536:NIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/95:ps
MD5:	9C8EE04962ACB22F0820680029A74D43
SHA1:	3B46390C7DD676891DE236797278572DBF6B6AFD
SHA-256:	E90C956770D5047339881775973B2FAC8C1CB267240E154202178A7E1F2E5110
SHA-512:	98ECA12DFDB0A488405D33E9421EF3D9541B726A8FDC6D7E6F49506EE5CC1E71FE417F92E0050E41D1E1B1790DFEC030BC7B822E96C6F2536ECF54CED4687542
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........Cr0..Cm...1.0...+......0..(7..+.....7.....('0..("0...+.....7.....SbT..F.L..%.,.^..130801022912Z0...+.....7.....0...0....R4.7.E.F.9.F.1.5.F.F.E.2.1.3.9.5.0.0.1.7.F.1.4.C.9.1.3.E.E.0.6.2.9.D.B.7.4.C.2.9...1.._04..+.....7...1&0$...F.i.l.e........9.6.5.g...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........G.........L.>.b..L)0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.0.1.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\965g.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9966
Entropy (8bit):	3.6343609127140826
Encrypted:	false
SSDEEP:	96:R1AYVM/1z+VwB5tYJ8GaE9aEImaot3aMalPJCFVWPOHSdaQ+wMy:h6tgESNbh6TlaQ2y
MD5:	8BEB8FE485805561F1477A4924D50A5D
SHA1:	47EF9F15FFE213950017F14C913EE0629DB74C29
SHA-256:	FF651606D5902278CC6D017F7A117E1BDE974378C7E77B49C44872DBE3E35BC6
SHA-512:	3943DFFC21DDAB75EDF4A1A61E5E18DADEF7F3BE3BA0AF57193757508C450C2AE0EBCF1AABB0B22AC8BA66709948296E3CFB78219FA05C168B9FC1428510C34D
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .9.6.5.g...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .8.2.X.X.X. .M.e.m.o.r.y. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\965m.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148359
Entropy (8bit):	4.513181321243695
Encrypted:	false
SSDEEP:	1536:VIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9K:BH
MD5:	D2AFFD45C06F792F1E82AFE79D6C8BF1
SHA1:	86F7F6FFEF22DEE00C7F4A16DC3911C015EBEC2A
SHA-256:	ED754514E8856F107E86B6EDF21479B44A27DA053F5B11AA77DED217269A6CF6
SHA-512:	2FC65904E782A276AD0BCF6DB6D29CEFB3AF67DEBD58BF26186C48CEB71D7E26C4EE56D79833CAAB68AA8F94ED4078DBE3BE22B87E866AFBA8DE6AB3DE6389EE
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........Cr0..Cm...1.0...+......0..(7..+.....7.....('0..("0...+.....7......7}.y.[G.`c....J..130801022913Z0...+.....7.....0...0....R4.9.5.8.4.B.D.D.E.C.A.C.3.6.C.5.6.5.3.5.D.6.8.4.C.B.2.E.1.D.D.9.7.7.9.B.7.E.5.A...1.._04..+.....7...1&0$...F.i.l.e........9.6.5.m...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........IXK..6.e5.....w.~Z0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.0.1.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\965m.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8274
Entropy (8bit):	3.565397861161557
Encrypted:	false
SSDEEP:	96:R/w+yVM/1z+VwB5O8EIUX0IHXFalPJCFVWPOHSdaQ+wMy:ul6tgEsb4TlaQ2y
MD5:	7A283C2D2690A39D59B41B72808B8244
SHA1:	49584BDDECAC36C56535D684CB2E1DD9779B7E5A
SHA-256:	B2427F4E2C71E48EE8D0A9B731C3D1D92DE3CA8B8D59341AE43B0D37FF695F78
SHA-512:	987C9DA4E5507BCC5E8E0ADFB7D2D0E812B6A8F119FA17C24C0C62F484A35260144BD5C0A03F145422485726DF5F2BE47DA33B842C8C72A775FA67F0BB961BA3
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .9.6.5.m...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .8.2.X.X.X. .M.e.m.o.r.y. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\CentCore.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	18308
Entropy (8bit):	3.687220514652435
Encrypted:	false
SSDEEP:	384:VAgECXNGEV/E2TpCgRbASPVeM20Fv0mDZyQBYXNGEV/E2TpCgRbASPVeM20Fv0mf:VHTXNGEV/E2TpCgRbASPVeM20Fv0mDZc
MD5:	CF5B32AA40F90B0BB2CF3F95575A92D3
SHA1:	A94F495DA72764858CBABC3456308EA582055448
SHA-256:	718F1F629FE089AFAC226F67B3EEC02D98F78E9A8325C0A481CB7F589A041078
SHA-512:	54347BF7C1CB98423C6EA0D2D5803FA0B41DC1ACF9F695CABC32999118669EBB6D79C7C016E03C9250B58C40268BD977864EF39A43C07A695A360B5BF5D259D0
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .C.e.n.t.C.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .C.o.r.e. .I.N.F. .f.o.r. .I.n.t.e.l.(.R.). .C.e.n.t.e.r.o.n. . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.5.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\CentSMB.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8606
Entropy (8bit):	3.57473038348051
Encrypted:	false
SSDEEP:	96:R4rbM/1z+VwB5OC6kr2rkfNfyfbf6alPJCFVWPOHSdaQ+wMy:6gtgEACpCQ16DXTlaQ2y
MD5:	0AFC236315CB1B853C285CBFDA9998F8
SHA1:	3EDEED98B3F38BF81D5EE99734D5623EEF0A7194
SHA-256:	2F61CC180AB6D95F2B098F1F89C23D205B9A7D2AD7BD1080E3D952D4802D5FCE
SHA-512:	2178656F1F66D248318EC73E6883F91B47969138A40C1C89ADEB502E2C8950A2E3D3CED82F300D4535B82000E081571BD471D841435E97B5EAED29A6E3932CDD
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .C.e.n.t.S.M.B...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .S.M.B. .I.N.F. .f.o.r. .I.n.t.e.l.(.R.). .C.e.n.t.e.r.o.n. . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.5.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\CentURT.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6606
Entropy (8bit):	3.4287940273454205
Encrypted:	false
SSDEEP:	96:RsjWdM/1z+VwB5KZQgZ8y4U/7mAalPJCFVWPOHSdaQ+wMy:KKytgEQKgfmlTlaQ2y
MD5:	B9981ADA678684D73E68DF4FC3881D9A
SHA1:	8F9DE76BDDDC50E3B8EAE7B5CBAC7C1708D9B9B9
SHA-256:	D92B00EF8EDE9CF743FAB44C1892DE6DE14C89046C6C550FE1053BA45442E1C7
SHA-512:	D51B5ABF5D499BE00EE86FAAB111E1D9F5C08EFCF145EC212927B773DB582711C6EB94D0C01E8F72F885A4373CB70C23885FB83A5882A9881CECAABD68EDED94
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .C.e.n.t.U.R.T...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .A.t.o.m. .P.r.o.c.e.s.s.o.r. .S.1.2.0.0. .S.e.r.i.e.s. .U.A.R.T. . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\CrysWell.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8016
Entropy (8bit):	3.5262691336022645
Encrypted:	false
SSDEEP:	96:Rk0udM/1z+VwB5G8ACHJvyJuaJShalPJCFVWPOHSdaQ+wMy:DuytgE8kUL5TlaQ2y
MD5:	C3842D201E1E2321756874E8DDD9BFA8
SHA1:	59F5DD1307441997220274705415798156F76F81
SHA-256:	4C80270A9F3DF24BF1D00CB77947BF878E7EF7F808F743003480F7310EFC65A9
SHA-512:	0358ECBAB7D6F0FE8DC0555366511071AD2AAF0F6D4DE159204B7AC455CBFF3231BA54CDA25C83FDA784516F75C5E8793364DB50CF54E32783107607A0DBCDA9
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .C.r.y.s.W.e.l.l...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .C.r.y.s.t.a.l. .W.e.l.l. .P.r.o.c.e.s.s.o.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\DH89xxCC-ME.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6600
Entropy (8bit):	3.4457384747644024
Encrypted:	false
SSDEEP:	96:Rppw/mwM/1z+VwB5OQF2CFxalPJCFVWPOHSdaQ+wMy:/ztgEATlaQ2y
MD5:	8EC0386C5C19948E8BC54CE6BE45C775
SHA1:	3A4EF9C74D8322063E10728A0ABA52F6F11BFEE6
SHA-256:	6DCE942AFBC3E57B33E709BA46B0B138DC75993B2B50875C452F10C1FEB9ABF1
SHA-512:	3E111ECDEBA24512427526B6CE50760B6B2842A99AB56E15D659E12855578437D218CCFE535ACE1E5DFA1920A4BDE3F92FF3ED3B07969B70FD8204D045079D7F
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .D.H.8.9.x.x.C.C.-.M.E...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l. .I.D.E. .D.r.i.v.e.r. .f.o.r. .D.H.8.9.x.x.C.C. . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\DH89xxCC-ahci.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6410
Entropy (8bit):	3.396802344365448
Encrypted:	false
SSDEEP:	96:RpFEY/NwM/1z+VwB5SbFCqAhalPJCFVWPOHSdaQ+wMy:pztgEITlaQ2y
MD5:	9B425D66D041A3AB13D5C4426F3A2EA2
SHA1:	EDB454C201DE2049D6E81172EF2CEE4058A910C2
SHA-256:	C687D1545AF743BC9098F1318AFE37D6E1637EE4F20AECEE3F595079A40AD881
SHA-512:	A93282CB7AA575E53ED932BF2B6DA3569B8C7AA06CDD4BFA92E7D4DE75414EE4F2056E451163B42FC56A505FA5189C4803B54924EE44DB62EAA65AB23BF0B4A5
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .D.H.8.9.x.x.C.C.-.a.h.c.i...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .F.i.l.e. .f.o.r. .D.H.8.9.x.x.C.C. .A.H.C.I. .D.e.v.i.c.e.s. . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\DH89xxCC-cor.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	13680
Entropy (8bit):	3.6965235780759804
Encrypted:	false
SSDEEP:	96:RppmEcpewM/1z+VwB5d80f8c51pzApF2CFgycdEUESEG9jiXRpEalPJCFVWPOHSj:B2eztgEz8uuTlaQ2y
MD5:	CE5C998A36186305E9AFF4FA094CA776
SHA1:	3D11C63230932982FB6583D8D786338C4C77B343
SHA-256:	8C92D457083D6E876D93955038706592F1A0B19545B7576AEB7A06A3A804BB77
SHA-512:	2E611E3D41AD2D14302C11A280BBDE36A997C1B0735A1F3FBBB0F6C0C1A8484C36450797AF5B938A7E0535C22F31A85F894ECA8E38EDC6EB99432C278C8BC9FD
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .D.H.8.9.x.x.C.C.-.c.o.r...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .F.i.l.e. .f.o.r. .D.H.8.9.x.x.C.C. .C.o.r.e. .D.e.v.i.c.e.s. . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\DH89xxCC-id2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7458
Entropy (8bit):	3.4947463081352765
Encrypted:	false
SSDEEP:	96:Rp0w/RwM/1z+VISwmQwmiuBPckK08QDAS08QDwalPJCFVWPOHSdaQ+wMy:XztgImkYTlaQ2y
MD5:	3FC2623DB2BB9A215B35C31817F48A58
SHA1:	5D871A456188E9B72F416184BB3A789550CF05B5
SHA-256:	0CA44AD7735151C2AA103380CF7104DB88666350491C0C38934B038F1E4E63EC
SHA-512:	3D877F2BD6DAE80AA0194E5AAE8BA906FD8EE55AFD9E06BB1BA1D5B732CDD8374C47B6D55AFAEAA3D4E1491CF54FFB6EEDA610DCEFDE66939DE7E81C26530110
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .D.H.8.9.x.x.C.C.-.i.d.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l. .I.D.E. .D.r.i.v.e.r. .f.o.r. .D.H.8.9.x.x.C.C. . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\DH89xxCC-ide.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6866
Entropy (8bit):	3.4382270876059993
Encrypted:	false
SSDEEP:	96:RpGEL/+wM/1z+VIgkK08QDAS08QDwalPJCFVWPOHSdaQ+wMy:qztgImTlaQ2y
MD5:	036E28073A006D4659F19237BE663FB2
SHA1:	A36CFB2E94AC9CC6B3D2C0023981E66E9B96EDAB
SHA-256:	CD7A1A4459839193BAAC93D4C93F55A110CC5F31FC8192F1514F62579C087A0D
SHA-512:	8EBB3B0FB67E45FE755A64107153BDEDEC416BA48AA5C655B74DCA315BBAB80F612CD4C04AB99CA1F649FC0E97CA129F33A302E171A2960A6E0FF08F782F3441
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .D.H.8.9.x.x.C.C.-.i.d.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .F.i.l.e. .f.o.r. .D.H.8.9.x.x.C.C. .I.d.e. .D.e.v.i.c.e.s. . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\DH89xxCC-smb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6200
Entropy (8bit):	3.390821522436664
Encrypted:	false
SSDEEP:	96:RpKE/iwM/1z+VwB52PoWalPJCFVWPOHSdaQ+wMy:WztgEJTlaQ2y
MD5:	FD85E7C83B6BCEFFECA7C017A5116055
SHA1:	03E6338F923AC53E03F22C466F725402FD3CF4EA
SHA-256:	AC7EDE9E969F850121BC54FD81CB9E24BA5420F6510406E12124A06EF1AC5149
SHA-512:	FE7B78A65F4666E4464739CC8999F26C361E1D7EC0160E762B7020A92F5A80BB56B12EE63FC9C46F98E93DCD03551398585E3B287025E33CE47170243247E3DB
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .D.H.8.9.x.x.C.C.-.s.m.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .F.i.l.e. .f.o.r. .D.H.8.9.x.x.C.C. .S.M. .B.u.s. .D.e.v.i.c.e.s. . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\DH89xxCC-usb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7518
Entropy (8bit):	3.5065063635045233
Encrypted:	false
SSDEEP:	96:Rpi/mnCM/1z+VwB5c+C++9+TdNL9NrQNc8LJ8LzalPJCFVWPOHSdaQ+wMy:NVtgE++L+9+TdNL9NrQNDTlaQ2y
MD5:	BA82B00F9428664B99227474C7087478
SHA1:	7753862E514758A8FAAA660AEFEB02C7DE127B15
SHA-256:	84A0E24BC5453AB113FE7DDE62A01E7B285AEF7EFCAE11059AF28A7F4EFDDC52
SHA-512:	97724DCAD1FE00EC5CE4D9229F4CB89F17839712CF881F61C8B2DDEA7E60C10EB46373D6ED1502BAEE1E69490D7F48803E9D2DBD08FBF87537BFFD076C30756D
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .D.H.8.9.x.x.C.C.-.u.s.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.0.0.0. .a.n.d. .X.P. .I.N.F.,. .2.k.3. .&. .2.k.8. .S.e.r.v.e.r. .I.N.F.,. . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .D.H.8.9.x.x.C.C. .U.S.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.4.0.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\E5100.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	14042
Entropy (8bit):	3.672940817656436
Encrypted:	false
SSDEEP:	96:RBWzUVM/1z+VwB5+g48NLcA4IWtkgCCryozookyBDzFYalPJCFVWPOHSdaQ+wMy:mY6tgEwgu7hpfTlaQ2y
MD5:	CC051DDACDAACB48A6B00F710FAAAE05
SHA1:	DB585210BB597256FA1C7ABFCBD0FF2EDB8F7757
SHA-256:	CCB487ED3EE00F6CFFEF85B2F559A65CADC05EBC0B43BF08047CCC14191F488F
SHA-512:	28724155478549E8AA20FB23C41AC71CE1320C061E2640BC49F7914AAFA07AB7A78E41A42147F7B7E9E34368A477C9CC84D8920BFDBBE146F99C2AA823983B88
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .E.5.1.0.0...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3.,. .2.0.0.8.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .M.e.m.o.r.y. .I./.O. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\E7220.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148361
Entropy (8bit):	4.513635278058358
Encrypted:	false
SSDEEP:	1536:/IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9z:r+
MD5:	7F8B5E0A14D640506540D3DDBD3FB48E
SHA1:	CB7048EFA82C8671948A75333B0F1A2160B1E044
SHA-256:	B401F91E930CE0E59638D3174E5FB277A913CAC69306CDC7C044D35D0EA53566
SHA-512:	94B8967757719C8FE36B5B12E74805544037C067E7837D5E7FF0315196BEA85D74E3478BCF783FA3BF3206963BA4D68994E0573A6487C3B74A19F205CFFBEE1C
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Ct0..Co...1.0...+......0..(9..+.....7.....()0..($0...+.....7.....4}..{.K./+.).....130801022916Z0...+.....7.....0...0....R1.4.1.8.C.F.C.0.2.A.9.4.2.D.2.5.5.D.C.2.4.D.3.8.0.2.9.C.F.E.2.5.1.9.0.7.4.B.E.1...1..a06..+.....7...1(0&...F.i.l.e........e.7.2.2.0...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.............-%].M8...%..K.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.0.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\E7220.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7620
Entropy (8bit):	3.5136108482911173
Encrypted:	false
SSDEEP:	96:RiRvVM/1z+VwB5lYIgalPJCFVWPOHSdaQ+wMy:y6tgELTlaQ2y
MD5:	3E633B79F862A893FE65E711E48B9450
SHA1:	1418CFC02A942D255DC24D38029CFE2519074BE1
SHA-256:	C0ADBFF1AFAD470FE4517E5215BECF6ABB90411436E7AEBEF26AC2AF5B9A1AA8
SHA-512:	FA0574D7DEF108F611CF82C19E29F8E4DF8475808151129A39642FD0B8085C17795C3926955C90891751C7B0D5444E9BE900813F38647673DD5F303A5ECBDB89
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .E.7.2.2.0...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.0.0.0.,. .X.P.,. .2.0.0.3. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .8.2.X.X.X. .M.e.m.o.r.y. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\E7230.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7184
Entropy (8bit):	3.4723699775558896
Encrypted:	false
SSDEEP:	96:RLAeVM/1z+VwB5m8zamalPJCFVWPOHSdaQ+wMy:h6tgEvATlaQ2y
MD5:	570C523D729EE8D75DCC8725113066AA
SHA1:	6CB8B02FFD2589011766A21EED3CBBDC72DF24DD
SHA-256:	30B84BD9224B6380D5412E0785185F143B51004900502782E666BDCAD476DD73
SHA-512:	F6EBE4CB43F440A13ECB89FE3A19BAB3F5CAF07095D7D01976285ACBCB4CE182B7DDC9153DE24DE17EF77DEA442E25D82B27B1DBFC69FCD4A21221B5874C2E51
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .E.7.2.3.0...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .8.2.X.X.X. .M.e.m.o.r.y. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\E7300.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	12194
Entropy (8bit):	3.64852827121558
Encrypted:	false
SSDEEP:	96:RxWzkVM/1z+VwB59w/Ww/t8oLsH+k+kjhCkT8HP2alPJCFVWPOHSdaQ+wMy:2o6tgEzKWKciTlaQ2y
MD5:	71CCEE52D926336CFD2A948F2CA9B854
SHA1:	27DFB82BB5F38724D1E9E1E531AD3157D9208418
SHA-256:	3A216396DDF3C9AC5BEB425B1AA88F694C95BCBF61D741C7282B461E01A6C91A
SHA-512:	C610ABDAE2007F2D9ACD0B4922F84A0B8C9144D26BA2128167D98225F52BF3297CD4500AE2DDF17BFA9DA41CCDE1B4CD1CF051F57919C49B32CE822A0B8F8DF5
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .E.7.3.0.0...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3.,. .2.0.0.8.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .M.e.m.o.r.y. .I./.O. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\E7520.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148361
Entropy (8bit):	4.514107086409621
Encrypted:	false
SSDEEP:	1536:xUIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/P:wk
MD5:	971B0AD9AAD2C93717AA9B294057F8EE
SHA1:	67D9D22A32DC0F9F5F3A9BACC2DB4CD4AA1F31D8
SHA-256:	2F9E52C41ACFACE874587EA4F91AE9384E6CA9495FB9E42BF7BDE9DD29C3CB8F
SHA-512:	4A63830C7D59BC17846D9F6180832C33F094D9BEB60D86209796E357B83966767070E41CAE20FD87FD8122225EB91630C2022BED00C710223873A7F542E9B7E7
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........Ct0..Co...1.0...+......0..(9..+.....7.....()0..($0...+.....7.....h]..#..K.E.g.....130801022917Z0...+.....7.....0...0....RC.3.E.3.5.0.E.B.8.A.0.D.B.B.8.C.0.D.1.2.E.6.4.0.D.C.E.1.6.A.5.6.0.C.1.0.3.E.9.D...1..a06..+.....7...1(0&...F.i.l.e........e.7.5.2.0...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........P.......@..jV..>.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.0.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\E7520.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	18630
Entropy (8bit):	3.715929423782743
Encrypted:	false
SSDEEP:	96:RFJwVM/1z+VwB5kXGPXGd8fQlgzwi4XjG2hJ12alPJCFVWPOHSdaQ+wMy:K6tgE6XIXGMCjTlaQ2y
MD5:	A0E6237886E16DD8B4372B2604F8EBC2
SHA1:	C3E350EB8A0DBB8C0D12E640DCE16A560C103E9D
SHA-256:	5A2323BF162E9B46C54640BC5E49DC009359EED16006B797A043BBD208F61BE0
SHA-512:	CD19E658DA1205D14AC0CEEB1C13F50E72652C7B8C3CC6E4DCE2899F10C79A74160A2F8C539DAA612B87FDA89719830486059E905EF7509A462B2C3CFEA67D53
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .E.7.5.2.0...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.0.0.0.,. .X.P.,. .2.0.0.3. .I.N.F. .F.i.l.e. .f.o.r. .L.i.n.d.e.n.h.u.r.s.t./.T.u.m.w.a.t.e.r.......;. ... . . . . . . . . . . . . . . . . . . . . .M.e.m.o.r.y. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\E8500.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148361
Entropy (8bit):	4.513681007550251
Encrypted:	false
SSDEEP:	1536:iIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9T:Q+
MD5:	BD3A5DBF5C2927B5AF751DA1FE00FB94
SHA1:	90A823B195BA0B8296A2C0DC61D1282926BCEF9B
SHA-256:	4482444A3E84B2C4D0A101F84B03FFB93813000C0C47A3F6BF1298B12DDAA8AB
SHA-512:	22BA91D91FCEE27E83621ED1E240AFD96B656AA216923ED2343C174E2A25B217583CC6D57C37CB07D36666FAFF52850451E70BCB4651504D06DBDF55E1F2DF5A
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........Ct0..Co...1.0...+......0..(9..+.....7.....()0..($0...+.....7........k..L..s.......130801022917Z0...+.....7.....0...0....RC.3.C.F.B.E.9.2.D.D.0.9.1.2.C.5.4.3.B.9.8.8.5.A.8.3.C.C.1.D.8.2.C.1.5.E.6.8.D.7...1..a06..+.....7...1(0&...F.i.l.e........e.8.5.0.0...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...............C..Z.....^h.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.0.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\E8500.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	26626
Entropy (8bit):	3.6683121961057212
Encrypted:	false
SSDEEP:	96:Rw7tVM/1z+VwB5O1eci1e/1ekYB0/zQ4P5TSalPJCFVWPOHSdaQ+wMy:g6tgEw181o1DZnTlaQ2y
MD5:	523601357D5C089248421C812591B503
SHA1:	C3CFBE92DD0912C543B9885A83CC1D82C15E68D7
SHA-256:	02F26277E4683D88949C81409077269CA77994770EBDBA1BF307209DCD47EBE3
SHA-512:	26D937CF46F2191884FFF2A2381289E64EAE9CB2909D10747701B3A24432B5605116B04FAA32F284E641F35EC092DB2BFC3B2DE3EDEF218301045553944B55AD
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .E.8.5.0.0...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.0.0.0.,. .X.P.,. .2.0.0.3. .I.N.F. .F.i.l.e. .f.o.r. .T.w.i.n. .C.a.s.t.l.e. . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .M.e.m.o.r.y. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ESB2id2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	3.490078376778965
Encrypted:	false
SSDEEP:	96:R7tWEt1VM/1z+VISwmQwmiuBPckP6QDID8alPJCFVWPOHSdaQ+wMy:9s816tgImkATlaQ2y
MD5:	9AFF70B4189827EC954B81B58F558C53
SHA1:	D663053E1339B2ECF5273DF20B7AF70F5C50671C
SHA-256:	227D7042EB94AC43A9E126A264BFAB39B598B38A2139EF37AE380B1623B2037D
SHA-512:	C5521A3CAB387FD8965939210FA1103A55D3FE26799ED28AAEC1A6AFB8A7075D457E9EE5EFADAC95AE476719BAD870949CEC22ECB771EE74A3A09C369CE0A1EF
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .E.S.B.2.i.d.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3.,. .2.0.0.8.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .I.D.E. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ESB2ide.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6932
Entropy (8bit):	3.4297745422872317
Encrypted:	false
SSDEEP:	96:R7aWEtaVM/1z+VIgkP6QDID8alPJCFVWPOHSdaQ+wMy:9D8a6tgIOTlaQ2y
MD5:	B2AC9757464DC37F9AA02D9F3C2286A5
SHA1:	27022FFF3789DEB0E475FB5F466122BAA50EB129
SHA-256:	E3CEF53D40A862F366D723B90DC57F50B125A9D4243E8262C55A3062A708E8D3
SHA-512:	32E1D60A3907B6CFA3B1E3CCE535BF9A299ECF3B278CF0FD642C47BF362B851E47394DFB110AE782761D6C48A4AE6E4A3F53BB1BCA4D21356ACB7B86868238BF
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .E.S.B.2.i.d.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3.,. .2.0.0.8.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .I.D.E. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ESB2usb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	10602
Entropy (8bit):	3.638732037367929
Encrypted:	false
SSDEEP:	192:9HtgEfdCQmtrwrwHO9wrwHO8hdkBdJdfJ9fpQfidNL9NrQNKTlaQ2y:9NgEfdC3trwr2O9wr2O8hdkBdJlJFpw0
MD5:	9DD7C53962C40B06D46D4BD702AB1FA0
SHA1:	AD1004177A1263E61CC2448F8FF1BD331A448387
SHA-256:	859D542CD8651B3AC3C31EBF82FF1C28E8F9DC9EE5C8422E3404C187C22A5727
SHA-512:	B3FCC0A5A1558DA9A2854D4AA44EA52E3EF87DAB0FC3C210B591D2CAE7202A755A4AA51E2121F562F3440DCDD92B87AF30BBD39C517874295D375E1DD28EE13A
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .E.S.B.2.u.s.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.k. .&. .X.P. .o.n.l.y. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .U.S.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.6.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\Haswell.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9190
Entropy (8bit):	3.5842079130342768
Encrypted:	false
SSDEEP:	96:R8HdM/1z+VwB5m8HCqMCSxvMJvqMJuSMJSWalPJCFVWPOHSdaQ+wMy:qHytgE7xMZZMcM7MmTlaQ2y
MD5:	6E7D1D03C6B09B78E8FEFB18CFD02DAE
SHA1:	0F7865367BA0A38457A9066A5019007172736FED
SHA-256:	9C679483DB519567B9FF1FBADA93C0775E079A5DF0E27836A70AA07D1A1EE450
SHA-512:	3815C5F7C0BFF189E6F869637E899655DAB16B3DF9E488D993FE86C61A13984A194A4416D69D5099DCF875FA85A90EFA67A2F392FECB19FA916D9851C018CA18
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .H.a.s.w.e.l.l...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .h.a.s.w.e.l.l. .P.r.o.c.e.s.s.o.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\IntelCP2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	34182
Entropy (8bit):	3.6994628766745286
Encrypted:	false
SSDEEP:	384:G5ugEftqxtqC3s315hqtSYgIUQetvNrtvNDzxz2jv0Hr50r5sr5/XRaQF:G52uEF
MD5:	450CDE29C9215960A7E8EA72D904180C
SHA1:	03558EE026C7D1019B4A138DD4B58B8AE39211C4
SHA-256:	56A95EBB96198B68D317534A1DE3FB62E67BEA4A1A0FAFFDA026293A3DA10AF5
SHA-512:	98E32A2398B6494DED5C99512028767C7F5F54D67EBA89E0DA0C2BEBC01F3B5E8AE57F1496EE2885B6946FBB3D4154EC3F5F32B433436FD50412753333840703
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .I.n.t.e.l.C.P.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3.,. .2.0.0.8. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .8.2.X.X.X. .M.e.m.o.r.y. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\IntelCPU.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	16786
Entropy (8bit):	3.6744047794525874
Encrypted:	false
SSDEEP:	96:RfM1weFEVM/1z+VwB5uHIeSHIeqhPf2+R9Z8RZDZMgZzpjZYuBZJZF2ZIpzZS5vN:gFW6tgEAHIeSHIeOWo8BCTlaQ2y
MD5:	1091CC67F85D039489747C945BBF9B43
SHA1:	1659000176CAC920FADF8955BB4DEF0124E60E2C
SHA-256:	0453C21EC52E3C8C16E5B7B9B8350BF9B0AFFF73705F262CD36432BCEF43F19B
SHA-512:	C67873AEF68B1AF50CBCCEBF41CCEF558A59534BD873D0CE8F7243C23A4D56ED39C06E05EADE7C59F5987CCF56BE646CD26DB92FB8A1068509C86C5607D21E8C
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .I.n.t.e.l.C.P.U...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.0.0.0.,. .X.P.,. .S.e.r.v.e.r. .2.0.0.3.,. .S.e.r.v.e.r. .2.0.0.8. . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. .C.P.U. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\IntelIOH.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	22172
Entropy (8bit):	3.733071173215089
Encrypted:	false
SSDEEP:	96:R0TdGVM/1z+VwB5uBN+FBN+j8GtMGkERUfURB4rSXqdX1WS75alPJCFVWPOHSdao:OdG6tgEK+R+OGfC8oIq11CTlaQ2y
MD5:	6278BA3BA5D89853679FAA8BB49597D1
SHA1:	ED810FFB415BA44CFFBFDE4E3A80FA4D67842D61
SHA-256:	F2BF3BF211C2AECD4056995FBEFE1CF7DD1BF89116B8B417719EF6396236EFC8
SHA-512:	E8D99C312972CCCBED1FF09A65D6A76FCCD0DFC5F132C55AB732DB71494FB924F157A25026902D56A8DFCF19AA96C3C509D751AF5968ED385D4F32A6251C8AEF
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .I.n.t.e.l.I.O.H...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.0.0.0.,. .X.P.,. .2.0.0.3.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. .I.O.H. . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\IvyBridg.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	10086
Entropy (8bit):	3.62246992697015
Encrypted:	false
SSDEEP:	192:BuZtgEtOpzpoDOp2OpROppOpIOpDTlaQ2y:BuDgEtOpzpoDOp2OpROppOpIOpDRaQF
MD5:	13E71A7A95D99AE3CA3549684C56EF50
SHA1:	83BD00C716F1169D20B314216E9D9D7642D0E2EC
SHA-256:	CF78E684D798415649D4B4A21980A33EE5C4E99308A2D73D511EFB93958DB3DB
SHA-512:	CF8AF64D2E8062569251C535B4C73FC49B0D41FB4FA1A5E0F83BEEB8BC70748432D67991B0D8A1CAD6B1340F29D71E5CF36B6DDF230C0E66CC3B514EFAEF2CFA
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .I.v.y.B.r.i.d.g...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.v.y. .B.r.i.d.g.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...3...0. .B.u.i.l.d. .1.0.2.9.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\IvyTown.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	66358
Entropy (8bit):	3.6858979984078273
Encrypted:	false
SSDEEP:	768:0hX5fw65ul3BSlqX8eYgudQHMfyJPcBfOtejAF:0WF
MD5:	02426B8F4D040BA6DC906B8034CA85EC
SHA1:	FC356F09B5689A5611EA3BB8EF5723279EC571B2
SHA-256:	B79FB447F50349FCEDD9AB6016FEB09C3F09DDB93E47D9C6A12E12DCB366E150
SHA-512:	4009EB28AD53F38E292053E78273FFE8C1BC1F8A5BDAA049FC37A6732447A36B85D1730DCC3BE12F8C46C56E5771AA453CC23DDC7BEC58FBA022880FC1340167
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .I.v.y.T.o.w.n...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .X.e.o.n.(.R.). .E.5. .v.2./.C.o.r.e. .i.7. . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\JakeTown.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	48352
Entropy (8bit):	3.7130695472175064
Encrypted:	false
SSDEEP:	768:4UYmaYtCdmaYtCDqUV5aDGtU7iJwnUWL8nULZMpYju6cALL+PFfmsnEL5LALbLWp:4otJttgCF
MD5:	DBF41ADEA6773848AF38B8501ED83C50
SHA1:	9F426E5036C57A25653637F7D504BC3FCDBD4EAC
SHA-256:	0EE55F1307B9D290131BB4FD9BF6FE4A574623E242609F89935AA086EE218333
SHA-512:	8AF88F02E25AD00D7B160C6DD9F162A034E62A1E3F1146B12CDA73C4D60FAF2366078134DEEB89BB1593CC5E34D8D78ACB07479AEFB778DF5B30CEE6CBFE6938
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .J.a.k.e.T.o.w.n...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .J.a.k.e.T.o.w.n. .P.r.o.c.e.s.s.o.r. .S.a.n.d.y. .B.r.i.d.g.e. .-. .E.N./.E.P./.E.X. . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...3. .B.u.i.l.d. .1.0.3.2.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\JasperFo.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	37862
Entropy (8bit):	3.687268654331974
Encrypted:	false
SSDEEP:	192:gaV6tgEiFnHyCPDBVu6FnHyCPDBVuODCtoZUbiXh2WPNpx8UTlaQ2y:gaVugEmpROW3R1RaQF
MD5:	36800610EA60B18C84CDFD06FB1785CF
SHA1:	0A8416DD2ECA46AC87C44C2756F083A9C52EE1FD
SHA-256:	A8B345854EF8F704A5071F71D2F3C91D27B732BCDCC70AB1630F81F4C29C548A
SHA-512:	CBF5D316593AD89C2B020A14C983CFB309730F001E8DBE5FD708900105D47DA7D6BDBB4A436B42229670C1A973340305FD45D3BF1190B24023C2E00FA8857ABD
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .J.a.s.p.e.r.F.o...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\LxLpAHCI.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6796
Entropy (8bit):	3.438568672915122
Encrypted:	false
SSDEEP:	96:RcddM/1z+VwB5ib62NalPJCFVWPOHSdaQ+wMy:4ytgETTlaQ2y
MD5:	1E8C81E5E191EA326DFE90F5A440717D
SHA1:	87403FF3ADDFA1770936C9436A187AC3B9FBC8DE
SHA-256:	9DC166B1A56F48951992696E31AB5EAAFC7DE38F5F471FC53E64882C007515B2
SHA-512:	1B8030161194EA2E437C84B42A53FF3EB49EFEE7F3CFB1042E8531E840183DE35D370D678E54487C4815777EA492FAE56DA4992B53431C00CB1DA11AC28B8532
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.L.p.A.H.C.I...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .A.H.C.I. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\LxLpCore.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	30096
Entropy (8bit):	3.689242974709826
Encrypted:	false
SSDEEP:	96:RDdM/1z+VwB5f0RgIEk0RgIEl8cdYq1Fvppp4pw/pypwfpCpw/p0Hpw/pwcpwVpY:VytgExIfEkIfEohCTlaQ2y
MD5:	80E1CB15455989A36D55AFCA21FC90AA
SHA1:	078A72ED351A0D19BF463CD57FCD819F05D9BCFD
SHA-256:	96D685DE59BD206E60CA5EA4B121914AF43D3D43A66E111F843D1F6635761C0A
SHA-512:	711637C95EFA77AF7827ADDF5DB1AA199293F18912E0EB105A1E2735C474B1DAF250956CA925046EB321881CAB0C17E0A7EEF4DA5EDE9357132AD3C67729FEF6
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.L.p.C.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .c.o.r.e. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\LxLpId2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8348
Entropy (8bit):	3.5424934709413556
Encrypted:	false
SSDEEP:	96:RfhdM/1z+VISwmQwmiuBPck98QD28QDY8QDA8QD3alPJCFVWPOHSdaQ+wMy:vytgImkTTlaQ2y
MD5:	CDD70174FD482D42DD50AEB619175E43
SHA1:	0208D7CAD953297674108FAE7DFE3C9BC6E2382A
SHA-256:	08265AC651B47C9B15ADAB2BBEC13AB646B159441F196EC8A36A60340555AFF7
SHA-512:	63BE2783C68DC57EB5D694828AEBF3A2D68C1562E1FC3EEFF22687AFEB5D599AD9BC6F8498ABBF492E8476A60C4026CE2E4323D2CCE28F1FB1E255A43E31ECC3
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.L.p.I.d.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .I.D.E. .d.e.v.i.c.e. .(.I.n.t.e.l.D.r.v.e.r.). . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\LxLpIde.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7740
Entropy (8bit):	3.496639388931525
Encrypted:	false
SSDEEP:	96:RYudM/1z+VIgk98QD28QDY8QDA8QD3alPJCFVWPOHSdaQ+wMy:HytgIdTlaQ2y
MD5:	F38CF2554EEC0C9DD116BA38E002EA6F
SHA1:	67F866074001ED77BF3E571558ACCB18D9BD4D95
SHA-256:	BC9CEA29DDAC4CAD96E692CCB6E65B6C0F4CAD2709E70E9421117B5EBDB8673C
SHA-512:	45669837C1AB74DB31BAB16369FE3F4DCF7F1E4A36C13077A48799F5F4EF6F33A0BCA0BD9F4CD665F62D37122FCF1DC4EBD472C33EB4ABC855416559CDB89BA7
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.L.p.I.d.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .I.D.E. .d.e.v.i.c.e. .(.I.n.t.e.l.D.r.v.e.r.). . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\LxLpSMB.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6138
Entropy (8bit):	3.3718242327961376
Encrypted:	false
SSDEEP:	96:R0dM/1z+VwB5mWealPJCFVWPOHSdaQ+wMy:yytgETTlaQ2y
MD5:	9C82EF3F43AD28E904089B49B0F7E33B
SHA1:	BDBD400472735932E15286ACD00A1DA1856D2B6D
SHA-256:	6262CCADA3F2943E63BDB6046BBE82EB0BC4783FEADDC3C753976967D9AB9AB3
SHA-512:	1F4427CB9CDB554E63B7A08FD2807C1C733D30DE481E703CF49329BD491CEE042D23D0ADEA01A1677A92A84DE48BFE663790EBD6DFAC6A5CC48738E4645D69B3
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.L.p.S.M.B...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .S.M.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\LxLpSens.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7860
Entropy (8bit):	3.4835261301467373
Encrypted:	false
SSDEEP:	96:RkkidM/1z+VwB5yeAenRZKQhsilPJCFVWPOHSdaQ+wMy:cytgE8eAenRZdhpTlaQ2y
MD5:	834BDF5203802B9B5BC0E5A39BFA3DF4
SHA1:	4172F17C97A655D54424E6AC2A9D573D75A74012
SHA-256:	502FD916BACFE8BD29C703A21D56CD3BA2FAA668680FCB93310D52C8C14014FA
SHA-512:	EDDFB17C07A8EA27383697DE1AD7B775ACCC60FEAA8183F2EE44DC6D7A60E54DE5FF926BDCA336765877C4F5AB9AA671C6508DEE199BA1FD355213C5927AA444
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.L.p.S.e.n.s...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .L.y.n.x.P.o.i.n.t. .L.P. .S.e.n.s.o.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\LxLpThrm.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6070
Entropy (8bit):	3.364456309031035
Encrypted:	false
SSDEEP:	96:RyJyM/1z+VwB5MCYvalPJCFVWPOHSdaQ+wMy:UFtgEaSTlaQ2y
MD5:	AD1008FA28302BFECB8692620C6C09A9
SHA1:	877B562249D0D6A363448F1FEE0D29177E760061
SHA-256:	3FA18A58DFDD83ACD37E2510FDA3FDF8EC53181F60C0E6537ACC00573B22DF53
SHA-512:	C7ADE58430D3A718D6048FF42345206C4CFEBE8399CCFAA0050651E61C94A256BCC664B11EA1F5813A24659390746F6E86833F703501AEBB77F3AC4F4B0EEE3E
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.L.p.C.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .T.h.e.r.m.a.l. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .1.2.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.2.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\LxLpUSB.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7616
Entropy (8bit):	3.515649684848947
Encrypted:	false
SSDEEP:	192:+gtgElUu7s79hdkBdrdNL9NrQNATlaQ2y:+AgElUu7s79hdkBdrHLnr+ARaQF
MD5:	325C819540E1A5A5441B4E63F36FBF34
SHA1:	A6995A77D26D0B0292A9C3B4878836D232899FE0
SHA-256:	38A98558580AA1A6F7DA1702D6ED6694EC1AA0C947F99E73F825843AB605A4CB
SHA-512:	DBB2304EB6C776CD39F36F2168A3E6636C8549E49BBE43A5663EB5BA89B74FDC4369FE2AD2CDD8DD973B753F450625BADF9CB4BBB81199BF7B6B83FC6051932F
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.L.p.U.S.B...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .U.S.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.5.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\LxLpUSB3.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6486
Entropy (8bit):	3.431241068565181
Encrypted:	false
SSDEEP:	96:RddM/1z+VwB51JK4K5XK4KnK4KwFffKiezalPJCFVWPOHSdaQ+wMy:bytgErJK4KpK4KnK4KgKLuTlaQ2y
MD5:	F86D0337A1F2F6413C796870191DDC28
SHA1:	076A953D3C244FBC8390EF42F82854A39F796A6F
SHA-256:	6E8355B28C817D4330A25D8943ECF9CEA02868993D0D1A73D1D50F200C486D70
SHA-512:	92595FBFF37C98D8461804E5C26666F5B60F6D52086650E147D2BE5266D31536309AC61CCF11A18D4FC47F8D493B268398CB6C91E36A0579DE67AC4167AA3A19
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.L.p.U.S.B.3...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .U.S.B.3. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\LxPtAHCI.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	3.4366240963392753
Encrypted:	false
SSDEEP:	96:REFdM/1z+VwB5ib4GUalPJCFVWPOHSdaQ+wMy:IytgE0TlaQ2y
MD5:	8E79A3E9313365F8661BC3F6BAE49BD0
SHA1:	BEF4C12F02CF6630DE998A20B5494DE3AD55E0F2
SHA-256:	2F207B38FB2A5BC56CDA571648DCFF542110D5CFD0E3D6F057EE3429DEAE4604
SHA-512:	09238F5BAF885D87C9E0BB56DAB58F7AE147E979AA9618D4635A5D8E8B83DD0F44A349F68ECE883B3E5909F35309E0AB1B839D358995ECA97B2F09899780F402
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.P.t.A.H.C.I...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .A.H.C.I. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\LxPtCore.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	29128
Entropy (8bit):	3.6665810433167114
Encrypted:	false
SSDEEP:	96:RzdM/1z+VwB5P3gQIH93gQIHk8cbYyyAQpZpcp/pVpfpzp/pxp1pOpUpQpZpmp/D:FytgEBQvH9QvHFQaJ+TlaQ2y
MD5:	E719D3965E7CA415153AEE8D0771BFEF
SHA1:	269FABA273CFCBAD56CAC4B3CBC11AFDF04AEA2B
SHA-256:	EE77683EFF4978F1643AD5EAE11FF720FC56EBA1BF6C25FF415082BFC984C054
SHA-512:	CA45D02A55F7A8625D4F1A6B70B3E1092EEDE0F72E7FDFCC516DE95092FF62AA2EA778E50DF78E5F80014DB96081994DCB52F43144AFD538EAAB74415EF658E8
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.P.t.C.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .c.o.r.e. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\LxPtId2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8396
Entropy (8bit):	3.5391698795076456
Encrypted:	false
SSDEEP:	96:RXZdM/1z+VISwmQwmiuBPckb8QDm8QDP8QDg8QDualPJCFVWPOHSdaQ+wMy:/ytgImkzTlaQ2y
MD5:	83C19367EFBD72416C2E62688AA796C7
SHA1:	5180FC3F0DFCB3DDDFE0C664A7E506574ABF7E6B
SHA-256:	EDC89347C820FDCB8869117BD76DA240D75AB931BF0809302D6553CFC730423F
SHA-512:	2CFCC3A93119582286BAAA95C7143ADE98EB145EA1EC958AAC5D93D9E80927223D8EE26474C84B7E4CA5826A6253D4FD9B80A1F1BF3689714237647CECFB4773
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.P.t.I.d.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .I.D.E. .d.e.v.i.c.e. .(.I.n.t.e.l.D.r.v.e.r.). . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\LxPtIde.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7788
Entropy (8bit):	3.493733148540773
Encrypted:	false
SSDEEP:	96:RQGdM/1z+VIgkb8QDm8QDP8QDg8QDualPJCFVWPOHSdaQ+wMy:HytgI9TlaQ2y
MD5:	776F7B040CE18150F597426EF107370F
SHA1:	866F2AE809FEFDC5773DE1527B1098AAEE87ED96
SHA-256:	3645F89584177330A9B832FC0BF0EFFD389FFAFFC8D3E696FBAF2213FE1EE5E2
SHA-512:	CB0B73D25636E6E9CCB4CA6F81152D2FBBB3147FC362CFB6020CB9EC06FEE9450FB3C34F3912AB13B9710AA5DB16C263BEC174A9218D6674DBEFB4D5258ECFF0
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.P.t.I.d.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .I.D.E. .d.e.v.i.c.e. .(.I.n.t.e.l.D.r.v.e.r.). . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\LxPtSMB.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6162
Entropy (8bit):	3.372265020360397
Encrypted:	false
SSDEEP:	96:R0dM/1z+VwB5WsnalPJCFVWPOHSdaQ+wMy:yytgEkTlaQ2y
MD5:	57F1896F0E441C6BA0F0F406D91666AC
SHA1:	7A08E0F82E6B7E34AD605134BD923E903C893BF4
SHA-256:	1EFF44909B1B0F5BB14564807FC1E0F7C9FFB09528E696E462267F6AAD4C0A80
SHA-512:	FCAB495E8C68A54C9DB383AF4B123EB2B5A3564F6BBC52E857D74BE3824461DBE91BF3634495C81D754B3CEC114AA791B0DB33336392FF37E4235D7AE8825CF9
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.P.t.S.M.B...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .S.M.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\LxPtUSB.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7584
Entropy (8bit):	3.513926717877048
Encrypted:	false
SSDEEP:	192:ugtgE60+b0bChdkBdrdNL9NrQNwTlaQ2y:uAgE60+b0bChdkBdrHLnr+wRaQF
MD5:	5644431E18246FAC31F2E38FE8BD477F
SHA1:	4AC0FF1CA4CEC00C49C2C3ED599D94F8680DEA5D
SHA-256:	9446645D3B291572AC45020E82ABA1DACFD91C81067F39254EEAC9355B02A97D
SHA-512:	50E6FE717F8AD1A0A127D8463C166EDAAD923E59566018E14AF333270D1139D67E7721C4984A1F6004A10442B8EEA58E008C54B9766DF8CD4CDAD34B6C1A0C52
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.P.t.U.S.B...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .U.S.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.5.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\LxPtUSB3.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6468
Entropy (8bit):	3.430598646482522
Encrypted:	false
SSDEEP:	96:R9dM/1z+VwB517w5VwlwwFftNzalPJCFVWPOHSdaQ+wMy:bytgEr7wbwlwoNuTlaQ2y
MD5:	814A9E0FC1A1BBC6DA1793A7B63CD0E1
SHA1:	0FEF7FDD09D9CAFCA23BADD5032B6523D30FD207
SHA-256:	6876711098C00E665EF5C403992BC1A326334C7AA613E97DA58EEEC342630DDF
SHA-512:	CBD92D2C6FC7ED82671C6887AF002CE0259701E05A8E3B41037B0CBE5EDE6B5458A2FF6113CD633BB1FDB452526F54FA6B78D7549E003E5C1BC56E8E70464AE3
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.P.t.U.S.B.3...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .U.S.B.3. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\NehalMEX.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	38794
Entropy (8bit):	3.6995314667536325
Encrypted:	false
SSDEEP:	384:RugE1B+kogWylivFwzBX2YsSDyOwnDnbEWFVR8A83aia+zoF2vrgQ0VRaQF:R5B1F
MD5:	2F8AE5A3D9A2AB40885BE7BD9796AA5D
SHA1:	966E3A7106B1FBE77FF2FA4DE998759039851D90
SHA-256:	9E1AB424978F96861D52899FB76F49DAA63F5B114E4F5A1C8564EE525F365755
SHA-512:	16B50D4EE672D756B331957C7FDE41F106B9599787D2B296521FB37F20A3348F83005F68E46EC2DCA240A1C6B72C81376C4AFB4964FF549B56D6D47471E46CED
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .N.e.h.a.l.M.E.X...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.0.0.0.,. .X.P.,. .2.0.0.3. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. .C.P.U. . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\PantAHCI.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7044
Entropy (8bit):	3.4305561636781348
Encrypted:	false
SSDEEP:	96:RI8CmmM/1z+VwB5ibdeveDalPJCFVWPOHSdaQ+wMy:tLZtgEzTlaQ2y
MD5:	28832BAD606C2852DD23B19C6D4606A6
SHA1:	460800BD6D45344235417A6FF035EED5A18F10D9
SHA-256:	C7AAA66D67E586CD39E1A252E7BFFBB77AD430B63624D2A3FD90E3330EB75EF0
SHA-512:	F687EF45828548AF56B9B3A42B1F8A78527FB03E78FC2943FFB7C7C0B8FB4DEB21D3B5FB3BA5AA92F1BADBF5AFBB7B96A5D91755912B51867DB0CD8CC811152A
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .P.a.n.t.A.H.C.I...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .A.H.C.I. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...3...0. .B.u.i.l.d. .1.0.2.9.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\PantCore.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	20482
Entropy (8bit):	3.7053631282499557
Encrypted:	false
SSDEEP:	384:wDgEtLiWKWg7tuchXsu/pKgYiLdvmxLiWKWg7tuchXsu/pKgYiLdvm4tZW9WtYgD:wE7tr7tuchXsu/pKgYiLdvmktr7tuchh
MD5:	8B07F112FAE9119FE92C76B6F253971D
SHA1:	122EDB961C585445DE50E3DA17B2F9598215CC07
SHA-256:	FC9979D20882B22D6CB7ED85B3D042C53411B9D90C2A71DB728CD2C24BAF48B1
SHA-512:	A30E588E1838847E1706BF793491E73BB99DE9306C9D8A92BF6026F7696FB946B4A21B48CE064EBCD6ECB8AE299EB52D14CA0AB997829980E6320C125B44E259
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .P.a.n.t.C.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .c.o.r.e. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...3...0. .B.u.i.l.d. .1.0.2.9.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\PantIDE.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8068
Entropy (8bit):	3.499762260730757
Encrypted:	false
SSDEEP:	96:RD2RNmM/1z+VIgkqe8QDPe8QDHI8QDvI8QDZalPJCFVWPOHSdaQ+wMy:E7ZtgIdTlaQ2y
MD5:	8654F5A3B1B91C7D0E6DEBD0FD209D9C
SHA1:	FA1078CF71DC97A0E2612C719FAF9DC2E0F61740
SHA-256:	513D135F31907BE149D1FDAF23D8BA992632485903E8836C537121D004AAD520
SHA-512:	BFFCC965B2929D8E348E4588A19382028D23FD2F4D81CB500DCCEF58AB68D9ECB5149B62DDCE07DE17B1B961CCC6BD6995ABCE674F2101B2F44E6C1E4B62ACC1
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .P.a.n.t.I.D.E...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .a.n.d. .2.0.0.3. .S.e.r.v.e.r.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .I.D.E. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...3...0. .B.u.i.l.d. .1.0.2.9.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\PantId2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8676
Entropy (8bit):	3.546883506286136
Encrypted:	false
SSDEEP:	96:R02FSmM/1z+VISwmQwmiuBPckqe8QDPe8QDHI8QDvI8QDZalPJCFVWPOHSdaQ+wX:TwZtgImkTTlaQ2y
MD5:	ACFE3DD8591562198940D95AE755CD1C
SHA1:	9CE86B1065059ADC1EC7FB8F97BF971EDFA4D321
SHA-256:	AC65274F0AA7FCC7DCC4C1903FD9C7EC0ECA3854F071E93CE69F28C939C75053
SHA-512:	ADB3A66DAB80AFDC6DEF9160E809EE5FF62FABEB12E2936F69AB91FDA0A6829FBFBA7756B83FFD4DEAED2A7384E8CCF5190AF27BC1DDEB523716E293EF8644E5
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .P.a.n.t.I.d.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .a.n.d. .2.0.0.3. .S.e.r.v.e.r.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .I.D.E. .d.e.v.i.c.e. .(.I.n.t.e.l.D.r.v.e.r.). . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...3...0. .B.u.i.l.d. .1.0.2.9.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\PantSMB.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6356
Entropy (8bit):	3.3738180848104524
Encrypted:	false
SSDEEP:	96:RvsXmM/1z+VwB52P0walPJCFVWPOHSdaQ+wMy:iXZtgEjTlaQ2y
MD5:	D08B5C2483D264C838F17DD1DCDDF3F4
SHA1:	6DC326785D1A5ED0261354439A2D806ABDAE4B62
SHA-256:	2F92007C0CE1F9C838CC89EA2BEBFDDFD2E057831FBBD2897B10786A6EB3EEB6
SHA-512:	95E1EA2902D6B710D3D9E4E81286E080FDB9C13FA342DA26AEB2610E27262F6D3B008A510A9AA19BB6B04561CB52AEAE6D5D5677D838D6D3A0A50EF23B9F9B7C
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .P.a.n.t.S.M.B...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .S.e.r.v.e.r. .I.N.F.,. .V.i.s.t.a. .F.i.l.e. .f.o.r. . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .S.M.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...3...0. .B.u.i.l.d. .1.0.2.9.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\PantUSB.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7852
Entropy (8bit):	3.5157022310316766
Encrypted:	false
SSDEEP:	192:6W5tgELUu787jhdkBdrdNL9NrQNDTlaQ2y:7jgELUu787jhdkBdrHLnr+DRaQF
MD5:	868FDC195F7626ED4A69054B68595608
SHA1:	2E43588354D6C5ED9C6FF17319CAFD002D74B8FB
SHA-256:	5F21D1FD7CBBDC2D12D8260955423385A1A854BF0A58D45A8646B44A7A556AA9
SHA-512:	4BB0AE7CE8315DE5241AE5AE912F948A20734BF16B7D29C354B0EE43D0CEC02C557F6B9A598432B015045810B057455E0DB66EEFAAC6A4D017650FB844875544
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .P.a.n.t.U.S.B...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .S.e.r.v.e.r. .I.N.F.,. .V.i.s.t.a.,. .W.i.n.7. .F.i.l.e. .f.o.r. .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .U.S.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...3...0. .B.u.i.l.d. .1.0.3.0.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\PantUSB3.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6546
Entropy (8bit):	3.4343719106043076
Encrypted:	false
SSDEEP:	96:RKmM/1z+VwB51uQFfFnve6alPJCFVWPOHSdaQ+wMy:cZtgErSTlaQ2y
MD5:	59B1641B1FC3FED9298CF5FB198602A1
SHA1:	85CC53B07129E8232567649DC7528314547F0D9E
SHA-256:	23351024354D8C4C126269CD67116FDB6F859850E990A863F4C1F983A7805BCB
SHA-512:	33B0B455A899803540B96DDF26ED8C40C6CEB52144AD319C63E3C3CF39D5DFE03E7E8D131B807B2A980A9E981905F4A6537780F9CBB0A1D1C35434AFD7ECE157
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .P.a.n.t.U.S.B.3...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .N.u.l.l. .d.r.i.v.e.r. .f.o.r. .I.n.t.e.l.(.R.). .U.S.B. .3...0. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...3...0. .B.u.i.l.d. .1.0.2.9.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\SNB2009.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9756
Entropy (8bit):	3.616291341649528
Encrypted:	false
SSDEEP:	96:R6iEnKM/1z+VwB5c94P94f8iiINiIBILiqi+ui+6si+VzalPJCFVWPOHSdaQ+wMy:MiENtgEui4icWiqiRiAiDTlaQ2y
MD5:	51AD4B757D87AE384B434805A567718E
SHA1:	3217B9A82A0DA65403CDBC1201521A5A89CA30B0
SHA-256:	3515622B03C8B933F37754FE899D27DF2110403E3F32618DB23253C78284F260
SHA-512:	BD1B5E999A2D205F9A15725BA23B2184E36FAE65FEA3A31AA231788C50B257F8E3762593BE1051F4BFEF17ADA39D5524127B6ABD909F575999F5E6F4715161BA
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .S.N.B.2.0.0.9...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .X.e.o.n. .E.3.-.1.2.0.0./.2.n.d. .G.e.n.e.r.a.t.i.o.n. .I.n.t.e.l.(.R.). .C.o.r.e.(.T.M.). .P.r.o.c.e.s.s.o.r. .F.a.m.i.l.y.......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...0. .B.u.i.l.d. .1.0.3.5.). . . . . . . . . . . . . . . .......;. .......................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\Tcreek.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	13374
Entropy (8bit):	3.676321297113655
Encrypted:	false
SSDEEP:	96:Rs3XVM/1z+VwB5ZZn3ZZZU8cvM+skNXTsmIRYabualPJCFVWPOHSdaQ+wMy:aH6tgE0M+skVTXIRY0TlaQ2y
MD5:	D4FC4B58E0AFA676D633B7BCC90B2E82
SHA1:	F3E9E9B7E8A70F26DCE7F5F7FD83A40D011BD4BD
SHA-256:	30A7512FDFE68937F0340EE819745AAC736A1D7E68F6AD42995052B0AB1A2AB5
SHA-512:	130E9846E6DAA6E74F5ECAC37212001D653DC2BF317B66410F34F2177A3ED294EE257B6546DB8C905180ED7EDA2B7A0D3E39D454BA62CCF78A7ED3784F8E239A
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .T.c.r.e.e.k...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .A.t.o.m.(.T.M.). .P.r.o.c.e.s.s.o.r. .E.6.x.x. . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .P.l.a.t.f.o.r.m. .C.o.n.t.r.o.l.l.e.r. .H.u.b. .E.G.2.0.T. . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\TcrkSD.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7280
Entropy (8bit):	3.473824011988193
Encrypted:	false
SSDEEP:	96:RpQVM/1z+VwB5Ah8XJASJkalPJCFVWPOHSdaQ+wMy:o6tgEjTlaQ2y
MD5:	B55554DCEBB7369E29B48EC037D16AA2
SHA1:	F00BF86444072916B2BD399D7C73DDEC92C67254
SHA-256:	A54319EF4A86D8D60B6B5AFA644DB33B6564B1D505ADD47022E464B4DAE27CDF
SHA-512:	7E60EED2FEC5DA082BC724F9EA02517608AF21A41A6F643E3CC2ADA81E0341BD2FFE04A698C2E3CDE41D7E6C82297D73996F16480D28F457D8675AEE2D355105
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .T.c.r.k.S.D...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.0.0.0. .a.n.d. .X.P. .I.N.F.,. .2.k.3. .&. .2.k.8. .S.e.r.v.e.r. .I.N.F.,. . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .T.c.r.e.e.k. .S.D.H.o.s.t. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\Tcrkahci.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6370
Entropy (8bit):	3.3853120100988416
Encrypted:	false
SSDEEP:	96:R2erVM/1z+VwB5yb0a+alPJCFVWPOHSdaQ+wMy:T6tgEGTlaQ2y
MD5:	E99872AE259FA8665164D61E058587AE
SHA1:	0889BCC2A21F8B83EBF13C7A2DEB9922B7B65285
SHA-256:	490BEE967487E75EF5B85CCED919BC46B8437B8A4E216120E0693CF274084D0A
SHA-512:	CE85E84F1555A2EB418356D40430D14D9814F30B8A83F2C69B505845C8694EA4263203C2C7E3BC2983EA7ACC576C3DDF5F433A386119998CFFCF1EECBF131221
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .T.c.r.k.a.h.c.i...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .P.l.a.t.f.o.r.m. .C.o.n.t.r.o.l.l.e.r. .H.u.b. .E.G.2.0.T. . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\cdvcore.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.5146468703356195
Encrypted:	false
SSDEEP:	1536:6IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9H:4m
MD5:	256077B82CB21B3110B170E6C9795648
SHA1:	9C31E2F41DCC7D8CEC9053BFA1DA654A17199810
SHA-256:	641725CCCBF343BAE5F1A86924F0D67BB8FE3FFC0CFD3EE4EEB4C9C0CB577117
SHA-512:	14551AFB80B01544E381D19145ABBFD46F9B9EFE1CD69D734479E58434FEB482B4EAB1BD40F59B1F581C67001B25DE1FEFD5CC1E739FE5D11CF8F52FFE881910
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......Z+.ZcB.....#.l..130801022914Z0...+.....7.....0...0....RF.A.E.0.5.F.E.B.7.2.2.2.6.E.6.3.B.0.2.8.D.3.0.F.9.4.D.7.C.A.8.D.B.D.0.B.0.A.E.3...1..e0:..+.....7...1,0...F.i.l.e........c.d.v.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........._.r"nc.(.........0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\cdvcore.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	10792
Entropy (8bit):	3.67411996670037
Encrypted:	false
SSDEEP:	96:RqB1wM/1z+VwB5ISn1yJiXr0tGRalPJCFVWPOHSdaQ+wMy:i1ztgEBQJiXr0tG8TlaQ2y
MD5:	B015F03AB216B47E84C60D00E9CF82AB
SHA1:	FAE05FEB72226E63B028D30F94D7CA8DBD0B0AE3
SHA-256:	B71F02BC68E82A747A5BBD13C77DB84C47D4677F7646655C7F3F946ACE1B5A14
SHA-512:	8072BD47485A194C1DBE2DEAA8D57ECE1F22DBBD876DB487D6B30D2D93DC61AD660728FC164674424DE3E0B97765B3BC1B48097BFC263777AF609EE59AE1C87F
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .c.d.v.c.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .f.o.r. .C.e.d.a.r.V.i.e.w. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\centcore.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.5143146106008585
Encrypted:	false
SSDEEP:	1536:TIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9t:P38
MD5:	0FA70EE89CE3CF42DFF90BAAA660531F
SHA1:	8DFB3D17B51B812488DA98A9D499413BC67B89F7
SHA-256:	31A05AF3C76D4D2B5278B4102A88DD49E245E7DDA350876BB77182486B0EC2C9
SHA-512:	9FF51B72890F65DFCF97EE9DFBB2551C54C9F8149D33DCD9604C24CDF486C1AFDAB4BD578EF74F0CEFF9A6CE0147C0AF29BD8299605AD7E2D96FA442CEBC9C47
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.......#3.8.E.........130801022914Z0...+.....7.....0...0....RA.9.4.F.4.9.5.D.A.7.2.7.6.4.8.5.8.C.B.A.B.C.3.4.5.6.3.0.8.E.A.5.8.2.0.5.5.4.4.8...1..g0<..+.....7...1.0,...F.i.l.e........c.e.n.t.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........OI].'d....4V0....TH0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\centsmb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513658967457855
Encrypted:	false
SSDEEP:	1536:UIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9l:a0
MD5:	08F306FCA0945D3F2B29403AF2CB9DB3
SHA1:	A2206C7F88C889EE0BAA4E23449F822DB8ADD2A6
SHA-256:	9E980F73D3024711130C63537FC46B686F39C8D97636286395300BCA15C60C42
SHA-512:	8E378BAFECAA85D41BBF52A80AD4FEBC90DC423C17A4B302C587DD647FBF17839011B19F6FDA7B5CB76454BD4F87B1268E2CB397170364512D7382EE9AF2883D
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7........7;..O...n1.'...130801022914Z0...+.....7.....0...0....R3.E.D.E.E.D.9.8.B.3.F.3.8.B.F.8.1.D.5.E.E.9.9.7.3.4.D.5.6.2.3.E.E.F.0.A.7.1.9.4...1..e0:..+.....7...1,0...F.i.l.e........c.e.n.t.s.m.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........>.....^.4.b>..q.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\centurt.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	147045
Entropy (8bit):	4.516981544434934
Encrypted:	false
SSDEEP:	1536:ot0kD1nmOHa4hlIYsB9NpBFlO2geM+/wGCrbY2B2PzbHQjkM/RZ90KVDM0YVrX0f:PI
MD5:	330DA9B4FFFF938C7A766BE7BE068F47
SHA1:	D93FB8AFBD7896E22835FAAB7989C06FEA80B7E1
SHA-256:	5FD0A418658EB7E08628D21579FC7990B2E8A978F4CD076AAAE3D5E73800F75C
SHA-512:	93DA60B8BDCE2748F6A48898D5397216EC458DD22E479396A91A72066D89661A3A8D066E4356A1D783FAF554B9B39DAAB667509DA397B937A4319B02F64460B5
Malicious:	false
Reputation:	low
Preview:	0..>`...H.........>P0..>K...1.0...+......0..#...+.....7.....#.0..#.0...+.....7.......J.B....4.....130729171825Z0...+.....7.....0...0....R8.F.9.D.E.7.6.B.D.D.D.C.5.0.E.3.B.8.E.A.E.7.B.5.C.B.A.C.7.C.1.7.0.8.D.9.B.9.B.9...1..e0:..+.....7...1,0...F.i.l.e........c.e.n.t.u.r.t...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........k..P....\|....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3...... .0.. .0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.4.5.6...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\cougahci.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.514069276537974
Encrypted:	false
SSDEEP:	1536:kIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9V:qg
MD5:	2137D1E13865B02CBA5C0C3C98C6F13E
SHA1:	91FB3B08C45FDC6CF634845CE0CD9926D26281BA
SHA-256:	5CB845846870B8CA81DACA9A46BD441B6E7F670FB3EBF6524B2553D7BC5809FA
SHA-512:	29086128EBD09AAC9CC57332F59191301CFC94760964632142CEA8194BF46BA0B9B11601EA15A8294A5184F2B631E3548C6A90EB32BEBA11458C8795E75B4297
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....!.0....J.t.3W[....130801022914Z0...+.....7.....0...0....R0.5.D.7.D.D.C.9.9.D.2.5.F.B.4.0.5.6.C.9.1.B.5.8.1.D.C.5.0.3.E.5.D.9.C.2.2.3.B.8...1..g0<..+.....7...1.0,...F.i.l.e........c.o.u.g.a.h.c.i...i.n.f...0E..+.....7...17050...+.....7.......0!0...+............%.@V..X......#.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\cougahci.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6932
Entropy (8bit):	3.4454464855984877
Encrypted:	false
SSDEEP:	96:Rq7rnKM/1z+VwB5ibeMq6MqlalPJCFVWPOHSdaQ+wMy:0NtgEzTlaQ2y
MD5:	9BCADC4F9C78667E232F55E227003352
SHA1:	05D7DDC99D25FB4056C91B581DC503E5D9C223B8
SHA-256:	545C744A7523AA1CF2E2A1BE395A69888E779CEE3F32D3A90D7521AD86DD8DF7
SHA-512:	A17F22C35C63EF071F23A22DD6C7080219FE8E55D6DF0D41BE278936FA943F2712CEEADD081ECFD7A6B900C269B61FDE4AEA5CCBA15B142EFF6DEB66A28393EA
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .c.o.u.g.a.h.c.i...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .6. .S.e.r.i.e.s./.C.2.0.0. .S.e.r.i.e.s. .C.h.i.p.s.e.t. .F.a.m.i.l.y. . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...0. .B.u.i.l.d. .1.0.3.5.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\cougcore.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.51386581765464
Encrypted:	false
SSDEEP:	1536:YIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9A:+x
MD5:	E0C3CEE9AEF89B4446BD73434A42EC24
SHA1:	8D37CD510262D8EAEB48D14A376BEA5BF3BC2132
SHA-256:	7B55B198A729F558816A2425A3E0474606B5A13B026CBA7BD860839B6BEEEBB7
SHA-512:	0B2B0BF11988DF873AB7DA72524586A1F3AB424609CF495476AC195674E1AEC08770217105400842B2A3D85E47748FCB5063FFB2D0D552D2360540A3A53CD9DC
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.......m..d.N...y55W...130801022914Z0...+.....7.....0...0....RA.4.0.7.B.5.5.D.F.4.6.F.B.0.E.C.6.7.F.B.A.1.F.9.E.5.9.A.2.0.7.0.F.B.A.6.A.B.5.1...1..g0<..+.....7...1.0,...F.i.l.e........c.o.u.g.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........].o..g.... p...Q0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\cougcore.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	22708
Entropy (8bit):	3.706624575867439
Encrypted:	false
SSDEEP:	96:RqBnKM/1z+VwB51RQI3RQIE8cuxpzd0IX0RJ3XaDF+tMF+toF+tnF+tyF+tqF+tj:KNtgErRv3RvxyuTlaQ2y
MD5:	24F53B2423B5318234745D3878803228
SHA1:	A407B55DF46FB0EC67FBA1F9E59A2070FBA6AB51
SHA-256:	7E08F0C23E5B89D979226D5B12DDC22955C0CC80AF2FD2AF8F3743A190D50370
SHA-512:	8495B1E75CB446C35DE9646FA093C16CAA8E96D8711471AD0270A231986CBAD6533A25BBA07D8266222FD1B79E3CB416C1C540D44B0739465D442082D20B2B9C
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .c.o.u.g.c.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .6. .S.e.r.i.e.s./.C.2.0.0. .S.e.r.i.e.s. .C.h.i.p.s.e.t. .F.a.m.i.l.y. . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...0. .B.u.i.l.d. .1.0.3.5.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\cougide.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.512823525791104
Encrypted:	false
SSDEEP:	1536:qIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9U:oF
MD5:	8F671D027E518AA5742DE89E626D2112
SHA1:	F80C4DC14ED2CEBA9B0C4B3AC4AFBDBA547D9282
SHA-256:	523AF378ED224C3D2AFAC5FDECE5EABE3C9A79178D88DACA9623DBDBB8C397B0
SHA-512:	90212D59FD6602D92E1A40B5F1D88158D082ED801BDE40E2BB29B5BF5DC55E48E7F7A5F47DD478A16C93A0FC7AE617BB541CF4458D42A0B432373A12F34D84DC
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......E..'.F..W..c....130801022914Z0...+.....7.....0...0....RC.F.3.9.8.3.0.B.E.4.E.E.F.6.A.6.2.5.B.6.D.D.2.4.C.A.6.7.D.7.4.4.9.8.A.C.B.6.D.D...1..e0:..+.....7...1,0...F.i.l.e........c.o.u.g.i.d.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........9......%..$.g.D....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\cougide.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7956
Entropy (8bit):	3.504061655267565
Encrypted:	false
SSDEEP:	96:RR7onKM/1z+VIgkxe8QDae8QDiI8QD6I8QD/alPJCFVWPOHSdaQ+wMy:ENtgINTlaQ2y
MD5:	8EC36E73044BF7B1C3BBD7ACDFDFDCFF
SHA1:	CF39830BE4EEF6A625B6DD24CA67D74498ACB6DD
SHA-256:	D294D96D57A9E5D6CED5385BB7A5178A94D7D89CB65922CB501FD89BFDCE391F
SHA-512:	E6E587654361758C939B1069AEBE1F8273CACA4FC98A55AE9422E62A6E423314C43947119BA8F4632BEA8B2AB7CA6EDE7FA3F8D63BFA72E5FF1A9DCF3890CAFD
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .c.o.u.g.i.d.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .6. .S.e.r.i.e.s./.C.2.0.0. .S.e.r.i.e.s. .C.h.i.p.s.e.t. .F.a.m.i.l.y. . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...0. .B.u.i.l.d. .1.0.3.5.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\cougsmb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513680398322059
Encrypted:	false
SSDEEP:	1536:SUIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/M:rf
MD5:	B9C1E1B937088304598E85E7E3FBF10B
SHA1:	F4AD25BE5576ACCD2B7857D54366F7C5B5C82A56
SHA-256:	6F829688E32A2466F910A421EF17DF005E9353BD382CE222EAE13516F8B69773
SHA-512:	4FC6D3DD3CF87EAF8EBE703CF132DA7D851146DA0E6AC0B6B0BCE664B7C22D83808854E603D63EBAFDA6042EC25593E5E43D443CC993ABE0886DE9A07C1AEE95
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......b.#.cE...>.J....130801022915Z0...+.....7.....0...0....RF.9.8.9.6.E.3.5.7.2.C.6.7.0.F.7.3.5.0.5.C.C.C.7.9.D.E.5.C.1.C.A.F.D.3.3.2.3.B.E...1..e0:..+.....7...1,0...F.i.l.e........c.o.u.g.s.m.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........n5r.p.5.......3#.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\cougsmb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6192
Entropy (8bit):	3.3780934242000065
Encrypted:	false
SSDEEP:	96:RdenKM/1z+VwB528c2alPJCFVWPOHSdaQ+wMy:yNtgE+TlaQ2y
MD5:	FBE9B313FB51A6F6B63687FB6DE21B62
SHA1:	F9896E3572C670F73505CCC79DE5C1CAFD3323BE
SHA-256:	D12C68C3DB263A271D023ABA97CC2BE8BEB61F2A43B4E207742F5673D974F20A
SHA-512:	4FCACABF951FC1003ADB24332D2053697002DFE38742B814C6F231528B26348E720E356F0B97A266322F2E8253FD82101B692191F154082795BAD7983832982E
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .c.o.u.g.s.m.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .6. .S.e.r.i.e.s./.C.2.0.0. .S.e.r.i.e.s. .C.h.i.p.s.e.t. .F.a.m.i.l.y. . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...0. .B.u.i.l.d. .1.0.3.5.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\cougusb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513998847892706
Encrypted:	false
SSDEEP:	1536:IIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9f:u2
MD5:	CD3A90A9CE3CA04A2C606A9FE17013FC
SHA1:	94D28D8DFBCF08684EF04E2066A4C0119588FEB1
SHA-256:	D870EF82C0BC9D61657C0A79B3F413F7811457D323FA42DD4278A8ABF84CA5F3
SHA-512:	EBA026B4DD70F406AF9D22ACE42AB4FD786648541FB65DEA89028C0E2A9F900A813BAB66B1012E52AA4A9F3C40978A7F310316EAC704BE75F2DC3E800F3C1A3D
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....l..CJ..M.5[V..h...130801022915Z0...+.....7.....0...0....RF.7.1.B.E.E.8.2.5.9.1.F.5.A.2.C.6.F.C.F.7.B.2.1.6.0.B.F.A.3.2.B.4.2.C.E.F.2.2.D...1..e0:..+.....7...1,0...F.i.l.e........c.o.u.g.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........Y.Z,o.{!`..+B..-0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\cougusb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7712
Entropy (8bit):	3.517469943053321
Encrypted:	false
SSDEEP:	192:T0tgE9UO7s7VhdkBdrdNL9NrQNrTlaQ2y:TMgE9UO7s7VhdkBdrHLnr+rRaQF
MD5:	39105C1743306B7266901FEDB554427A
SHA1:	F71BEE82591F5A2C6FCF7B2160BFA32B42CEF22D
SHA-256:	46E1BCB7DF222B8F756555D68FCDCDDF504EFEC40BD1677F904BBB3B5E5881F6
SHA-512:	73148981FC9171FC542FF30B22B4A930A65C35D99B6CAD7E71B2818A7D5D173C4FE671E24ABB7B006E6526E88D2AA4F75E66FEF0DFD489223B61BB30E705745F
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .c.o.u.g.u.s.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .6. .S.e.r.i.e.s./.C.2.0.0. .S.e.r.i.e.s. .C.h.i.p.s.e.t. .F.a.m.i.l.y. . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...0. .B.u.i.l.d. .1.0.3.6.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\couide2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513786811507935
Encrypted:	false
SSDEEP:	1536:zIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9z:v2
MD5:	BC67F9E26BF7D7B84DFA8A75A35CFF13
SHA1:	AD2B7D575C2AF4F65DF0EB112C6A54E6D86DD2CE
SHA-256:	534A8AB8EAA089B298C31DA4B1BC6A2C4E4925C8FFE6AB2166F4F96F25C040EA
SHA-512:	A18B5506A38E835AFF58494B796CEC7399C5FAEE5FDFE319771A85D2C9B6C8B9606AD2F47C36B74C68900E4A727DBF45B61B37A2EDC59AA19B01EC8B7540FDB2
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......fj..B...N....130801022915Z0...+.....7.....0...0....RF.0.6.4.6.B.1.C.E.7.7.E.2.5.B.4.D.4.3.4.4.0.D.9.5.B.5.F.8.C.2.0.F.2.E.B.0.1.2.3...1..e0:..+.....7...1,0...F.i.l.e........c.o.u.i.d.e.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........dk..~%..4@.[_. ...#0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\couide2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8564
Entropy (8bit):	3.540130499407597
Encrypted:	false
SSDEEP:	96:R7NnKM/1z+VISwmQwmiuBPckxe8QDae8QDiI8QD6I8QD/alPJCFVWPOHSdaQ+wMy:3NtgImkjTlaQ2y
MD5:	87E867735372976FECBA1F4260E6A9D1
SHA1:	F0646B1CE77E25B4D43440D95B5F8C20F2EB0123
SHA-256:	D6D8125DA5C39F51419454091A41112FF04E7CBB3B46252DEC88DBF7B40F3D7E
SHA-512:	58456DC8B25ED3A71891977ECE79D77A0241FF410A2EDFEB182F42DB27B8C86EC3B1C9FD5D983BEFE98B83CD831E03E4E7C41B2E6F05B5612284A7BD1E151AD0
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .c.o.u.i.d.e.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l. .I.D.E. .D.r.i.v.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...0. .B.u.i.l.d. .1.0.3.5.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\cryswell.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513445849937441
Encrypted:	false
SSDEEP:	1536:fIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9F:LpK
MD5:	9C632FF7BD7A3F8A5B06A6B96B7D8A7D
SHA1:	7EECE7317EDE6B537F3B6277765552514D7076A9
SHA-256:	EC10EE326E770E9F20D8425FB24DD16CF016C83FC55D0AD47524F3077FDC133B
SHA-512:	E6F4D960794B90D0B69EA45E832E7B752A639E5D5C283CB4898E7528B8381DA581DE8B6ED8000D46670DCD83678C0F461DC971F63708A0D2BA187A016D80324D
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....0.h.[..E..21.r....130801022915Z0...+.....7.....0...0....R5.9.F.5.D.D.1.3.0.7.4.4.1.9.9.7.2.2.0.2.7.4.7.0.5.4.1.5.7.9.8.1.5.6.F.7.6.F.8.1...1..g0<..+.....7...1.0,...F.i.l.e........c.r.y.s.w.e.l.l...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........Y....D..".tpT.y.V.o.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\dh89xxcc-ahci.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148377
Entropy (8bit):	4.514119318005891
Encrypted:	false
SSDEEP:	1536:0IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9Y:6Ck
MD5:	7DD441A45A94E51FD6E72BEED65573DB
SHA1:	982CEE3984BDBBE991D8ED4620BD9377D9DC0493
SHA-256:	B97797B49CF6BC52EF8CEB6D3048ADD002FAC4E7A62E48EA47B1396ACB01CE32
SHA-512:	B4D017076A977DA303ED178BFA3A4E145675E78F34DDC13FCB9BC6593E86128A4ADB5426DC9B57A4E7FC8F7B21CFF22146C26F253CB2D26259A6827A83F175AE
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........C.0..C....1.0...+......0..(I..+.....7.....(90..(40...+.....7.....33.u.A.H...QbhF'..130801022915Z0...+.....7.....0...0....RE.D.B.4.5.4.C.2.0.1.D.E.2.0.4.9.D.6.E.8.1.1.7.2.E.F.2.C.E.E.4.0.5.8.A.9.1.0.C.2...1..q0E..+.....7...17050...+.....7.......0!0...+.........T... I...r.,.@X...0F..+.....7...1806...F.i.l.e.......$d.h.8.9.x.x.c.c.-.a.h.c.i...i.n.f...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\dh89xxcc-cor.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148375
Entropy (8bit):	4.513829335640103
Encrypted:	false
SSDEEP:	1536:9IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9Y:ZOI
MD5:	4B55DD21B4F7B1644E42E5D3F89F2D8F
SHA1:	89955CE0A5F0B6CBAD20950FBDA4D7AA867A46E2
SHA-256:	ED5CFAE6C353359FD4A7BE98A81A93088A9B119FE0ADC4C9638EC3523BF8E3B7
SHA-512:	58D19754DDF3DF1736456CF4E034A1FCACA41F7FBB20BBB4ABD216FA53B47596EB7278C0053E6EC1B71AAF5D9B8E1176A775F4E604C6864E84779B1A28CFA802
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........C.0..C}...1.0...+......0..(G..+.....7.....(70..(20...+.....7.....3~..qv.A..b...-D..130801022915Z0...+.....7.....0...0....R3.D.1.1.C.6.3.2.3.0.9.3.2.9.8.2.F.B.6.5.8.3.D.8.D.7.8.6.3.3.8.C.4.C.7.7.B.3.4.3...1..o0D..+.....7...1604...F.i.l.e......."d.h.8.9.x.x.c.c.-.c.o.r...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........=..20.)..e...3.Lw.C0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\dh89xxcc-id2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148375
Entropy (8bit):	4.513259277983852
Encrypted:	false
SSDEEP:	1536:TIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9Y:Pl
MD5:	880B5E3DA9696DCE12B12B49677C31D5
SHA1:	400D4F636FAEC899B4380030FFF7900E29D7453A
SHA-256:	7734DBC388E140146374A25E99A420E203581F82C06CC60F93486BD639ADC818
SHA-512:	C5EE02D33FB3450F00C9B7A507F2863A2428806BBCDF04F6516650BEA1F5C6F5FF98C835EC529849CDCC242AED92D3A9AF67A657070EB570DBC6BA8EFF9ED8F7
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........C.0..C}...1.0...+......0..(G..+.....7.....(70..(20...+.....7......4u.f6.H.sK9M..3..130801022915Z0...+.....7.....0...0....R5.D.8.7.1.A.4.5.6.1.8.8.E.9.B.7.2.F.4.1.6.1.8.4.B.B.3.A.7.8.9.5.5.0.C.F.0.5.B.5...1..o0D..+.....7...1604...F.i.l.e......."d.h.8.9.x.x.c.c.-.i.d.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........]..Ea../Aa..:x.P...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\dh89xxcc-ide.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148375
Entropy (8bit):	4.513924613458999
Encrypted:	false
SSDEEP:	1536:VIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9I:B1
MD5:	F0E91BBB5CF754211D0F8512B03BF9DA
SHA1:	273CA61D39EDEE2FE09944E3CC1C18C00EB99ED0
SHA-256:	94F85D6CBDED76CCDC42C78C4B20995574CE468CB367E266DF960CE31BFFBE43
SHA-512:	47166C3A954B46F606EF226588C43DA313ACC833CC447B9236EE500CE5257E7D1FB4AD992BDA4CF626C943A80E24E0E6AABC99D1CB51388122C71D0100D500A0
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........C.0..C}...1.0...+......0..(G..+.....7.....(70..(20...+.....7.....yrD....L.CU.2}....130801022916Z0...+.....7.....0...0....RA.3.6.C.F.B.2.E.9.4.A.C.9.C.C.6.B.3.D.2.C.0.0.2.3.9.8.1.E.6.6.E.9.B.9.6.E.D.A.B...1..o0D..+.....7...1604...F.i.l.e......."d.h.8.9.x.x.c.c.-.i.d.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........l.........9..n...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\dh89xxcc-me.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148373
Entropy (8bit):	4.514090550996422
Encrypted:	false
SSDEEP:	1536:KIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9C:In
MD5:	1B99780417E375A8E05CEEB964579050
SHA1:	B1702095FF04212B8D7B5A3865A2D6598C0F9D81
SHA-256:	07E9DE6917443F74FC39D52F07C53FDD87DF9262A487A5509C71C6B67E03CB01
SHA-512:	A3BA4B0BE26BB86C32BDA31A42D6626A60E9112A986A0BCF620784EFCC18725161723696B3A4EA54D906F9E52BDF7871E82E53A60B727F6D30AAFB172496685A
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........C.0..C{...1.0...+......0..(E..+.....7.....(50..(00...+.....7.....M.}8...L....P....130801022916Z0...+.....7.....0...0....R3.A.4.E.F.9.C.7.4.D.8.3.2.2.0.6.3.E.1.0.7.2.8.A.0.A.B.A.5.2.F.6.F.1.1.B.F.E.E.6...1..m0B..+.....7...1402...F.i.l.e....... d.h.8.9.x.x.c.c.-.m.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........:N..M.".>.r...R.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\dh89xxcc-smb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148375
Entropy (8bit):	4.5125417263285605
Encrypted:	false
SSDEEP:	1536:HIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9t:jk
MD5:	77D57C9A68879886630E7170876F3E96
SHA1:	FA34E2E5994987B92FFB23C9B415A882E887B938
SHA-256:	961789723AD11254895FE40FBDFCE72D4A79EA93A8C0F0FC605EF886000E5812
SHA-512:	4D3A3A7ADA626918E6A00C57E673C6C954F2E4825A742E359663A9F434AC4F92BC35E7384D3B94FDDD9E8A468AA444F64ACFED6EEC0AFFC57121F537F3AD3105
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........C.0..C}...1.0...+......0..(G..+.....7.....(70..(20...+.....7.....:.[~[..D..L..B.I..130801022916Z0...+.....7.....0...0....R0.3.E.6.3.3.8.F.9.2.3.A.C.5.3.E.0.3.F.2.2.C.4.6.6.F.7.2.5.4.0.2.F.D.3.C.F.4.E.A...1..o0D..+.....7...1604...F.i.l.e......."d.h.8.9.x.x.c.c.-.s.m.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........3..:.>..,ForT..<..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\dh89xxcc-usb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148375
Entropy (8bit):	4.514398355873162
Encrypted:	false
SSDEEP:	1536:+IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9F:ME
MD5:	BF3BA4887E63E09697B6EE295D26D183
SHA1:	198F8B3401AEC0AAEDB8002AF346DC295970F92C
SHA-256:	E38A8578B1C84FCA222BF912FCFE44CC3908F0150692A6C0C1E53D0B7CDA3416
SHA-512:	77C0E380AEA41E7B787A1716434E6648EBC399E6D654EF6C49D6D032BC78FD6CDB951A9FABD9EFB68578AD80D86A772D324B0000331670A4F703A60FE65C48BF
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........C.0..C}...1.0...+......0..(G..+.....7.....(70..(20...+.....7.....M.....F.w....s..130801022916Z0...+.....7.....0...0....R7.7.5.3.8.6.2.E.5.1.4.7.5.8.A.8.F.A.A.A.6.6.0.A.E.F.E.B.0.2.C.7.D.E.1.2.7.B.1.5...1..o0D..+.....7...1604...F.i.l.e......."d.h.8.9.x.x.c.c.-.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........wS..QGX...f.......{.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\e5100.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148361
Entropy (8bit):	4.512844059825549
Encrypted:	false
SSDEEP:	1536:RIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/91:tw
MD5:	670B5AECC69829B961823FB1BBF79447
SHA1:	91DCB47FAE52FFFD2F5C278D57C364694F967159
SHA-256:	3BE732139773EEABAA1A49E183C2EC34F607AE125E9FBC7394D9D96006C99929
SHA-512:	0975E145B4D8661B1D0A317F0A06F10AFC7F595C3906DC69A46E2E677AB0DE836DF414DBBF9788233BE0E4661F8AEF7ED13916D3029E4B4D1CB5331A50D0EBC9
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........Ct0..Co...1.0...+......0..(9..+.....7.....()0..($0...+.....7.........D+.K..1...B...130801022916Z0...+.....7.....0...0....RD.B.5.8.5.2.1.0.B.B.5.9.7.2.5.6.F.A.1.C.7.A.B.F.C.B.D.0.F.F.2.E.D.B.8.F.7.7.5.7...1..a06..+.....7...1(0&...F.i.l.e........e.5.1.0.0...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........XR..YrV..z......wW0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.0.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\e7230.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148361
Entropy (8bit):	4.513531102455451
Encrypted:	false
SSDEEP:	1536:1IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9r:he
MD5:	6A0980C44594CF379DA9B4ADCE805F25
SHA1:	091B3A9903C23B953F4F1259D64292C6B63657A6
SHA-256:	614EBF155680A09CC08BCF3660C02B9E3FBF925BBA4B25F6829D76A0F792CA82
SHA-512:	0585D5271E3D8393B39DDE76757284CBED85AAF4827C31C108F5AEAF896F6D9B1A8E7E9F9B36C22DE2F87592D1E0357A4D190C3EF3E1B85A6E9AD4D95EF640B4
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........Ct0..Co...1.0...+......0..(9..+.....7.....()0..($0...+.....7......W..=.r@..........130801022916Z0...+.....7.....0...0....R6.C.B.8.B.0.2.F.F.D.2.5.8.9.0.1.1.7.6.6.A.2.1.E.E.D.3.C.B.B.D.C.7.2.D.F.2.4.D.D...1..a06..+.....7...1(0&...F.i.l.e........e.7.2.3.0...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........l../.%...f...<..r.$.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.0.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\e7300.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148361
Entropy (8bit):	4.512876700508877
Encrypted:	false
SSDEEP:	1536:3+IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/0:8n
MD5:	13CC60787A5A3B5DB1B3C5F5214EEAAD
SHA1:	B1C249BC8D2094AE2724C9E8507F4B421EBFCCA1
SHA-256:	FA24E087656D443C781D6CE726EC16183622586859E3D38BC5FD44021CFDCE68
SHA-512:	3F07C7CD3255EA0FBE6D3EB12EC38F14CE269AAAD4C9D37449D1DAFD39B793393FFFB6434CE535478DB9CAFDC33430C793E372AE2FA66F5FA942A88AB7BEE3B8
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........Ct0..Co...1.0...+......0..(9..+.....7.....()0..($0...+.....7........r..WG.....yGO..130801022916Z0...+.....7.....0...0....R2.7.D.F.B.8.2.B.B.5.F.3.8.7.2.4.D.1.E.9.E.1.E.5.3.1.A.D.3.1.5.7.D.9.2.0.8.4.1.8...1..a06..+.....7...1(0&...F.i.l.e........e.7.3.0.0...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........'.+..$....1.1W. ..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.0.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\esb2id2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.514640542725869
Encrypted:	false
SSDEEP:	1536:TIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9K:P7
MD5:	E69A6710C3C87F599B08D2ED00628C90
SHA1:	17FB981EF45FF071352C24FB7A56704849E75D61
SHA-256:	E5C5C613DCC87CA1809EF7A7D55A8C39BE84565155D6DEB6D75A600F05807FFE
SHA-512:	27E2C88413FB7EE5BD1B4268EED19C22C4ED80CF8DB69660CC9458B06D8E4603D7CB41B2C26226F246EBC717BC1154410B9789DCE1528E9B5D7E76C9FF9F5F45
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....&...I..K..V......130801022917Z0...+.....7.....0...0....RD.6.6.3.0.5.3.E.1.3.3.9.B.2.E.C.F.5.2.7.3.D.F.2.0.B.7.A.F.7.0.F.5.C.5.0.6.7.1.C...1..e0:..+.....7...1,0...F.i.l.e........e.s.b.2.i.d.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........c.>.9...'=..z..\Pg.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\esb2ide.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.5138348149632455
Encrypted:	false
SSDEEP:	1536:5IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9W:lf
MD5:	AC93E85223399253ED9C980376490C4B
SHA1:	A07F55125B2115B2928CB816DE76DC5DABF76F3E
SHA-256:	A5E7AD3B6A708E526680A8B3C7E1AB7662A16E367B240267656AD3AC9D70D3DB
SHA-512:	F911665B6FB18CBFCB58AA4F8741831F23F6A8C2698D9E320C2CED6ED9DC38C7AC3B2C3AD95E871D22EDAE13C645E4BB347E6FDC73E8D5EF2C1C2E4D0F0FC6E1
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7..........".E.1.x.b...130801022917Z0...+.....7.....0...0....R2.7.0.2.2.F.F.F.3.7.8.9.D.E.B.0.E.4.7.5.F.B.5.F.4.6.6.1.2.2.B.A.A.5.0.E.B.1.2.9...1..e0:..+.....7...1,0...F.i.l.e........e.s.b.2.i.d.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........'./.7...u._Fa"....)0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\esb2usb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513473157687878
Encrypted:	false
SSDEEP:	1536:NIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/98:p9
MD5:	E1492C6C2F7404C6F3B1486E9E479F91
SHA1:	AB0AF5ACD43595AAE87873D383F7C6F629868C1A
SHA-256:	EBD36A1CAA56C288BBB21E67FC69DB156D169DB9BB7A3257D63138BE1D912565
SHA-512:	FA672D7852369BBDDD5D2C9B6517957B038F999AC9C6AC78475398C08F84705AD37589FD6F4C5771B4E95B63107325D7A96F68A23070335B3F7D8DBF9567EF8D
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......u.XTRgJ.$...'p..130801022917Z0...+.....7.....0...0....RA.D.1.0.0.4.1.7.7.A.1.2.6.3.E.6.1.C.C.2.4.4.8.F.8.F.F.1.B.D.3.3.1.A.4.4.8.3.8.7...1..e0:..+.....7...1,0...F.i.l.e........e.s.b.2.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+............z.c...D...3.D..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\g33q35.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148363
Entropy (8bit):	4.512952331957548
Encrypted:	false
SSDEEP:	1536:+nIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/Z:Ke
MD5:	1637C5F87AF0691436937E91D461357A
SHA1:	04949C573D9EB60547CBB6046AB32F5A63022562
SHA-256:	115070BFC2027B8B84016F0A6E864B311747E12CD3734C17BA16E4CD901DB13F
SHA-512:	0CBE1EE8D651C2B2107A7BD8CA84BB6F5B03B38DBF808FBE4ECEC28598AE6DF9203787F804C8C9931BA7F94AEE9F5A74FC4F1E8DDC9C20DDF78FED26C5477ECB
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cv0..Cq...1.0...+......0..(;..+.....7.....(+0..(&0...+.....7......u...bK..`.lV....130801022917Z0...+.....7.....0...0....R5.5.F.C.6.5.3.5.0.6.E.7.3.D.0.E.F.2.4.1.3.0.9.C.7.F.5.E.3.A.6.3.6.6.5.6.8.B.C.1...1..c08..+.....7...10(...F.i.l.e........g.3.3.q.3.5...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........U.e5..=..A0..^:cfV..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\g33q35.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	12510
Entropy (8bit):	3.6789369712245694
Encrypted:	false
SSDEEP:	96:RBOWu1VM/1z+VwB5m819afG9ax+R9a/R/9aYvxGMpKpralPJCFVWPOHSdaQ+wMy:nXS6tgETXnIfc2TlaQ2y
MD5:	3CBABB025D9E9D616A4E65532F05CB1A
SHA1:	55FC653506E73D0EF241309C7F5E3A6366568BC1
SHA-256:	D1AC4FD46B0125F94BE9BF22C6FB1A5382D65C4242DA3CF227A383D8772CEBF0
SHA-512:	EC368BF659AB793709B803E6617768405819521D865205EF0C16BCDE9626B9779891176C6BFA9752CCE864E33FB315F33E929DB9BDA5AE63C6B1C17278B428F0
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .g.3.3.q.3.5...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3.,. .2.0.0.8.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .8.2.X.X.X. .M.e.m.o.r.y. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\haswell.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.512626731726999
Encrypted:	false
SSDEEP:	1536:dIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9D:5K
MD5:	40941619CB3DB0F51F6D4C32E3C3FD41
SHA1:	88396BADB69CE47C883C656238EC7D0BE3DE6018
SHA-256:	49BACC03DCF6B9A60BFA74C43624365A967AAC56472E110B2A44C8878BBEE07D
SHA-512:	9E5F96F8E1EB84CBD56B4866C2F40DA2E651AD2491848D93CE83927FF3BFD76E5B2F192AFB7124854E078C79BAA590986467F52DD937BD1FBBC3F83107D22007
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7...../d!...TF.F+bG.....130801022917Z0...+.....7.....0...0....R0.F.7.8.6.5.3.6.7.B.A.0.A.3.8.4.5.7.A.9.0.6.6.A.5.0.1.9.0.0.7.1.7.2.7.3.6.F.E.D...1..e0:..+.....7...1,0...F.i.l.e........h.a.s.w.e.l.l...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........xe6{...W..jP..qrso.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ibexahci.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513799310610962
Encrypted:	false
SSDEEP:	1536:FIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/90:xN
MD5:	327FDBD3697E5A5D176A71EE2455E77E
SHA1:	A4F3A40FE48ADCB11BDD4F34D9A75CF952314BD9
SHA-256:	7076911A9E290C5E3E3740E34CDF854C12A31013B956A1C6268ABEC714DDAED2
SHA-512:	6ED92A1C8E3E28962832E79533A183EF2E659B85154DBAD0AE4B51F4EEEF17A0F3617FAB46B86A0E900C9E3668CDC84411F646884F508E2CE2C2B56321522AA1
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....~......@.{...J....130801022918Z0...+.....7.....0...0....R6.3.C.6.6.B.A.D.D.3.7.4.2.5.C.9.8.A.0.7.9.D.8.4.1.B.8.1.D.1.5.C.E.7.6.0.D.3.A.6...1..g0<..+.....7...1.0,...F.i.l.e........i.b.e.x.a.h.c.i...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........c.k..t%.......\.`.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ibexahci.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	13002
Entropy (8bit):	3.6766746066386107
Encrypted:	false
SSDEEP:	96:Rd8PzfVM/1z+VwB5gtAtKbhd+iqitqobqTqQqQqwqkMqX+qc+qpMqBalPJCFVWP/:wr6tgEOtAt25WTlaQ2y
MD5:	2F7051D08DEA2B20510426C0C4C40115
SHA1:	63C66BADD37425C98A079D841B81D15CE760D3A6
SHA-256:	FA3B1F98FC7C1CDC8230921D9E5939B13C609ACA5F57744111EE47103CEC43DB
SHA-512:	BC1DEE06AF46A17941B95281AECEA9FCDC7B9EB6D726443A242CF483967BBF0A6513CFCB81E72CC8BC8DCBEC1AA497B58223E5B133E6169BEF502BDD156AB743
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.b.e.x.a.h.c.i...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .I.D.E. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ibexcore.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.512179261506319
Encrypted:	false
SSDEEP:	1536:bIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9j:nO
MD5:	E255D4083AE0911E07FE32F427E22915
SHA1:	EE2F46FB3877402F85921F9D7CC8FA9086F45224
SHA-256:	4E1088BAF5F29B6F21CDBB488FDCB21AB6C7BF5E398BA71C9F915E2C8270DA92
SHA-512:	83D066AEAA5199DFF83594B78C0D6E576FC784CD057B023BB947EF41BCC0C74140441861E26D85C45ED4DCD364E2189F7CE1EEAA48EA3FE4745D29501F7FE132
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....\|...\.yJ.zK.f!.L..130801022918Z0...+.....7.....0...0....RB.F.1.A.D.0.1.0.5.E.B.D.C.A.6.E.7.3.0.B.E.9.3.D.E.5.8.3.3.4.3.3.3.9.8.3.0.A.7.A...1..g0<..+.....7...1.0,...F.i.l.e........i.b.e.x.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+............^..ns..=.439..z0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ibexcore.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	28078
Entropy (8bit):	3.717187357286976
Encrypted:	false
SSDEEP:	96:RNFNfVM/1z+VwB5vt6xistft6xist28coF/ddxu0QzB+IIyAF+tXF+t6r+tNr+t9:Z96tgEhgvdgvZrHmFbTlaQ2y
MD5:	D16FDBB70E5C124AE1771EA189D09DAB
SHA1:	BF1AD0105EBDCA6E730BE93DE583343339830A7A
SHA-256:	EA3DD9A606D0A7F45E1BDCAC75A04AC9491A27C9BF91AA57EFE0FF4C4E30A9E8
SHA-512:	19098BE4BFD4FA3B9157F79CE882D71893BE34DD0F5CBCA0EF43FC148DA45209F39957D18571A0FFD83979DF4DE7743DA6AE1FD1A1A4461469C230801293E306
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.b.e.x.c.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .S.e.r.v.e.r.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .c.o.r.e. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ibexid2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513109619647383
Encrypted:	false
SSDEEP:	1536:RIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9+:tL
MD5:	7F93AD17EB2B461F657474173A79A6B7
SHA1:	1B74FFD4A80E714E546502EAF068665F094A3E42
SHA-256:	E58ACF7A3EA37C74E4195C488EB922F02B479413705E905C31CA3C7B96E4C61B
SHA-512:	13D32A34289C62450D4349E3228C67FE5D80082F663C92C266A5A772FD272603CC4C1CC7061CAB598292058F8BC97AA45B57DB4FBE7ECD83407DAA6260CA33E0
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.......S..C.D...a.L.,..130801022918Z0...+.....7.....0...0....R3.1.2.8.2.5.B.F.7.E.A.1.9.E.D.1.0.9.F.F.6.B.E.9.6.2.1.1.5.F.5.B.0.3.0.7.6.E.4.4...1..e0:..+.....7...1,0...F.i.l.e........i.b.e.x.i.d.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........1(%.~.....k.b._[..nD0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ibexid2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	14518
Entropy (8bit):	3.6810647713241966
Encrypted:	false
SSDEEP:	96:Rx2nzTVM/1z+VI4/b/jwmQwmiuBPckj8QDH8QD3x8QDtA8QDL8QDU8QDo8QDP8QQ:2v6tgI+k7TlaQ2y
MD5:	AD520A3A7486E7571FED5FD46CD7C5C1
SHA1:	312825BF7EA19ED109FF6BE962115F5B03076E44
SHA-256:	9F40A0CE67B6538318CBDF1A3ED6B1247633F309C69965E81D419F69EE8E803C
SHA-512:	503E766507B42E8AF3437E3E8988E633BA72E74B831EADAE730E45FFB860CC3FE04D1CCED147927A931C2C27FE30BBBEA5F5879D75BA69218AD61E83AFDA5500
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.b.e.x.i.d.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .a.n.d. .2.0.0.3. .S.e.r.v.e.r.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .I.D.E. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ibexide.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.5127728994758565
Encrypted:	false
SSDEEP:	1536:zIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9E:vB
MD5:	986794C79B174E688C056AF448E2F446
SHA1:	B5E68F8F9A988B779EE0938754F24720E2F8E82B
SHA-256:	3FBB0FEB3FE492B8C778CDB40CF961B1653D668E297D3C4CCB1E48694071B3C7
SHA-512:	71F6360E35035BF5663E38392A9D37C964ADA86F6BE0C480378CFA39C649437BC46239F9E0F5CC524083CCE449B3D3ED933E72A42F55040412614A8A9E19B5FE
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7........g..lM....5.....130801022918Z0...+.....7.....0...0....R4.5.E.1.5.2.4.3.F.F.2.2.9.D.0.F.0.6.6.7.0.A.5.B.2.6.2.C.A.9.C.7.8.8.7.0.8.5.F.6...1..e0:..+.....7...1,0...F.i.l.e........i.b.e.x.i.d.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........E.RC."...g.[&,..p..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ibexide.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	13822
Entropy (8bit):	3.66852808084733
Encrypted:	false
SSDEEP:	96:RG2nz8VM/1z+VI4fbfBkj8QDH8QD3x8QDtA8QDL8QDU8QDo8QDP8QDo8QDBe8QD8:hw6tgI9TlaQ2y
MD5:	6B0D146B82C8836F24141DD12F077917
SHA1:	45E15243FF229D0F06670A5B262CA9C7887085F6
SHA-256:	D1517338F7772AEDC0E807CA6622C34923DF68E504BF4BE93E4F804CCF36FF91
SHA-512:	0E16DC99BFC599CF8869FC6DCF57B8E8B43C0255C7A014276FA299DAB59BAF0A5702AD05614A64F07D004D862A21CE52E68FE049AAB1019DBBE4EB57D39AF2FA
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.b.e.x.i.d.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .a.n.d. .2.0.0.3. .S.e.r.v.e.r.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .I.D.E. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ibexsmb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513499245945604
Encrypted:	false
SSDEEP:	1536:kMIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/P:kCE
MD5:	179F96C2E689A2FB6E13E97429BDC0DB
SHA1:	EA1105CA2FC6FAE38668A55CA7C842F988657A42
SHA-256:	2F19E8BF519ED6D53FDE899863FA27CC5E587E6EE95FD66B524829990252C982
SHA-512:	8CA1D668D15AEC7DAAF5B35FF443E4477CABD84F393126A9640BF346AD0DE6CC1FF556B4435A2B1AA398C42DCD8D002870119F0401147479E955496B60B3B6A4
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7..... .ey,..N..0...L...130801022918Z0...+.....7.....0...0....RC.A.C.4.5.6.4.7.A.9.5.9.F.2.3.7.C.E.2.5.C.0.5.2.F.D.B.9.A.4.A.9.1.4.C.3.4.8.3.0...1..e0:..+.....7...1,0...F.i.l.e........i.b.e.x.s.m.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........VG.Y.7.%.R......H00b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ibexsmb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8148
Entropy (8bit):	3.556679397833379
Encrypted:	false
SSDEEP:	96:RqsaAVM/1z+VwB5GhleSIcualPJCFVWPOHSdaQ+wMy:3L6tgEiTlaQ2y
MD5:	8408B220CFDD24CB36270B3F631750F7
SHA1:	CAC45647A959F237CE25C052FDB9A4A914C34830
SHA-256:	B83D609CBAC0B406F616F2A11EAAA4072303690806ACCF8709AE60BC87BED243
SHA-512:	56B8D5EC0B0889674E471F93710BE1F421D3F75D60BC2BFE1FCE939DC35E2B56886C692B1C1AAD02AA864EB3F3B43A4BC8393A30CD0796DC0EA46A2FE91F07A8
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.b.e.x.s.m.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .S.e.r.v.e.r. .I.N.F.,. .V.i.s.t.a. .F.i.l.e. .f.o.r. . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .c.o.r.e. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ibexusb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513533800150837
Encrypted:	false
SSDEEP:	1536:aIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9y:YT
MD5:	451019EF214A1FACB63DE640E31E0279
SHA1:	E15092C1CC76788061685BB35E03DD7B0E42716C
SHA-256:	11E68DAA28A34FE161C0601EFBEB52177CB0F2AC4F43E1AC463288DC8006CF78
SHA-512:	456AB3A05433F50DA722FC8455B4961FD494135E9E8D8B8DDE7CD81C5E279FAA06AF69A6348B0E29FA11ED4DDB302FD9489580A76EC7284C1DCD4B22A256120C
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......0`...J..e(.G5I..130801022918Z0...+.....7.....0...0....RE.1.B.1.0.D.E.C.A.B.A.8.A.2.3.1.D.5.3.B.9.5.2.4.2.A.D.5.9.F.C.5.6.7.8.6.E.A.A.0...1..e0:..+.....7...1,0...F.i.l.e........i.b.e.x.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+............1.;.$*..g..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ibexusb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	18904
Entropy (8bit):	3.702275635418851
Encrypted:	false
SSDEEP:	384:9NgEpE9DNCXdYXVJJQKgrW+1WYaJQKgrW+1WY/JQKgrW+1WYeJQKgrW+1WYihdkr:96sC/F
MD5:	7AA816AA616FE50D44CBE7F8B37F0842
SHA1:	E1B10DECABA8A231D53B95242AD59FC56786EAA0
SHA-256:	9320FC5F47ED3A1A26581AF3FA1052035A8076DED2047869F9045A27619511E5
SHA-512:	B6EB4F119D425B3D502ADC1F053211F04FF612FE7D27791C69DEDB0E4714A25A580DCDDA76677804CAD5563D39248EFFC01FA86049CB96AD23A2B8C717EEDD7F
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.b.e.x.u.s.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .F.i.l.e. .f.o.r. .I.n.t.e.l.(.R.). .8.2.8.0.1. .U.S.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.6.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich5core.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.514161628859979
Encrypted:	false
SSDEEP:	1536:lIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9S:R7
MD5:	8F0A48C298B5BE406FE9DCDDDA09026F
SHA1:	87F9DCD7E2D1103F4AA3A53AEF0A74B12D525CC0
SHA-256:	206348C7190B3E4525B42FCD561C71EA55FE1530D044BA1A1DF5CC10154B086B
SHA-512:	85BEBA15C13BBD5E4ADF8565CF2C0E2323A63BC4DEF40FDD1E13C4A905C1644C22EA88C1C6BB26A142C0C4F5B3608BBF326AD018878CC4F8C98122FC2826316A
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......]".U{C....:.X...130801022918Z0...+.....7.....0...0....R7.B.C.4.6.6.F.6.5.D.E.A.4.C.4.1.4.7.C.8.1.B.A.2.1.E.1.8.7.6.9.2.7.A.7.D.D.5.2.5...1..g0<..+.....7...1.0,...F.i.l.e........i.c.h.5.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........{.f.].LAG.....v.z}.%0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich5core.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	10192
Entropy (8bit):	3.6402283503632322
Encrypted:	false
SSDEEP:	96:Rcc+VM/1z+VwB5Cz8D+tG+tWu+tWk8ashalPJCFVWPOHSdaQ+wMy:66tgEOaFTlaQ2y
MD5:	8DBEA0296E745B02C9876D8A05187354
SHA1:	7BC466F65DEA4C4147C81BA21E1876927A7DD525
SHA-256:	CD1DD77A78F224FE6A4029C44CCF3C51CDD7F8283387159272F8CEBE545F9372
SHA-512:	5FFABBA8383DDD31FD2339EB56E0D92CAA48272C4D6B8A6434C537513C2E3FDF56FEBEF075FAD355B8B7AC021BFD6D6182C9B8183483C55084B0728D991C6371
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.5.c.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .I.N.F. .U.p.d.a.t.e. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .c.o.r.e. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich5id2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513882168969553
Encrypted:	false
SSDEEP:	1536:1IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9x:hE
MD5:	0D959D3792EEE261CFF97CF83F29F1B5
SHA1:	7DB11A7EE400C7310B5F085B32B1202C885998F2
SHA-256:	F7ACDEA654A713A97AC6F9FFED94F26048795B8E7258A34B47DF6F2B784F4502
SHA-512:	B67EA2CD70ADB9E002DE4729F319EE7898ABF4701BED33B4E90D7F8214DC80992A2C3D1BE1C9B841AC5FB25522248F6C185992979DDCFC1C09712F6FCFFBCC6E
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......\|...DG..k..6....130801022919Z0...+.....7.....0...0....RD.A.7.5.1.3.9.3.0.3.F.5.7.E.3.6.D.8.1.6.9.4.4.C.9.7.1.D.5.9.0.1.3.5.A.9.C.6.5.F...1..e0:..+.....7...1,0...F.i.l.e........i.c.h.5.i.d.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........u....~6...L..Y.5.._0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich5id2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8458
Entropy (8bit):	3.556789202555497
Encrypted:	false
SSDEEP:	96:RQ8zaVM/1z+VISwmQwmiuBPckGD9DnDJbxalPJCFVWPOHSdaQ+wMy:86tgImkTTlaQ2y
MD5:	65ED16DFC880049F8AB87099AFFCECB8
SHA1:	DA75139303F57E36D816944C971D590135A9C65F
SHA-256:	E14ABDD76DC1D07B8C85E77E0EAAD84015C510C411FFA4F411764C164EF34FC8
SHA-512:	D70C5776D7E4150408AA0816308907A8FCF6B73B9BBA275B39787294AD3CE3BF5A6C9A6945508A06BD6E35DB00B8001A078207D81421265B52601DDB1F50FF77
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.5.i.d.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .I.N.F. .U.p.d.a.t.e. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .I.D.E. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich5ide.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513506069438266
Encrypted:	false
SSDEEP:	1536:NIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9m:phci
MD5:	6F1D88A5E0603D772C31D72FD6B2518B
SHA1:	C796D038FB8B39E5316D4F5C9C8F5FE71DD1321C
SHA-256:	206F0A331386DFC948173C17367910F9D60EBFB78327214D585CBB30B1ADC328
SHA-512:	9FD9D0683CE895E5CD270B0DB064E5497D88D422B1AFBF7E23A08C62EA6829F5AA7397791B0471421E6220873ED6927A0C09DB05A9FCD45CA115AE288B841CB3
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......m..sX.G.........130801022919Z0...+.....7.....0...0....R6.0.7.8.B.8.4.C.2.0.D.1.8.0.1.A.9.6.E.D.5.4.5.E.0.8.1.7.9.F.9.F.9.9.2.9.5.5.6.A...1..e0:..+.....7...1,0...F.i.l.e........i.c.h.5.i.d.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........`x.L ....T^.....)Uj0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich5ide.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8458
Entropy (8bit):	3.5562076107534
Encrypted:	false
SSDEEP:	96:Rn8z1VM/1z+VISwmQwmiuBPckGD9DnDJbxalPJCFVWPOHSdaQ+wMy:k6tgImkTTlaQ2y
MD5:	69294F8BF02925770EA7970A23E5DF60
SHA1:	6078B84C20D1801A96ED545E08179F9F9929556A
SHA-256:	C1FE3639225F2CBD96247283B7E9AB6BD09DB63F49BD6C473D719D1C40E04DE0
SHA-512:	B57C2B2D3134820A31A05B5D89F0BC5100D933821471D0A5077D79D53B3739A97494507EEA556DD52087517529DA69C3453805691103C4E7D630F9040C7F8FD0
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.5.i.d.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .I.N.F. .U.p.d.a.t.e. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .I.D.E. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich5usb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513416342499832
Encrypted:	false
SSDEEP:	1536:1IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9c:hF
MD5:	812D664C5A2C9194AC212034C0CF085B
SHA1:	77CB7964F27E07BDB7C91947D895D2BD93B51621
SHA-256:	58F3A14DA528D77BEB073E0BE828445BEFF36DA5F999974D390D78183C97E70C
SHA-512:	06AFD23FDF1E099C0283249C532372371935B9FA37289A25E9690A1D4840BA077E949047D30EDD8837BD95507DACEA35A233FD10906632436E260F8A901D8A20
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....u.k.Zf.E....\|#;...130801022919Z0...+.....7.....0...0....R0.6.3.E.6.4.0.E.5.C.C.9.0.3.8.4.1.3.7.9.D.7.E.6.2.E.F.8.B.C.A.A.5.B.7.E.4.6.D.1...1..e0:..+.....7...1,0...F.i.l.e........i.c.h.5.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........>d.\....y......[~F.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich5usb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	15952
Entropy (8bit):	3.710329246280735
Encrypted:	false
SSDEEP:	384:1NgEAYXUdNihoVW5+ALa5VW5jL9VW5+ALayVW5+ALaDhdkBdJlJFpwiHLnr+E0BM:16PC3F
MD5:	1B26FA17963123EBF5578CA2E152F020
SHA1:	063E640E5CC903841379D7E62EF8BCAA5B7E46D1
SHA-256:	CE0428B659D72CC2A88B30FAB06D9140750F5A12E0CBA8D2790F2DA81FCDB9A4
SHA-512:	15EF9636400955CA31235B18B96AC3034342D0911BEB0DAD504E529ECCDE628F08D7B711C7CDBC8BE772FF8C2DBB7BB8C310630DDDA56DABABCA33C403D08D3F
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.5.u.s.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.0.0.0. .a.n.d. .X.P. .I.N.F. .U.p.d.a.t.e. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .U.S.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.6.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich6core.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513197016035512
Encrypted:	false
SSDEEP:	1536:UoIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/Q:FX
MD5:	9D6731CFE11BF1F037116AAD34FA57E3
SHA1:	7A383D5E636566B07F341CFC526B0190F41F3924
SHA-256:	05A45C4094E2D4FFE285048CE4C85819AE309293C1FC98201A3E7D9BD07E09FC
SHA-512:	9C6E9C767BF903F2888402F8BFA60721819B8927276539A9B6C25FD1C2861F8C7668A3097AFDB7DB3EE17B4CE7E96F0BA780A046AE1677D04AA44531178C1EC5
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.......ix...B...J......130801022919Z0...+.....7.....0...0....R3.2.7.7.F.3.4.4.F.1.A.8.C.9.F.1.6.D.7.A.5.6.5.9.7.7.D.4.5.6.2.A.3.1.8.B.7.7.C.1...1..g0<..+.....7...1.0,...F.i.l.e........i.c.h.6.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........2w.D...mzVYw.V*1.w.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich6core.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	10224
Entropy (8bit):	3.6303240386450564
Encrypted:	false
SSDEEP:	96:RHgVVM/1z+VwB56Guz8w+ti+tT+ta/alPJCFVWPOHSdaQ+wMy:e6tgEUGeTlaQ2y
MD5:	1744B11055F22CA922E1A86AEDAA8FD6
SHA1:	3277F344F1A8C9F16D7A565977D4562A318B77C1
SHA-256:	88F9F635C91DEB22D48657FB2B26E8F851E4A7E541FACA8AB25DBDEADBE21535
SHA-512:	B6041C3B795E6964FA6DD52BB831CDA8C6792DC3DDF74C02056009FEB6AF53DEB8852714040AE0761646A4D16877255C1AF384EDA25293D0D042AA501FF23FE2
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.6.c.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .S.e.r.v.e.r. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .c.o.r.e. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich6id2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513655117099038
Encrypted:	false
SSDEEP:	1536:rrIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/Z:r3G
MD5:	46AD990BDE302C6C0B726434E0FDD809
SHA1:	1C766D08A7348B99B71247539DF34195F9A92BF8
SHA-256:	3A7884C19DCF46B526441E109B3E5168DDB56B27A44982A6379439EEE00E2C13
SHA-512:	DAF08C30FE74C1308FA606FBD39962C06116288D666D7F964544C5BA2BC06C48E7D2B4DA9069BAE8FE0597B9020D7286032554B3A828AFE187B895D1AE285A66
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.........S{I...m..j...130801022919Z0...+.....7.....0...0....R1.4.2.9.4.0.F.E.3.8.2.A.F.0.9.8.F.3.1.4.4.7.8.0.5.5.7.1.4.9.9.B.D.F.3.1.A.6.8.6...1..e0:..+.....7...1,0...F.i.l.e........i.c.h.6.i.d.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........)@.8...G.UqI..1..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich6id2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8792
Entropy (8bit):	3.5754939976832993
Encrypted:	false
SSDEEP:	96:RrLz5VM/1z+VIywmQwmiuBPckXD7DvDrDbalPJCFVWPOHSdaQ+wMy:D6tgIGkETlaQ2y
MD5:	C7E10941C0EE916611019429B761DC4B
SHA1:	142940FE382AF098F31447805571499BDF31A686
SHA-256:	B524DC83F30CB47138CD7DD49EC946896C285473D39F82E58B48B67142EE3F28
SHA-512:	EEC711B48805F21F611695F3C57A587400CA12E50EA9C20256992BD50E54BB69DC3233349EC0101900961C2AB2FA251F6A38DB522C90E4BD39546FD8723F0FBF
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.6.i.d.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .a.n.d. .2.0.0.3. .S.e.r.v.e.r. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .I.D.E. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich6ide.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513281224783014
Encrypted:	false
SSDEEP:	1536:OIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9g:chX
MD5:	676CDA6BA68AC94CAFD40B5653401F1B
SHA1:	1B23E96E84C65027A7AD23CFC9951C64B7153F4E
SHA-256:	51AB6E5EB0B38621B6C055A22E9A27826754CB04AF6A00BEC068702E101FC607
SHA-512:	138C3F5630B3A3E52C41A3797559B9F58EF05B34BDBAE54A725F85667A03F7DE4647B78CDAF5DF20DDAB25AB0BD0EAB0D02E4E30F7A6E218652E31D7FAF3640E
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.......Brz.C.n.....&..130801022919Z0...+.....7.....0...0....R5.C.D.E.A.8.D.D.D.7.B.3.F.6.9.6.8.F.1.D.4.7.D.8.B.8.C.6.B.4.A.F.4.2.F.0.2.5.4.4...1..e0:..+.....7...1,0...F.i.l.e........i.c.h.6.i.d.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........\.......G...B.%D0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich6ide.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8792
Entropy (8bit):	3.574975105865057
Encrypted:	false
SSDEEP:	96:RcLzmVM/1z+VIywmQwmiuBPckXD7DvDrDbalPJCFVWPOHSdaQ+wMy:L6tgIGkETlaQ2y
MD5:	4D77E53E627FBEEC5AA0015B4E9024DF
SHA1:	5CDEA8DDD7B3F6968F1D47D8B8C6B4AF42F02544
SHA-256:	563C652B5A5FDFF82A8E126FEA9E88DFD86D226AD299EB51430967377C45A73A
SHA-512:	14EA395BEE7849E018EB91ECA195631261021CB2E2F7F31D0DBFD62F85862407DAEDC7797DB12C7858F325B46A9BB388B706D18C6ECFBCFA39874539CCAA23E2
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.6.i.d.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .a.n.d. .2.0.0.3. .S.e.r.v.e.r. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .I.D.E. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich6usb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513602481470565
Encrypted:	false
SSDEEP:	1536:YIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9r:+rm
MD5:	79CACE7DA58D8BB61A0B98456A829916
SHA1:	C1116BC1C52BBA7DA77AA424471A12415D063B09
SHA-256:	32DB58BD801C327AD7153A5B040F193516D65B90AEEEBF63C1E722C2510B8C99
SHA-512:	2EE5325D2CCCCA4568EE7D478E844047AA25025ABAD60BE83F513A7E48B1F91B1540646CFD8F3E86756204930F9DCDC702DE5FA5FE39B7ABA724EA093C852B76
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.........T..D........130801022919Z0...+.....7.....0...0....RE.1.D.B.B.0.5.9.C.A.F.3.3.A.F.7.6.6.3.C.6.F.4.C.7.8.4.1.8.2.8.F.F.1.C.4.6.C.5.E...1..e0:..+.....7...1,0...F.i.l.e........i.c.h.6.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........Y..:.f<oLxA....l^0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich6usb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	12980
Entropy (8bit):	3.6918744286208276
Encrypted:	false
SSDEEP:	384:NNgEztyXt7AbWOGAbWbAbWO1AbWOThdkBdJlJFpwiHLnr+E0BrRaQF:N65C6F
MD5:	AA55C08A1D37C4C67E2090B234C5A1C9
SHA1:	E1DBB059CAF33AF7663C6F4C7841828FF1C46C5E
SHA-256:	A27A81AD348E4498396FA216D35EF39E7747AE5E0E9608987117CE29549A9529
SHA-512:	E4DE4C995F456CD29CABAC2BA680C4F067C82D2FCFA4EDB3A8A7C2AB5101A94F02FAEF2E275FADF833CCAE8471534A320555C98C9086431CF73E2957C1BC6C5D
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.6.u.s.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.0.0.0. .a.n.d. .X.P. .I.N.F. .U.p.d.a.t.e. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .U.S.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.6.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich78id2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513138533748444
Encrypted:	false
SSDEEP:	1536:8IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9j:yC
MD5:	FE2A94D8D6F9C673714F95F992DF0BAA
SHA1:	FE5CED51E10762CCBA87260DEEBBAAD8A2BEC646
SHA-256:	ACD451D9B9677103C7C33FF73A80B66D652E4B1912FCCCFAB171AB8B0FA942AB
SHA-512:	1F35BCE6BAF36DB0C55C4B0943DF1451B26E7EA73A8327CFFAAC79E0AE84078DF04E08BBBCCD7161E039B71F0AE8ED7168D691B4DE778B5EC43CBF6A03214922
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....^..:,C.E..P.J...130801022919Z0...+.....7.....0...0....R0.A.B.4.E.7.B.4.5.F.B.E.B.7.D.4.C.4.1.5.5.D.1.E.8.A.7.0.E.E.F.4.9.4.5.B.1.B.E.9...1..g0<..+.....7...1.0,...F.i.l.e........i.c.h.7.8.i.d.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........._.....]..p...[..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich78id2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9820
Entropy (8bit):	3.6099063936049993
Encrypted:	false
SSDEEP:	96:RKQz4VM/1z+VIawmQwmiuBPcktQDHQD/Dq8QD98QDR8QDRDYalPJCFVWPOHSdaQF:Y6tgI+k4TlaQ2y
MD5:	E7E6982824515456FDCC5F8C22DEC966
SHA1:	0AB4E7B45FBEB7D4C4155D1E8A70EEF4945B1BE9
SHA-256:	E057E3EE6660E5A9017967681F51184CF86D9DF01A32F23B49728E390C0133DE
SHA-512:	52E65B08A30821FC1B49D1522253CF9ED4440896FDAD8CC594EA174A6F36C396B4D7D116FE34E886DF4B7D8CEAB5499574DD2D61DBAABB0EB155A1F878EE9010
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.7.8.i.d.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .F.i.l.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich78ide.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.512913103447628
Encrypted:	false
SSDEEP:	1536:MIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9d:CI
MD5:	15C7ABDB7B9F8CA0D8E76C5FE13D9F2F
SHA1:	CC7769D79E56A2BCA88A40BAFBFDB7C543F82F44
SHA-256:	8347256B785B87015A34FDE4DF5FD143B62673F65A91D4FDE0D9D20407638C5C
SHA-512:	5E25B02C8EA9934A13568204D55956CE6AC829DD082148BB7F678DA5FA25DC6E7377AC40E84D09774DD73B91AA060FA9B8548D09C4D025F35A8E274086666F8C
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......,U.W.DJ.!U..D..130801022920Z0...+.....7.....0...0....R0.F.C.8.9.E.F.2.5.B.8.E.7.E.B.4.E.6.D.E.C.6.8.A.A.B.6.F.C.0.8.D.9.7.0.0.1.8.E.8...1..g0<..+.....7...1.0,...F.i.l.e........i.c.h.7.8.i.d.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........[.~.....o......0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich78ide.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9736
Entropy (8bit):	3.6177001850533808
Encrypted:	false
SSDEEP:	96:R1QzXVM/1z+VIawmQwmiuBP8ktQDHQD/Dq8QD98QDR8QDRDYalPJCFVWPOHSdaQF:g6tgI+kYTlaQ2y
MD5:	513FEA56E19397C8D767FC15FF398D8F
SHA1:	0FC89EF25B8E7EB4E6DEC68AAB6FC08D970018E8
SHA-256:	F5A75E9968F93AFC6F1F3144C3AE81A4CD285F70D4D5718ECC9361A2426E4D38
SHA-512:	BEC3B5F642A37A80E99A0F637D7FFD101347392B3E9353EFC8DFE0A23CF16504C63520D0E0A7C28300B216DCEE5E5AC94DF1111071E1A3807533716E7FE73CB1
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.7.8.i.d.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .F.i.l.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich78usb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513004159193995
Encrypted:	false
SSDEEP:	1536:YIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9n:+G
MD5:	4F04A6C0FA5F4F4A1A69D33BEF24E54C
SHA1:	43075E702112A6BAF2365A75B055F2938D09358A
SHA-256:	9204BC008FC906889283F023953A85D6C61A68ECDDDC00243E8CE8ACC5D9D2DE
SHA-512:	5CB7C68B3AA50ABCE9E6BA4403023B1DFC1D572EEE20A232766CCEDD23550F5AB57AA947991908273D40AA17707E37AA95649E731AB16D03EC9359DC4EF98328
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.......m...H....:.p...130801022920Z0...+.....7.....0...0....RA.3.F.7.A.D.3.9.2.6.5.B.E.E.C.1.C.C.0.F.1.5.4.1.D.C.7.6.0.F.6.A.6.7.2.A.A.B.9.4...1..g0<..+.....7...1.0,...F.i.l.e........i.c.h.7.8.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........9&[.....A.v.jg*..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich78usb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	17314
Entropy (8bit):	3.7063559331131977
Encrypted:	false
SSDEEP:	384:nNgEldiHd2tXotXrcwLG+XAWlAYkywLG+XAWlAYk+wLG+XAWlAYkhhdkBdJlJFpa:n6cCqF
MD5:	496E4546EB9CA8E12E58023E08B29906
SHA1:	A3F7AD39265BEEC1CC0F1541DC760F6A672AAB94
SHA-256:	1AAEA88A241CF633FEB16FECED4525A6605329B58AA3D5D07E84A2F57293D4D0
SHA-512:	9A101DA0474F730049DEF81610DD7B273912D443ABAC99623FC8B9D00EB69BFFD387427BA2A21B4FE53BA49E30D562E46D82E461372696D8620B4CCEE824DBF3
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.7.8.u.s.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .U.p.d.a.t.e. .F.i.l.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .U.S.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.6.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich7core.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.514261947623607
Encrypted:	false
SSDEEP:	1536:EIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9H:Khg
MD5:	17E47F8558CAFFCE856571C7E482D8A3
SHA1:	2A073113BCE5F9A0E574EA0F207A80B1A5A66BA2
SHA-256:	6CBC92C2F847923F35FD95E355E0ED16CDE552C359B605B752824DBE1EB5908D
SHA-512:	DCF7414EB0E9C65EA77D232195D30A60EB509F7EE9375FD08786990C379A5F9848150E1987381194CA3BBC9E0EFECFF01B4BA46F4685A38C3462ECC430BCDC87
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....7).C./.N...=.I4...130801022920Z0...+.....7.....0...0....RD.C.6.2.C.B.6.6.B.4.C.D.4.4.9.7.A.E.A.4.9.E.9.9.8.3.3.B.1.C.0.3.F.7.3.B.C.8.A.C...1..g0<..+.....7...1.0,...F.i.l.e........i.c.h.7.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........b.f..D......;...;.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich7core.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	11498
Entropy (8bit):	3.6637460381183784
Encrypted:	false
SSDEEP:	96:ROgsVM/1z+VwB5c4hWu4hWU8cs8m+tv6+tC+tq+t/alPJCFVWPOHSdaQ+wMy:u6tgESEWuEWS76TlaQ2y
MD5:	CA370FFA5C2948414EA2F529BDB28182
SHA1:	DC62CB66B4CD4497AEA49E99833B1C03F73BC8AC
SHA-256:	EEE8A7B482E6583F7A4E46EFC2C8D409F2B8862C6995D643A63BAE2AA96B1AAE
SHA-512:	19392F421D16768A4146D0A5FE45ADCE1158270647F83528C466341EC8710283079950CDF594764FF6858BE3F52FCD13B554A42888F9BD6AD906FBB45E209EAC
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.7.c.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .F.i.l.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich8core.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.512972928967156
Encrypted:	false
SSDEEP:	1536:3IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9K:Tj
MD5:	70919245C227D94FD4CC61FE1433C4DE
SHA1:	E2A6C1793D82C39815276298EBEC42C39601303F
SHA-256:	2133DE2E78D468EAB5FFAB5D06574456187EAFC890612A6BE0CCCB423779016C
SHA-512:	7057D400B365D78E3B5C7E672F6EAF00999C379A1D0C6C7B4263AD1F4F98687645EEF52A7CE0919AAD85D31DDD62B72089CFF12990B696C896A0E632B41C2E03
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7........o.j,H..BO..^x..130801022920Z0...+.....7.....0...0....R6.6.3.4.E.1.3.E.F.4.1.F.5.1.2.F.E.4.1.D.D.5.0.A.A.A.1.A.5.6.5.C.6.3.D.3.7.E.6.A...1..g0<..+.....7...1.0,...F.i.l.e........i.c.h.8.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........f4.>..Q/......V\c.~j0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich8core.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	12134
Entropy (8bit):	3.667095591733993
Encrypted:	false
SSDEEP:	96:R5WV7VM/1z+VwB52jYjc8cUQXnD+tco+to+t++tB+tqalPJCFVWPOHSdaQ+wMy:+x6tgE0jYjyXn6TlaQ2y
MD5:	8656A78991FBF84CDEDAF5CBB7319922
SHA1:	6634E13EF41F512FE41DD50AAA1A565C63D37E6A
SHA-256:	0522B2D9D8EC947900BD60777ECA2D52CE3804A5D50FD3F1A656CD132998D616
SHA-512:	63DB991F5D4C68A5589792FA73EA5DBE57DFA3D03AF3CC18A81A6DEA31355D3004519073E2185BBCB25436A84EF70234736EFF17BAF08ACFF5DBA7FED7C0AC2C
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.8.c.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3.,. .2.0.0.8.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .c.o.r.e. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich9core.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513213879069047
Encrypted:	false
SSDEEP:	1536:JyIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/d:mC
MD5:	411A36C3A680DE7B6DDEA05DAEE17A71
SHA1:	1D61D17D2803B22911B5D35914301AEFB36D8A6D
SHA-256:	6E1D3F88FF843F3B824B3606409E67015092BB4B262E68D9BFD9CFEF29ADF953
SHA-512:	A0F370F5B16F2695FB1C945DF93BAF58CD0C378F8316B48431DE7F1836C50F20F6E9673D3BFFEA606E1ACF3AF0C446BCDD41687A395AA5DC215D29A2C9FFBB3A
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......)..n..C....Y.....130801022920Z0...+.....7.....0...0....RB.0.8.1.E.5.7.B.1.4.5.5.3.7.4.F.B.6.1.0.E.E.C.2.6.F.6.1.5.4.A.8.8.7.0.B.8.8.5.9...1..g0<..+.....7...1.0,...F.i.l.e........i.c.h.9.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........{.U7O....oaT....Y0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich9core.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	20370
Entropy (8bit):	3.70930779787876
Encrypted:	false
SSDEEP:	96:RgWVyVM/1z+VwB5sIi8c1kcec6cecScde868e9sK+tu+tT+tp+tK+tO+teK+tO+2:/I6tgEiIjcec6cecScde868e9qTlaQ2y
MD5:	BC7FF14DDA8CB5DF1FC5F5E1BFEE7491
SHA1:	B081E57B1455374FB610EEC26F6154A8870B8859
SHA-256:	791623F421C6C6CACBAA1B04D339C23EA527471A970AC65B7A81940CB9D655BA
SHA-512:	A062B227766217A3E55B8B13A12118667453E5047CD2B9CB29336A8A2CEB29791F01FDD0CCFF844958B6150129D7A3D5BD40AAB4F86607B4CAF0170D439E21A2
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.9.c.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3.,. .2.0.0.8.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .c.o.r.e. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich9usb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.5139107830571
Encrypted:	false
SSDEEP:	1536:UIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9B:aA
MD5:	3C23B82154821D7BB41699D2B825E24F
SHA1:	F6D1962B515E1FB81DFC920E4DB3EF98DF3F2C4D
SHA-256:	9C35374FECB749FD8B6A76AE61EE61BF5C8E810C5719919B45A1ECD52FB187CB
SHA-512:	DBC0F24686949B5BDBEC34EE575830FCC61C9E841C687BA824DC7D933B4ACBD247DD3F2BE877A942AB71726EE4CA66169C74F9072E732918EBD2AB506464E967
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7....._{...A....9.....130801022920Z0...+.....7.....0...0....R7.6.3.5.0.7.F.8.C.9.D.6.5.A.1.9.2.5.4.C.B.6.9.6.4.C.9.E.4.B.F.C.0.0.8.A.0.2.9.0...1..e0:..+.....7...1,0...F.i.l.e........i.c.h.9.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........v5....Z.%L..L.K.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ich9usb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	12652
Entropy (8bit):	3.6741951378589883
Encrypted:	false
SSDEEP:	384:FNgE/dn9zdCUPwmQ6wJ7ZwmQ6wJ7ohdkBdJlJFpwiHLnr+DRaQF:F6HCEF
MD5:	80F2544F8E2DD909FC9E5ADB3F98D691
SHA1:	763507F8C9D65A19254CB6964C9E4BFC008A0290
SHA-256:	4C0D53CE4B29269A94E8345458415A329A65914C09D4965007AAD2689D9F32F5
SHA-512:	C5372E974AE52713A82E9B93AE0851D5269067231AC792F71610EC655C011C958BB1BEB6EDC7BED67CD2EDBDC5BB95805B4879D1ADF52EC11D904810CA232F65
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.9.u.s.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.0.0.0. .a.n.d. .X.P.,. .2.0.0.3. .S.e.r.v.e.r.,. .2.0.0.8. .s.e.r.v.e.r.,. .a.n.d. . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .U.S.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ichXdev.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6450
Entropy (8bit):	3.392934208178725
Encrypted:	false
SSDEEP:	96:RvNg9VVM/1z+VwB5lzalPJCFVWPOHSdaQ+wMy:pAV6tgEiTlaQ2y
MD5:	76702791ED6B509F622EDB49A3E5D578
SHA1:	33439F332B5BAF910F8D8882EA877A36CDC0B59D
SHA-256:	92ECD3115ED9F679B562F5D99786F21D34B6B291717A3F7D9F2E81FE695DDAC1
SHA-512:	6D783A2BB072FDA1E9387E70ABE511ECC4726ACCF02DD7596FA133292877EA871087E0A4C32E3D9FA368639CE0BAFAF4663C156C3D9471BFCA7B97C1DA73B813
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.X.d.e.v...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .S.e.r.v.e.r. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .c.o.r.e. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ichacore.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513487191015232
Encrypted:	false
SSDEEP:	1536:UIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9h:aU
MD5:	A990A4E7FA4143CBF2B48E6A35498DA4
SHA1:	8EED05AC41A5467990FCA8757187A7590528861A
SHA-256:	30BF1E9BE9E3AAE3B76648B5AA306FB2F95A1E0A7BE20D17FC36234BCABD0F3C
SHA-512:	EB86B712D165C9AFE502A82537621698AF80FD4BC3A30114A5059CF2795927307217069069F956998607590FE759EA4EC52CE4EE779E74749F3A5DB0160AEC35
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7..........o.N.!...Nu<..130801022920Z0...+.....7.....0...0....R0.D.5.F.F.1.6.D.F.1.E.B.1.D.7.9.5.2.5.F.A.3.E.6.1.4.1.8.1.0.8.F.8.F.3.0.0.2.E.1...1..g0<..+.....7...1.0,...F.i.l.e........i.c.h.a.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........._.m...yR_.......0..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ichacore.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	23182
Entropy (8bit):	3.702394667247857
Encrypted:	false
SSDEEP:	192:Zg6tgECPBRqdSn8xm7Ql6yW5uPBRqdSn8xm7Ql6yW5s+ses6sesicteIb6seZENI:OugECPBGPBkZ9eRaQF
MD5:	547B9A01A8C70B4DA1E0C857051B39B6
SHA1:	0D5FF16DF1EB1D79525FA3E61418108F8F3002E1
SHA-256:	2F02530DF949E7FFB291BC705DA78AF8FBB87C817AFE70561D16F5EBF942B4EA
SHA-512:	A57CC6E830441AC1827EF707B96C63D568DF9BD40B6CE3EB304538CE11388769050E853B37F5AED4E5D83BAEB13C49ACD1323115C7BFDADB2BDACF57DE61DE76
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.a.c.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3./.2.0.0.8. .S.e.r.v.e.r.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .c.o.r.e. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ichausb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513433951361258
Encrypted:	false
SSDEEP:	1536:RIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9M:tN
MD5:	E5F67DFFA5BCB9B6024A3639B49D6999
SHA1:	858B1F5ED118B8E871791E473AD6E487C265FEFF
SHA-256:	5DB6580B1069AD84F0ADC09E48E7B178D7766653D67FA94EFE1BF146FCDD091A
SHA-512:	DF4C6E3D2CBF2087FC847178BBA09DAADB062DE74D2CB7461F378D9FE4C74BABC5DDDD6116217A667E96D3E64E6E3CCDF937A06F66B35DC2E0B2E21F9CA3D2E8
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......6.g...G.%....Bp..130801022921Z0...+.....7.....0...0....RB.0.C.C.3.8.E.1.C.E.1.3.9.A.5.1.7.9.B.F.0.F.8.2.5.5.8.6.5.B.D.2.9.D.A.0.0.B.0.2...1..e0:..+.....7...1,0...F.i.l.e........i.c.h.a.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........8....Qy...U.[....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ichausb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	18184
Entropy (8bit):	3.7128952559364223
Encrypted:	false
SSDEEP:	384:j4gEb9HdT9iUsd39DtiEoQGwaQp7hw2QKApriQGwaQp7hw2QKAprrhdkBdJlJFpQ:jvHC0F
MD5:	78DC97F7D72863E1BB2F3EF7EC5A2ABE
SHA1:	B0CC38E1CE139A5179BF0F8255865BD29DA00B02
SHA-256:	C8EA26F1C24EA15C89985454E6616B5AF73658C3E9B32E156051D5A04B49056F
SHA-512:	8635721CFA640C3B2B4A1EC96C0C25373D4349BEBFF977BBA0F5B492BBA6BF928808188B7302E3C8229F099182F3DBC76B568183CD1CA6AB255D5CD61D3A4BFD
Malicious:	false
Reputation:	low
Preview:	..;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.6.). . . . . . . . . . . . . . . .....;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.a.u.s.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.0.0.0. .a.n.d. .X.P. .I.N.F.,. .2.0.0.3. .S.e.r.v.e.r. .I.N.F.,. .V.i.s.t.a. .U.p.d.a.t.e. .F.i.l.e. .f.o.r.......;. ..*. . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .U.S.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ichxdev.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513689666897898
Encrypted:	false
SSDEEP:	1536:zSIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/p:Eq
MD5:	C53EE556256600126DEA1F8C93F516AC
SHA1:	B71DB5F32355BCEE6289737D55A605EADEFD9852
SHA-256:	36800385A5A76D1A0DD1BAC0BFC75921E1424E584BF318FA263ABFA21CC96805
SHA-512:	FC3D7E90EA3B4150C3F91714664E46EB68995829D02DD49556168EB31A3A6B8CAB78D9A938D45B88E361B5D46815421AC8721E5B2D59B89D8410A0CF53D2F837
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.......~..>F.]G.)..F..130801022921Z0...+.....7.....0...0....R3.3.4.3.9.F.3.3.2.B.5.B.A.F.9.1.0.F.8.D.8.8.8.2.E.A.8.7.7.A.3.6.C.D.C.0.B.5.9.D...1..e0:..+.....7...1,0...F.i.l.e........i.c.h.x.d.e.v...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........3C.3+[.......z6....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\intelcp2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513873604676116
Encrypted:	false
SSDEEP:	1536:EIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9g:KN
MD5:	B462016F4461AF4405207E8D0DE0EED7
SHA1:	B8EDF975A9C05E23DDF17B3A280A10BD7DEFCA90
SHA-256:	63C008B92C0B912CF1ADA6F66F272987FEA13068F0086798C586AB9748C1C226
SHA-512:	6273C9B15D2066F512CA45F9D72760728692932A67D2479824316D6E3E338B367BC9D144A235E6D467C859AC43C44FD55BAC9D94C8DC51FDFB7F37C2FE02F44C
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......PEh...C..w.i....130801022921Z0...+.....7.....0...0....R0.3.5.5.8.E.E.0.2.6.C.7.D.1.0.1.9.B.4.A.1.3.8.D.D.4.B.5.8.B.8.A.E.3.9.2.1.1.C.4...1..g0<..+.....7...1.0,...F.i.l.e........i.n.t.e.l.c.p.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........U..&....J........0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\intelcpu.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513446290906662
Encrypted:	false
SSDEEP:	1536:sIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/93:iW
MD5:	1DB3F0CDE2893DF455C4395482417B1C
SHA1:	C6E99433DC6FFD07BA6EB682BA93949E54D7EBB0
SHA-256:	F4617006CE124978018288AD8E0DCEC382105AB655B4FFC78B5255DE60261F26
SHA-512:	FAEC41301B2AE3A11AE076AD8E221BDDCCF7D349B6DB54B45187E5B85F622484E9AD70F859F74F6DDAE620970E613EE7F8183AAF63416539B41C61CAD4C38709
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....z....T.L...%......130801022921Z0...+.....7.....0...0....R1.6.5.9.0.0.0.1.7.6.C.A.C.9.2.0.F.A.D.F.8.9.5.5.B.B.4.D.E.F.0.1.2.4.E.6.0.E.2.C...1..g0<..+.....7...1.0,...F.i.l.e........i.n.t.e.l.c.p.u...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........Y..v.. ..U.M..$..,0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\intelioh.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513975505181807
Encrypted:	false
SSDEEP:	1536:wIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9c:mt
MD5:	F6A43E22A506A260ECADE2035E081794
SHA1:	3FDDFFE3DE224507E1C5E4BA62D731394B179C7A
SHA-256:	5EF8A8104F108D00DF6F3C7469EFF465B7588C1D39194829F9DB47C277E733A4
SHA-512:	77BD9AABE76C1EBEA801002D314B1F4D438655DFA4AA077398D7A217CCB69898B180698B9BA1278D3D06F582E79C1A028279A08DD7C54C207E58B2ADA7BC93C4
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......+.....C....I.....130801022921Z0...+.....7.....0...0....RE.D.8.1.0.F.F.B.4.1.5.B.A.4.4.C.F.F.B.F.D.E.4.E.3.A.8.0.F.A.4.D.6.7.8.4.2.D.6.1...1..g0<..+.....7...1.0,...F.i.l.e........i.n.t.e.l.i.o.h...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........A[.L...N:..Mg.-a0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ioatdma.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.5137844730237475
Encrypted:	false
SSDEEP:	1536:rIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9G:37
MD5:	E36798320580B04EF02859E4072948A4
SHA1:	C7D82A1C640C0B5439C1C0398ABB55A522347D2F
SHA-256:	CEF780C562979EF8986C2D7A50B013BAE19B507FCE7F39424C72BFDE8B496D39
SHA-512:	6041D1352481E2E78EC3D565370965B381BDBBF71906A24F29FED7619102B0DC48F762E0BA87B0B80E38A5DE58F8FD925175751F164A9E1E1C7134D3FD6A7511
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....w.....4O.%.@..tc..130801022921Z0...+.....7.....0...0....R9.7.5.3.B.2.8.9.C.2.2.6.C.1.F.C.C.C.2.3.4.1.4.7.3.1.9.8.F.1.4.7.4.3.A.8.4.3.D.F...1..e0:..+.....7...1,0...F.i.l.e........i.o.a.t.d.m.a...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........S...&...#AG1..GC.C.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ioatdma.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6684
Entropy (8bit):	3.431882186229182
Encrypted:	false
SSDEEP:	96:RUBeF0M/1z+VwB5/jadBalPJCFVWPOHSdaQ+wMy:SoFHtgEvTlaQ2y
MD5:	B5F1EE87FB0172302A5A4194B3CD294D
SHA1:	9753B289C226C1FCCC2341473198F14743A843DF
SHA-256:	4DDE563A61197DF44D8571F37767095931E6C4CEEB5B525A8704E7921CB1965E
SHA-512:	58B101E1EEB4C5BE03E7F26A40E2A464E6B003BE856671A464C2EC75D6F5B2C04917D229B0D517262C591DC5AC3818A188A039C78C75E6D08BE5634C4FD03998
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.o.a.t.d.m.a...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.6.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ivybridg.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.514118897292868
Encrypted:	false
SSDEEP:	1536:4IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9S:e/
MD5:	876FF80F5021C5E2E780D2326110FEFF
SHA1:	7FAE9DEECA1CF861377CF278001FEEB45CF76E61
SHA-256:	936A72F33EE35AC31EE033C67205A2D9F12A89918DE6E48DE65E84A704076922
SHA-512:	9085B356E2B550A0E90C37A32912517AA5887D54FDF68841482D44F7D08C9BA4EE393A533FDA014636D3E5D9FF17E6A8401BA3771A3BA973BA1DC729FD8F9A28
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....).@..^kL..9.N.)..130801022921Z0...+.....7.....0...0....R8.3.B.D.0.0.C.7.1.6.F.1.1.6.9.D.2.0.B.3.1.4.2.1.6.E.9.D.9.D.7.6.4.2.D.0.E.2.E.C...1..g0<..+.....7...1.0,...F.i.l.e........i.v.y.b.r.i.d.g...i.n.f...0E..+.....7...17050...+.....7.......0!0...+................ ..!n..vB...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\ivytown.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	147045
Entropy (8bit):	4.517388701238824
Encrypted:	false
SSDEEP:	1536:Zt0kD1nmOHa4hlIYsB9NpBFlO2geM+/wGCrbY2B2PzbHQjkM/RZ90KVDM0YVrX0G:A9
MD5:	84C1D634172CDF3A8AC888977873CDF1
SHA1:	EDF7A3BD6232CA125A3FC6CE1C2C3234598E49E4
SHA-256:	0665D602600D68C640C76A18CF173AB7DF70DC249C2D0273CCC3BC7071B6B840
SHA-512:	70F2EF956D36D3376B59FE01BB6A2A8C51E9AFBC1EC897AB0F93C5AD586BE030221DFA9537CAA15C222AECB4BA960A0D3DB4DE8083116D8A9F773BC56A95EBE2
Malicious:	false
Reputation:	low
Preview:	0..>`...H.........>P0..>K...1.0...+......0..#...+.....7.....#.0..#.0...+.....7......zq...K.];.0E....130729171832Z0...+.....7.....0...0....RF.C.3.5.6.F.0.9.B.5.6.8.9.A.5.6.1.1.E.A.3.B.B.8.E.F.5.7.2.3.2.7.9.E.C.5.7.1.B.2...1..e0:..+.....7...1,0...F.i.l.e........i.v.y.t.o.w.n...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........5o..h.V..;..W#'..q.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3...... .0.. .0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.4.5.6...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\jaketown.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513385490875967
Encrypted:	false
SSDEEP:	1536:TIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9A:P5
MD5:	D5AECDC5C32CFAD983C35DC850D799BB
SHA1:	68B6EE76BBA80517FC6185638D21883D29D95EFD
SHA-256:	D5871F5132CFFC152C72205294F9375C1FCA2A34AC5636B280C0EF48FD1F25D0
SHA-512:	BF9F996F0D8E32B9FAD1FD0463E5407FFD453C7B7DBF18E9F5732A5C3EBE07BE34E6F84E77AA4966ABCC275E2D315D9D9F9B61B283E21455A2EFA1CAB26BB2BB
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......,.Y\|..A.... q.Z..130801022922Z0...+.....7.....0...0....R9.F.4.2.6.E.5.0.3.6.C.5.7.A.2.5.6.5.3.6.3.7.F.7.D.5.0.4.B.C.3.F.C.D.B.D.4.E.A.C...1..g0<..+.....7...1.0,...F.i.l.e........j.a.k.e.t.o.w.n...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........BnP6.z%e67....?.N.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\jasperfo.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.51456288041575
Encrypted:	false
SSDEEP:	1536:NIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9/:pS
MD5:	CA334590C26EB275855BD81AE7584BD7
SHA1:	20B14E3418E8A0149696E2B95652A18A857BE69F
SHA-256:	AFD190E206A0265F6ED6C4ED115CA23A5382BAC8C253227699B69B3CB687F8F2
SHA-512:	BFF19E5762AE38DF62CF27FEB979784DF893EBF0F9EC3E776760B884270E42CBD6D4C64D77FFCA9F750CDBFEAB45123DBCAE446A92679F6D143353E8CD29ED7C
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......z.WKfaJ...s..\x..130801022922Z0...+.....7.....0...0....R0.A.8.4.1.6.D.D.2.E.C.A.4.6.A.C.8.7.C.4.4.C.2.7.5.6.F.0.8.3.A.9.C.5.2.E.E.1.F.D...1..g0<..+.....7...1.0,...F.i.l.e........j.a.s.p.e.r.f.o...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..............F...L'V.......0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\lxlpahci.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.514228098056477
Encrypted:	false
SSDEEP:	1536:qIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9C:of
MD5:	83FC3960EFAE6F7C537B3F4851E651DD
SHA1:	109E892A80CEE1B20E74624DA479AD04F070A222
SHA-256:	E8F17601BF0764959CB848D197D6D2EA8F584181CE02EC6C06F3DEF5E44D084F
SHA-512:	D535C197AADBD5A14660D69FAF34457E75F428501AF14672DF91EC2B69AA461AB15954F4EC197129B664E9993960F5800BF27A7F8191DD667F78B37CC9AA76FB
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.......U..o.I.b.9.}.a..130801022922Z0...+.....7.....0...0....R8.7.4.0.3.F.F.3.A.D.D.F.A.1.7.7.0.9.3.6.C.9.4.3.6.A.1.8.7.A.C.3.B.9.F.B.C.8.D.E...1..g0<..+.....7...1.0,...F.i.l.e........l.x.l.p.a.h.c.i...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........@?..w.6.Cj.z....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\lxlpcore.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513990256882763
Encrypted:	false
SSDEEP:	1536:vIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/93:bi
MD5:	71EF9BD6BA3610BAA5176703183E2B6A
SHA1:	9B2D323D139C33B87FCD7CAA6D34DF8E1A4AC9C8
SHA-256:	681F55A5D7956594348DD9FE879B1807618273F37D13F6B475C7AAC366AFD449
SHA-512:	0E532B2E8BFE98B770C613726C3DCF2749F64E5B5CB57CF5BEB1AB535F41AA6670B23F9EEFCE4B80BD0A868CFBDA2410E1DD1F54B13DE841B7572DDA3D9326B9
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....2..u.^A....h."...130801022922Z0...+.....7.....0...0....R0.7.8.A.7.2.E.D.3.5.1.A.0.D.1.9.B.F.4.6.3.C.D.5.7.F.C.D.8.1.9.F.0.5.D.9.B.C.F.D...1..g0<..+.....7...1.0,...F.i.l.e........l.x.l.p.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........r.5....F<.......0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\lxlpid2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513213891476564
Encrypted:	false
SSDEEP:	1536:bIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9+:n3
MD5:	8C6CA3303C4133D1CA298F679076186E
SHA1:	FF7DB62E4948439230C883DDBEECA4DC040208E2
SHA-256:	0B6F829D6C747EB4FF4FCFF9033773A2310624923C2248069D4599C020244124
SHA-512:	57E5FC53DAD9177B4D95A560B1EAA004BE9A707440E25CD4A19C5BCB09F1655319E9375DCBC5CF5D6FBDC73EAC60FAE29079359D84AFACF05CA2C831F3C5C89D
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....)....v.J.....+....130801022922Z0...+.....7.....0...0....R0.2.0.8.D.7.C.A.D.9.5.3.2.9.7.6.7.4.1.0.8.F.A.E.7.D.F.E.3.C.9.B.C.6.E.2.3.8.2.A...1..e0:..+.....7...1,0...F.i.l.e........l.x.l.p.i.d.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.............S)vt...}.<...8*0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\lxlpide.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513197389125169
Encrypted:	false
SSDEEP:	1536:3IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9b:TO
MD5:	58E14B5EB263261819347F75DBC01539
SHA1:	CE73C6C477D86C0043A74FAC41041138F9F15CD5
SHA-256:	F391945DE33F4A363489DBFA3EAB2904B6B992B54E5CDCD9DA95812F65FCE08A
SHA-512:	46B06E3E985DBC4FFC91153D6C8229EDBAE016F1489090D52FB87E59D2E5A6E26B0B07190A1F274F6275D7A4E32B1CFE813E6896D4592E736DBA18C4EF27A256
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.......g6{.=F.f..}.....130801022922Z0...+.....7.....0...0....R6.7.F.8.6.6.0.7.4.0.0.1.E.D.7.7.B.F.3.E.5.7.1.5.5.8.A.C.C.B.1.8.D.9.B.D.4.D.9.5...1..e0:..+.....7...1,0...F.i.l.e........l.x.l.p.i.d.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........g.f.@..w.>W.X....M.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\lxlpsens.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.512983375962746
Encrypted:	false
SSDEEP:	1536:cdIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/Q:o/
MD5:	69B463C1FD7B543697AFABAE08F8D8F3
SHA1:	D347329626A6C4D8162C4C2E89DF53DBFC2BBB78
SHA-256:	AAEF6B37D5AEAFE1275E12AB83E302D65A9FFE168273C3DA12D21B9087425C1B
SHA-512:	5AC730BF5C72505485E0BE26747710DB20D60FC424C8B076FE2873632E77DAB12D5671B4E939ADEBE007D2783D1EE04A8D81B178C09A1130C0A395EBB755F9E3
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....u\|..!9.@....]b.~..130801022922Z0...+.....7.....0...0....R4.1.7.2.F.1.7.C.9.7.A.6.5.5.D.5.4.4.2.4.E.6.A.C.2.A.9.D.5.7.3.D.7.5.A.7.4.0.1.2...1..g0<..+.....7...1.0,...F.i.l.e........l.x.l.p.s.e.n.s...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........Ar.\|..U.D$.*.W=u.@.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\lxlpsmb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513695473964375
Encrypted:	false
SSDEEP:	1536:BIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/97:de
MD5:	E2F0A09C8712A5405DE8A4677E09C3E2
SHA1:	DB351412182C8E8F87B11361FD2C6CD4E52B84EE
SHA-256:	FAD8175DDA8F6A40DB3BE84ABA306D904A1477D72DA6B3110159125DB9E0F6BE
SHA-512:	D33AA18E052E3EA05EF427EACEA090EEF72D715E1FA737CE41CC677A039C556AB468270E8E04FFCD73E2838426F1D27C51E1C098CC1D74D990B86DE1F907A665
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....^O.....H..5..9.<..130801022922Z0...+.....7.....0...0....RB.D.B.D.4.0.0.4.7.2.7.3.5.9.3.2.E.1.5.2.8.6.A.C.D.0.0.A.1.D.A.1.8.5.6.D.2.B.6.D...1..e0:..+.....7...1,0...F.i.l.e........l.x.l.p.s.m.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........@.rsY2.R.......m+m0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\lxlpthrm.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513251085176305
Encrypted:	false
SSDEEP:	1536:WIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/97:U2
MD5:	8232938E3AF079AACA221BDDB23E2E5B
SHA1:	F34CCD651AB114DB3922706887F3CA4A6AA110ED
SHA-256:	4E7AD9F3DED7E19EA6F21EC98B6C5E65921A2E1F38F78C54FB2A5D1E3E8FBBB9
SHA-512:	023886C3A3DBFBB17976BBB345238A6E8073DE8DAB1A5F9FF2E574C6A5873933226E777CD003A2F2C02927D27B829756E0C7F8C727F8CFED8C7F6E30197FEA26
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....L.F...L.SN..>....130801022923Z0...+.....7.....0...0....R8.7.7.B.5.6.2.2.4.9.D.0.D.6.A.3.6.3.4.4.8.F.1.F.E.E.0.D.2.9.1.7.7.E.7.6.0.0.6.1...1..g0<..+.....7...1.0,...F.i.l.e........l.x.l.p.t.h.r.m...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........{V"I..cD....).~v.a0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\lxlpusb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513457699671097
Encrypted:	false
SSDEEP:	1536:0IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9M:6V
MD5:	F1C87150C66B612C9EDAFBD1757C238A
SHA1:	C14CCF73E41BAB53DE548BD33DDB390179B9C2E3
SHA-256:	2363BF995CC74E95E952B048865BE42C901F46C69D4B71D7542ADD97BB236E05
SHA-512:	2426E9069C0DD73A73511D5312AE47A622BAE2961661DC73972405429CAB08F022A926B4D3E8B0F9643807B0EA753267ACFDF160E23F67592135A45CF6360F08
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.......2.{I.J..\|..+...130801022923Z0...+.....7.....0...0....RA.6.9.9.5.A.7.7.D.2.6.D.0.B.0.2.9.2.A.9.C.3.B.4.8.7.8.8.3.6.D.2.3.2.8.9.9.F.E.0...1..e0:..+.....7...1,0...F.i.l.e........l.x.l.p.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........Zw.m.......6.2...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\lxlpusb3.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.5131086739018675
Encrypted:	false
SSDEEP:	1536:KIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9W:ID
MD5:	012AE1BF52D15A8BDAB4DCBFEE58980D
SHA1:	7B31A94CAB0A5EB71A055CC0B1150216D727CE56
SHA-256:	BA0F0C3F145626A3E187D63D7512A243B7AF397776F968157C45E9D35F740FB3
SHA-512:	635A6FFA237AB3A2CF7AFEFE3DB804F76324EAF684E2CEAEA089E3A26FB0581C98265F379BEFB77125E8A3F19273A5E301881D05B1B631842EE8D0725C25117A
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......l.=Y..H..q.2.....130801022923Z0...+.....7.....0...0....R0.7.6.A.9.5.3.D.3.C.2.4.4.F.B.C.8.3.9.0.E.F.4.2.F.8.2.8.5.4.A.3.9.F.7.9.6.A.6.F...1..g0<..+.....7...1.0,...F.i.l.e........l.x.l.p.u.s.b.3...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........j.=<$O....B.(T..yjo0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\lxptahci.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513998771617217
Encrypted:	false
SSDEEP:	1536:gIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9o:WV
MD5:	099DCD7E95EF2ECA45208AD0E6FDC9D0
SHA1:	26051B30A03B0B23D43269E32244E4811601902C
SHA-256:	8DAAA0A937B57543B06DA7721F614802D1F6624520A438072B3D8FC6AADC78F8
SHA-512:	9B97AE7BEA64E45046D828DB799A44E00CFEE61272C09BFB2365977618B5C0F9C0457CC1FDB675D5BA557DB41969209AD6FBFC98740BBCDFFF334E0DA5F42ADA
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......R..ZE...,.....130801022923Z0...+.....7.....0...0....RB.E.F.4.C.1.2.F.0.2.C.F.6.6.3.0.D.E.9.9.8.A.2.0.B.5.4.9.4.D.E.3.A.D.5.5.E.0.F.2...1..g0<..+.....7...1.0,...F.i.l.e........l.x.p.t.a.h.c.i...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........../..f0.. .IM.U..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\lxptcore.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.514278857781245
Encrypted:	false
SSDEEP:	1536:9IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9r:ZC
MD5:	5EDFCECCB19D635F54650444E08AC853
SHA1:	C365D882645D4BB130B88655628AE67BC9F50A1F
SHA-256:	62E6C6580DBBDFE09613B0B01C55CDDC850FA7C1A8413986A9B02B25377082ED
SHA-512:	5FD6E4CDB8D0EE0CBEAB5B94AD678D31E4F00AE94EB792E05E855F4400E91379A92CCEFBC3EC688CA8EB1E8F07484EAE39B581F002AB79336FF57C4643B5927C
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....E..{i7.M.../zx....130801022923Z0...+.....7.....0...0....R2.6.9.F.A.B.A.2.7.3.C.F.C.B.A.D.5.6.C.A.C.4.B.3.C.B.C.1.1.A.F.D.F.0.4.A.E.A.2.B...1..g0<..+.....7...1.0,...F.i.l.e........l.x.p.t.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........&...s..V.......J.+0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\lxptid2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513749673276953
Encrypted:	false
SSDEEP:	1536:6IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9l:4E
MD5:	7575145CBBA8AE1D2EB7E65194F28DE2
SHA1:	467CD311826E86E769D470DD071DEFA43F2D46FE
SHA-256:	F6EAD97AE37138057BD135F435DECA1B48EAE86C59E99E9D594A760D3150102F
SHA-512:	756956A6C561F5163F58BED8EEB231562634A0B5FE5B281AA9C0E29B2FFBA43779BA170DA32DFE6FCFB9C1E72A380736B9537DF4D528BD163537C53F6A2F1448
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....+...0.@....i....130801022923Z0...+.....7.....0...0....R5.1.8.0.F.C.3.F.0.D.F.C.B.3.D.D.D.F.E.0.C.6.6.4.A.7.E.5.0.6.5.7.4.A.B.F.7.E.6.B...1..e0:..+.....7...1,0...F.i.l.e........l.x.p.t.i.d.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........Q..?.......d...WJ.~k0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\lxptide.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513464213663126
Encrypted:	false
SSDEEP:	1536:2IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9/:02
MD5:	35FB95DCBDBA333FEB71A8EC753CABC6
SHA1:	8EFF24ADBC047FE52DAEE4BB29AAF4D0858E90AF
SHA-256:	FA1E36B973701398615FEACD3AED2D98CCA257C9A0FF669A5179820F6A6E492B
SHA-512:	25DCE25FE8CA731560E3564874A45BABDBC38CEAB5E01F3D7002EACE75E61D8D4DE229509B0DD7797D412D284B9DE8A84A991A833EFF16284E6D69BAC75AA421
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....E.-.X..D.7. i>....130801022923Z0...+.....7.....0...0....R8.6.6.F.2.A.E.8.0.9.F.E.F.D.C.5.7.7.3.D.E.1.5.2.7.B.1.0.9.8.A.A.E.E.8.7.E.D.9.6...1..e0:..+.....7...1,0...F.i.l.e........l.x.p.t.i.d.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........o*.....w=.R{.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\lxptsmb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.514182950631902
Encrypted:	false
SSDEEP:	1536:PIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/93:7q
MD5:	8A9D102A05B758D1C120892ABB4D6AB5
SHA1:	233D9BF1051C79E92BD42E24AC45CFDF494288F1
SHA-256:	2290681817281618ED85193765FF6E5F8F4E78A8F92F853EC9D7C97AD2BF6F55
SHA-512:	D20A9E7EC95C8F55B4D05C0ED99F8820BD5F61919DA094519B09948769E13EBB4F00B91105D30AC82833260F59D935DED9C6654B75F792EBF35C3A74732533D8
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7........D.U.F.3..Ljz@..130801022924Z0...+.....7.....0...0....R7.A.0.8.E.0.F.8.2.E.6.B.7.E.3.4.A.D.6.0.5.1.3.4.B.D.9.2.3.E.9.0.3.C.8.9.3.B.F.4...1..e0:..+.....7...1,0...F.i.l.e........l.x.p.t.s.m.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........z....k~4.`Q4..>.<.;.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\lxptusb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.514043749124207
Encrypted:	false
SSDEEP:	1536:XIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9j:zC
MD5:	DCBC02A73C034147AD86098C97273C67
SHA1:	3E30EDB6AE1C820E34DA1AA722200A2AD51F971F
SHA-256:	B439C529C64D49B187BEE76619415C07CA99C13214D1D3992EFD1A80597EC8F3
SHA-512:	D36148D6FF13E4D6202A2DF3817E028098ECC8339F971A8E6FA97C7C71BE02416E0F604E4EBC1810CBA3AE1C8917593BD6218FECD8EFB23B492ACFAFA0D66700
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......MX..JoK.>K.Vf...130801022924Z0...+.....7.....0...0....R4.A.C.0.F.F.1.C.A.4.C.E.C.0.0.C.4.9.C.2.C.3.E.D.5.9.9.D.9.4.F.8.6.8.0.D.E.A.5.D...1..e0:..+.....7...1,0*...F.i.l.e........l.x.p.t.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........J.......I...Y...h..]0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\lxptusb3.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513679617058208
Encrypted:	false
SSDEEP:	1536:OIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9Y:c7TR
MD5:	FE07F44EB8DDEE817A8C7DDE7E4BEA82
SHA1:	ECB9B45C871080050382A148DDE21B6BA34EA1C9
SHA-256:	028A109A4B6F173FDA347AC13D8F7C7C9891EEAD55F4A8EDB302E651CC760990
SHA-512:	6AA730AC3631519DA935FEED822F2F54A60AE86242E070016AEEDAE2ED4C290708E3271F7CCC16CA7DBD49D1A9EEF8FAA1DB7376C81E4BDE960437E93DC39AD1
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....]..i0..N.7...X%{..130801022924Z0...+.....7.....0...0....R0.F.E.F.7.F.D.D.0.9.D.9.C.A.F.C.A.2.3.B.A.D.D.5.0.3.2.B.6.5.2.3.D.3.0.F.D.2.0.7...1..g0<..+.....7...1.0,...F.i.l.e........l.x.p.t.u.s.b.3...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.................;...+e#....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\nehalmex.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513641824911754
Encrypted:	false
SSDEEP:	1536:1IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9D:he
MD5:	C8D964C47A992C028B70DF461754F61B
SHA1:	38FE001696E68D27C6B86CEE3A14E207994B6A71
SHA-256:	88B290BFC9963F5049B80D996363A8DF0DA8732CBDEC0C4F3925EE4D0A5B33EF
SHA-512:	A978BC72523C84D9C8A50E5FA1F379A51C4DC61BF0E09F22AA38A9BFB5E1381A168391546E48E8D3D4B894944282448EF74E46CCC9BCD61CFB72351C932A34EA
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....G..H..J...x+.[..130801022924Z0...+.....7.....0...0....R9.6.6.E.3.A.7.1.0.6.B.1.F.B.E.7.7.F.F.2.F.A.4.D.E.9.9.8.7.5.9.0.3.9.8.5.1.D.9.0...1..g0<..+.....7...1.0,...F.i.l.e........n.e.h.a.l.m.e.x...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........n:q.......M.u.9...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\pantahci.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.512783810174099
Encrypted:	false
SSDEEP:	1536:uIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9X:8K
MD5:	7BAA5D4D0BA9AC10D8FCD693831BFFB4
SHA1:	00226182490CEC21AC33D9F05A524165ED7AFA5E
SHA-256:	6C31F0855ED9EE77DF2F0E0DF7701F37331EA66FE32F1D6CF21E79C210216407
SHA-512:	2BD25F5C3545660FE13325C3CC08483625EDF439DEBB9592AD607E64DA633B6614E693F689451457A70D807C09697D2B2C0D6444479396D29C14B7C185613A82
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......@ab.JA.m...5...130801022924Z0...+.....7.....0...0....R4.6.0.8.0.0.B.D.6.D.4.5.3.4.4.2.3.5.4.1.7.A.6.F.F.0.3.5.E.E.D.5.A.1.8.F.1.0.D.9...1..g0<..+.....7...1.0,...F.i.l.e........p.a.n.t.a.h.c.i...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........F...mE4B5Azo.5.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\pantcore.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513834276233813
Encrypted:	false
SSDEEP:	1536:fIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/97:Lm
MD5:	1D6B07B61EAEF14121728223EA97E57A
SHA1:	15013C4580EDD5B0D816C08F7DC12BA76522681F
SHA-256:	9B9D9AA7BBBEABD37D684B91D10485EB6E26C55D9077A258B8D1ABCD22DF0503
SHA-512:	8252E4E482893271047E553425645BFD1D0429241585CAD9D38C77BCA4DE01E8557E8149D1724DF4E9739D8C3964B25FBA8344247423820D1962D26C0C8FD256
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.........IW@....V..Z..130801022924Z0...+.....7.....0...0....R1.2.2.E.D.B.9.6.1.C.5.8.5.4.4.5.D.E.5.0.E.3.D.A.1.7.B.2.F.9.5.9.8.2.1.5.C.C.0.7...1..g0<..+.....7...1.0,...F.i.l.e........p.a.n.t.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+............XTE.P.....Y....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\pantid2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.514428523744979
Encrypted:	false
SSDEEP:	1536:+IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9R:MU
MD5:	508A071A3A26B7A9BEC0F61E89E4BBD0
SHA1:	0312AD015C24297FF73F851EB5654E0FED0710DD
SHA-256:	13FE2AFB591B3C980DCB8F9D1E41E9B96B19FE536807A72FAD53E281F6BADE62
SHA-512:	9C4EE7D41E11FD98BF1C362E28FA9DE0317DF3A5871CE6C0E9E2DB85BBDD781F103361C1A2F63EB835196B7FF0E159CC070C33A2BFA311573F5CF9BE3E06F8B4
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....0...rp.F....$._..130801022924Z0...+.....7.....0...0....R9.C.E.8.6.B.1.0.6.5.0.5.9.A.D.C.1.E.C.7.F.B.8.F.9.7.B.F.9.7.1.E.D.F.A.4.D.3.2.1...1..e0:..+.....7...1,0...F.i.l.e........p.a.n.t.i.d.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........k.e.............!0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\pantide.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513786184240789
Encrypted:	false
SSDEEP:	1536:iIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9W:QL
MD5:	1718A0136F9F10D530B2FE272D1BFA91
SHA1:	F50503EFC3429146A2227B33D204B8566179FEAC
SHA-256:	1FB03AC2C376919307360736F0CED98C8DC8B07FA386CBE7CB2BACD243B5ECFF
SHA-512:	36796E9FF8EBA61349FCD19A7E81DEB9DF750D6BACF5065E7DE0E936535B1D92394E8F3A5B96D89164831DD86DFBD1EC81C3053F176023CE5D84BE7975F98D67
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......V.7.B.I...!..A2..130801022924Z0...+.....7.....0...0....RF.A.1.0.7.8.C.F.7.1.D.C.9.7.A.0.E.2.6.1.2.C.7.1.9.F.A.F.9.D.C.2.E.0.F.6.1.7.4.0...1..e0:..+.....7...1,0...F.i.l.e........p.a.n.t.i.d.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........x.q...a,q.......@0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\pantsmb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.512855492734815
Encrypted:	false
SSDEEP:	1536:rIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9l:3A
MD5:	5D07574BB89B13EADE2DAE8FFA5A4DE0
SHA1:	C52DB5E10E35A7D8E57C6DC613BF755F51183837
SHA-256:	B36783477EAE088B1DD24B0E7355429927769ED8DCC5E619FBF40E7A43052CF9
SHA-512:	7958478443F12CD8C3142AA4AFBE1AE4357FFAFB67B20767166A1738400A8009258879E6A8151AEF6AE050F1B3A683884022F92909DAD199F97A451F7B97A3C9
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....x..V.CI.kK.Jb....130801022925Z0...+.....7.....0...0....R6.D.C.3.2.6.7.8.5.D.1.A.5.E.D.0.2.6.1.3.5.4.4.3.9.A.2.D.8.0.6.A.B.D.A.E.4.B.6.2...1..e0:..+.....7...1,0...F.i.l.e........p.a.n.t.s.m.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........m.&x].^.&.TC.-.j..Kb0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\pantusb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513292819167988
Encrypted:	false
SSDEEP:	1536:zYIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/V:z+2r
MD5:	62570DF85A149ACFFFD7843E86E3E948
SHA1:	75737C10A0F578A589AA3A29AD9C9911A3CE8200
SHA-256:	0F5FF862C563D32595BE3FE1864C05E8F7A9482BF6C5792D62CD82435A7FFF9D
SHA-512:	63E0F0D328BA662460788624BF83F5179CFEB6A99D18E60E31FFB048B98502FA6F2DDDA099BD6E8941289AE451B477BD7D7D22152F0D55486DECB5125F5E73BB
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7........{.".A..q.1{....130801022925Z0...+.....7.....0...0....R2.E.4.3.5.8.8.3.5.4.D.6.C.5.E.D.9.C.6.F.F.1.7.3.1.9.C.A.F.D.0.0.2.D.7.4.B.8.F.B...1..e0:..+.....7...1,0...F.i.l.e........p.a.n.t.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........CX.T...o.s....-t..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\pantusb3.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.5138355755117585
Encrypted:	false
SSDEEP:	1536:DIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9q:/L
MD5:	EA2D0AC9A544D6B8628A593690C06102
SHA1:	D0AD7847FFFFB8E7F4E9129C8A9DEC7D6C93A042
SHA-256:	B981E91BC0CCD083C94F15A3FE38E470D1CF6624BA0382566CD697FF324718D1
SHA-512:	D26068E9D58A01B9B32EA70F26D93B7DB84669FBEF34925F42567397C95104CFB82B52A875172F7197A3805EF7B2E06D0CD0AFB87B474D8CBEBA83D7B8A75DA1
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......G.@..G.....<.I..130801022925Z0...+.....7.....0...0....R8.5.C.C.5.3.B.0.7.1.2.9.E.8.2.3.2.5.6.7.6.4.9.D.C.7.5.2.8.3.1.4.5.4.7.F.0.D.9.E...1..g0<..+.....7...1.0,...F.i.l.e........p.a.n.t.u.s.b.3...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........S.q).#%gd..R..T...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\patahci.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513668465128195
Encrypted:	false
SSDEEP:	1536:UIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/90:aQ5w
MD5:	052AFFD04909DC8486C7C84C32E58F62
SHA1:	97A76A957F49084379551D879A2B54D4F97591D5
SHA-256:	7CCC10EA509F8DD6FE34D626F5B4F8E6CCE53474CF15855DA3058F7DE8DF1C37
SHA-512:	FDD57265235067CE3BCA02CBBA2EAFFBE6EC7E3685DB52E8DC8EA97BBD39074A2E592F6699F87E19A6D7888B9FE7A1BDFEB16BEADE92BC811FBC5E51E32DD623
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.......$.rtgI...{\....130801022925Z0...+.....7.....0...0....R8.D.C.6.3.6.E.6.3.1.6.E.A.4.9.A.1.8.C.E.E.A.F.A.7.3.0.E.E.1.D.0.0.0.3.D.B.D.D.A...1..e0:..+.....7...1,0...F.i.l.e........p.a.t.a.h.c.i...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........6.1n......s....=..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\patahci.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6370
Entropy (8bit):	3.3759395793655207
Encrypted:	false
SSDEEP:	96:RG8EQ2M/1z+VwB5SbmvqzalPJCFVWPOHSdaQ+wMy:DjptgErTlaQ2y
MD5:	0CE57DCD3451B531E7C1D06A317B42ED
SHA1:	8DC636E6316EA49A18CEEAFA730EE1D0003DBDDA
SHA-256:	75A73C06404E9247E2F020E21501F82E7357D8D376EC4683AA764DDA3723A171
SHA-512:	40615E3C4D07E603D6B8C698A5A19CF617DB0B7F7AC7A08065BA9A6F00C2DBCDCDE3A99F0F1D4FB182FADB264F92F3E3B6EA46E3219947EDE3F3B6A52D6ADC4A
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .p.a.t.a.h.c.i...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...3. .B.u.i.l.d. .1.0.3.2.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\patcore.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513618862789318
Encrypted:	false
SSDEEP:	1536:6IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9S:47
MD5:	20B8824B739720E297E70ACA45931A6C
SHA1:	9921943A6225F21AB73D2429A2B870EF7F662DFE
SHA-256:	F69753C933994E4BBA1BD88666D5AB672FE0862746501D68918CEAF03CB058B1
SHA-512:	62F94029DE5B6EC55371AFF6F32140A34B5EE9BEA986F51B8DE03E9CAA7F72EC155A0920275FED274AA8336CF7C8A0B95485DE51F081B4463A752AE18CACA25D
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......N.y..HN..8..$f...130801022925Z0...+.....7.....0...0....RB.4.0.6.5.5.E.E.B.1.1.0.B.9.F.7.D.5.5.8.4.6.9.9.1.2.2.A.A.4.2.F.5.F.2.6.1.8.C.D...1..e0:..+.....7...1,0...F.i.l.e........p.a.t.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........U.....XF..*./_&..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\patcore.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	19078
Entropy (8bit):	3.688496887228576
Encrypted:	false
SSDEEP:	96:R2FF2M/1z+VwB5zYkBxR2YkBxRt8c2P4UKeeJJjEGj9KtqAsvK1Kn/x+/q89asBn:yFptgE3xsxFPI4WTTlaQ2y
MD5:	78BE0B6895CC9C710ECCA1B51491D498
SHA1:	B40655EEB110B9F7D5584699122AA42F5F2618CD
SHA-256:	644A6003FBC86D3419291BB60E78EB2ECE69FF2D6D64EFD32CD25A0CC10C5768
SHA-512:	C19BD070F1FC37BEB6D09ABC0C35730934D9AD3CDB0BCB0762FA9B65235F8104E9AEFE73F12D00AB9093483CC92A91F78F960464E9F7D3726A9A526CB82AE786
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .p.a.t.c.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .S.e.r.v.e.r.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...3. .B.u.i.l.d. .1.0.3.2.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\patid2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148363
Entropy (8bit):	4.513626115825693
Encrypted:	false
SSDEEP:	1536:FIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9Y:xt
MD5:	0B5048AC772498692AE1AF49294BF7DC
SHA1:	18E2CD143A29B86A60308244A049E56D7C5A027E
SHA-256:	FBF6EF237AA0F1A8C8F4EA3DB6BDDC11208982409BB883A5DB659E7CAA4F211B
SHA-512:	28D1CDB9D07DB9BBF2F6A37265CBCC49E9FE0265C6A78F4F60BC261FC30AC242AAEC3B11C16A5BC4DA85856C258EC7B56BAF54553BFFD10271D24CFC0589FBA9
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cv0..Cq...1.0...+......0..(;..+.....7.....(+0..(&0...+.....7......{..p.ED..O.(R.K..130801022925Z0...+.....7.....0...0....RD.C.7.D.0.D.B.7.6.3.B.E.0.D.0.A.B.F.A.7.6.F.4.E.5.1.8.4.3.5.1.3.2.B.6.E.0.6.C.2...1..c08..+.....7...10(...F.i.l.e........p.a.t.i.d.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........}..c.....oNQ.5.+n..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\patid2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7518
Entropy (8bit):	3.4778524284328567
Encrypted:	false
SSDEEP:	96:Rq2hU2M/1z+VISwmQwmiuBPckB1XfcuCfJalPJCFVWPOHSdaQ+wMy:dCptgImkB7TlaQ2y
MD5:	BDE0C72E56E43B681F9C0337662B0A47
SHA1:	DC7D0DB763BE0D0ABFA76F4E518435132B6E06C2
SHA-256:	FD17EE347F800AF79FFDA2E751537A0B3FAF77405D34604616273A6491555418
SHA-512:	7EB535C62BB2A025A53207A9FC9394F8D922DB2DB7A1EE423E30377295DBDBB33F58C0D9C18EADAF217C6EE82DF6B9997F71F67EFBF417BECE3DBDCF90CA54F4
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .p.a.t.i.d.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .a.n.d. .2.0.0.3. .S.e.r.v.e.r.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .I.D.E. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...3. .B.u.i.l.d. .1.0.3.2.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\patide.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148363
Entropy (8bit):	4.513025547601642
Encrypted:	false
SSDEEP:	1536:3IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9U:T5
MD5:	5B31E63BA435B08B3905E531946B99FE
SHA1:	AB546A7592FF45D70FDE81C59B2CAB2082B5C2D2
SHA-256:	049B8F7D95BAFA6B10F3D3CCD80C517B2B2FC6E3D245E0734E3086BAA30FB999
SHA-512:	A6EAAE2EADAD2082F46A3C12D5D52F8E3133C831AA70550552FFDC0803412785BFD0567A3DAAFD233851E87128050331D0FB18895D0D54433DBDB2178806153B
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cv0..Cq...1.0...+......0..(;..+.....7.....(+0..(&0...+.....7.....+.]...J...,j.....130801022925Z0...+.....7.....0...0....R9.D.8.B.8.4.2.1.D.6.B.8.5.7.7.7.7.0.3.A.E.4.D.0.8.3.6.A.A.5.C.2.2.C.E.9.7.4.8.3...1..c08..+.....7...10(...F.i.l.e........p.a.t.i.d.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........!.Wwp:..j..,.t.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\patide.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6926
Entropy (8bit):	3.4170980333186702
Encrypted:	false
SSDEEP:	96:Rl2hL2M/1z+VIgkB1XfcuCfJalPJCFVWPOHSdaQ+wMy:CdptgI/7TlaQ2y
MD5:	D91FE38B4619B2DD16E8CEB8C8987224
SHA1:	9D8B8421D6B85777703AE4D0836AA5C22CE97483
SHA-256:	47F022E0EB5C822497E2BD7D1A951979F97E7EC440B4A4FC72113347B39B3817
SHA-512:	43AD2D773276004531EB7146958D31BAB896801BC73214A5734BAD94B7EE9394B8C242FB677F48DF716265B5DCAA04ED75AE6328807B68C84FE0914CD5EF8455
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .p.a.t.i.d.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .a.n.d. .2.0.0.3. .S.e.r.v.e.r.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .I.D.E. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...3. .B.u.i.l.d. .1.0.3.2.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\patsmb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148363
Entropy (8bit):	4.51382330465323
Encrypted:	false
SSDEEP:	1536:cIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/99:SI
MD5:	73ABC50BF7EBEEB3162D6BBCEBE4D57F
SHA1:	91A3557903FA14E7CB70C3DDA4A366663FA1627F
SHA-256:	6C49574DB2589526E2D4C72222B6ABED08108AEC5FE4D074E49C1A429693BB69
SHA-512:	235DA01C84776BC685B8F7070CE86F6ED94BF9BF4B27BB9B0CD69CDED0594E05DB9A1D175824CE966D42D16EF4133384B519EA57E41785669EC8551ABA0A9F63
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cv0..Cq...1.0...+......0..(;..+.....7.....(+0..(&0...+.....7.......!v...E.I.......130801022925Z0...+.....7.....0...0....R3.F.F.F.4.C.B.6.9.5.2.2.3.C.9.A.9.A.A.8.A.7.3.3.5.C.7.0.9.6.4.C.0.E.4.6.4.F.3.6...1..c08..+.....7...10(...F.i.l.e........p.a.t.s.m.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........?.L.."<....3\p.L.FO60b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\patsmb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7740
Entropy (8bit):	3.51968959192463
Encrypted:	false
SSDEEP:	96:Rpsj2M/1z+VwB5uU2Tuyu0uualPJCFVWPOHSdaQ+wMy:EjptgEFTlaQ2y
MD5:	E1AD4D0821CE59975FCE4F2DFE301EDF
SHA1:	3FFF4CB695223C9A9AA8A7335C70964C0E464F36
SHA-256:	85A2C075B7F7F60E2F954E51803952C6C7E60B8F4621A3940A76C181818BFA76
SHA-512:	89359B8A631301B66DA7CC4972F2A7CA152A9DC1E5B91FE345FBCCDAF06081D63BE903B26031CEFCDEE8018D02B99907BFD7EDF44EE2C1479BECC30CE2A9AA79
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .p.a.t.s.m.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .S.e.r.v.e.r. .I.N.F.,. .V.i.s.t.a. .F.i.l.e. .f.o.r. . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .P.a.t.s.b.u.r.g. .C.o.r.e. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...3. .B.u.i.l.d. .1.0.3.2.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\patusb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148363
Entropy (8bit):	4.514578844944956
Encrypted:	false
SSDEEP:	1536:AIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9g:2Z
MD5:	A7D5E7BF4BB4C8909A4DD21760980FA0
SHA1:	95B690EFA53BE4C89B67E6882F6BCB35B4D47C9C
SHA-256:	C7DC0E6D0BBAD6BFBFF7D4B1AAC30435DAE0CF16E93FC848A0084AC39BEC7A89
SHA-512:	2A4618E76F469C2932E6AA9097A58178E9186BB5DF3251719F1112B6DA4A75B3E712E7E8C3231C61FE56C030F2D7F1869D232D9BFEE23941F7B20145FF318F04
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cv0..Cq...1.0...+......0..(;..+.....7.....(+0..(&0...+.....7.........,7C....W....130801022926Z0...+.....7.....0...0....R0.3.1.A.8.F.2.6.A.2.E.B.6.B.C.C.4.A.8.6.E.4.E.B.5.3.A.C.9.B.5.3.9.5.A.B.8.E.B.3...1..c08..+.....7...1*0(...F.i.l.e........p.a.t.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........&..k.J...S..S....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\patusb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7846
Entropy (8bit):	3.5106013972990375
Encrypted:	false
SSDEEP:	192:1WtgEoEurUrghdkBdrdNL9NrQNgTlaQ2y:1ygEoEurUrghdkBdrHLnr+gRaQF
MD5:	1FAF6852B794A3B7DEFE8A3F34BDDE4A
SHA1:	031A8F26A2EB6BCC4A86E4EB53AC9B5395AB8EB3
SHA-256:	E23DFB9673894E4033616EF8A80262CD6D75CDB189D9B59990A33C06786BFD95
SHA-512:	288B1BBF88B3BE3295332F07524BA31D8D064B794971003B57507183294A05542DA890C76CF7FA2AB416105686AA23815B9EC1F04E86494796C2D7225366958E
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .p.a.t.u.s.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.0.0.0. .a.n.d. .X.P. .I.N.F.,. .2.k.3. .&. .2.k.8. .S.e.r.v.e.r. .I.N.F.,. . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .U.S.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...3. .B.u.i.l.d. .1.0.3.3.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\pm45gm45.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513130816097907
Encrypted:	false
SSDEEP:	1536:TIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9L:P2
MD5:	C748D67D4BB0A706B7FA4FB05C4602AB
SHA1:	23366EF702E776B1808F4698F74F9308B01F6304
SHA-256:	CC9920C934D24643D3EA62C7DC3046EE62B8B0283F3B806B7C52F236B88DCC08
SHA-512:	A13B7C75E490796CFBE68BAD4C19D390262F93137F0208F25C6D4E9CA80C1D8A72E859EF107DE9042D870412F9B529CAD546424BA60EFA55FDBA169D885CC9B6
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......^....'A...M><....130801022926Z0...+.....7.....0...0....R6.9.3.8.5.6.C.0.2.3.2.B.9.2.F.B.4.0.9.D.C.6.7.2.B.2.3.A.1.C.4.2.A.B.5.8.8.3.E.8...1..g0<..+.....7...1.0,...F.i.l.e........p.m.4.5.g.m.4.5...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........i8V.#+..@..r.:.B.X..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\pm45gm45.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7224
Entropy (8bit):	3.4742380991217936
Encrypted:	false
SSDEEP:	96:RXiGqVM/1z+VwB5m8J9X98alPJCFVWPOHSdaQ+wMy:kV6tgEvDTlaQ2y
MD5:	F8B94A281002874C1A6E6ABB168BC82C
SHA1:	693856C0232B92FB409DC672B23A1C42AB5883E8
SHA-256:	6867AA7212F2836BE3422799E18EA0A8CD2BAC27EC9C49E4B678E5550AE19C50
SHA-512:	F6DE54B245CD69F3E0E160E9B863C15C89BBB1C02D67B7AAE007370CB459F981E4C7EFA380ACC788E32D699410321FDEF37C762A86E97D76337B34298D497907
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .p.m.4.5.g.m.4.5...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3.,. .2.0.0.8. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .8.2.X.X.X. .M.e.m.o.r.y. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\qd3nodrv.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513145167565257
Encrypted:	false
SSDEEP:	1536:jIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9S:fT
MD5:	3EEA6D13FF03E6B54A57A82D9CCBACEC
SHA1:	76BFF3C64845B0AFCB8AB4083DC3A572A49F5E88
SHA-256:	E0F395CCCF624533A7B474C751D89182ACF67CCE42349E7BA97E9E433840DBF5
SHA-512:	5A9854B16298A617BBF30E1861AA4C77BB9EF6857D86AF2ABB5DFFD749C05CF8CC6285CE9BDD427092174A90B0DB4E5885E787A77F0AA65717C8E878A329009C
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......}.[.@.-..e....130801022926Z0...+.....7.....0...0....R0.5.A.5.1.8.C.B.A.8.7.B.6.7.3.D.D.B.D.E.4.D.F.4.B.4.5.9.7.8.7.E.D.C.E.A.F.D.C.1...1..g0<..+.....7...1.0,...F.i.l.e........q.d.3.n.o.d.r.v...i.n.f...0E..+.....7...17050...+.....7.......0!0...+............{g=..M..Yx~....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\qd3nodrv.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9526
Entropy (8bit):	3.622311290777779
Encrypted:	false
SSDEEP:	96:Rx0M/1z+VwB566zKgyAyhigQalPJCFVWPOHSdaQ+wMy:HHtgEU6YTlaQ2y
MD5:	191423185234D61AA55D55C5D6BC8D11
SHA1:	05A518CBA87B673DDBDE4DF4B459787EDCEAFDC1
SHA-256:	92530D24DAFC6514B5F365F0BDCE36A9CE19E3321A562A45916C9BB98ADAE980
SHA-512:	572AA4D09260ED59430DAB64F2E8BB2B1832F31828F733C2DCBC4DBCE821238E0A1A7EE42519076C733B81A9B2BAD0D34E3C1BB2A94B4C7824E71C738AD2DD57
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .q.d.3.n.o.d.r.v...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.6.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\snb2009.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.514448576389999
Encrypted:	false
SSDEEP:	1536:EIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9L:Kf+
MD5:	9DA5CF293C99E1B925B29A2C056D51D8
SHA1:	872D8168BC731E13703A0B1700C73F3BB5AA988C
SHA-256:	94AA7CFA13F8979999D7D41D2592B0CFA3650152E6F6E992D1CBCB6CFE222706
SHA-512:	D27773070BAB98E08C87C2ECFCBB6367D194308C620CF9261156E67A9EAC85F1A1D42C05F6DBEC9FE6C3A7EF49325753A9E681B7E42F38EACD25C352A9F6BA96
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....O....f.G..U.0A!c..130801022926Z0...+.....7.....0...0....R3.2.1.7.B.9.A.8.2.A.0.D.A.6.5.4.0.3.C.D.B.C.1.2.0.1.5.2.1.A.5.A.8.9.C.A.3.0.B.0...1..e0:..+.....7...1,0...F.i.l.e........s.n.b.2.0.0.9...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........2...*..T....R.Z..0.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\tcreek.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148363
Entropy (8bit):	4.513010177891821
Encrypted:	false
SSDEEP:	1536:EIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9W:Kn
MD5:	2DD156C58A89232A3E43E3A47F4ED2BE
SHA1:	8EAFFDAAEBADF2D8EA79B745F36E596C5375C76D
SHA-256:	0E49B7BF3422D0D21ED3482B6B5B806A48C872E3E418EEA2B0CACB491D27DE12
SHA-512:	F51B273044299520C3E5F679C45A078F3BA8654D2968EBB69C3CE785668BD752B6510FB5E2C765716C7C2849F6127D2B904B3F307984C755ACE0BFD98281F475
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cv0..Cq...1.0...+......0..(;..+.....7.....(+0..(&0...+.....7.....h>..h.M.....Nx...130801022926Z0...+.....7.....0...0....RF.3.E.9.E.9.B.7.E.8.A.7.0.F.2.6.D.C.E.7.F.5.F.7.F.D.8.3.A.4.0.D.0.1.1.B.D.4.B.D...1..c08..+.....7...10(...F.i.l.e........t.c.r.e.e.k...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.............&...........0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\tcrkahci.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.514039217958842
Encrypted:	false
SSDEEP:	1536:rIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9A:3B
MD5:	1A7D1E225B95B5D7902328A6942849F0
SHA1:	AFAE3128C48930A284AFA6FF8D97AEC06F4DC67E
SHA-256:	99EC18963C6496852A76660AC48CBB42B8CB64C3BB024862EDFBC0AEC4BDA3D2
SHA-512:	8DCAD9B3FD90611FD6BE5CF025C8F166AC34CE77032C0A19EE8C12B50B5B6EBD91811E581EE3AF3B895F1E06BE3D9AE4365785BCEE763E4DC2C3CB3F93A500B3
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.......8.8wI...t^.pp..130801022926Z0...+.....7.....0...0....R0.8.8.9.B.C.C.2.A.2.1.F.8.B.8.3.E.B.F.1.3.C.7.A.2.D.E.B.9.9.2.2.B.7.B.6.5.2.8.5...1..g0<..+.....7...1.0,...F.i.l.e........t.c.r.k.a.h.c.i...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.................<z-."..R.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\tcrksd.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148363
Entropy (8bit):	4.512773000013317
Encrypted:	false
SSDEEP:	1536:uIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9S:8/
MD5:	DD82F473798C5833604F16566A3E6BAC
SHA1:	7CC63C88014184FFE09284636B4D8F068BE599B3
SHA-256:	05DBECE9E22396317074B20A374D425699A4183F3DFE0E2ECEB8D16369CE8EA6
SHA-512:	16ABBD4457E4D5D866C3DD1B94B92EB40671BF545FB546A79B5F08D47753342223CA0180617AF1442E0FBF591BA30F30D6F1189686330A9C1E1243D94E8680EE
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cv0..Cq...1.0...+......0..(;..+.....7.....(+0..(&0...+.....7...........B....H.I`..130801022926Z0...+.....7.....0...0....RF.0.0.B.F.8.6.4.4.4.0.7.2.9.1.6.B.2.B.D.3.9.9.D.7.C.7.3.D.D.E.C.9.2.C.6.7.2.5.4...1..c08..+.....7...10(...F.i.l.e........t.c.r.k.s.d...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........dD.)...9.\|s...rT0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\tcrkusb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.51353385072559
Encrypted:	false
SSDEEP:	1536:zIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9p:vA
MD5:	BBD63948628F6BBE40557CDE361EF30C
SHA1:	AB02815CD04A3FE77404AD37BB950753AA6DCA06
SHA-256:	F2DEFE69E1ADC170602D7FEEB763D5629885293BC7D4BEA73B08A134F5E3E17F
SHA-512:	C3F7BFAE7B62D8FAF20DC581D092B2B31FA454D3B76E3BBD9EACEA863B171C2ECD2FEF40C08635A405B91608888B2B00AD47B67E155B9F59DB5DAFE4F0580FB3
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......F..99.F.xV.\M....130801022926Z0...+.....7.....0...0....R1.7.8.B.D.E.9.3.6.A.7.0.D.8.7.6.2.5.9.8.8.1.6.4.D.8.D.A.6.4.1.1.F.5.6.6.6.8.8.0...1..e0:..+.....7...1,0...F.i.l.e........t.c.r.k.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........jp.v%..d..d..fh.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\tcrkusb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	12552
Entropy (8bit):	3.6601571804572814
Encrypted:	false
SSDEEP:	384:cNgEvdnB79E9QwmsSQL+qwmsSQL+HhdkBdJlJFpwiHLnr+bRaQF:c6HCcF
MD5:	CA56FB297EA0F8AB37E3CDFC58302187
SHA1:	178BDE936A70D87625988164D8DA6411F5666880
SHA-256:	3172945D544D0F6DD5A68DD48F44C27CEA0C432BD4743BEA6881E613EF287173
SHA-512:	48F7A3EFF760A736B4D1F0FC53D038847C9F7BFCD52D8B9E464FACCF4A5B14CA29CD559F89D23CB79F99772571C1D83C6CB3201C9D380069067BA4A6A9B7CAFF
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .t.c.r.k.u.s.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .P.l.a.t.f.o.r.m. .C.o.n.t.r.o.l.l.e.r. .H.u.b. .E.G.2.0.T. . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.6.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\whed_dev.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513882806783741
Encrypted:	false
SSDEEP:	1536:ZIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9A:F5
MD5:	A7447B75ABEC6B8B342D2E9AD3EE62AB
SHA1:	33863E9A7772CE0AE8DDBBBAAF1ED3B611ADCFEE
SHA-256:	A17F472346D6E6962FC1E6E21B3EB571A0EEF5F7F0D0F6F5A057EDFB65F05C22
SHA-512:	95761148670032279B44B4B7B69546A01013DDD65CD6CD5C25FB35C95FDCEF91E58FE542766D401D6827A7D03C783C64C55B6CC556FC2FA3A2614908F5F77457
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7...........qG.Vs.^.p\|..130801022928Z0...+.....7.....0...0....R2.0.6.5.4.3.3.2.8.0.E.3.7.3.F.5.E.5.7.1.D.9.7.D.0.2.2.9.8.B.7.2.9.9.E.6.D.D.2.1...1..g0<..+.....7...1.0,...F.i.l.e........w.h.e.d._.d.e.v...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........ eC2..s..q.}.).r...!0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\whed_dev.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6158
Entropy (8bit):	3.3102928387280532
Encrypted:	false
SSDEEP:	96:RiNGI0M/1z+VwB5uyalPJCFVWPOHSdaQ+wMy:gIIHtgEwTlaQ2y
MD5:	098757F72D4C7368EE8BAD8676DA214E
SHA1:	2065433280E373F5E571D97D02298B7299E6DD21
SHA-256:	6ADF9661A67B220DF68C7965B8C128D7D7E748F0A74E5CB9F81E4351DCC210DF
SHA-512:	B909BD3120643B50AA5C456943A2193AFEDCDD97AD0CF5D7612ACC6BFAD74209BDBBFFB29193F096A6EB714F8FA911F6EC224E32463F36957DFC7A0E138D6D1B
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .w.h.e.d._.d.e.v...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .c.o.r.e. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.6.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\whtpI2C.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6920
Entropy (8bit):	3.481029050519518
Encrypted:	false
SSDEEP:	96:R7dfwM/1z+VwB5ASXujalPJCFVWPOHSdaQ+wMy:vztgEJTlaQ2y
MD5:	E495D0157D8245AA0DFFDE923FAA3E1D
SHA1:	AB306CD85D81ABBA805D2D441CDF71CB4D2CEC62
SHA-256:	CD170474AC3FE5289870ADE63FE21D4056A496AA5C075584FDD6B0206BD548DE
SHA-512:	5751E8E6B378204F89A08379E7B933D28FA42E8D6F04F48C78C0D4B0701930E3CF4DD1D522D929BCED0CB71A1304439CEF0BC8F2664DA9CCDE4E8C145651C700
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .w.h.t.p.I.2.C...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .f.o.r. .I.n.t.e.l.(.R.). .S.M.3.5. .E.x.p.r.e.s.s. .C.h.i.p.s.e.t. . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\whtpI2C2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6338
Entropy (8bit):	3.411702904545476
Encrypted:	false
SSDEEP:	96:RBdVwM/1z+VwB5OKm3alPJCFVWPOHSdaQ+wMy:PztgE3TlaQ2y
MD5:	77746201806558AD0D4BD5A92433B628
SHA1:	DF9CB30137B3EE3985B4A6287ED5D067B28078C6
SHA-256:	C2B341284D91423878C0AB62AB886C963A4925775003D6CFED0608869F2C336D
SHA-512:	31921AFE868577EC50445E9346843D318DE064791C4EB2B6DE259E31A21A8DFBB4920B356C5A40A83154C11AF7F4C810CACEEF52E2E36CF8FD2EBE386E6652AB
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .w.h.t.p.I.2.C.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .f.o.r. .I.n.t.e.l.(.R.). .S.M.3.5. .E.x.p.r.e.s.s. .C.h.i.p.s.e.t. . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\whtpi2c.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513666212304721
Encrypted:	false
SSDEEP:	1536:ERIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/F:kC
MD5:	003CE3936B5961E3AA0526694C84BFBC
SHA1:	36952612168295204360B6C94992E85BAFF466B4
SHA-256:	C4ECF8E6A7C92A94835A45E27104BD96AFB0FB3763FCAC9641E83910910B0825
SHA-512:	53D2F14152B2D2261A487DD48B91AF60FA1DB7CE8E09EF3F09F15AB614DF6E0BF632FDB78EE21AF6C9C8B474D3C3B231DD66F14D08931CD0F252F0733DF5A841
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....E.!r...H.........130801022929Z0...+.....7.....0...0....RA.B.3.0.6.C.D.8.5.D.8.1.A.B.B.A.8.0.5.D.2.D.4.4.1.C.D.F.7.1.C.B.4.D.2.C.E.C.6.2...1..e0:..+.....7...1,0...F.i.l.e........w.h.t.p.i.2.c...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........0l.]....]-D..q.M,.b0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\whtpi2c2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513382863678816
Encrypted:	false
SSDEEP:	1536:bIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9Q:n5
MD5:	FECFD599CD6BC660063E7C546241C909
SHA1:	4723FA9D7C8EBF73FA90B45509EEE0AED2EC3816
SHA-256:	6444345EF97CD44C8776BC7A7108BEF84476542C3A6B455EB43FCBFDB06FE99C
SHA-512:	84E00BDE1CA465503DA872991DAA95609DC2D7993288C7E999F4FA1A8590BBEC74BF2674A2A839E58DB0793C144D039BC7F021A826114F9ADD7C38E3BD6520D7
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.......j...N...u.....130801022929Z0...+.....7.....0...0....RD.F.9.C.B.3.0.1.3.7.B.3.E.E.3.9.8.5.B.4.A.6.2.8.7.E.D.5.D.0.6.7.B.2.8.0.7.8.C.6...1..g0<..+.....7...1.0,...F.i.l.e........w.h.t.p.i.2.c.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........7..9...(~..g..x.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\whtpoint.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.51411165208097
Encrypted:	false
SSDEEP:	1536:PIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9s:7h
MD5:	466645854058983CC34ABF927CA44CA6
SHA1:	F0CD624117BB30C24BFE0F29C37127EA017F6A1C
SHA-256:	7A0776DDCAF6E742152CA5DBA69635E6BA4BC21DC831B8C9053F3497E723A53D
SHA-512:	4E13E0206D503B85823D4CD88C4B43A017F1D1616459D14E7128FBCBC27B0EFA935E0DF209A8C772310A44814FC93FD7621988FB729025753152DB09FD54AA3B
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.......<...4L.q.=.....130801022929Z0...+.....7.....0...0....RF.C.B.5.9.9.D.4.B.5.8.8.5.9.5.6.3.C.7.D.2.5.D.A.8.9.5.C.D.4.1.2.4.5.B.6.B.4.F.0...1..g0<..+.....7...1.0,...F.i.l.e........w.h.t.p.o.i.n.t...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.............YV<}%.\..E...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\whtpoint.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	10246
Entropy (8bit):	3.6313861807521914
Encrypted:	false
SSDEEP:	96:R/ewM/1z+VwB5x9x7X9xcf9x7X9xO9x7X9xNzExn6nH2jkFCin2Agr+tBsalPJCs:gztgECWTlaQ2y
MD5:	76EF74772844E50734F26782FD550C3C
SHA1:	FCB599D4B58859563C7D25DA895CD41245B6B4F0
SHA-256:	9F35ED69003AB550CCB681BA12616A2D62A3EF6C816BEB715944B1DA02936F8F
SHA-512:	86AAEFC26959840C8ADAFD9F23005DA9D1C9537BDF005BF2150BE3C0E4AFF56128128C874883F9035613B15C4FCBF5896A611B9BCF68E5F7D59C240210396CFD
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .w.h.t.p.o.i.n.t...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .f.o.r. .W.h.i.t.n.e.y. .P.o.i.n.t. . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\whtptsd.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.5133814950725695
Encrypted:	false
SSDEEP:	1536:3IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/96:T/
MD5:	3D416CB331B1D4BFF4419C7C64122DCE
SHA1:	F34596E6149EABDDC606F3C58C762F62F6DC2F8E
SHA-256:	0E88983650DE53EBD700FBEDC6C3D4C9345CD24D5AE65DA37255454B3F74DD7B
SHA-512:	A18E28A73B2CB24BCDF6F58D5B75892593B74CE4E16B07B8DC6C243E5B9EAE6C876F6C61D93D43D455847A0D938743AC242600E51B227AE7C191C53A2401E69A
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....A`.mA..O..I..4R...130801022929Z0...+.....7.....0...0....R2.F.D.1.2.3.C.5.C.7.1.6.D.3.2.2.9.7.1.6.D.7.4.4.9.C.8.9.2.0.7.4.8.9.6.B.D.0.1.B...1..e0:..+.....7...1,0...F.i.l.e........w.h.t.p.t.s.d...i.n.f...0E..+.....7...17050...+.....7.......0!0...+......../.#...."...D.. t.k..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\whtptsd.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7802
Entropy (8bit):	3.5192713045369355
Encrypted:	false
SSDEEP:	96:RIMwM/1z+VwB5DJLNJ/JT8xxcV6JalPJCFVWPOHSdaQ+wMy:tztgEpTlaQ2y
MD5:	B801CCD79E91E1C649772DA44066C004
SHA1:	2FD123C5C716D3229716D7449C892074896BD01B
SHA-256:	A4C79375EFF4FA88DDFF861DD5433D35C96E927560FBE828040767A380211472
SHA-512:	A8AADFCC3B16B3983663D51C8FAC7F9A8D0A7B5EAE99E8FCF8A389F8F1C5BC77E7BD3C820AA111344F7C53A64530FB6325C20F1C8301C15FA1A6B25077E430D9
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .w.h.t.p.t.s.d...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.0.0.0. .a.n.d. .X.P. .I.N.F.,. .2.k.3. .&. .2.k.8. .S.e.r.v.e.r. .I.N.F.,. . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .W.h.i.t.n.e.y. .P.o.i.n.t. .S.D.H.o.s.t. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\wptahci.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.512691828097179
Encrypted:	false
SSDEEP:	1536:/IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9t:rBu
MD5:	AF78A4115CF50A1197EBD962344FC0AC
SHA1:	52AC138E9629D93EE769FCCCF71AF5F376D179E9
SHA-256:	F2DC140BABDD92F7F99EFFBEDAB2D64755D58C46E1DE3C4C7566496231B06155
SHA-512:	330FC8489F7A57BF3DEED4AD902275577A0F998EFFFBA80971449FB1267873E2F58F3EF891098099214402EF319D8DDC32A30956045F801E2A8D49A832ED20A1
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.......k.._.A....u....130801022930Z0...+.....7.....0...0....RB.5.1.B.0.6.9.2.C.0.5.2.8.2.A.3.0.7.1.8.9.7.E.7.D.9.C.6.F.C.6.5.9.E.8.2.2.D.8.1...1..e0:..+.....7...1,0...F.i.l.e........w.p.t.a.h.c.i...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.............R.........e..-.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\wptahci.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6518
Entropy (8bit):	3.3671821134452786
Encrypted:	false
SSDEEP:	96:Ro8AOwM/1z+VwB55mDm4blRMBNalPJCFVWPOHSdaQ+wMy:tJztgEsTlaQ2y
MD5:	E13EE71CAEF5E107BDDAF087C7D677B4
SHA1:	B51B0692C05282A3071897E7D9C6FC659E822D81
SHA-256:	42041F9D084E4E53D5BF07B160D26CB85C6CC6BD3A33A34766AE57B851E36296
SHA-512:	1F41550BF7327F891F20073528F85EA6FC9FC7434A7975DDBE81644849982EF999651448487841BA3A2A101DCF648AB115E5595E1E6353846A561AF4F0FE48C4
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .w.p.t.a.h.c.i...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .I.D.E. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\wptusb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148363
Entropy (8bit):	4.5146037835911
Encrypted:	false
SSDEEP:	1536:oIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/91:Os
MD5:	7591596D1CC8FB76F7E504653C23783E
SHA1:	6368E92A0F6493A435C0007A3CE81104179F246F
SHA-256:	0A128E71674658F40C967370A3C775D58B81CB7218C2E92A27CD383FFB17340D
SHA-512:	A6921D6B147966AD4DB93131000245268630362A613AD0795A1470C062160D4FE59FE7AF7D8C89EE0A7B030094087C74F7AEBD91E44E982129BEA4C66B663182
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cv0..Cq...1.0...+......0..(;..+.....7.....(+0..(&0...+.....7..........S.B.M/.9..G..130801022930Z0...+.....7.....0...0....R7.C.B.9.1.C.7.8.A.7.9.C.F.D.D.5.8.8.D.1.6.D.C.5.E.0.9.9.3.7.6.2.C.5.E.9.F.B.7.F...1..c08..+.....7...10(...F.i.l.e........w.p.t.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........\|..x.....m...7b....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\All\wptusb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7670
Entropy (8bit):	3.521336131391875
Encrypted:	false
SSDEEP:	192:DVtgE9gy/Y/xhdkBdrdNL9NrQNoTlaQ2y:DXgE9gy/Y/xhdkBdrHLnr+oRaQF
MD5:	20E1FFE99BC6DBCE8545E52ACEC9F71C
SHA1:	7CB91C78A79CFDD588D16DC5E0993762C5E9FB7F
SHA-256:	2BBC35B6E4BAB5FFAF5FC7F10D473C0F81451C83E609EE9EA4F17CB2A8264442
SHA-512:	66C4D541E043E6790B5E0204F155EDC4A7BBA303AB6442EE37606C749737FE384B7F38BC4451855554BB3CF57052F98254BCA98357D93CA8278F5BFE4DD049C5
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .w.p.t.u.s.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .f.o.r. .I.n.t.e.l.(.R.). .S.M.3.5. .E.x.p.r.e.s.s. .C.h.i.p.s.e.t. . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.4.0.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\CSVer.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	59688
Entropy (8bit):	5.531348731188262
Encrypted:	false
SSDEEP:	768:aXTQ3dz80P3mkj0wWyRepPVJuiNdVtHHwUX7:aX4HVj0wWyEB5tHHp7
MD5:	E666404C6F3DF64AEDF086C636A060F0
SHA1:	B64CA8964C7D18C1EE6258CA255D7BC8FFEEA99C
SHA-256:	FF9CB3A55F744E6AAA7EDC4CDF192A0EAD519CE99EF83290D94B362CF5AFCD1B
SHA-512:	8F85B97777A05D324176B7DBF1B908C25650761C13F56393102342C188226E0209BDC534D393653953B7F927B6C962B93AFBC6AB5259089B4782DECF797F6711
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G4^..U0..U0..U0.$.M..U0.$.].DU0..Zm..U0..U1.HU0.$.^..U0.$.L..U0.$.H..U0.Rich.U0.................PE..L......Q...........!.....p...`......................................................gZ..........................................(.......................(...............................................@............................................text....d.......p.................. ..`.rdata..r........ ..................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Help.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	727
Entropy (8bit):	4.363946556040609
Encrypted:	false
SSDEEP:	12:aMIrz1dVpsDT9c8H2SNzON73rK6Fs9fL9gYy9noE2EvbNzONmA9E69:aMo9s1c8H3NzO9K6KpL2YyhoCvbNzOJ5
MD5:	B01ACAE1B7C4BD922787C9E5EF14D4C8
SHA1:	6FE9CD313BCE91CF658580BDE4207B3B907DA44C
SHA-256:	5AE39975A4E7020F678341EE042B6350ACCDC5CC99B9CFC0C7707AFB7C005F73
SHA-512:	076308E9D9632DE5362696AC7E7CF33963E30DB92AF68C2503367A42FA283DD41574DE11EB584BB5E9ECFB6C7DA45C98334B6E17DBE65E17B57F71B37C9A3CFF
Malicious:	false
Reputation:	low
Preview:	Help for Setup Command-Line Options.... -?...displays this help dialog.. -a...extracts all driver files.. -aonly..extracts driver files that match the system hardware.. -b...reboots the system after setup is complete.. -f2 <path>..changes the default log path.. -l <number>..specifies the language of the setup dialogs.. -nowel..does not display the welcome dialog.. -nolic..does not display the license agreement dialog.. -noread..does not display the readme dialog.. -overide..overwrites the IDE driver.. -overall..overwrites all drivers.. -overwrite..ignores the overwrite warning.. -p <path>..changes the default install path.. -s...does not display any setup dialogs

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\IIF2.ini

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	774
Entropy (8bit):	4.900850497627834
Encrypted:	false
SSDEEP:	12:HxkXsfUdXMneVqFMAuwx2Ltt8asCfoGgr3J2viEaDMipu2HSin:0gnjMVYK6Z2eFuU
MD5:	709CCC902999208995B9F3BF3121A7E4
SHA1:	65945A44D983041D3F95688BC7E3A42281475659
SHA-256:	5DF694DDAA1A0176870B41A399575A8AF195642649978F56FDABD43B21AA0954
SHA-512:	E485DABB6316DD89EF54E7E7C300FADDEFABBC52A9C104EBD668DCC03EAAEF8C9D05155544B91103A5DD917093D210BA58C8CEA584C0725917D04DC96ED8E515
Malicious:	false
Reputation:	low
Preview:	;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;..;; Instruction INI file for Chipset INF installer..;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;....[variables]..;CUSTOM VARIABLES CAN NOT HAVE NESTED CUSTOM VARIABLES..; ONLY MAY NEST PRE-DEFINED VARIABLES..;path=EXECUTION PATH ;pre-defined..;system=SYSTEM PATH ;pre-defined..;progfilesdir=PROGRAM FILES DIRECTORY ;pre-defined..;root=WINDOWS DRIVE (ie C:). ;pre-defined..[/variables]....[registry]..keyroot=HKLM..keypath=SOFTWARE\Intel\Infinst..keyvalue=Language..keydata=%lang%..keytype=sz..uninstall=true..[/registry]....[copy file]..source=%path%\CSVer.dll..destination=%system%\CSVer.dll..uninstall=true..[/copy file]..

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\IIF2v.ini

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	483298
Entropy (8bit):	5.137706782530424
Encrypted:	false
SSDEEP:	768:tMZt+SK5v4VpSymVzQIAfZhLgSQoXl5bYsSSBZ3rOMKaJV/z2LptVhhJ98:LvhzygAY6OG2LptVhhJ98
MD5:	1D10B76E75A4400E3913DFCC7C70A937
SHA1:	FAF4708980FF22A2BEEE46B0DB565EEBEDDAF7C5
SHA-256:	E8DE33DD55498EF33BBC5AA1F2B946E411B06924C112B1230543545B692FB97C
SHA-512:	5459F02204498776114C478B61BAB1A43A27D74FFFABB0F34BBEFEFA83147166160D4AE0A1D7D4788EAF8AC94A88E9C655D679773366F87747056B8030A8F7C0
Malicious:	false
Reputation:	low
Preview:	;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;..;; Instruction INI file for Chipset INF installer..;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;....[variables]..;CUSTOM VARIABLES CAN NOT HAVE NESTED CUSTOM VARIABLES..; ONLY MAY NEST PRE-DEFINED VARIABLES..;path=EXECUTION PATH ;pre-defined..;system=SYSTEM PATH ;pre-defined..;progfilesdir=PROGRAM FILES DIRECTORY ;pre-defined..installdir=%progfilesdir%\Intel\InfInst..[/variables]....[copy file]..source=%path%\all\852.cat..destination=%installdir%\production\XP-x86\ICH5\852.cat..error=ignore..[/copy file]..[copy file]..source=%path%\all\852.inf..destination=%installdir%\production\XP-x86\ICH5\852.inf..error=ignore..[/copy file]..[copy file]..source=%path%\all\855.cat..destination=%installdir%\production\XP-x86\ICH5\855.cat..error=ignore..[/copy file]..[copy file]..source=%path%\all\855.inf..destination=%installdir%\production\XP-x86\ICH5\855.inf

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ARA\ChipsetARA.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	92456
Entropy (8bit):	4.497865970512971
Encrypted:	false
SSDEEP:	768:SVHxAvB/KxHx/mqwrOla8BfIrKcnai1f0k2APWiSM2konC06px3zs:SVAIpdwrsa8BfI1ai1f0ugl6fDs
MD5:	83E471DD014A870E7BF7F717E041D853
SHA1:	55E7077C85E2C334305B7CFF647688F695A46E27
SHA-256:	20CFB1D85FC09F7A0C6D901728823C4E40916D2DDF648C85E9BA29896C59FC79
SHA-512:	B55A0474F16020E50FB0A2D564E6515029A2C594FA63A73616F7633F6D87276E207F251BC7377175A92A4ED80F7835C0A256E9F3672D5A662C229256E1BF5F9B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!.........@...............................................P.......R............................................... ...............P..(....@.......................................................................................rdata..............................@..@.rsrc........ ... ... ..............@..@.reloc.......@.......@..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ARA\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (765), with CRLF line terminators
Category:	dropped
Size (bytes):	40408
Entropy (8bit):	4.168126794831629
Encrypted:	false
SSDEEP:	384:JxA3/XRHfHZ8xHxHfQ+gqmb1r1M3zDfoK7SF8BfIXRdKcUVfjK7SFi1f0XRo:JxAvB/KxHx/mqwrOla8BfIrKcnai1f0q
MD5:	689D56D2277763A33A8F7DDA8D524D97
SHA1:	D43C2F5563C83740B3E3FA01C1D7DE026DC22448
SHA-256:	43A92DF3B4EBB6854CA8B990F4D7C7C7BDB6A2591C75ECFAA89E0D37E211AD31
SHA-512:	235E084AB42BC8831DE118D1880151643732A2540D6F71BB11A02279C21EDE5301294B597431DC5457B5619B72D2E9347A282F05A28FFDCAA76AAF22A577414E
Malicious:	false
Reputation:	low
Preview:	......'..A.'.B. ..1...J.5. .(.1.E.,.J.'.. .%.F..D. .(..H.2.J.9. .O.E.M. ./. .I.H.V. ./. .I.S.V. .H.'.D.E.3..../.E. .'.D.A.1./.J.).........G.'.E. .. .'.D.1.,.'.!. .'.D.B.1.'.!.). .B.(.D. .'.D.F.3..... .'.D..+.(.J.. .#.H. .'.D.'.3..../.'.E.......D.'. ..B.E. .(..-.E.J.D. .G.0.'. .'.D.(.1.F.'.E.,. .#.H. .#.J. .E.H.'./. .#...1.I. .(.%.,.E.'.D.'.K. .".'.D.(.1.F.'.E.,.".). .%.D.'. .(.9./. .B.1.'.!.). .'.D.4.1.H.7. .H.'.D.E.A.'.G.J.E. .'.D..'.D.J.). .(.9.F.'.J.)... ..-.E.J.D. .#.H. .'.3..../.'.E. .G.0.'. .'.D.(.1.F.'.E.,. .J.9.F.J. .E.H.'.A.B..C. .9.D.I. .4.1.H.7. .G.0.'. .'.D.'..A.'.B... .%.0.'. .C.F.. .D.'. ..1.:.(. .A.J. .'.D.E.H.'.A.B.)... .A.D.'. ..B.E. .(..-.E.J.D. .#.H. .'.3..../.'.E. .'.D.(.1.F.'.E.,... .........'.D.1.,.'.!. .C.0.D.C. .E.D.'.-.8.).:...... .%.0.'. .E.'. .C.F.. .E.O.5.F.Q.9. .#./.H.'.. .#.5.D.J. .(.O.E.M.). .#.H. .(.'.&.9. .#.,.G.2.). .E.3..B.D. .(.I.H.V.). .#.H. .(.'.&.9. .(.1.'.E.,. .E.3..B.D. .(.I.S.V.)... .A.J.F.7.(.B. .9.D.J.C. .'.*.A.'.B.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ARB\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (680), with CRLF line terminators
Category:	dropped
Size (bytes):	17990
Entropy (8bit):	3.706359990826687
Encrypted:	false
SSDEEP:	192:/RxA3zaWSs33Ip272gHiqa5eqmIRxHzbhHiqP5evmg:JxA3/XRHfHZ8xHxHfQ+g
MD5:	347A13923187CB93CE2B5D95B74BF668
SHA1:	4C59D945E9EA9E00F231CECB6824A5694DE439F6
SHA-256:	BB7291704C6E50BF11C03E8E342A93A2FB5DA056B94E9979A5FDBD6213AE579A
SHA-512:	55305842DC615C3A75D0CE4CFBDF3DDA4C4E30634CC65C41FDA760A9825CA8DA654C64B3CA426E271D7355AEB672AF8D2B365E8A754A10B7D0DD8693011612A5
Malicious:	false
Reputation:	low
Preview:	......'..A.'.B. ..1...J.5. .(.1.E.,.J.'.. .%.F..D. .(..H.2.J.9. .O.E.M. ./. .I.H.V. ./. .I.S.V. .H.'.D.E.3..../.E. .'.D.A.1./.J.).........G.'.E. .. .'.D.1.,.'.!. .'.D.B.1.'.!.). .B.(.D. .'.D.F.3..... .'.D..+.(.J.. .#.H. .'.D.'.3..../.'.E.......D.'. ..B.E. .(..-.E.J.D. .G.0.'. .'.D.(.1.F.'.E.,. .#.H. .#.J. .E.H.'./. .#...1.I. .(.%.,.E.'.D.'.K. .".'.D.(.1.F.'.E.,.".). .%.D.'. .(.9./. .B.1.'.!.). .'.D.4.1.H.7. .H.'.D.E.A.'.G.J.E. .'.D..'.D.J.). .(.9.F.'.J.)... ..-.E.J.D. .#.H. .'.3..../.'.E. .G.0.'. .'.D.(.1.F.'.E.,. .J.9.F.J. .E.H.'.A.B..C. .9.D.I. .4.1.H.7. .G.0.'. .'.D.'..A.'.B... .%.0.'. .C.F.. .D.'. ..1.:.(. .A.J. .'.D.E.H.'.A.B.)... .A.D.'. ..B.E. .(..-.E.J.D. .#.H. .'.3..../.'.E. .'.D.(.1.F.'.E.,... .........'.D.1.,.'.!. .C.0.D.C. .E.D.'.-.8.).:...... .%.0.'. .E.'. .C.F.. .E.O.5.F.Q.9. .#./.H.'.. .#.5.D.J. .(.O.E.M.). .#.H. .(.'.&.9. .#.,.G.2.). .E.3..B.D. .(.I.H.V.). .#.H. .(.'.&.9. .(.1.'.E.,. .E.3..B.D. .(.I.S.V.)... .A.J.F.7.(.B. .9.D.J.C. .'.*.A.'.B.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\CHS\ChipsetCHS.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80168
Entropy (8bit):	4.696252558996541
Encrypted:	false
SSDEEP:	768:dMFeZ0S8BOZHqwrOla8BfIrKcnai1f8p2APWiSM2WonADlgn7pq:dMsuJ48wrsa8BfI1ai1f8PgODWnw
MD5:	0EAFFCCBAAA1A34938E839C4E23A5550
SHA1:	8DF7AEE4F8C95869CC4B07D7E6894E7D99165F0A
SHA-256:	3FE6B2E3D53FDC6B38F56CA05598894D9BB7724AD6E08154A3C6AD96779C209A
SHA-512:	AA6A786F79A76871E6018B6D7A62D2570E8AF171D25BB03E3426D8839EFFBC0248642F5472F01495B11A156340028023D7AA9E7C99D5D65EC68D7D12586BE9FD
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!......................................................... .......<............................................... ............... ..(............................................................................................rdata..............................@..@.rsrc........ ....... ..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\CHS\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (765), with CRLF line terminators
Category:	dropped
Size (bytes):	30360
Entropy (8bit):	4.705072246333782
Encrypted:	false
SSDEEP:	384:LD6ZLVg/S8BT6ZLJwgqmb1r1M3zDfoK7SF8BfIXRdKcUVfjK7SFi1f8XRV:LeZ0S8BOZHqwrOla8BfIrKcnai1f8T
MD5:	66B3080BCDA73DD402597C6223D4E7DB
SHA1:	BFC8DFDAF9937DF17E5E97DFF3DC76E68FA2F2B7
SHA-256:	8BF40D54EDE27D3441507F75408CAD374934D154A1B74FFA5A35BDF23AA1736D
SHA-512:	19E8A6C98230F9521743B9DAB37257B5546AC5A12713184BA100DEE61B6A8C361DFE2999D45A1A39635A6581E3FC737F32180777B3E67CC224F2887EA2240B89
Malicious:	false
Reputation:	low
Preview:	..I.N.T.E.L. .o..N...SOS....O.E.M./.I.H.V./.I.S.V. ..R...TUSN(u7b................w ... .(W.Y6R.0.[..b.O(uKNMR....HQ.N.~.....0.....S.g(W.N.~.....Nb..vag>kKN.T...e.S.O(u.b.}.,go..N.S.vsQPg.e..;`.y:N. o..N. ...0.}..b.O(u,g. o..N. ..sSh..f.`.T.a,g. OS... .vag>k.0.Y.g.`.N.T.a,g. OS... .vag>k.....N...[..b.O(u,g. o..N. .0........dk.Y......l.a....... ..Y.g.`/f.S.Y...Y6R .FU .(.O.E.M.)..0.r.zlx.N...UFU .(.I.H.V.)....b.r.zo..N.O.^FU .(.I.S.V.)...,g. ...SOS... .v@b.g.Q.[.[.`..(u.0....*. ..Y.g.`/f.g.~(u7b...R.S.gD..N.N..sS. I.N.T.E.L. .o..N...SOS... .[.`..(u.0.........[.N .O.E.M..0I.H.V. ..T .I.S.V..............S....N. o..N. .N...S(ueg.N .I.n.t.e.l. ..~.N.N.T.~.T.O(u.0,g. OS... .N.c.N.\dk. o..N. .TvQ.[^. .I.n.t.e.l. ..~.N.N.T.~.T.O(u.v...S.0.S,g. OS... ag>k.v.~_g..I.n.t.e.l. .lQ.SncvQHrCg.c.N.`.N..^..N.g.0.N.Sl....0hQ.t'`.T.[hQ.N.n.v...S........1... .:N.`,g...v._.S.T.~.b.v.v...Q..O(u.09e.R.T.Y6R. o..N. ..v^.N......2... ..f9e.0.Y6Rv^.T.`.v.g.~(u7b.R... o..N. ...S.b,g. o..N. .vM..u.N.T..ag

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\CHT\ChipsetCHT.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80168
Entropy (8bit):	4.7045638712919935
Encrypted:	false
SSDEEP:	768:4IwbfJosqwrOla8BfIrKcnai1f0p2APWiSM2WoMg0JYIUk:4IwTswrsa8BfI1ai1f0PgWOnk
MD5:	7FFE0E954BEA9AE67FB9C56F526C7383
SHA1:	70907E8A65FFCB10EDE6ECAAA7A2C39C28431790
SHA-256:	504F50BB8DDE048BAE7FF8D666EF5A49390CE4675EBD4B26576FF012C4820487
SHA-512:	1B61D301BABB493E22051DA16F08D90261426820200BCE69F3714AE0681D2895EF63F395CDE538773C0432C67E915E5F5F4BE06E17BAD979A87030047927FEA3
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!......................................................... ....................................................... ............... ..(............................................................................................rdata..............................@..@.rsrc........ ....... ..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\CHT\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (765), with CRLF line terminators
Category:	dropped
Size (bytes):	30572
Entropy (8bit):	4.767703926594234
Encrypted:	false
SSDEEP:	384:lvWSj6gMbstpxRi4jgabststqmb1r1M3zDfoK7SF8BfIXRdKcUVfjK7SFi1f0XRV:lbfJosqwrOla8BfIrKcnai1f0T
MD5:	2C4783D304A1C8431810FA141733D3F7
SHA1:	8B140F4CE074DEE2A8D9ECE170AB7BAD6623FA56
SHA-256:	5E9FA8952F146723009FF54254318AE0E3F36677BA94666275A5F04D4E8D6528
SHA-512:	3EE8D803F00F4CEBD3B119955E2296AEDD25903E5CBD91CFA2AA5E0C0348CA8F722795D4CBF271E8E54A927D6C57C39A2820436EB820CEC58208B35281D180FF
Malicious:	false
Reputation:	low
Preview:	..I.N.T.E.L. ....c.k.T.}.f..O.E.M. ./. .I.H.V. ./. .I.S.V. .M....T.U.N.O(u................N.....(W.....0.[..b.O(uKNMRHQ....dk.T.}.f.0.....HQ.N0}.....N.N.v.h>k.T.h.N.Q.O(u.b..eQdk...T.NUO.v..v..e...N.N.T1z.p.0...0...0..eQ.b.O(udk.0...01\h.:y.`.T.adk.0.T.}.f.0-N.v.h>k.0.Y.g.`.N.T.a....N...[..b.O(udk.0...0.0.........N..l.a.. ...... ..Y.g.`/f.S.Y-..P.. ..^FU .(.O.E.M.)..0hs.zlx..O.aFU .(.I.H.V.)..0.bhs.z...O.a .(.I.S.V.)......N.[te.v.0.c.k.T.}.f.0i.(u.e.`....... ..Y.g.`/f. .N,..O(u... ...S.g. D... .A.. .0I.N.T.E.L. ....c.k.T.}.f.0i.(u.e.`.0..........e .O.E.M..0I.H.V..0.T .I.S.V............c.k..,g.0...0.v.c.k.PAQ1..`.\vQ.. .I.n.t.e.l. ..vCQ.N"u.T.T(u.0dk.0.T.}.f.0.N.c.k.`.\dk.0...0..^. .I.n.t.e.l. ..vCQ.N"u.T.T(u.09h.ddk.0.T.}.f.0.v.h>k..I.n.t.e.l. ..O .I.n.t.e.l. ..vW.\O.k...[.c...`^..\l\.0.N.SI....0hQ.t'`.0.N.S.[hQ.N...v.c.k.f...`.S.N........a.). ..p.`..].v..\|v.T.}.O.v.v..gQ..O(u.0.O9e.T........&N.N......b.). ..O9e.0.....T.P^..0...0...S.bdk.0...0.v.^

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\CSY\ChipsetCSY.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	100648
Entropy (8bit):	4.1488142705889475
Encrypted:	false
SSDEEP:	1536:ZRKYK8aoc21wwrsa8BfI1ai1f0lgpFuI7:CCaobdpFuI7
MD5:	26FB8EE34D988D1B01AFFE57C73A242A
SHA1:	2D555C576225C54AA9F079D8E4777EE51DC66D53
SHA-256:	5FDEB76215A37310213571E451AFA3FC5F09DE28BD33AD5CF78E53A50579D6C9
SHA-512:	7384A96166B4643823D2453375038048B9DEB3D10F7E216765BE4052682DFE3848B981B6F0CDD0CBE02821850D96C380903A6FF08C97FDF06D2708995A92037C
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!.........`...............................................p....................................................... ...9...........p..(....`.......................................................................................rdata..............................@..@.rsrc....9... ...@... ..............@..@.reloc.......`.......`..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\CSY\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (879), with CRLF line terminators
Category:	dropped
Size (bytes):	46378
Entropy (8bit):	3.702573669495455
Encrypted:	false
SSDEEP:	768:+0ZJtmux8hQhS+tBqx1yYqwrOla8BfIrKcnai1f0U:rYK8aoc21wwrsa8BfI1ai1f0U
MD5:	DEACC60E7F89431FAF063E3D2C8C357E
SHA1:	1B0F9BD09DC316D4A9C9D868BBB718EC8D0C80CE
SHA-256:	C4B944CEDFDDD2570A4151C65A75E77B32A5DC55F5DBF4EAE8386B4D04F9C41C
SHA-512:	92345963979370A0A79EEF9596B4ADF06A31D12737311F41144949850917EEC3C4568A794D237EA99BE809D9579E575508C20256B7C22F61ED55438E71BE599E
Malicious:	false
Reputation:	low
Preview:	..L.I.C.E.N...N... .S.M.L.O.U.V.A. .N.A. .P.O.U.}.I.T... .S.O.F.T.W.A.R.U. .I.N.T.E.L. .(.D.i.s.t.r.i.b.u.c.e. .O.E.M./.I.H.V./.I.S.V. .a. .j.e.d.n.o.t.l.i.v... .u.~.i.v.a.t.e.l.).........D.n.L.E.}.I.T... .U.P.O.Z.O.R.N...N... .-. .P.X.E...T...T.E. .S.I. .T.E.N.T.O. .T.E.X.T. .P.X.E.D. .K.O.P...R.O.V...N...M.,. .I.N.S.T.A.L.A.C... .N.E.B.O. .P.O.U.}.I.T...M... .....N.e.p.o.u.~...v.e.j.t.e.,. .a.n.i. .n.e.z.a.v...d...j.t.e. .t.e.n.t.o. .s.o.f.t.w.a.r.e. .a. .s.o.u.v.i.s.e.j...c... .m.a.t.e.r.i...l.y. .(.s.o.u.h.r.n.n... .o.z.n.a...e.n... .j.a.k.o. .".S.o.f.t.w.a.r.e.".).,. .d.o.k.u.d. .s.i. .p.o.z.o.r.n... .n.e.p.Y.e...t.e.t.e. .n...s.l.e.d.u.j...c... .p.o.d.m...n.k.y... .Z.a.v.e.d.e.n...m. .n.e.b.o. .p.o.u.~.i.t...m. .t.o.h.o.t.o. .S.o.f.t.w.a.r.u. .p.Y.i.j...m...t.e. .p.o.d.m...n.k.y. .t...t.o. .S.m.l.o.u.v.y... .P.o.k.u.d. .s. .p.o.d.m...n.k.a.m.i. .n.e.s.o.u.h.l.a.s...t.e.,. .S.o.f.t.w.a.r.e. .n.e.i.n.s.t.a.l.u.j.t.e.,. .a.n.i. .n.e.p.o.u.~...v.e.j.t.e...........D...l.e. .u.p.o.z.o.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\DAN\ChipsetDAN.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	100648
Entropy (8bit):	3.9867631809813164
Encrypted:	false
SSDEEP:	1536:eqJMpgRa93EaI4Ywrsa8BfI1ai1f0+gBZlm0Twq:8gRM3EMaBZlm0Twq
MD5:	54D214A3B9072F3BA28406FC3C5FDAE3
SHA1:	6A942BDBB09B663FADFB4B3A9E72127F2E08E5FB
SHA-256:	39306432778CC32834D7DA5DFD6EF5F4BCC343E2CD589983357AFC7A433F78A3
SHA-512:	CA2A57A5DB9CEFC51D6BD9E56A18751F4617AA408C0575BADCB73E3F18841E0E0AB90D5D2389ECE4CA879A1065E3760316BD74A16BB07A3206E8A152A26CA31A
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!.........`...............................................p......A(............................................... ..P?...........p..(....`.......................................................................................rdata..............................@..@.rsrc...P?... ...@... ..............@..@.reloc.......`.......`..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\DAN\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (911), with CRLF line terminators
Category:	dropped
Size (bytes):	47718
Entropy (8bit):	3.5109025249016437
Encrypted:	false
SSDEEP:	768:QkpgRQbHWi3EQbHWuY7cVBqwrOla8BfIrKcnai1f0T:JpgRa93EaI4Ywrsa8BfI1ai1f0T
MD5:	58009F0600E21FC4FDEDFB342510BE9F
SHA1:	AEA632D32D61B7786BA9A45F65E7FBA991561351
SHA-256:	5A61815446603BD8FF69D9558B18781457481BB505DC3B59954BC0C773A71978
SHA-512:	D80B8EFFF1FAC41F795B1D89EC8CAB625FFB48288C31D73DC350B8C6ACEC10EF856CBB5E6B0641FFE742F3F0FEB32E194E74426687A11F925C9A855301219C5D
Malicious:	false
Reputation:	low
Preview:	..I.N.T.E.L. .P.R.O.G.R.A.M.V.A.R.E.L.I.C.E.N.S.A.F.T.A.L.E. .(.O.E.M. ./. .I.H.V. ./. .I.S.V. .D.i.s.t.r.i.b.u.t.i.o.n. .&. .E.n.k.e.l.t.b.r.u.g.e.r.).........V.I.G.T.I.G.T. .-. .L...S. .A.F.T.A.L.E.N. .I.G.E.N.N.E.M.,. .F...R. .P.R.O.G.R.A.M.M.E.T. .K.O.P.I.E.R.E.S.,. .I.N.S.T.A.L.L.E.R.E.S. .E.L.L.E.R. .T.A.G.E.S. .I. .B.R.U.G... .....P.r.o.g.r.a.m.m.e.t. .e.l.l.e.r. .t.i.l.h...r.e.n.d.e. .m.a.t.e.r.i.a.l.e. .(.u.n.d.e.r. ...t. .k.a.l.d.e.t. .".p.r.o.g.r.a.m.m.e.t.".). .m... .i.k.k.e. .t.a.g.e.s. .i. .b.r.u.g. .e.l.l.e.r. .i.n.d.l...s.e.s.,. .f...r. .d.u. .h.a.r. .l...s.t. .n.e.d.e.n.s.t...e.n.d.e. .v.i.l.k...r. .o.g. .b.e.t.i.n.g.e.l.s.e.r. .n...j.e. .i.g.e.n.n.e.m... .I.n.d.l...s.n.i.n.g. .e.l.l.e.r. .i.b.r.u.g.t.a.g.n.i.n.g. .a.f. .p.r.o.g.r.a.m.m.e.t. .b.e.t.r.a.g.t.e.s. .s.o.m. .d.i.n. .a.c.c.e.p.t. .a.f. .a.f.t.a.l.e.v.i.l.k...r.e.n.e... .S...f.r.e.m.t. .d.u. .i.k.k.e. .k.a.n. .a.c.c.e.p.t.e.r.e. .d.i.s.s.e. .v.i.l.k...r.,. .m... .d.u. .i.k.k.e. .i.n.s.t.a.l.l.e.r.e. .e.l.l.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\DEU\ChipsetDEU.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	103776
Entropy (8bit):	3.953923398053227
Encrypted:	false
SSDEEP:	1536:UDJ1Ry1JYRLwrsa8BfI1ai1f0PgubezqqpKj7uCc2G:B1Jjubezq+Kj7PNG
MD5:	175B112A68C8675230796227260D0B4D
SHA1:	B03A4B7F13336CC5667933ACB981D32D13ACCDA2
SHA-256:	F5E9C885D92B5AC90681FA265F817D0398E911088B59F7C36AAF6FEE68FE6835
SHA-512:	5A94A90DF5095D924A4CF527F7AF71431DD39F066E4CD964F85AF48050B4677C8561FC9684BC6E2FB8167703C002D4A35C26732CBC8A6012A765B39036152F78
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!.........p......................................................]................................................ ...M..............`....p.......................................................................................rdata..............................@..@.rsrc....M... ...P... ..............@..@.reloc.......p.......p..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\DEU\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (923), with CRLF line terminators
Category:	dropped
Size (bytes):	50692
Entropy (8bit):	3.517262638790405
Encrypted:	false
SSDEEP:	384:O1RdUdGgMg1JYRdUdGgMD/qqmb1r1M3zDfoK7SF8BfIXRdKcUVfjK7SFi1f0XRV:O1Ry1JYRF/qqwrOla8BfIrKcnai1f0T
MD5:	A9341E142E37D6D41E28906B5096F989
SHA1:	176AEB72507849276F5E8287149E8C5D6ED24D03
SHA-256:	4A5B864F5CC4FAF291A4E8B9F23FBAFCB353F33CB27A4CAB3364293E36249608
SHA-512:	9DCD2E6D8FB8FA91AE89B6FFDE6AEBCA3747F82213AE8AB28BE07DCD6B7DDCA8D6EAB409D8A4C7FE7F5D3A73EF7FEDA07103F9C4A661056608FEF61A45162CB9
Malicious:	false
Reputation:	low
Preview:	..I.N.T.E.L. .S.O.F.T.W.A.R.E.-.L.I.Z.E.N.Z.V.E.R.E.I.N.B.A.R.U.N.G. .(.O.E.M.-.H.e.r.s.t.e.l.l.e.r./.u.n.a.b.h...n.g.i.g.e. .H.a.r.d.w.a.r.e.-. .u.n.d. .S.o.f.t.w.a.r.e.a.n.b.i.e.t.e.r. .u.n.d. .E.i.n.z.e.l.b.e.n.u.t.z.e.r.).........W.I.C.H.T.I.G. .-. .B.I.T.T.E. .V.O.R. .D.E.M. .K.O.P.I.E.R.E.N.,. .I.N.S.T.A.L.L.I.E.R.E.N. .O.D.E.R. .V.E.R.W.E.N.D.E.N. .D.E.R. .S.O.F.T.W.A.R.E. .S.O.R.G.F...L.T.I.G. .D.U.R.C.H.L.E.S.E.N... .....V.e.r.w.e.n.d.e.n. .o.d.e.r. .l.a.d.e.n. .S.i.e. .d.i.e.s.e. .S.o.f.t.w.a.r.e. .u.n.d. .a.l.l.e. .d.a.z.u.g.e.h...r.i.g.e.n. .E.l.e.m.e.n.t.e. .(.n.a.c.h.f.o.l.g.e.n.d. .a.l.s. .. S.o.f.t.w.a.r.e.. .b.e.z.e.i.c.h.n.e.t.). .e.r.s.t. .d.a.n.n.,. .w.e.n.n. .S.i.e. .d.i.e. .f.o.l.g.e.n.d.e.n. .B.e.s.t.i.m.m.u.n.g.e.n. .u.n.d. .B.e.d.i.n.g.u.n.g.e.n. .d.u.r.c.h.g.e.l.e.s.e.n. .h.a.b.e.n... .D.u.r.c.h. .d.a.s. .L.a.d.e.n. .o.d.e.r. .V.e.r.w.e.n.d.e.n. .d.e.r. .S.o.f.t.w.a.r.e. .e.r.k.l...r.e.n. .S.i.e. .s.i.c.h. .m.i.t. .d.e.n. .B.e.d.i.n.g.u.n.g.e.n. .d.i.e.s.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ELL\ChipsetELL.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	108840
Entropy (8bit):	4.732072180583515
Encrypted:	false
SSDEEP:	1536:3ExzsL/3Oc/Ewrsa8BfI1ai1f0ug0kglSCj9xbB:ezsL/3Oc/q0kglSCj9xN
MD5:	550325AF39A3CC24AD5D9EFE1DFECD41
SHA1:	442533E127E7818D81637B805B540FC02C9FCDAF
SHA-256:	3C75A87877830628DE4AE25F6F0D27019F9739BF6D63E816A2A812B63C51F81B
SHA-512:	694415B63700BCA163C18CF3C23F85F4E9D897C41C247D1548BEE9271480BA8B507065D53BE5C86E32FB9E54647926D46253B863B9FFADE35AAD939CE2AA6F12
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!................................................................................................................. ...Q..............(............................................................................................rdata..............................@..@.rsrc....Q... ...`... ..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ELL\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1149), with CRLF line terminators
Category:	dropped
Size (bytes):	51072
Entropy (8bit):	4.447666493946975
Encrypted:	false
SSDEEP:	768:vzsFZkLI7cw3Oc7cwlqwrOla8BfIrKcnai1f0q:vzsL/3Oc/Ewrsa8BfI1ai1f0q
MD5:	AC3AB19C17ABCA235FA7AA8F1B140B57
SHA1:	FCEDFD9E9802F0FEF9A2601B36739F6E041B25D9
SHA-256:	0D6910240197185F69998E6C205570584DCB512759488E3535046D6327FCEBFE
SHA-512:	C0DEF8E1ED1B67AAA672B022D775A07E2434A838CFFF948CBE1F7ABFF6733AC71E202CF635DF9C22AF642527F54758B32F10203D2D11212C7406FB8BD5FD035C
Malicious:	false
Reputation:	low
Preview:	........................ ............. ............. ..................... ....... .I.N.T.E.L. .(............... .O.E.M. ./. .I.H.V. ./. .I.S.V. ....... ........................... ...............)....................... .-. ................. ..... ........... ....................... ......... .......................,. ........................... ... ............................... ..... ............................. ............................... ... ................... ..... ........... ................... ....... ......... ....................... ........... .(.....'. ......... ....................... ..... ..... ."...................".). ..... ....... ................... ..................... ......... ................. ........... ....... ........................... ..... ..... ............... ... ........... ....... .....................,. ..................... ..... ......... ........... ....... ................. ........................... ..... ................... ....... ...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ENG\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (774), with CRLF line terminators
Category:	dropped
Size (bytes):	22772
Entropy (8bit):	3.478560432747434
Encrypted:	false
SSDEEP:	384:9KCb1r18HzD5oKrSF8BfdXcXcdF5jKrSF81fhXm40:9KUruDq8BfdMXcoq81fh240
MD5:	025981BEC835144CF833CBB9BD96BB62
SHA1:	2493E36AB89A523C7EC279F761766D9186475F91
SHA-256:	EE448C092CE739C1FABE3FE2E59770AD485337C5F7ADF7426322A56332A2C577
SHA-512:	DE731EAEDC6E8200FE5C7DD4CF7382841F3701B32ECE5FBCD7A7E0F2DC683B5277EBF3583614DBA6D697FD3A1623C8512F14D39D6C021B588A223068F448F7CE
Malicious:	false
Reputation:	low
Preview:	..I.N.T.E.L. .S.O.F.T.W.A.R.E. .L.I.C.E.N.C.E. .A.G.R.E.E.M.E.N.T. .(.O.E.M. ./. .I.H.V. ./. .I.S.V. .D.i.s.t.r.i.b.u.t.i.o.n. .&. .S.i.n.g.l.e. .U.s.e.r.).........I.M.P.O.R.T.A.N.T. .-. .R.E.A.D. .B.E.F.O.R.E. .C.O.P.Y.I.N.G.,. .I.N.S.T.A.L.L.I.N.G. .O.R. .U.S.I.N.G... .....D.o. .n.o.t. .u.s.e. .o.r. .l.o.a.d. .t.h.i.s. .s.o.f.t.w.a.r.e. .a.n.d. .a.n.y. .a.s.s.o.c.i.a.t.e.d. .m.a.t.e.r.i.a.l.s. .(.c.o.l.l.e.c.t.i.v.e.l.y.,. .t.h.e. .".S.o.f.t.w.a.r.e.".). .u.n.t.i.l. .y.o.u. .h.a.v.e. .c.a.r.e.f.u.l.l.y. .r.e.a.d. .t.h.e. .f.o.l.l.o.w.i.n.g. .t.e.r.m.s. .a.n.d. .c.o.n.d.i.t.i.o.n.s... .B.y. .l.o.a.d.i.n.g. .o.r. .u.s.i.n.g. .t.h.e. .S.o.f.t.w.a.r.e.,. .y.o.u. .a.g.r.e.e. .t.o. .t.h.e. .t.e.r.m.s. .o.f. .t.h.i.s. .A.g.r.e.e.m.e.n.t... .I.f. .y.o.u. .d.o. .n.o.t. .w.i.s.h. .t.o. .s.o. .a.g.r.e.e.,. .d.o. .n.o.t. .i.n.s.t.a.l.l. .o.r. .u.s.e. .t.h.e. .S.o.f.t.w.a.r.e...........P.l.e.a.s.e. .A.l.s.o. .N.o.t.e.:.....*. .I.f. .y.o.u. .a.r.e. .a.n. .O.r.i.g.i.n.a.l. .E.q.u.i.p.m.e.n.t. .M.a.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ENU\ChipsetENU.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	76072
Entropy (8bit):	4.107805783374975
Encrypted:	false
SSDEEP:	768:wNKqwrOla8BfIrKcnai1f0W4i2APWiSM2soWbbj/k:wNJwrsa8BfI1ai1f0KgMTk
MD5:	5A6759BB4B8F829B914C71EAADE0ED45
SHA1:	4C785A4CF595851AC33B6F45FB9567DF90B72E3E
SHA-256:	FC4CEC4D0BCBBD4BD017BCC12CD92B9B591A5A620B310B61D0826BBC54F57C29
SHA-512:	B7EC2D3AD7FC478E0F31820AC2D41769692C9EE3A1C607116751E7C8DBE8986F153048C112AF9C4F20EB8515EC81E6FD5A79DAFF78A3CED0760A71FC3FF0C629
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!................................................................................................................ ..T...............(............................................................................................rdata..............................@..@.rsrc...T.... ....... ..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ENU\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (765), with CRLF line terminators
Category:	dropped
Size (bytes):	22644
Entropy (8bit):	3.4810057440784297
Encrypted:	false
SSDEEP:	384:Nqmb1r1M3zDfoK7SF8BfIXRdKcUVfjK7SFi1f0XRw4U:NqwrOla8BfIrKcnai1f0W4U
MD5:	D6BF7496A982BA8D8743EF295AA46732
SHA1:	DEDCEEEF3224E6F2CD81D48B99AA9367DD5DC187
SHA-256:	90B020441FB3F2A8787408C8FECCD5385188856CB132A645D65A4B3E0B0F22BA
SHA-512:	414D8BCC22A6FC7A842C4C42C5936B6A01AC696796510E8E76452C09535090359B9E456A589C2DAE3E15449941EBA61E441B112AC51044E21EE7DDCE1100F2EA
Malicious:	false
Reputation:	low
Preview:	..I.N.T.E.L. .S.O.F.T.W.A.R.E. .L.I.C.E.N.S.E. .A.G.R.E.E.M.E.N.T. .(.O.E.M. ./. .I.H.V. ./. .I.S.V. .D.i.s.t.r.i.b.u.t.i.o.n. .&. .S.i.n.g.l.e. .U.s.e.r.).........I.M.P.O.R.T.A.N.T. .-. .R.E.A.D. .B.E.F.O.R.E. .C.O.P.Y.I.N.G.,. .I.N.S.T.A.L.L.I.N.G. .O.R. .U.S.I.N.G... .....D.o. .n.o.t. .u.s.e. .o.r. .l.o.a.d. .t.h.i.s. .s.o.f.t.w.a.r.e. .a.n.d. .a.n.y. .a.s.s.o.c.i.a.t.e.d. .m.a.t.e.r.i.a.l.s. .(.c.o.l.l.e.c.t.i.v.e.l.y.,. .t.h.e. .".S.o.f.t.w.a.r.e.".). .u.n.t.i.l. .y.o.u. .h.a.v.e. .c.a.r.e.f.u.l.l.y. .r.e.a.d. .t.h.e. .f.o.l.l.o.w.i.n.g. .t.e.r.m.s. .a.n.d. .c.o.n.d.i.t.i.o.n.s... .B.y. .l.o.a.d.i.n.g. .o.r. .u.s.i.n.g. .t.h.e. .S.o.f.t.w.a.r.e.,. .y.o.u. .a.g.r.e.e. .t.o. .t.h.e. .t.e.r.m.s. .o.f. .t.h.i.s. .A.g.r.e.e.m.e.n.t... .I.f. .y.o.u. .d.o. .n.o.t. .w.i.s.h. .t.o. .s.o. .a.g.r.e.e.,. .d.o. .n.o.t. .i.n.s.t.a.l.l. .o.r. .u.s.e. .t.h.e. .S.o.f.t.w.a.r.e...........P.l.e.a.s.e. .A.l.s.o. .N.o.t.e.:.....*. .I.f. .y.o.u. .a.r.e. .a.n. .O.r.i.g.i.n.a.l. .E.q.u.i.p.m.e.n.t. .M.a.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ESP\ChipsetESP.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	104744
Entropy (8bit):	4.060219937712777
Encrypted:	false
SSDEEP:	1536:xGNI9Kdie0Xnwrsa8BfI1ai1f0+gpX35P:3KdlIx35P
MD5:	66DAD1DA51DDB8707FC23A47E2312F98
SHA1:	93E8A8CCC987014748348E945EF193AC100EF76E
SHA-256:	66E4F3DBFFF003D628355A1B44C032A8B15B4B95304299B2D25E4B2BA6D3524C
SHA-512:	14DAC79D604AEC5C4CF8F84946F8FE9AB470333D22112A36306C63CFDD1A8DFFF5CBE2E893D11FE4E5B9222B13B0077B0612BE9BD8E61922159FD7C2F984EE0E
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!.........p....................................................................................................... ...D..............(....p.......................................................................................rdata..............................@..@.rsrc....D... ...P... ..............@..@.reloc.......p.......p..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ESP\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (984), with CRLF line terminators
Category:	dropped
Size (bytes):	48130
Entropy (8bit):	3.4908023481130055
Encrypted:	false
SSDEEP:	384:MHulkdrdc6QAQWH6fLr0qmb1r1M3zDfoK7SF8BfIXRdKcUVfjK7SFi1f0XRV:blodiAQW0Lr0qwrOla8BfIrKcnai1f0T
MD5:	444CCE83ECEB61E38BC317C5D09CF931
SHA1:	14B65637D5701B941A4032BF23B8196A32DD4CBE
SHA-256:	F732B8AC7FF688FF723D367D8D8FED818EEFFF19AEC4AC8A217C0A0833C4EC11
SHA-512:	59F1A5E0DB770CB2A6AD5C4BED58C3DAD132F2DCEF76C8DF86D70194AB8FD0637CB4B708B80D7FFE4705D7138955319268E46A465C67E1893B7527687189FD5E
Malicious:	false
Reputation:	low
Preview:	..C.O.N.T.R.A.T.O. .D.E. .L.I.C.E.N.C.I.A. .D.E. .S.O.F.T.W.A.R.E. .I.N.T.E.L. .(.O.E.M. ./. .I.H.V. ./. .D.i.s.t.r.i.b.u.c.i...n. .a. .I.S.V. .y. .u.s.u.a.r.i.o. ...n.i.c.o.).........I.M.P.O.R.T.A.N.T.E.:. .L...A.S.E. .A.N.T.E.S. .D.E. .C.O.P.I.A.R.,. .I.N.S.T.A.L.A.R. .O. .U.T.I.L.I.Z.A.R. .E.L. .S.O.F.T.W.A.R.E.......N.o. .u.s.e. .n.i. .c.a.r.g.e. .e.s.t.e. .s.o.f.t.w.a.r.e. .n.i. .s.u.s. .m.a.t.e.r.i.a.l.e.s. .a.f.i.n.e.s. .(.c.o.l.e.c.t.i.v.a.m.e.n.t.e.,. .".S.o.f.t.w.a.r.e.".). .h.a.s.t.a. .n.o. .h.a.b.e.r. .l.e...d.o. .c.u.i.d.a.d.o.s.a.m.e.n.t.e. .l.o.s. .s.i.g.u.i.e.n.t.e.s. .t...r.m.i.n.o.s. .y. .c.o.n.d.i.c.i.o.n.e.s... .A.l. .c.a.r.g.a.r. .o. .u.s.a.r. .e.l. .S.o.f.t.w.a.r.e.,. .c.o.n.v.i.e.n.e. .r.e.v.i.s.a.r. .l.o.s. .t...r.m.i.n.o.s. .d.e. .e.s.t.e. .c.o.n.t.r.a.t.o... .S.i. .n.o. .d.e.s.e.a. .p.r.e.s.t.a.r. .s.u. .c.o.n.s.e.n.t.i.m.i.e.n.t.o.,. .n.o. .i.n.s.t.a.l.e. .n.i. .u.s.e. .e.l. .S.o.f.t.w.a.r.e...........T.a.m.b.i...n. .t.e.n.g.a. .e.n. .c.u.e.n.t.a. .q.u.e.:...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\FIN\ChipsetFIN.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	100648
Entropy (8bit):	4.047919945373341
Encrypted:	false
SSDEEP:	1536:K/pUmU6VHEn6VHjwrsa8BfI1ai1f0PgmCDsPsv:2UmfV3VwlIPsv
MD5:	0AC97B87F0805AB9CEA59E9C1D8D21D8
SHA1:	DD3FD443F22AD239A60AB1FAE032F1FFD3F051AD
SHA-256:	CF878168EFE32A2CF5336944D84C33BE0A994D5175C468B77599B2A899838ECC
SHA-512:	84366FEC6CC5C1DA516452001010012C9CD76422F5C3F91EE09F7016A4AAA7C7382B1D5D75FA048CE2875357EB374AB0BA8255CC3C99D0B18E8FD09E44DBF23C
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!.........`...............................................p......7................................................ ...:...........p..(....`.......................................................................................rdata..............................@..@.rsrc....:... ...@... ..............@..@.reloc.......`.......`..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\FIN\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (816), with CRLF line terminators
Category:	dropped
Size (bytes):	46872
Entropy (8bit):	3.5317224354245322
Encrypted:	false
SSDEEP:	768:CUmU6VHJ6n6VHheqwrOla8BfIrKcnai1f0T:CUmU6VHEn6VHjwrsa8BfI1ai1f0T
MD5:	18B7086AA28AC04A0F7E33D706C5F28C
SHA1:	05B848A81283500799B8D1F1060325D6A5B20FCC
SHA-256:	10C4B32AC10009351037C81614CDB0DAC83C7EB3EFE4C87A25ED28616E4E49E5
SHA-512:	B289EBB28DC95E7D4BBA785022EA6E332C8BE4DB2145335D7FFF419CCCC6D14086E50F77E0861B10818BC0A0BBE882AFFC2EC90E471F6BD978459BC666D8A3DC
Malicious:	false
Reputation:	low
Preview:	..I.N.T.E.L.-.O.H.J.E.L.M.I.S.T.O.N. .K...Y.T.T...O.I.K.E.U.S.S.O.P.I.M.U.S. .(.O.E.M./.I.H.V./.I.S.V.-.j.a.k.e.l.u. .j.a. .y.k.s.i.t.t...i.s.k...y.t.t...j...).........T...R.K.E..... .-. .L.U.E. .E.N.N.E.N. .K.O.P.I.O.I.N.T.I.A.,. .A.S.E.N.N.U.S.T.A. .T.A.I. .K...Y.T.T....... .......l... .k...y.t... .t.a.i. .l.a.t.a.a. .t...t... .o.h.j.e.l.m.i.s.t.o.a. .t.a.i. .m.i.t.....n. .s.i.i.h.e.n. .l.i.i.t.t.y.v..... .a.i.n.e.i.s.t.o.a. .(.j.o.i.h.i.n. .v.i.i.t.a.t.a.a.n. .y.h.t.e.i.s.n.i.m.e.l.l... .".o.h.j.e.l.m.i.s.t.o.".). .e.n.n.e.n. .k.u.i.n. .o.l.e.t. .l.u.k.e.n.u.t. .h.u.o.l.e.l.l.i.s.e.s.t.i. .s.e.u.r.a.a.v.a.t. .e.h.d.o.t... .L.a.t.a.a.m.a.l.l.a. .o.h.j.e.l.m.i.s.t.o.n. .t.a.i. .k...y.t.t...m...l.l... .s.i.t... .h.y.v...k.s.y.t. .t...m...n. .s.o.p.i.m.u.k.s.e.n. .e.h.d.o.t... .J.o.s. .e.t. .h.a.l.u.a. .h.y.v...k.s.y... .n.i.i.t...,. ...l... .a.s.e.n.n.a. .t.a.i. .k...y.t... .o.h.j.e.l.m.i.s.t.o.a...........H.u.o.m.a.a. .m.y...s.:.....*. .J.o.s. .o.l.e.t.t.e. .a.l.k.u.p.e.r...i.n.e.n. .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\FRA\ChipsetFRA.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	104744
Entropy (8bit):	4.008898093560649
Encrypted:	false
SSDEEP:	768:RAB6WSrIp6FVEnPcck6JIinPeqwrOla8BfIrKcnai1f0k2APWiSM2/oKjnlaiok4:RAk9VEfISFwrsa8BfI1ai1f0ugHok2l
MD5:	51B704E3D42E70940DFDDF634CB21205
SHA1:	C7222F2244BF9DD275C89F00B9833050B5E673FA
SHA-256:	3E28F7559CEE7307C72306C90D1A02519FC6BD13734D82D680364A0BD425FDA9
SHA-512:	7C73FE7CA8D776D17F300DD0CD4131D2FCF655C960A7ED3C5657793050C2C9A12D2B02121A4B22B521607BB54BE7788497EFE8C1A592645C527F542E91FD4B2A
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!.........p......................................................n................................................ ...K..............(....p.......................................................................................rdata..............................@..@.rsrc....K... ...P... ..............@..@.reloc.......p.......p..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\FRA\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (957), with CRLF line terminators
Category:	dropped
Size (bytes):	49024
Entropy (8bit):	3.501157480134015
Encrypted:	false
SSDEEP:	768:I6WSrIp6FVEnPcck6JIinPeqwrOla8BfIrKcnai1f0q:H9VEfISFwrsa8BfI1ai1f0q
MD5:	94C41B97FB11B6E6D7871E7A220D1CD3
SHA1:	D394A419C7C4CF006C71E9A29AB83CBFE78568BC
SHA-256:	F51C42F3674919C27560C010CC8F7F82C143B11D7288724651D368E484FF5D33
SHA-512:	2DE8228F97F7FA0B90CBD567C02785A34B6FE367348423E355CEE9B40CF9330DCCFED118F694557F3310B6F958B858B1FFBC907EA1341C569C7C41D7D1F449AA
Malicious:	false
Reputation:	low
Preview:	..A.C.C.O.R.D. .D.E. .L.I.C.E.N.C.E. .D.U. .L.O.G.I.C.I.E.L. .I.N.T.E.L. .(.d.i.s.t.r.i.b.u.t.i.o.n. .O.E.M. ./.I.H.V./. .I.S.V. .e.t. .m.o.n.o.-.u.t.i.l.i.s.a.t.e.u.r.).........I.M.P.O.R.T.A.N.T. .-. ... .L.I.R.E. .A.V.A.N.T. .D.E. .C.O.P.I.E.R.,. .D.'.I.N.S.T.A.L.L.E.R. .O.U. .D.'.U.T.I.L.I.S.E.R. .L.E. .L.O.G.I.C.I.E.L.....L.i.s.e.z. .a.t.t.e.n.t.i.v.e.m.e.n.t. .l.e.s. .t.e.r.m.e.s. .e.t. .c.o.n.d.i.t.i.o.n.s. .d.u. .p.r...s.e.n.t. .c.o.n.t.r.a.t. .d.e. .l.i.c.e.n.c.e. .a.v.a.n.t. .d.'.u.t.i.l.i.s.e.r. .o.u. .d.e. .c.h.a.r.g.e.r. .l.e. .p.r...s.e.n.t. .l.o.g.i.c.i.e.l. .e.t. .t.o.u.t. .l.e. .m.a.t...r.i.e.l. .a.s.s.o.c.i... .(.a.p.p.e.l...s. .c.o.l.l.e.c.t.i.v.e.m.e.n.t. .l.e. ... .l.o.g.i.c.i.e.l. ...)... .L.'.u.t.i.l.i.s.a.t.i.o.n. .o.u. .l.e. .c.h.a.r.g.e.m.e.n.t. .d.u. .l.o.g.i.c.i.e.l. .c.o.n.s.t.i.t.u.e. .u.n.e. .a.c.c.e.p.t.a.t.i.o.n. .d.e.s. .t.e.r.m.e.s. .d.u. .p.r...s.e.n.t. .c.o.n.t.r.a.t... .E.n. .c.a.s. .d.e. .r.e.f.u.s. .d.e. .c.e.s. .t.e.r.m.e.s.,. .n.'.i.n.s.t.a.l.l.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\FRC\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (959), with CRLF line terminators
Category:	dropped
Size (bytes):	26306
Entropy (8bit):	3.463892326108816
Encrypted:	false
SSDEEP:	384:I4dWS8ttm6iyX690sfg2n4S9riyXaNgisfgk:I6WSc836690sf5Vk6egisfh
MD5:	A0D5C38A6E2E67A69B0BBE8DABF4BB9E
SHA1:	E0F041C15E4254FC097CF9A454C754B9D7868C52
SHA-256:	4353A56062710B7DC4D9BE1C16A4CAEC4AAD2AE584628DD9E03552DD2A998354
SHA-512:	8B75E78B84AA41E675FE7B12A19AC78387FA4E4E711619ABD64E9AEE446485189B2CAB5B4C372CABEB34395E057543E8AE0149886720C9E591CAE9F749CCB30E
Malicious:	false
Reputation:	low
Preview:	..A.C.C.O.R.D. .D.E. .L.I.C.E.N.C.E. .D.U. .L.O.G.I.C.I.E.L. .I.N.T.E.L. .(.d.i.s.t.r.i.b.u.t.i.o.n. .O.E.M. ./.I.H.V./. .I.S.V. .e.t. .m.o.n.o.-.u.t.i.l.i.s.a.t.e.u.r.).........I.M.P.O.R.T.A.N.T. .-. ... .L.I.R.E. .A.V.A.N.T. .D.E. .C.O.P.I.E.R.,. .D.'.I.N.S.T.A.L.L.E.R. .O.U. .D.'.U.T.I.L.I.S.E.R. .L.E. .L.O.G.I.C.I.E.L.....L.i.s.e.z. .a.t.t.e.n.t.i.v.e.m.e.n.t. .l.e.s. .t.e.r.m.e.s. .e.t. .c.o.n.d.i.t.i.o.n.s. .d.u. .p.r...s.e.n.t. .a.c.c.o.r.d. .d.e. .l.i.c.e.n.c.e. .a.v.a.n.t. .d.'.u.t.i.l.i.s.e.r. .o.u. .d.e. .c.h.a.r.g.e.r. .l.e. .p.r...s.e.n.t. .l.o.g.i.c.i.e.l. .e.t. .t.o.u.t. .l.e. .m.a.t...r.i.e.l. .a.s.s.o.c.i... .(.a.p.p.e.l...s. .c.o.l.l.e.c.t.i.v.e.m.e.n.t. .l.e. .".l.o.g.i.c.i.e.l.".)... .L.'.u.t.i.l.i.s.a.t.i.o.n. .o.u. .l.e. .c.h.a.r.g.e.m.e.n.t. .d.u. .l.o.g.i.c.i.e.l. .c.o.n.s.t.i.t.u.e. .u.n.e. .a.c.c.e.p.t.a.t.i.o.n. .d.e.s. .t.e.r.m.e.s. .d.u. .p.r...s.e.n.t. .c.o.n.t.r.a.t... .E.n. .c.a.s. .d.e. .r.e.f.u.s. .d.e. .c.e.s. .t.e.r.m.e.s.,. .n.'.i.n.s.t.a.l.l.e.z. .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\HEB\ChipsetHEB.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	92456
Entropy (8bit):	4.562843153633132
Encrypted:	false
SSDEEP:	1536:XJmhyY6EFsHR5s7L0UIwrsa8BfI1ai1f0vgQu0:4KEFC0v06Qu0
MD5:	F0539DE0664EC8D34451A48BB9F4438B
SHA1:	9C13EC63721C9985C8950F697AABA02B079F1239
SHA-256:	B121E287CA4FC024C8D59984A87055513AF37FBAFDF0125F689D8238D0F92231
SHA-512:	4CD5ABACC2A6DD98605AB8856D0F2B5D729D782ABAB4DE460C9A7EA58CD2967F176AD5858F9A7E00F0871F1215A10B151BE77849AB79A69A3FE6E4627180B119
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!.........@...............................................P....................................................... ...............P..(....@.......................................................................................rdata..............................@..@.rsrc........ ... ... ..............@..@.reloc.......@.......@..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\HEB\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (765), with CRLF line terminators
Category:	dropped
Size (bytes):	39676
Entropy (8bit):	4.212089317144857
Encrypted:	false
SSDEEP:	768:rSwM+IY6EFsHFj5s7L0URqwrOla8BfIrKcnai1f0z:rhyY6EFsHR5s7L0UIwrsa8BfI1ai1f0z
MD5:	D56B611DCFD29047762ED2378AEFC9AC
SHA1:	76934A0D99BCD413100922C245249C8A61CB96E9
SHA-256:	AC7B0FD4868A3FA32463CA47930163481B3E33276D2CE06BE16F33669A9833AF
SHA-512:	40725A74FB706CE478062EFAC2785803CDAC93F0DA38400EB408D414433CD59848060A5BD1AB820203182823B246F777CD637914FE8DE8562EE52C5F5F60A23D
Malicious:	false
Reputation:	low
Preview:	.......... ........... ........... ..... .I.n.t.e.l. .(........... ..."... ......... ......... ........... .O.E.M.).)./. . ....... ........... ........... .(.I.H.V.). ./. ....... ........... ........... .(.I.S.V.). . ............. .........)................. .-. ..... ........... ......... ...........,. ........... ..... ............. ........... ............. ..... ............. ........... ..... ............... ............... ......... .(......... ........... .................,. ..."...........".). ..... ......... ......... ............. ............. ............. ........... ............. ..... ........... .....,. ............. ..... ............. ............. ..... ......... ....... ..... ......... ........... .............,. ....... ............. ..... ............. ............................. ....... .....:.....*. ..... ....... ......... ......... ........... .(.O.E.M.).,. ....... ........... ........... .(.I.H.V.).,. ..... ....... ........... ........... .(.I.S.V.).,. .....

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\HUN\ChipsetHUN.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	104744
Entropy (8bit):	4.143191957823037
Encrypted:	false
SSDEEP:	3072:0X27PeRxr4DX0+GhoaLrehZemYS0hoaLeWaZds7TS1EFWvXg6jXA3k:B
MD5:	3D72CC74E2EB098360246F5B4CF67346
SHA1:	861306500FC34009E8DF89D3F6CBE654C028945B
SHA-256:	78422CF31B563913A72A1A5E791992E8B995C28BAB0EDDB3E68C1236ED8CD017
SHA-512:	F924F03CA6567B91498A7AA7E643E8983303C585DED512DD1C15286FC73AC620C7FFEE918523F567008D33AA67D35A4F7A8C4706EA548AE3FA3B2D08CF15A49F
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!.........p....................................................................................................... ...E..............(....p.......................................................................................rdata..............................@..@.rsrc....E... ...P... ..............@..@.reloc.......p.......p..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\HUN\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (900), with CRLF line terminators
Category:	dropped
Size (bytes):	48874
Entropy (8bit):	3.631600879295551
Encrypted:	false
SSDEEP:	768:Ysi27PIPA0xr4DXWoJO+GhoaN5+YebNPxemYS0hoaN5DKWgFPxd3xMIBqwrOla8J:YX27PeRxr4DX0+GhoaLrehZemYS0hoaV
MD5:	3AB259E80D8ED5C5EBFFFF63313F904C
SHA1:	186382765B6514DABB4DFBA0C53A050AA2862430
SHA-256:	D5A0A255BA97756924E2B89B89B33C4BA6E215B1D0104A258F5B79E3C79AD4C4
SHA-512:	C1443D7793A15E6FF610446ED2B7CB3107ED08EF9497958D6813FE3FA88A2CF6AA6679448FC4C9F35A31EC7328F3F35D7776F1B5262C5F539341C893E4708883
Malicious:	false
Reputation:	low
Preview:	..I.N.T.E.L. .S.Z.O.F.T.V.E.R.L.I.C.E.N.C.-.S.Z.E.R.Z...D...S. .(.O.E.M. ./. .I.H.V. ./. .I.S.V. ...s. .e.g.y.e.d.i. .f.e.l.h.a.s.z.n...l...k. .s.z...m...r.a.).........F.O.N.T.O.S. .F.I.G.Y.E.L.M.E.Z.T.E.T...S.:. .A. .S.Z.O.F.T.V.E.R. .M...S.O.L...S.A.,. .T.E.L.E.P...T...S.E. ...S. .H.A.S.Z.N...L.A.T.A. .E.L...T.T. .O.L.V.A.S.S.A. .E.L. .A.Z. .A.L...B.B.I.A.K.A.T... .........N.e. .h.a.s.z.n...l.j.a. ...s. .n.e. .t...l.t.s.e. .b.e. .a. .s.z...m...t...g...p.b.e. .a. .s.z.o.f.t.v.e.r.t. ...s. .a.z. .a.h.h.o.z. .k.a.p.c.s.o.l...d... .a.n.y.a.g.o.k.a.t. .(...s.s.z.e.f.o.g.l.a.l... .n...v.e.n.:. .a. .".S.z.o.f.t.v.e.r.t.".).,. .a.m...g. .f.i.g.y.e.l.m.e.s.e.n. .e.l. .n.e.m. .o.l.v.a.s.t.a. .a.z. .a.l...b.b.i. .f.e.l.t...t.e.l.e.k.e.t... .A. .S.z.o.f.t.v.e.r. .b.e.t...l.t...s...v.e.l. ...s. .h.a.s.z.n...l.a.t...v.a.l. ...n. .e.l.f.o.g.a.d.j.a. .a. .j.e.l.e.n. .S.z.e.r.z...d...s. .f.e.l.t...t.e.l.e.i.t... .H.a. .n.e.m. .k...v...n.j.a. .e.l.f.o.g.a.d.n.i. .e. .f.e.l.t...t.e.l.e.k.e.t.,. .n.e. .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ITA\ChipsetITA.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	104744
Entropy (8bit):	4.019849681384971
Encrypted:	false
SSDEEP:	768:qYDZezf0jMUnTYbbMUoqwrOla8BfIrKcnai1f002APWiSM2io032Jtm4:q8ZezspU5wrsa8BfI1ai1f0+ga32Jo4
MD5:	3F2BE05B7A5EA9E9606BC70481C6E8FA
SHA1:	7478061FC8FD57489C3C6931C1CA690B2B1CA182
SHA-256:	F03C855E1BC7D3DCEAE99EA80448A972B904DC4BD3F2A441E6791D0CB8FBF78C
SHA-512:	565A3399CCEB24216C1800398DD2A9EA97984A278F06DEAADEF3AB39F96FE42FC63C1112D13CAD1531664A345BBBF718A86224968B42DD193A3DFB02FA8734EC
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!.........p....................................................................................................... ...I..............(....p.......................................................................................rdata..............................@..@.rsrc....I... ...P... ..............@..@.reloc.......p.......p..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\ITA\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (957), with CRLF line terminators
Category:	dropped
Size (bytes):	49306
Entropy (8bit):	3.4753362114672375
Encrypted:	false
SSDEEP:	768:Rezf0jMUnTYbbMUoqwrOla8BfIrKcnai1f0T:RezspU5wrsa8BfI1ai1f0T
MD5:	C4D548FF41EEC6876BB808042E808453
SHA1:	97EBD1D55436780A27E15A2C95CEF6D0E242B968
SHA-256:	22446C6E168CF281EE475A578FCF5FB519DFA9B1A4823ED5FED05AA15358B02D
SHA-512:	1DECBC5949EE6958A98EDE5B8548C896E7A6242646E48C68B3C29119BCB1BB1CE29D4084E0111D9E758F05E1A7AE729C0AFC04A94019705AFFA51A5094CDDA1C
Malicious:	false
Reputation:	low
Preview:	..C.O.N.T.R.A.T.T.O. .D.I. .L.I.C.E.N.Z.A. .D.E.L. .S.O.F.T.W.A.R.E. .I.N.T.E.L. .(.D.i.s.t.r.i.b.u.z.i.o.n.e. .O.E.M. ./. .I.H.V. ./. .I.S.V. .e. .U.t.e.n.t.e. .s.i.n.g.o.l.o.).........I.M.P.O.R.T.A.N.T.E. .-. .L.E.G.G.E.R.E. .P.R.I.M.A. .D.I. .C.O.P.I.A.R.E.,. .I.N.S.T.A.L.L.A.R.E. .O. .U.S.A.R.E. .I.L. .S.O.F.T.W.A.R.E... .....N.o.n. .u.s.a.r.e. .o. .c.a.r.i.c.a.r.e. .i.l. .s.o.f.t.w.a.r.e. .e.d. .a.l.c.u.n. .m.a.t.e.r.i.a.l.e. .a.d. .e.s.s.o. .a.s.s.o.c.i.a.t.o. .(.c.o.l.l.e.t.t.i.v.a.m.e.n.t.e.,. .i.l. .".S.o.f.t.w.a.r.e.".). .p.r.i.m.a. .d.i. .a.v.e.r. .a.t.t.e.n.t.a.m.e.n.t.e. .l.e.t.t.o. .i. .s.e.g.u.e.n.t.i. .t.e.r.m.i.n.i. .e. .c.o.n.d.i.z.i.o.n.i... .I.l. .c.a.r.i.c.a.m.e.n.t.o. .o. .l.'.u.t.i.l.i.z.z.o. .d.e.l. .S.o.f.t.w.a.r.e. .c.o.m.p.o.r.t.a. .l.'.a.d.e.s.i.o.n.e. .a.i. .t.e.r.m.i.n.i. .d.e.l. .p.r.e.s.e.n.t.e. .C.o.n.t.r.a.t.t.o. .d.i. .l.i.c.e.n.z.a... .I.n. .c.a.s.o. .n.o.n. .s.i. .d.e.s.i.d.e.r.i. .a.d.e.r.i.r.e. .a.i. .t.e.r.m.i.n.i. .d.i. .q.u.e.s.t.o. .C.o.n.t.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\JPN\ChipsetJPN.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	84264
Entropy (8bit):	4.738896191854272
Encrypted:	false
SSDEEP:	768:4FWzdSghqwrOla8BfIrKcnai1f0U2APWiSM2wolveY7:4FsAwrsa8BfI1ai1f0egJWa
MD5:	1AE00B6F32DE47C2DE697A9B4431FF62
SHA1:	4794377FAF7C4F68FB9F08A52E44ADF9A9F90132
SHA-256:	863B6D156731F8EEF8C9652244D4518B3789D6279EDF60931F23B53E740DD975
SHA-512:	E3AE46A77E5D79131D8460C53BB56172790FEBCC08C8679BA3C78E76031822D80BA75A1C38FD45AD4C34B1C37E0EE360836EA9FFDF19C04A838AA0EA049AD66A
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!......... ...............................................0...... ................................................ .. ............0..(.... .......................................................................................rdata..............................@..@.rsrc... .... ....... ..............@..@.reloc....... ....... ..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\JPN\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (765), with CRLF line terminators
Category:	dropped
Size (bytes):	33058
Entropy (8bit):	4.754872945161072
Encrypted:	false
SSDEEP:	384:rJNA7DARX/AR2hqmb1r1M3zDfoK7SF8BfIXRdKcUVfjK7SFi1f0XR1:rzdSghqwrOla8BfIrKcnai1f0z
MD5:	8F13E7A88735A2BA4C660DD2E0607782
SHA1:	68EB2C13FD7A1EE71CEB9612ECFFF738C17C5B31
SHA-256:	65D18987E7280E78698626E48A44519E62FAC0A6D8AF7873BE1977F605BC90BC
SHA-512:	39813FDA56543151C9A35EB4AEC1D22DABEDD3B23E2B7E97BA393F89AFBCAAE8C324E9175FE8C7E5C49A77B7E6F443C5856304A59EDE5410A370239DA7F0C947
Malicious:	false
Reputation:	low
Preview:	...0.0.0.0 ..0.0.0.0.0.0.O(u1...QY.}.f ...O.E.M. ./. .I.H.V. ./. .I.S.V. .M..^ .J0.0s0 ..0.0.0.0 ..0.0.0(u............. .-. ..0.0.0.0.0.0.0.0.0.0.0.O(un0MRk0J0...0O0`0U0D0.0 ......N.Nn0ag.N.0.l.a.mO0J0...0k0j0.0~0g0.0.0.0.0.0.0.0J0.0s0..#...e .(..N.N.0.}.yW0f0.0,g.0.0.0.0.0.0.0h0D0D0~0Y0)..0.O(u~0_0o0.0.0.0W0j0D0g0O0`0U0D0.0,g.0.0.0.0.0.0n0.O(u~0_0o0.0.0.0k0.0c0f0.0J0.[.io0,gQY.}n0ag.Nk0.T.aW0_0S0h0h0j0.0~0Y0.0.T.aU0.0j0D04X.To0.0,g.0.0.0.0.0.0.0.0.0.0.0.0.0~0_0o0.O(uW0j0D0g0O0`0U0D0.0.........l.a.N............. ..O(u1...QY.}.fn0hQ...[o0.0ck.._jhV.. .CQ .(.O.E.M.). ..0.0.0.0.0.0.0.0.0.0 ..0.0.0.0.0.0 ..0.0.0(.I.H.V.)..0J0.0s0.0.0.0.0.0.0.0.0.0 ..0.0.0.0.0.0 ..0.0.0(.I.S.V.). .k0i.(uW0~0Y0.0..... ..0.0.0.0.0.0n04X.T.0QY.}ir.NA.n0.0.0.0.0 ..0.0.0.0.0.0.O(u1...QY.}.fn0.0L0i.(uU0.0~0Y0.0........ck.._jhV.. .CQ .(.O.E.M.)..0.0.0.0.0.0.0.0.0.0 ..0.0.0.0.0.0 ..0.0.0(.I.H.V.)..0J0.0s0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 ..0.0.0(.I.S.V.). ..[a............O(u1... .,g.0.0.0.0.0.0o0.0.0.0.0 ..0.0.0

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\KOR\ChipsetKOR.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	84264
Entropy (8bit):	4.676667327182485
Encrypted:	false
SSDEEP:	768:J+T4mgRNqwrOla8BfIrKcnai1f002APWiSM2goHpwLG+xtA:J+Txqcwrsa8BfI1ai1f0+gGLrA
MD5:	9BFCE24D1BF4D013742162CB3B146DF5
SHA1:	A18782923AB6B3BC9B482430976B1DD1E71721D5
SHA-256:	B4B65D7AC893CCFCF553195E9D7F178751D522C91DF43D5512A276B17CF60ED3
SHA-512:	55908FEB73401955B0D7B256BC11FE0CDA258B2F12D88826268DF6A9F7C6B7B1A984A6AB74D509077F7F2E1201F6C28E878259D7C9272B1762E543E2060FB78C
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!......... ...............................................0......I................................................ ...............0..(.... .......................................................................................rdata..............................@..@.rsrc........ ....... ..............@..@.reloc....... ....... ..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\KOR\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (765), with CRLF line terminators
Category:	dropped
Size (bytes):	35086
Entropy (8bit):	4.72066549471794
Encrypted:	false
SSDEEP:	384:fdsyEmsyMRNqmb1r1M3zDfoK7SF8BfIXRdKcUVfjK7SFi1f0XRV:l4mgRNqwrOla8BfIrKcnai1f0T
MD5:	292CF0C30AA64FD5D42A5F907FCADECA
SHA1:	46B1109A76C5068285F1A1920DDE2502B4253021
SHA-256:	E049A00C20DC83CECFAC2E0D9AA76368A7C26FBA82D72D95FFC123A0F2DDF54B
SHA-512:	B5A032D8BB65A918F093263F26E34BEB043B2751E3C12038021BAFA4FF2F36766C3C3992162D837718F4AC31C1FA73A0A15CEC741A296581C9D9E724A999C7E4
Malicious:	false
Reputation:	low
Preview:	..I.n.t.e.l. ......... .\|.t.<... ..}... .(.O.E.M. ./. .I.H.V. ./. .I.S.V. .0....... ...x. ......)............ .-. .....,. .$.X. ..... .....X.0. ..... .}.<.....$... ......L.X. ..}. .p.t... ....D. ...8... .}.0. ...... ... .........@. ..... ...(... ....\. .....(......<.\.,. .".........".\|.. .h.).t.\|.. .....X.p... .\..X... ......$... ... .........\|. .\..X.p... .....h.<.\.h.,. ...X.. .t. ..}...X. ...... ..X.i..... ..\|. ... ..}...X. ....... ..X.X... .J.<...t.,. ... .........\|. .$.X.X.p... .....X... ......$.............\. ..L. ...m.D. . .X.X...0. .............. ...8... ...\. ...). ...p.. .(.O.E.M.).,. ......x. .X..... ..... .(.I.H.V.).,. ..... ......x. ......... .....(.I.S.V.)... .t. .\|.t.<... ..}... ....X. ....D. ..... .).......... .\.. ......(.E.n.d.-.U.s.e.r.)... ...Y. .A.,. .I.n.t.e.l. ......... .\|.t.<... ..}...... ....D. .................O.E.M.,. .I.H.V.,. .I.S.V.:.........\|.t.<..... ... .......... .I.n.t.e.l. ..... ....

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\NLD\ChipsetNLD.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	104744
Entropy (8bit):	4.001179325511865
Encrypted:	false
SSDEEP:	1536:g3DjAqbaQPu8Y8zNPueu8rwrsa8BfI1ai1f0PgKLPS5:CkqbaQPub8zNPuP8ICS5
MD5:	34F7379D65E60DAD6A7C41E061379538
SHA1:	6F9F6AAEC6ED6A3557FE8E67DF5E7DE907615A62
SHA-256:	FB065AC4B910A520B1BDB1E1FD7F81C54FA684B52193A0A3B39664018101EF23
SHA-512:	145E14B6B9A4BF66E0F7DF66EBF809F8C83C513C152635EAB517B9EC6F54C26FCCC18A06214A47895AC323B9E271F7DCEF7EAC68F32CECDA36202630AAC29044
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!.........p....................................................................................................... ...K..............(....p.......................................................................................rdata..............................@..@.rsrc....K... ...P... ..............@..@.reloc.......p.......p..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\NLD\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (946), with CRLF line terminators
Category:	dropped
Size (bytes):	49388
Entropy (8bit):	3.492685162250004
Encrypted:	false
SSDEEP:	1536:rjAqbaQPu8Y8zNPueu8rwrsa8BfI1ai1f0T:rkqbaQPub8zNPuP8j
MD5:	3799E7DAA4279CF75BBEAA3637E5EAE3
SHA1:	E3B84D94E461A7E41DD57985ECF9F1B3625C8B22
SHA-256:	1A9627E8DD6DFFDE07F5BBB267311C827D7B73C60191C45E02776CA27281B779
SHA-512:	085AD897FAFB99FB122AFCA486055F60D0827EF0D06D38C60CFC9BBC659480DD2BC3E1F11000894E2F6542784989537AF0E2498D7F1E51DADD94886BB78C3C92
Malicious:	false
Reputation:	low
Preview:	..L.I.C.E.N.T.I.E.O.V.E.R.E.E.N.K.O.M.S.T. .I.N.T.E.L.-.S.O.F.T.W.A.R.E. .(.O.E.M./. .I.H.V. ./. .I.S.F.-.D.i.s.t.r.i.b.u.t.i.e. .&. .E.i.n.d.g.e.b.r.u.i.k.e.r.).........B.E.L.A.N.G.R.I.J.K. .-. .L.E.E.S. .D.E. .V.O.L.G.E.N.D.E. .I.N.F.O.R.M.A.T.I.E. .D.O.O.R. .V.O.O.R.D.A.T. .U. .D.E. .S.O.F.T.W.A.R.E. .K.O.P.I.E.E.R.T.,. .I.N.S.T.A.L.L.E.E.R.T. .O.F. .G.E.B.R.U.I.K.T... .....G.e.b.r.u.i.k. .e.n. .l.a.a.d. .d.e.z.e. .S.o.f.t.w.a.r.e. .e.n. .b.i.j.b.e.h.o.r.e.n.d.e. .m.a.t.e.r.i.a.l.e.n. .(.g.e.z.a.m.e.n.l.i.j.k.:. .d.e. .".S.o.f.t.w.a.r.e.".). .n.i.e.t. .v.o.o.r.d.a.t. .u. .z.i.c.h. .o.p. .d.e. .h.o.o.g.t.e. .h.e.b.t. .g.e.s.t.e.l.d. .v.a.n. .d.e. .v.o.l.g.e.n.d.e. .v.o.o.r.w.a.a.r.d.e.n... .D.o.o.r. .d.e. .S.o.f.t.w.a.r.e. .t.e. .l.a.d.e.n. .o.f. .t.e. .g.e.b.r.u.i.k.e.n. .s.t.e.m.t. .u. .i.n. .m.e.t. .d.e. .v.o.o.r.w.a.a.r.d.e.n. .v.a.n. .d.e.z.e. .o.v.e.r.e.e.n.k.o.m.s.t... .A.l.s. .u. .n.i.e.t. .m.e.t. .d.e.z.e. .v.o.o.r.w.a.a.r.d.e.n. .i.n.s.t.e.m.t.,. .i.n.s.t.a.l.l.e.e.r. .o.f.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\NOR\ChipsetNOR.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	100648
Entropy (8bit):	4.040174571053834
Encrypted:	false
SSDEEP:	1536:y4Eff+XAqoFLLjLUIfgNd0Mcwrsa8BfI1ai1f0PgeN+gjCNlJj6Uz7:6fGXAqoFLLjLUIfgNd0Mn2CNlJj6Uz7
MD5:	F833C99C7AEDACDCEEC26A924A95DD24
SHA1:	7FD7C35B0040CBA78C520EE82B65C29EE0C85AAF
SHA-256:	D75DEF5362CA9126B12D86DE0B671ECF961C755E945C905D6F19E9A5D3CC1BA3
SHA-512:	8539AEA5B5587AD181861DD921B086ECFC040F6C40EEEEED47446EDB84E9AC056AD3CC2867FF413F4C0CBBEBB5BE0953EE6DFCED931C72F93EB137B089DC29A5
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!.........`...............................................p....................................................... ...:...........p..(....`.......................................................................................rdata..............................@..@.rsrc....:... ...@... ..............@..@.reloc.......`.......`..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\NOR\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (856), with CRLF line terminators
Category:	dropped
Size (bytes):	46620
Entropy (8bit):	3.502078959103735
Encrypted:	false
SSDEEP:	768:Qff+XAqoFLLp2zQPLUjUfga2RQOd0MNqwrOla8BfIrKcnai1f0T:Qff+XAqoFLLjLUIfgNd0Mcwrsa8BfI1A
MD5:	991E7D7290FE15B47E6B5FF8A1CAC989
SHA1:	BCC168AB2D95F5CD9AD52348EF3967FD406C1521
SHA-256:	EE0EB3783C276DBE12314DCDFD1EACA74D3B55BAA2043663D0CE3D4EE37A20B5
SHA-512:	D617973D9CB24C4CEE8A15128607BDC0B98B54F7E561E8D35523F58CD1E4E5E72CA0C2E0C0CD0C96DF1B0A96C5D0E1F10C3F9E02AA5E0D2623EB9D785B79C6CA
Malicious:	false
Reputation:	low
Preview:	..I.N.T.E.L. .L.I.S.E.N.S.A.V.T.A.L.E. .F.O.R. .P.R.O.G.R.A.M.V.A.R.E. .(.O.E.M.-./.I.H.V.-./.I.S.V.-.d.i.s.t.r.i.b.u.s.j.o.n. .o.g. .e.n.k.e.l.t.b.r.u.k.e.r.).........V.I.K.T.I.G. .-. .L.E.S. .D.E.T.T.E. .F...R. .K.O.P.I.E.R.I.N.G.,. .I.N.S.T.A.L.L.A.S.J.O.N. .E.L.L.E.R. .B.R.U.K. .....D.u. .m... .i.k.k.e. .b.r.u.k.e. .e.l.l.e.r. .l.a.s.t.e. .i.n.n. .d.e.n.n.e. .p.r.o.g.r.a.m.v.a.r.e.n. .e.l.l.e.r. .n.o.e. .t.i.l.k.n.y.t.t.e.t. .m.a.t.e.r.i.a.l.e. .(.s.a.m.l.e.t. .u.n.d.e.r. .b.e.g.r.e.p.e.t. .".P.r.o.g.r.a.m.v.a.r.e.n.".). .f...r. .d.u. .h.a.r. .l.e.s.t. .n...y.e. .g.j.e.n.n.o.m. .f...l.g.e.n.d.e. .v.i.l.k...r. .o.g. .b.e.t.i.n.g.e.l.s.e.r... .V.e.d. ... .l.a.s.t.e. .n.e.d. .e.l.l.e.r. .b.r.u.k.e. .p.r.o.g.r.a.m.v.a.r.e.n.,. .a.n.g.i.r. .d.u. .a.t. .d.u. .g.o.d.t.a.r. .v.i.l.k...r.e.n.e. .i. .d.e.n.n.e. .a.v.t.a.l.e.n... .H.v.i.s. .d.u. .i.k.k.e. .v.i.l. .g.o.d.t.a. .a.v.t.a.l.e.n.,. .m... .d.u. .i.k.k.e. .i.n.s.t.a.l.l.e.r.e. .e.l.l.e.r. .b.r.u.k.e. .p.r.o.g.r.a.m.v.a.r.e.n.........

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\PLK\ChipsetPLK.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	104744
Entropy (8bit):	4.100418212973209
Encrypted:	false
SSDEEP:	1536:uBPbOQd2b3K/Gwrsa8BfI1ai1f0PgGHi9:MXGHi9
MD5:	3022A6472E21B793D26244F7465A0A50
SHA1:	5B8AA5F0C3A34EAD566F598D1D6EC6C64BC71727
SHA-256:	75895FA4E8DC857C51807BB72F014871DB37C8089D63722330D307D5E9740E24
SHA-512:	7252902354BCF0F9A32F8932A9228E41887EEFD166C37D961CF68593887D9F878EB66E4D704890C50EB5CD605AC261C693397F5639B249E35631FEE1F3872828
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!.........p.......................................................T............................................... ...L..............(....p.......................................................................................rdata..............................@..@.rsrc....L... ...P... ..............@..@.reloc.......p.......p..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\PLK\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1001), with CRLF line terminators
Category:	dropped
Size (bytes):	50908
Entropy (8bit):	3.6841988753335335
Encrypted:	false
SSDEEP:	768:oIMmVbOyNBAOJhcb9o46BZm4L/9oP6TqwrOla8BfIrKcnai1f0T:rbOQd2b3K/Gwrsa8BfI1ai1f0T
MD5:	10EEC1215F0BAA9AF3D037936A80389A
SHA1:	34B8C7D23F75EDB4F548421DEB55746FCE000921
SHA-256:	C09E45F8FB31BA3248E93483B36123A2E686019DE92B935C9CDE5C2BD12C971B
SHA-512:	FD3B4CE34327400933A8672D5F34779399F99B4FF6F77ABCC8213768FE0B7EEED6A3548B2DEC24C4A7C6F318786BB19A092EB5A566DA9EB0FAB91D0223095646
Malicious:	false
Reputation:	low
Preview:	..U.M.O.W.A. .L.I.C.E.N.C.Y.J.N.A. .O.P.R.O.G.R.A.M.O.W.A.N.I.A. .F.I.R.M.Y. .I.N.T.E.L. .(.O.E.M./.I.H.V./.I.S.V. .d.l.a. .d.y.s.t.r.y.b.u.t.o.r...w. .i. .u.\|.y.t.k.o.w.n.i.k...w. .i.n.d.y.w.i.d.u.a.l.n.y.c.h.).........W.A.{.N.E. .-. .P.R.Z.E.C.Z.Y.T.A... .P.R.Z.E.D. .R.O.Z.P.O.C.Z...C.I.E.M. .K.O.P.I.O.W.A.N.I.A.,. .I.N.S.T.A.L.A.C.J.I. .L.U.B. .U.{.Y.T.K.O.W.A.N.I.A. .....N.i.e. .n.a.l.e.\|.y. .u.\|.y.w.a... .a.n.i. .B.a.d.o.w.a... .n.i.n.i.e.j.s.z.e.g.o. .o.p.r.o.g.r.a.m.o.w.a.n.i.a. .i. .\|.a.d.n.y.c.h. .p.o.w.i...z.a.n.y.c.h. .z. .n.i.m. .m.a.t.e.r.i.a.B...w. .(.o.k.r.e.[.l.a.n.y.c.h. .z.b.i.o.r.o.w.o. .j.a.k.o. .. O.p.r.o.g.r.a.m.o.w.a.n.i.e.".). .p.r.z.e.d. .d.o.k.B.a.d.n.y.m. .z.a.p.o.z.n.a.n.i.e.m. .s.i... .z. .w.a.r.u.n.k.a.m.i. .i. .p.o.s.t.a.n.o.w.i.e.n.i.a.m.i. .z.a.w.a.r.t.y.m.i. .w. .d.a.l.s.z.e.j. .c.z...[.c.i. .d.o.k.u.m.e.n.t.u... .Z.a.B.a.d.o.w.a.n.i.e. .l.u.b. .r.o.z.p.o.c.z...c.i.e. .u.\|.y.w.a.n.i.a. .O.p.r.o.g.r.a.m.o.w.a.n.i.a. .j.e.s.t. .r...w.n.o.z.n.a.c.z.n.e. .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\PTB\ChipsetPTB.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	100648
Entropy (8bit):	4.012186238537226
Encrypted:	false
SSDEEP:	1536:taUdYI6TVM6Fwrsa8BfI1ai1f0Pg9dY/YkJ8:HPd9CJ8
MD5:	DD705A3B93B18612533CA75D5EA2CB2A
SHA1:	031F8A0737C85D6197DE12F78ED5C429FDDAE3C4
SHA-256:	6522F5D6DB5AC9138CF5128F3D8EF0FCFF3DACA351F347BAD9C82F9BDA8D6241
SHA-512:	55D7A8C24E3870E02B488B728B615D1CC0B46CF50BC862D4E46C9CFD7711A3CF760B46875545D40054D917DD0040AA4269688EA7580DD6075F8F7D45B96EDE1E
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!.........`...............................................p......hZ............................................... ...=...........p..(....`.......................................................................................rdata..............................@..@.rsrc....=... ...@... ..............@..@.reloc.......`.......`..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\PTB\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (882), with CRLF line terminators
Category:	dropped
Size (bytes):	46976
Entropy (8bit):	3.518348303390868
Encrypted:	false
SSDEEP:	768:BY9B6ixU66eV9BOixU6eqwrOla8BfIrKcnai1f0T:BYI6TVM6Fwrsa8BfI1ai1f0T
MD5:	9914B1F24B98BC7E1629127276763003
SHA1:	B553275C9BE7E147D7FC1D5121AD61AA90AC4479
SHA-256:	00696BBAB1E14E0AE9B1EC2520F0A1CDA7053566E70F5A1B603E4E4A24DFB0C3
SHA-512:	39D9F701F9100E7885A774ED1B3F88074BE87649A1BB4FAA760EE6BC4AE5C1F1CC0819AFE81A09CE3094325D0D0F388B8F52C6DC33F5277A5ED140BBE0BEA274
Malicious:	false
Reputation:	low
Preview:	..C.O.N.T.R.A.T.O. .D.E. .L.I.C.E.N...A. .D.E. .S.O.F.T.W.A.R.E. .D.A. .I.N.T.E.L. .(.D.i.s.t.r.i.b.u.i.....o. .p.o.r. .O.E.M. ./. .I.H.V. ./. .I.S.V. .e. .U.s.u...r.i.o. ...n.i.c.o.).........I.M.P.O.R.T.A.N.T.E. .-. .L.E.I.A. .A.N.T.E.S. .D.E. .C.O.P.I.A.R.,. .I.N.S.T.A.L.A.R. .O.U. .U.S.A.R... .....N...o. .u.s.e. .n.e.m. .c.a.r.r.e.g.u.e. .e.s.t.e. .s.o.f.t.w.a.r.e. .e. .q.u.a.l.q.u.e.r. .o.u.t.r.o. .m.a.t.e.r.i.a.l. .a.s.s.o.c.i.a.d.o. .(.c.o.l.e.t.i.v.a.m.e.n.t.e.,. .o. .".S.o.f.t.w.a.r.e.".). .a.t... .t.e.r. .l.i.d.o. .c.u.i.d.a.d.o.s.a.m.e.n.t.e. .o.s. .t.e.r.m.o.s. .e. .a.s. .c.o.n.d.i.....e.s. .a. .s.e.g.u.i.r... .A.o. .c.a.r.r.e.g.a.r. .o.u. .u.s.a.r. .o. .S.o.f.t.w.a.r.e.,. .v.o.c... .c.o.n.c.o.r.d.a. .c.o.m. .o.s. .t.e.r.m.o.s. .d.e.s.t.e. .C.o.n.t.r.a.t.o... .S.e. .n...o. .c.o.n.c.o.r.d.a.r.,. .n...o. .i.n.s.t.a.l.e. .n.e.m. .u.s.e. .o. .S.o.f.t.w.a.r.e...........O.b.s.e.r.v.e. .t.a.m.b...m.:.....*. .S.e. .v.o.c... .f.o.r. .u.m. .O.E.M. .(.F.a.b.r.i.c.a.n.t.e. .O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\PTG\ChipsetPTG.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	104744
Entropy (8bit):	4.061667187928991
Encrypted:	false
SSDEEP:	1536:7m7+uztRuzEwrsa8BfI1ai1f0PgNmHoTBTy5wKR/:eu/Q59/
MD5:	5D2BE1F832D59683F69178B63ACF4786
SHA1:	E4D5AC923C29D72719F63D1415D292C63B20B773
SHA-256:	ACA95627D835808194CA6C9A957CB2657B604A6F487FF376932F2737A32DC30D
SHA-512:	C81F9F81E71AF2CFFB5D72E2D2E7B6436A26AA40E99A425BE91A218E1D9DF1D39C8E77155DB0AE3C3C283563EBFBBE572EC9D9BBB7B7127BB46E21FCB7E0D858
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!.........p....................................................................................................... ...E..............(....p.......................................................................................rdata..............................@..@.rsrc....E... ...P... ..............@..@.reloc.......p.......p..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\PTG\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (983), with CRLF line terminators
Category:	dropped
Size (bytes):	48188
Entropy (8bit):	3.503587937031601
Encrypted:	false
SSDEEP:	768:c7U7g4llovBzXdl7g4llovBzX1qwrOla8BfIrKcnai1f0T:c+uztRuzEwrsa8BfI1ai1f0T
MD5:	037B5CD32589B75C4858DA0BD9C3404A
SHA1:	7F400216997783CDE51F45F3534EEE48349F623A
SHA-256:	608E11D997C21E4730D74665F65A2A3B0DCBCF8E07ECBE33E80537C03ED81137
SHA-512:	B734625DB76105DBB568468F690364536B63781691AADC2DDC959A6D8E4B53CFC25AF49FF33762CC2B9E0855147FF6AF699AF2B228862D6C68FB411F8B916DDC
Malicious:	false
Reputation:	low
Preview:	..C.O.N.T.R.A.T.O. .D.E. .L.I.C.E.N...A. .D.E. .S.O.F.T.W.A.R.E. .D.A. .I.N.T.E.L. .(.D.i.s.t.r.i.b.u.i.....o. .O.E.M. ./. .I.H.V. ./. .I.S.V. .e. .u.t.i.l.i.z.a.d.o.r. ...n.i.c.o.).........I.M.P.O.R.T.A.N.T.E. .-. .L.E.R. .A.N.T.E.S. .D.E. .C.O.P.I.A.R.,. .I.N.S.T.A.L.A.R. .O.U. .U.T.I.L.I.Z.A.R... .....N...o. .d.e.v.e. .u.t.i.l.i.z.a.r. .n.e.m. .c.a.r.r.e.g.a.r. .e.s.t.e. .s.o.f.t.w.a.r.e. .e. .q.u.a.l.q.u.e.r. .o.u.t.r.o. .t.i.p.o. .d.e. .m.a.t.e.r.i.a.l. .a.s.s.o.c.i.a.d.o. .(.c.o.l.e.c.t.i.v.a.m.e.n.t.e. .d.e.s.i.g.n.a.d.o. .p.o.r. .".S.o.f.t.w.a.r.e.".). .a.n.t.e.s. .d.e. .l.e.r. .c.u.i.d.a.d.o.s.a.m.e.n.t.e. .o.s. .s.e.g.u.i.n.t.e.s. .t.e.r.m.o.s. .e. .c.o.n.d.i.....e.s... .A.o. .c.a.r.r.e.g.a.r. .o.u. .u.t.i.l.i.z.a.r. .o. .S.o.f.t.w.a.r.e.,. .e.s.t... .a. .c.o.n.c.o.r.d.a.r. .c.o.m. .o.s. .t.e.r.m.o.s. .d.e.s.t.e. .c.o.n.t.r.a.t.o... .S.e. .n...o. .c.o.n.c.o.r.d.a.r. .c.o.m. .o.s. .t.e.r.m.o.s. .d.e.s.t.e. .c.o.n.t.r.a.t.o.,. .n...o. .d.e.v.e. .i.n.s.t.a.l.a.r. .n.e.m. .u.t.i.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\RUS\ChipsetRUS.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	104744
Entropy (8bit):	4.652803140226755
Encrypted:	false
SSDEEP:	768:rN9cJxRcW3IYmzhRcW3IYmzUqwrOla8BfIrKcnai1f0p2APWiSM2roPFSGZ:rN9OIdI/wrsa8BfI1ai1f0Pgs8q
MD5:	2C9457766D8D23FBBED7C8AC5EBD7D78
SHA1:	537DD9424B13F2055DBF96D82485E3A8D0C8A1D9
SHA-256:	3340D3CDC8E9E8DA694026599C712202CD3AC06CB555BA0A1BD5999D7E5997E0
SHA-512:	AD3CB743FD32A151DF981996C88A9E0C65F4D5F1899E3F74B75564756514BDEFFC062838C2C8E3B43D1CFE26902F23C211031E991D74E725ECCC62930FC9231E
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!.........p......................................................+................................................ ..0G..............(....p.......................................................................................rdata..............................@..@.rsrc...0G... ...P... ..............@..@.reloc.......p.......p..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\RUS\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1043), with CRLF line terminators
Category:	dropped
Size (bytes):	50020
Entropy (8bit):	4.360188930347877
Encrypted:	false
SSDEEP:	768:aJxRcW3IYmzhRcW3IYmzUqwrOla8BfIrKcnai1f0T:MIdI/wrsa8BfI1ai1f0T
MD5:	CE04D7411506A98A89DD39B262A8DAF8
SHA1:	8C8C4470C5A7208310DF2D361BBAE53762DD059A
SHA-256:	D121BF4D439208451B27C169264A3FF87030170BBEF852F1AE988DACD0D7965F
SHA-512:	275E603B344A4CC83A4C28F0706CAB4802E90F36F757D8727220380FA1D0FFCB481181A20E9C0F7C0654B084D66DB5EB08A42FD42B77FFC65294BAD9910B1FFF
Malicious:	false
Reputation:	low
Preview:	......&................... .!.........(......... .I.N.T.E.L. ..... ...!.......,............... ... ..... ............... .......!.....'......./. .(.4.;.O. .?.0.@.B.=.5.@.>.2. .O.E.M. ./. .I.H.V. ./. .I.S.V. .8. .4.;.O. .>.B.4.5.;.L.=.K.E. .?.>.;.L.7.>.2.0.B.5.;.5.9.).................../. .....$... .....&.../.!. ...............,."...!.,. ..... ..... ......... ...............,. .#.!."............... ....... ...!.......,................... .......5. .?.@.8.A.B.C.?.0.9.B.5. .:. .8.A.?.>.;.L.7.>.2.0.=.8.N. .8.;.8. .7.0.3.@.C.7.:.5. .4.0.=.=.>.3.>. .?.@.>.3.@.0.<.<.=.>.3.>. .?.@.>.4.C.:.B.0. .8. .;.N.1.K.E. .4.@.C.3.8.E. .A.2.O.7.0.=.=.K.E. .A. .=.8.<. .<.0.B.5.@.8.0.;.>.2. .(.4.0.;.5.5. .8.<.5.=.C.5.<.K.E. .".?.@.>.3.@.0.<.<.=.K.<. .>.1.5.A.?.5.G.5.=.8.5.<.". .-. .....).,. .=.5. .>.7.=.0.:.>.<.8.2.H.8.A.L. .A. .?.@.8.2.>.4.8.<.K.<.8. .=.8.6.5. .C.A.;.>.2.8.O.<.8... ...0.3.@.C.6.0.O. .8. .8.A.?.>.;.L.7.C.O. .....,. ...K. .?.@.8.=.8.<.0.5.B.5. .C.A.;.>.2.8.O. .=.0.A.B.>.O.I.5.3.>. .A.>.3.;.0.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\SVE\ChipsetSVE.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	100648
Entropy (8bit):	4.032309338782114
Encrypted:	false
SSDEEP:	1536:d5rD5WMwrsa8BfI1ai1f0PgpbFjsqVRnXGU68n:LknsqVRnXGU68n
MD5:	B2D28A986358D25993BF177019A50680
SHA1:	285E37E7A88E5B3753CFE769C669B6E716AF2D85
SHA-256:	D5C2B45BF3BB815C6A8FAD6FFCDC05B51CD97567F9952E1BA004665E6EC7F39A
SHA-512:	086DF888BD8B0BB7365537A004894478F8D14BFFA1251594F3C17383BB61CDDA0C9365F9A9C5913B08A86A9615C8F1CC7481D3F2AB2AA17F86F91F2D1EC59DB4
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!.........`...............................................p......]]............................................... ...;...........p..(....`.......................................................................................rdata..............................@..@.rsrc....;... ...@... ..............@..@.reloc.......`.......`..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\SVE\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (922), with CRLF line terminators
Category:	dropped
Size (bytes):	47324
Entropy (8bit):	3.529853053314194
Encrypted:	false
SSDEEP:	384:AfRmcd7mENXRzQQZ4YUIL7ANgvXRiQQZ4YUILKgqmb1r1M3zDfoK7SF8BfIXRdKx:A5Qs4T/Qs4TKqwrOla8BfIrKcnai1f0T
MD5:	C844BA1A32F71309AD28D04904A39458
SHA1:	F994026F39A28DEB6E40F333AE0094413A41068B
SHA-256:	F7380D5C702D39B7DF84D4E1E700AF405F25CC75DBC0A11896B798BFC90DABB3
SHA-512:	EF20AC09D25307831C02A670552760267A281AE05957C08E6BAB82EBCA6430F2EDE4F30665D89021C2BD740CD274D27C50B9019F2D117B9C9F94596173DA86EF
Malicious:	false
Reputation:	low
Preview:	..I.N.T.E.L.S. .P.R.O.G.R.A.M.V.A.R.U.L.I.C.E.N.S.A.V.T.A.L. .(.O.E.M.-./.I.H.V.-. .o.c.h. .I.S.V.-.d.i.s.t.r.i.b.u.t.i.o.n. .s.a.m.t. .e.n.s.k.i.l.d.a. .a.n.v...n.d.a.r.e.).........V.I.K.T.I.G.T.!. .-. .L...S. .I.N.N.A.N. .D.U. .K.O.P.I.E.R.A.R.,. .I.N.S.T.A.L.L.E.R.A.R. .E.L.L.E.R. .A.N.V...N.D.E.R. .P.R.O.G.R.A.M.V.A.R.A.N. .....A.n.v...n.d. .e.l.l.e.r. .i.n.s.t.a.l.l.e.r.a. .i.n.t.e. .d.e.n.n.a. .p.r.o.g.r.a.m.v.a.r.a. .o.c.h. .t.i.l.l.h...r.a.n.d.e. .m.a.t.e.r.i.a.l. .(.g.e.m.e.n.s.a.m.t. .k.a.l.l.a.d.e. .".P.r.o.g.r.a.m.v.a.r.a.n.".). .i.n.n.a.n. .d.u. .n.o.g.g.r.a.n.t. .h.a.r. .l...s.t. .i.g.e.n.o.m. .f...l.j.a.n.d.e. .v.i.l.l.k.o.r... .G.e.n.o.m. .a.t.t. .i.n.s.t.a.l.l.e.r.a. .e.l.l.e.r. .a.n.v...n.d.a. .P.r.o.g.r.a.m.v.a.r.a.n. .a.c.c.e.p.t.e.r.a.r. .d.u. .v.i.l.l.k.o.r.e.n. .i. .d.e.t.t.a. .l.i.c.e.n.s.a.v.t.a.l... .O.m. .d.u. .i.n.t.e. .a.c.c.e.p.t.e.r.a.r. .l.i.c.e.n.s.v.i.l.l.k.o.r.e.n. .f...r. .d.u. .i.n.t.e. .i.n.s.t.a.l.l.e.r.a. .e.l.l.e.r. .a.n.v...n.d.a. .P.r.o.g.r.a.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\THA\ChipsetTHA.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	100648
Entropy (8bit):	4.72949387063966
Encrypted:	false
SSDEEP:	1536:oONuznMdZv5ZGqwrsa8BfI1ai1f0/gu+oige/:489e/
MD5:	174540AC20FCD097AF247D426118EDC6
SHA1:	75E1D180D64912F7CCA9F15454226619E9704E90
SHA-256:	241C792E086079BB4B6486A5E3296D46B9BB220D0284890053AF6407330A9FF3
SHA-512:	70B9C5E65E4A1739F43DB3D1D3DB0224FA42474003FF95443F8E5D50BDA46FC613587A7B299623578308E5C6C3DC2F198919AAEDBE929D3E2AD8096B09510FDF
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!.........`...............................................p....................................................... .. 4...........p..(....`.......................................................................................rdata..............................@..@.rsrc... 4... ...@... ..............@..@.reloc.......`.......`..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\THA\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (845), with CRLF line terminators
Category:	dropped
Size (bytes):	45824
Entropy (8bit):	4.451002600855509
Encrypted:	false
SSDEEP:	768:fzFtML5ZvtMgZGnqwrOla8BfIrKcnai1f0D:fznMdZv5ZGqwrsa8BfI1ai1f0D
MD5:	FB31F3B2C0E4212670BF127097A54A4E
SHA1:	82FC76B73F56D57BE59008CAD838C6DB770290C5
SHA-256:	FE198B364EDEC30ED0F5DD6530A114EBF1B9DD9DB5B0DBEE79B84F44433D427D
SHA-512:	42E929EB0D86F96786E9A0CC34D829F192F7885AAC5B35A88F66D72D1D046489F313828EC59DFA245CD2C489F35F4259D49777A50A807DC8B7525EA86F217BAE
Malicious:	false
Reputation:	low
Preview:	....I.-.....%...@...5.H.".'...1.....2.#.-...8...2...C...I...2.....-.....L.A.'.#.L...-... .I.n.t.e.l. . .(..3.+.#.1.....2.#...1.....3.+...H.2.".B...". .O.E.M. ./. .I.H.V. ./. .I.S.V. .A.%.0...9.I.C...I.#.2.".@...5.".'.)...........I.-.!.9.%..3...1... .-. ...#.8...2.-.H.2.....H.-.....3..3.@...2. ...4.....1.I... .+.#.7.-.C...I...2... .....-.".H.2.C...I.+.#.7.-.B.+.%.....-.....L.A.'.#.L...5.I.A.%.0..H.'...-.7.H... .F. ...5.H.@...5.H.".'...I.-... .(.@.#.5."...B...".#.'.!.'.H.2. ."...-.....L.A.'.#.L.). .......'.H.2...8.....0.D...I.-.H.2...@...7.H.-...D.....H.-.D.....5.I.-.".H.2...%.0.@.-.5."... .C.....2.#.B.+.%...+.#.7.-.C...I...-.....L.A.'.#.L...5.I. ...0...7.-.'.H.2...8...D...I.".-.!.#.1...@...7.H.-...D.....-.....I.-.....%.....5.I.A.%.I.'. .+.2.....8...D.!.H.".-.!.#.1...@...7.H.-...D.....1.....%.H.2.'. .B...#...-.".H.2...4.....1.I...+.#.7.-.C...I...-.....L.A.'.#.L...5.I...........-.....2.....5.I. .B...#.....#.2...'.H.2. .....*. .+.2.....8...@...G.....9.I...%.4...-.8.....#...L.".H.-."...

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\TRK\ChipsetTRK.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	100648
Entropy (8bit):	4.102086638683019
Encrypted:	false
SSDEEP:	1536:Ere93wrOm1Z8cYJXdpcY7wrsa8BfI1ai1f0Pg7qHZ7PD+ybm23s4:n93wrOmkcYJncY47qHZ7PDbbm23H
MD5:	8ECEE215234938704848418C262D8810
SHA1:	27952530B150207F0B42606900064A72E1D7D35E
SHA-256:	ADAC5ABD1B78877DF959C52C145736F67B7AFD006EF1791072C7E8926316E216
SHA-512:	9B0FF4727B9823365DEBA382C445F72D0DD12F8EF7B03F4EA9824789267201478E3788368DCB3D687B4C7F2EEEBE672A118E78ECCB9DAD3B6EB6DFEAAD5E0AE9
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....d...d...d...o..d...h..d..Rich.d..................PE..L......E...........!.........`...............................................p.......h............................................... ...?...........p..(....`.......................................................................................rdata..............................@..@.rsrc....?... ...@... ..............@..@.reloc.......`.......`..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Lang\CHIP\TRK\license.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (862), with CRLF line terminators
Category:	dropped
Size (bytes):	48016
Entropy (8bit):	3.7301563003340816
Encrypted:	false
SSDEEP:	768:sgBRRrVs6wrOMTKsZVacYvkI9JdaacYQqwrOla8BfIrKcnai1f0T:r93wrOm1Z8cYJXdpcY7wrsa8BfI1ai12
MD5:	BB7F17BA079C9D71260D1C19F4CABF0B
SHA1:	532E21910CEF333A993721408238A9AD87A1070B
SHA-256:	0F46A3BC1F33284DBD3DC3F5BBBE2272C649D4AE2630CF7120D4E8E25FF7C691
SHA-512:	7169D9B5AD048C2857D59D9354349AB9008F7698A3AB69389F67090F81E9F10205F4B9F8454DAE4BFB126C7D3519668BFAD6D8CC827F93EB73D7C4E192EC2DF7
Malicious:	false
Reputation:	low
Preview:	..I.N.T.E.L. .Y.A.Z.I.L.I.M. .L.0.S.A.N.S. .S...Z.L.E.^.M.E.S.0. .(.O.E.M. ./. .I.H.V. ./. .I.S.V. .D.a...1.t.1.m.1. .v.e. .T.e.k. .K.u.l.l.a.n.1.c.1.)...........N.E.M.L.0. .-. .K.O.P.Y.A.L.A.M.A.D.A.N.,. .Y...K.L.E.M.E.D.E.N. .V.E.Y.A. .K.U.L.L.A.N.M.A.D.A.N. ...N.C.E. .O.K.U.Y.U.N... .....A._.a...1.d.a.k.i. .k.o._.u.l.l.a.r.1. .v.e. .h...k...m.l.e.r.i. .d.i.k.k.a.t.l.e. .o.k.u.m.a.d.a.n. ...n.c.e.,. .b.u. .y.a.z.1.l.1.m.1. .v.e. .i.l.i._.k.i.l.i. .m.a.l.z.e.m.e.l.e.r.i.n.i. .(.t.o.p.l.u. ._.e.k.i.l.d.e.,. .".Y.a.z.1.l.1.m.". .o.l.a.r.a.k. .a.n.1.l.a.c.a.k.t.1.r.). .k.u.l.l.a.n.m.a.y.1.n. .v.e.y.a. .y...k.l.e.m.e.y.i.n... .Y.a.z.1.l.1.m.'.1. .y...k.l.e.m.e.n.i.z. .y.a. .d.a. .k.u.l.l.a.n.m.a.n.1.z.,. .b.u. .S...z.l.e._.m.e.'.n.i.n. .k.o._.u.l.l.a.r.1.n.1. .k.a.b.u.l. .e.t.t.i...i.n.i.z. .a.n.l.a.m.1.n.a. .g.e.l.i.r... .K.o._.u.l.l.a.r.1. .b.u. ._.e.k.i.l.d.e. .k.a.b.u.l. .e.t.m.e.k. .i.s.t.e.m.i.y.o.r.s.a.n.1.z.,. .Y.a.z.1.l.1.m.'.1. .y...k.l.e.m.e.y.i.n. .y.a. .d.a. .k.u.l.l.a.n.m.a.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\Setup.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	957688
Entropy (8bit):	7.269168503589915
Encrypted:	false
SSDEEP:	12288:zCtdY8MfMYTBxlk/jzblEOGSEzUvzblE4wEQRUSEcfv44IdmIKf:26MEpcj+OP+ac34y
MD5:	B216D8A3BFFA5B6C08709B4E98ADEF12
SHA1:	9F77C2E3FD8BC9E909BDC9F2D8DCD1EE30390AD7
SHA-256:	E341B83C11EA306ADED5F26B849BFEFBFC9152D3B1DDCA1254BE184E858C699F
SHA-512:	75BF13FE60184D9627A2E7D9615A62EDDFEDFF6586E0EA419BDBEB940CC64DD4FD8963ED19629E7EAA8790F52E6C8B34B4841597CADBE429C7318729B4D2B4B3
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.HYN..YN..YN..~...LN..~....N...A..[N...A..LN..YN...N..~....N..~...XN..~...XN..RichYN..................PE..L......Q.............................`............@.................................lH.............................................................................................................(6..@...............d...\...@....................text...[........................... ..`.rdata..............................@..@.data...@9....... ..................@....rsrc..............................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\CentCore.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	18308
Entropy (8bit):	3.687220514652435
Encrypted:	false
SSDEEP:	384:VAgECXNGEV/E2TpCgRbASPVeM20Fv0mDZyQBYXNGEV/E2TpCgRbASPVeM20Fv0mf:VHTXNGEV/E2TpCgRbASPVeM20Fv0mDZc
MD5:	CF5B32AA40F90B0BB2CF3F95575A92D3
SHA1:	A94F495DA72764858CBABC3456308EA582055448
SHA-256:	718F1F629FE089AFAC226F67B3EEC02D98F78E9A8325C0A481CB7F589A041078
SHA-512:	54347BF7C1CB98423C6EA0D2D5803FA0B41DC1ACF9F695CABC32999118669EBB6D79C7C016E03C9250B58C40268BD977864EF39A43C07A695A360B5BF5D259D0
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .C.e.n.t.C.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .C.o.r.e. .I.N.F. .f.o.r. .I.n.t.e.l.(.R.). .C.e.n.t.e.r.o.n. . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.5.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\CentSMB.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8606
Entropy (8bit):	3.57473038348051
Encrypted:	false
SSDEEP:	96:R4rbM/1z+VwB5OC6kr2rkfNfyfbf6alPJCFVWPOHSdaQ+wMy:6gtgEACpCQ16DXTlaQ2y
MD5:	0AFC236315CB1B853C285CBFDA9998F8
SHA1:	3EDEED98B3F38BF81D5EE99734D5623EEF0A7194
SHA-256:	2F61CC180AB6D95F2B098F1F89C23D205B9A7D2AD7BD1080E3D952D4802D5FCE
SHA-512:	2178656F1F66D248318EC73E6883F91B47969138A40C1C89ADEB502E2C8950A2E3D3CED82F300D4535B82000E081571BD471D841435E97B5EAED29A6E3932CDD
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .C.e.n.t.S.M.B...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .S.M.B. .I.N.F. .f.o.r. .I.n.t.e.l.(.R.). .C.e.n.t.e.r.o.n. . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.5.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\CentURT.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6528
Entropy (8bit):	3.4254841947825123
Encrypted:	false
SSDEEP:	96:RsTT4HM/1z+VwB5KJQQJ8y4U/7mAalPJCFVWPOHSdaQ+wMy:KTUstgEQ6QvmlTlaQ2y
MD5:	1562406B258D77196F8A516DCA45875B
SHA1:	3C3C490D8BAECB10582D82B3AC0F4514D9E7A017
SHA-256:	8D84D8C4FF5A7ECB33E885BFD275CAC0B48E8BD6227BAED8ED1A7DF5EB158735
SHA-512:	F5E4074E7357BB1D9A2F6458EB4AFB621D987D7CF188F558A4FD112964E975B7EF870B8E29768BF7366ABDCB95A0D0DA0B593444FD7F2216320834C4F98D778F
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .C.e.n.t.U.R.T...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .A.t.o.m. .P.r.o.c.e.s.s.o.r. .S.1.2.0.0. .S.e.r.i.e.s. .U.A.R.T. . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .9.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.1.). . . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\CrysWell.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8016
Entropy (8bit):	3.5262691336022645
Encrypted:	false
SSDEEP:	96:Rk0udM/1z+VwB5G8ACHJvyJuaJShalPJCFVWPOHSdaQ+wMy:DuytgE8kUL5TlaQ2y
MD5:	C3842D201E1E2321756874E8DDD9BFA8
SHA1:	59F5DD1307441997220274705415798156F76F81
SHA-256:	4C80270A9F3DF24BF1D00CB77947BF878E7EF7F808F743003480F7310EFC65A9
SHA-512:	0358ECBAB7D6F0FE8DC0555366511071AD2AAF0F6D4DE159204B7AC455CBFF3231BA54CDA25C83FDA784516F75C5E8793364DB50CF54E32783107607A0DBCDA9
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .C.r.y.s.W.e.l.l...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .C.r.y.s.t.a.l. .W.e.l.l. .P.r.o.c.e.s.s.o.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\DH89xxCC-ME.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6600
Entropy (8bit):	3.4457384747644024
Encrypted:	false
SSDEEP:	96:Rppw/mwM/1z+VwB5OQF2CFxalPJCFVWPOHSdaQ+wMy:/ztgEATlaQ2y
MD5:	8EC0386C5C19948E8BC54CE6BE45C775
SHA1:	3A4EF9C74D8322063E10728A0ABA52F6F11BFEE6
SHA-256:	6DCE942AFBC3E57B33E709BA46B0B138DC75993B2B50875C452F10C1FEB9ABF1
SHA-512:	3E111ECDEBA24512427526B6CE50760B6B2842A99AB56E15D659E12855578437D218CCFE535ACE1E5DFA1920A4BDE3F92FF3ED3B07969B70FD8204D045079D7F
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .D.H.8.9.x.x.C.C.-.M.E...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l. .I.D.E. .D.r.i.v.e.r. .f.o.r. .D.H.8.9.x.x.C.C. . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\DH89xxCC-ahci.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6410
Entropy (8bit):	3.396802344365448
Encrypted:	false
SSDEEP:	96:RpFEY/NwM/1z+VwB5SbFCqAhalPJCFVWPOHSdaQ+wMy:pztgEITlaQ2y
MD5:	9B425D66D041A3AB13D5C4426F3A2EA2
SHA1:	EDB454C201DE2049D6E81172EF2CEE4058A910C2
SHA-256:	C687D1545AF743BC9098F1318AFE37D6E1637EE4F20AECEE3F595079A40AD881
SHA-512:	A93282CB7AA575E53ED932BF2B6DA3569B8C7AA06CDD4BFA92E7D4DE75414EE4F2056E451163B42FC56A505FA5189C4803B54924EE44DB62EAA65AB23BF0B4A5
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .D.H.8.9.x.x.C.C.-.a.h.c.i...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .F.i.l.e. .f.o.r. .D.H.8.9.x.x.C.C. .A.H.C.I. .D.e.v.i.c.e.s. . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\DH89xxCC-cor.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	13680
Entropy (8bit):	3.6965235780759804
Encrypted:	false
SSDEEP:	96:RppmEcpewM/1z+VwB5d80f8c51pzApF2CFgycdEUESEG9jiXRpEalPJCFVWPOHSj:B2eztgEz8uuTlaQ2y
MD5:	CE5C998A36186305E9AFF4FA094CA776
SHA1:	3D11C63230932982FB6583D8D786338C4C77B343
SHA-256:	8C92D457083D6E876D93955038706592F1A0B19545B7576AEB7A06A3A804BB77
SHA-512:	2E611E3D41AD2D14302C11A280BBDE36A997C1B0735A1F3FBBB0F6C0C1A8484C36450797AF5B938A7E0535C22F31A85F894ECA8E38EDC6EB99432C278C8BC9FD
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .D.H.8.9.x.x.C.C.-.c.o.r...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .F.i.l.e. .f.o.r. .D.H.8.9.x.x.C.C. .C.o.r.e. .D.e.v.i.c.e.s. . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\DH89xxCC-id2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7458
Entropy (8bit):	3.4947463081352765
Encrypted:	false
SSDEEP:	96:Rp0w/RwM/1z+VISwmQwmiuBPckK08QDAS08QDwalPJCFVWPOHSdaQ+wMy:XztgImkYTlaQ2y
MD5:	3FC2623DB2BB9A215B35C31817F48A58
SHA1:	5D871A456188E9B72F416184BB3A789550CF05B5
SHA-256:	0CA44AD7735151C2AA103380CF7104DB88666350491C0C38934B038F1E4E63EC
SHA-512:	3D877F2BD6DAE80AA0194E5AAE8BA906FD8EE55AFD9E06BB1BA1D5B732CDD8374C47B6D55AFAEAA3D4E1491CF54FFB6EEDA610DCEFDE66939DE7E81C26530110
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .D.H.8.9.x.x.C.C.-.i.d.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l. .I.D.E. .D.r.i.v.e.r. .f.o.r. .D.H.8.9.x.x.C.C. . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\DH89xxCC-ide.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6866
Entropy (8bit):	3.4382270876059993
Encrypted:	false
SSDEEP:	96:RpGEL/+wM/1z+VIgkK08QDAS08QDwalPJCFVWPOHSdaQ+wMy:qztgImTlaQ2y
MD5:	036E28073A006D4659F19237BE663FB2
SHA1:	A36CFB2E94AC9CC6B3D2C0023981E66E9B96EDAB
SHA-256:	CD7A1A4459839193BAAC93D4C93F55A110CC5F31FC8192F1514F62579C087A0D
SHA-512:	8EBB3B0FB67E45FE755A64107153BDEDEC416BA48AA5C655B74DCA315BBAB80F612CD4C04AB99CA1F649FC0E97CA129F33A302E171A2960A6E0FF08F782F3441
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .D.H.8.9.x.x.C.C.-.i.d.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .F.i.l.e. .f.o.r. .D.H.8.9.x.x.C.C. .I.d.e. .D.e.v.i.c.e.s. . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\DH89xxCC-smb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6200
Entropy (8bit):	3.390821522436664
Encrypted:	false
SSDEEP:	96:RpKE/iwM/1z+VwB52PoWalPJCFVWPOHSdaQ+wMy:WztgEJTlaQ2y
MD5:	FD85E7C83B6BCEFFECA7C017A5116055
SHA1:	03E6338F923AC53E03F22C466F725402FD3CF4EA
SHA-256:	AC7EDE9E969F850121BC54FD81CB9E24BA5420F6510406E12124A06EF1AC5149
SHA-512:	FE7B78A65F4666E4464739CC8999F26C361E1D7EC0160E762B7020A92F5A80BB56B12EE63FC9C46F98E93DCD03551398585E3B287025E33CE47170243247E3DB
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .D.H.8.9.x.x.C.C.-.s.m.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .F.i.l.e. .f.o.r. .D.H.8.9.x.x.C.C. .S.M. .B.u.s. .D.e.v.i.c.e.s. . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\DH89xxCC-usb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7518
Entropy (8bit):	3.5065063635045233
Encrypted:	false
SSDEEP:	96:Rpi/mnCM/1z+VwB5c+C++9+TdNL9NrQNc8LJ8LzalPJCFVWPOHSdaQ+wMy:NVtgE++L+9+TdNL9NrQNDTlaQ2y
MD5:	BA82B00F9428664B99227474C7087478
SHA1:	7753862E514758A8FAAA660AEFEB02C7DE127B15
SHA-256:	84A0E24BC5453AB113FE7DDE62A01E7B285AEF7EFCAE11059AF28A7F4EFDDC52
SHA-512:	97724DCAD1FE00EC5CE4D9229F4CB89F17839712CF881F61C8B2DDEA7E60C10EB46373D6ED1502BAEE1E69490D7F48803E9D2DBD08FBF87537BFFD076C30756D
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .D.H.8.9.x.x.C.C.-.u.s.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.0.0.0. .a.n.d. .X.P. .I.N.F.,. .2.k.3. .&. .2.k.8. .S.e.r.v.e.r. .I.N.F.,. . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .D.H.8.9.x.x.C.C. .U.S.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.4.0.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\Haswell.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9190
Entropy (8bit):	3.5842079130342768
Encrypted:	false
SSDEEP:	96:R8HdM/1z+VwB5m8HCqMCSxvMJvqMJuSMJSWalPJCFVWPOHSdaQ+wMy:qHytgE7xMZZMcM7MmTlaQ2y
MD5:	6E7D1D03C6B09B78E8FEFB18CFD02DAE
SHA1:	0F7865367BA0A38457A9066A5019007172736FED
SHA-256:	9C679483DB519567B9FF1FBADA93C0775E079A5DF0E27836A70AA07D1A1EE450
SHA-512:	3815C5F7C0BFF189E6F869637E899655DAB16B3DF9E488D993FE86C61A13984A194A4416D69D5099DCF875FA85A90EFA67A2F392FECB19FA916D9851C018CA18
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .H.a.s.w.e.l.l...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .h.a.s.w.e.l.l. .P.r.o.c.e.s.s.o.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\IntelCP2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	34182
Entropy (8bit):	3.6994628766745286
Encrypted:	false
SSDEEP:	384:G5ugEftqxtqC3s315hqtSYgIUQetvNrtvNDzxz2jv0Hr50r5sr5/XRaQF:G52uEF
MD5:	450CDE29C9215960A7E8EA72D904180C
SHA1:	03558EE026C7D1019B4A138DD4B58B8AE39211C4
SHA-256:	56A95EBB96198B68D317534A1DE3FB62E67BEA4A1A0FAFFDA026293A3DA10AF5
SHA-512:	98E32A2398B6494DED5C99512028767C7F5F54D67EBA89E0DA0C2BEBC01F3B5E8AE57F1496EE2885B6946FBB3D4154EC3F5F32B433436FD50412753333840703
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .I.n.t.e.l.C.P.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3.,. .2.0.0.8. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .8.2.X.X.X. .M.e.m.o.r.y. .C.o.n.t.r.o.l.l.e.r. .H.u.b. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\IntelIOH.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	22172
Entropy (8bit):	3.733071173215089
Encrypted:	false
SSDEEP:	96:R0TdGVM/1z+VwB5uBN+FBN+j8GtMGkERUfURB4rSXqdX1WS75alPJCFVWPOHSdao:OdG6tgEK+R+OGfC8oIq11CTlaQ2y
MD5:	6278BA3BA5D89853679FAA8BB49597D1
SHA1:	ED810FFB415BA44CFFBFDE4E3A80FA4D67842D61
SHA-256:	F2BF3BF211C2AECD4056995FBEFE1CF7DD1BF89116B8B417719EF6396236EFC8
SHA-512:	E8D99C312972CCCBED1FF09A65D6A76FCCD0DFC5F132C55AB732DB71494FB924F157A25026902D56A8DFCF19AA96C3C509D751AF5968ED385D4F32A6251C8AEF
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .I.n.t.e.l.I.O.H...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.0.0.0.,. .X.P.,. .2.0.0.3.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. .I.O.H. . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\IvyBridg.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	10086
Entropy (8bit):	3.62246992697015
Encrypted:	false
SSDEEP:	192:BuZtgEtOpzpoDOp2OpROppOpIOpDTlaQ2y:BuDgEtOpzpoDOp2OpROppOpIOpDRaQF
MD5:	13E71A7A95D99AE3CA3549684C56EF50
SHA1:	83BD00C716F1169D20B314216E9D9D7642D0E2EC
SHA-256:	CF78E684D798415649D4B4A21980A33EE5C4E99308A2D73D511EFB93958DB3DB
SHA-512:	CF8AF64D2E8062569251C535B4C73FC49B0D41FB4FA1A5E0F83BEEB8BC70748432D67991B0D8A1CAD6B1340F29D71E5CF36B6DDF230C0E66CC3B514EFAEF2CFA
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .I.v.y.B.r.i.d.g...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.v.y. .B.r.i.d.g.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...3...0. .B.u.i.l.d. .1.0.2.9.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\IvyTown.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	59208
Entropy (8bit):	3.6692143542386546
Encrypted:	false
SSDEEP:	768:+DKpJeqpwLZvcLk5CAmuwj+JyoYRivSQTZYF:+aF
MD5:	083A980B71309F9134E2302FE1C9A29F
SHA1:	D495FB7DEC8D08742DCAAC770AF448A7366F520A
SHA-256:	8F9C8554E80867BFFEAB6D425108CECB5F7D116D6E601D906C12AB916460098B
SHA-512:	0D8B1A05B1CD4A6E7E8D5797A69D788A8FB54803D803E960CD6B7F3571923D6B229E3F9F690707337148081F49A544D698BB6D014D95AB273F5AEC9AFEAFF3F1
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .I.v.y.T.o.w.n...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .X.e.o.n.(.R.). .E.5. .v.2./.C.o.r.e. .i.7. . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .9.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.1.). . . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\JakeTown.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	48352
Entropy (8bit):	3.7130695472175064
Encrypted:	false
SSDEEP:	768:4UYmaYtCdmaYtCDqUV5aDGtU7iJwnUWL8nULZMpYju6cALL+PFfmsnEL5LALbLWp:4otJttgCF
MD5:	DBF41ADEA6773848AF38B8501ED83C50
SHA1:	9F426E5036C57A25653637F7D504BC3FCDBD4EAC
SHA-256:	0EE55F1307B9D290131BB4FD9BF6FE4A574623E242609F89935AA086EE218333
SHA-512:	8AF88F02E25AD00D7B160C6DD9F162A034E62A1E3F1146B12CDA73C4D60FAF2366078134DEEB89BB1593CC5E34D8D78ACB07479AEFB778DF5B30CEE6CBFE6938
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .J.a.k.e.T.o.w.n...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .J.a.k.e.T.o.w.n. .P.r.o.c.e.s.s.o.r. .S.a.n.d.y. .B.r.i.d.g.e. .-. .E.N./.E.P./.E.X. . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...3. .B.u.i.l.d. .1.0.3.2.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\JasperFo.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	37862
Entropy (8bit):	3.687268654331974
Encrypted:	false
SSDEEP:	192:gaV6tgEiFnHyCPDBVu6FnHyCPDBVuODCtoZUbiXh2WPNpx8UTlaQ2y:gaVugEmpROW3R1RaQF
MD5:	36800610EA60B18C84CDFD06FB1785CF
SHA1:	0A8416DD2ECA46AC87C44C2756F083A9C52EE1FD
SHA-256:	A8B345854EF8F704A5071F71D2F3C91D27B732BCDCC70AB1630F81F4C29C548A
SHA-512:	CBF5D316593AD89C2B020A14C983CFB309730F001E8DBE5FD708900105D47DA7D6BDBB4A436B42229670C1A973340305FD45D3BF1190B24023C2E00FA8857ABD
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .J.a.s.p.e.r.F.o...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\LxLpAHCI.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6796
Entropy (8bit):	3.438568672915122
Encrypted:	false
SSDEEP:	96:RcddM/1z+VwB5ib62NalPJCFVWPOHSdaQ+wMy:4ytgETTlaQ2y
MD5:	1E8C81E5E191EA326DFE90F5A440717D
SHA1:	87403FF3ADDFA1770936C9436A187AC3B9FBC8DE
SHA-256:	9DC166B1A56F48951992696E31AB5EAAFC7DE38F5F471FC53E64882C007515B2
SHA-512:	1B8030161194EA2E437C84B42A53FF3EB49EFEE7F3CFB1042E8531E840183DE35D370D678E54487C4815777EA492FAE56DA4992B53431C00CB1DA11AC28B8532
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.L.p.A.H.C.I...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .A.H.C.I. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\LxLpCore.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	30096
Entropy (8bit):	3.689242974709826
Encrypted:	false
SSDEEP:	96:RDdM/1z+VwB5f0RgIEk0RgIEl8cdYq1Fvppp4pw/pypwfpCpw/p0Hpw/pwcpwVpY:VytgExIfEkIfEohCTlaQ2y
MD5:	80E1CB15455989A36D55AFCA21FC90AA
SHA1:	078A72ED351A0D19BF463CD57FCD819F05D9BCFD
SHA-256:	96D685DE59BD206E60CA5EA4B121914AF43D3D43A66E111F843D1F6635761C0A
SHA-512:	711637C95EFA77AF7827ADDF5DB1AA199293F18912E0EB105A1E2735C474B1DAF250956CA925046EB321881CAB0C17E0A7EEF4DA5EDE9357132AD3C67729FEF6
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.L.p.C.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .c.o.r.e. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\LxLpId2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8348
Entropy (8bit):	3.5424934709413556
Encrypted:	false
SSDEEP:	96:RfhdM/1z+VISwmQwmiuBPck98QD28QDY8QDA8QD3alPJCFVWPOHSdaQ+wMy:vytgImkTTlaQ2y
MD5:	CDD70174FD482D42DD50AEB619175E43
SHA1:	0208D7CAD953297674108FAE7DFE3C9BC6E2382A
SHA-256:	08265AC651B47C9B15ADAB2BBEC13AB646B159441F196EC8A36A60340555AFF7
SHA-512:	63BE2783C68DC57EB5D694828AEBF3A2D68C1562E1FC3EEFF22687AFEB5D599AD9BC6F8498ABBF492E8476A60C4026CE2E4323D2CCE28F1FB1E255A43E31ECC3
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.L.p.I.d.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .I.D.E. .d.e.v.i.c.e. .(.I.n.t.e.l.D.r.v.e.r.). . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\LxLpIde.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7740
Entropy (8bit):	3.496639388931525
Encrypted:	false
SSDEEP:	96:RYudM/1z+VIgk98QD28QDY8QDA8QD3alPJCFVWPOHSdaQ+wMy:HytgIdTlaQ2y
MD5:	F38CF2554EEC0C9DD116BA38E002EA6F
SHA1:	67F866074001ED77BF3E571558ACCB18D9BD4D95
SHA-256:	BC9CEA29DDAC4CAD96E692CCB6E65B6C0F4CAD2709E70E9421117B5EBDB8673C
SHA-512:	45669837C1AB74DB31BAB16369FE3F4DCF7F1E4A36C13077A48799F5F4EF6F33A0BCA0BD9F4CD665F62D37122FCF1DC4EBD472C33EB4ABC855416559CDB89BA7
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.L.p.I.d.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .I.D.E. .d.e.v.i.c.e. .(.I.n.t.e.l.D.r.v.e.r.). . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\LxLpSMB.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6138
Entropy (8bit):	3.3718242327961376
Encrypted:	false
SSDEEP:	96:R0dM/1z+VwB5mWealPJCFVWPOHSdaQ+wMy:yytgETTlaQ2y
MD5:	9C82EF3F43AD28E904089B49B0F7E33B
SHA1:	BDBD400472735932E15286ACD00A1DA1856D2B6D
SHA-256:	6262CCADA3F2943E63BDB6046BBE82EB0BC4783FEADDC3C753976967D9AB9AB3
SHA-512:	1F4427CB9CDB554E63B7A08FD2807C1C733D30DE481E703CF49329BD491CEE042D23D0ADEA01A1677A92A84DE48BFE663790EBD6DFAC6A5CC48738E4645D69B3
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.L.p.S.M.B...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .S.M.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\LxLpSens.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7860
Entropy (8bit):	3.4835261301467373
Encrypted:	false
SSDEEP:	96:RkkidM/1z+VwB5yeAenRZKQhsilPJCFVWPOHSdaQ+wMy:cytgE8eAenRZdhpTlaQ2y
MD5:	834BDF5203802B9B5BC0E5A39BFA3DF4
SHA1:	4172F17C97A655D54424E6AC2A9D573D75A74012
SHA-256:	502FD916BACFE8BD29C703A21D56CD3BA2FAA668680FCB93310D52C8C14014FA
SHA-512:	EDDFB17C07A8EA27383697DE1AD7B775ACCC60FEAA8183F2EE44DC6D7A60E54DE5FF926BDCA336765877C4F5AB9AA671C6508DEE199BA1FD355213C5927AA444
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.L.p.S.e.n.s...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .L.y.n.x.P.o.i.n.t. .L.P. .S.e.n.s.o.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\LxLpThrm.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6070
Entropy (8bit):	3.364456309031035
Encrypted:	false
SSDEEP:	96:RyJyM/1z+VwB5MCYvalPJCFVWPOHSdaQ+wMy:UFtgEaSTlaQ2y
MD5:	AD1008FA28302BFECB8692620C6C09A9
SHA1:	877B562249D0D6A363448F1FEE0D29177E760061
SHA-256:	3FA18A58DFDD83ACD37E2510FDA3FDF8EC53181F60C0E6537ACC00573B22DF53
SHA-512:	C7ADE58430D3A718D6048FF42345206C4CFEBE8399CCFAA0050651E61C94A256BCC664B11EA1F5813A24659390746F6E86833F703501AEBB77F3AC4F4B0EEE3E
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.L.p.C.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .T.h.e.r.m.a.l. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .1.2.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.2.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\LxLpUSB.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7616
Entropy (8bit):	3.515649684848947
Encrypted:	false
SSDEEP:	192:+gtgElUu7s79hdkBdrdNL9NrQNATlaQ2y:+AgElUu7s79hdkBdrHLnr+ARaQF
MD5:	325C819540E1A5A5441B4E63F36FBF34
SHA1:	A6995A77D26D0B0292A9C3B4878836D232899FE0
SHA-256:	38A98558580AA1A6F7DA1702D6ED6694EC1AA0C947F99E73F825843AB605A4CB
SHA-512:	DBB2304EB6C776CD39F36F2168A3E6636C8549E49BBE43A5663EB5BA89B74FDC4369FE2AD2CDD8DD973B753F450625BADF9CB4BBB81199BF7B6B83FC6051932F
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.L.p.U.S.B...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .U.S.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.5.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\LxLpUSB3.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6486
Entropy (8bit):	3.431241068565181
Encrypted:	false
SSDEEP:	96:RddM/1z+VwB51JK4K5XK4KnK4KwFffKiezalPJCFVWPOHSdaQ+wMy:bytgErJK4KpK4KnK4KgKLuTlaQ2y
MD5:	F86D0337A1F2F6413C796870191DDC28
SHA1:	076A953D3C244FBC8390EF42F82854A39F796A6F
SHA-256:	6E8355B28C817D4330A25D8943ECF9CEA02868993D0D1A73D1D50F200C486D70
SHA-512:	92595FBFF37C98D8461804E5C26666F5B60F6D52086650E147D2BE5266D31536309AC61CCF11A18D4FC47F8D493B268398CB6C91E36A0579DE67AC4167AA3A19
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.L.p.U.S.B.3...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .U.S.B.3. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\LxPtAHCI.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	3.4366240963392753
Encrypted:	false
SSDEEP:	96:REFdM/1z+VwB5ib4GUalPJCFVWPOHSdaQ+wMy:IytgE0TlaQ2y
MD5:	8E79A3E9313365F8661BC3F6BAE49BD0
SHA1:	BEF4C12F02CF6630DE998A20B5494DE3AD55E0F2
SHA-256:	2F207B38FB2A5BC56CDA571648DCFF542110D5CFD0E3D6F057EE3429DEAE4604
SHA-512:	09238F5BAF885D87C9E0BB56DAB58F7AE147E979AA9618D4635A5D8E8B83DD0F44A349F68ECE883B3E5909F35309E0AB1B839D358995ECA97B2F09899780F402
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.P.t.A.H.C.I...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .A.H.C.I. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\LxPtCore.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	29128
Entropy (8bit):	3.6665810433167114
Encrypted:	false
SSDEEP:	96:RzdM/1z+VwB5P3gQIH93gQIHk8cbYyyAQpZpcp/pVpfpzp/pxp1pOpUpQpZpmp/D:FytgEBQvH9QvHFQaJ+TlaQ2y
MD5:	E719D3965E7CA415153AEE8D0771BFEF
SHA1:	269FABA273CFCBAD56CAC4B3CBC11AFDF04AEA2B
SHA-256:	EE77683EFF4978F1643AD5EAE11FF720FC56EBA1BF6C25FF415082BFC984C054
SHA-512:	CA45D02A55F7A8625D4F1A6B70B3E1092EEDE0F72E7FDFCC516DE95092FF62AA2EA778E50DF78E5F80014DB96081994DCB52F43144AFD538EAAB74415EF658E8
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.P.t.C.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .c.o.r.e. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\LxPtId2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8396
Entropy (8bit):	3.5391698795076456
Encrypted:	false
SSDEEP:	96:RXZdM/1z+VISwmQwmiuBPckb8QDm8QDP8QDg8QDualPJCFVWPOHSdaQ+wMy:/ytgImkzTlaQ2y
MD5:	83C19367EFBD72416C2E62688AA796C7
SHA1:	5180FC3F0DFCB3DDDFE0C664A7E506574ABF7E6B
SHA-256:	EDC89347C820FDCB8869117BD76DA240D75AB931BF0809302D6553CFC730423F
SHA-512:	2CFCC3A93119582286BAAA95C7143ADE98EB145EA1EC958AAC5D93D9E80927223D8EE26474C84B7E4CA5826A6253D4FD9B80A1F1BF3689714237647CECFB4773
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.P.t.I.d.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .I.D.E. .d.e.v.i.c.e. .(.I.n.t.e.l.D.r.v.e.r.). . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\LxPtIde.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7788
Entropy (8bit):	3.493733148540773
Encrypted:	false
SSDEEP:	96:RQGdM/1z+VIgkb8QDm8QDP8QDg8QDualPJCFVWPOHSdaQ+wMy:HytgI9TlaQ2y
MD5:	776F7B040CE18150F597426EF107370F
SHA1:	866F2AE809FEFDC5773DE1527B1098AAEE87ED96
SHA-256:	3645F89584177330A9B832FC0BF0EFFD389FFAFFC8D3E696FBAF2213FE1EE5E2
SHA-512:	CB0B73D25636E6E9CCB4CA6F81152D2FBBB3147FC362CFB6020CB9EC06FEE9450FB3C34F3912AB13B9710AA5DB16C263BEC174A9218D6674DBEFB4D5258ECFF0
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.P.t.I.d.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .I.D.E. .d.e.v.i.c.e. .(.I.n.t.e.l.D.r.v.e.r.). . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\LxPtSMB.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6162
Entropy (8bit):	3.372265020360397
Encrypted:	false
SSDEEP:	96:R0dM/1z+VwB5WsnalPJCFVWPOHSdaQ+wMy:yytgEkTlaQ2y
MD5:	57F1896F0E441C6BA0F0F406D91666AC
SHA1:	7A08E0F82E6B7E34AD605134BD923E903C893BF4
SHA-256:	1EFF44909B1B0F5BB14564807FC1E0F7C9FFB09528E696E462267F6AAD4C0A80
SHA-512:	FCAB495E8C68A54C9DB383AF4B123EB2B5A3564F6BBC52E857D74BE3824461DBE91BF3634495C81D754B3CEC114AA791B0DB33336392FF37E4235D7AE8825CF9
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.P.t.S.M.B...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .S.M.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\LxPtUSB.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7584
Entropy (8bit):	3.513926717877048
Encrypted:	false
SSDEEP:	192:ugtgE60+b0bChdkBdrdNL9NrQNwTlaQ2y:uAgE60+b0bChdkBdrHLnr+wRaQF
MD5:	5644431E18246FAC31F2E38FE8BD477F
SHA1:	4AC0FF1CA4CEC00C49C2C3ED599D94F8680DEA5D
SHA-256:	9446645D3B291572AC45020E82ABA1DACFD91C81067F39254EEAC9355B02A97D
SHA-512:	50E6FE717F8AD1A0A127D8463C166EDAAD923E59566018E14AF333270D1139D67E7721C4984A1F6004A10442B8EEA58E008C54B9766DF8CD4CDAD34B6C1A0C52
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.P.t.U.S.B...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .U.S.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.5.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\LxPtUSB3.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6468
Entropy (8bit):	3.430598646482522
Encrypted:	false
SSDEEP:	96:R9dM/1z+VwB517w5VwlwwFftNzalPJCFVWPOHSdaQ+wMy:bytgEr7wbwlwoNuTlaQ2y
MD5:	814A9E0FC1A1BBC6DA1793A7B63CD0E1
SHA1:	0FEF7FDD09D9CAFCA23BADD5032B6523D30FD207
SHA-256:	6876711098C00E665EF5C403992BC1A326334C7AA613E97DA58EEEC342630DDF
SHA-512:	CBD92D2C6FC7ED82671C6887AF002CE0259701E05A8E3B41037B0CBE5EDE6B5458A2FF6113CD633BB1FDB452526F54FA6B78D7549E003E5C1BC56E8E70464AE3
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .L.x.P.t.U.S.B.3...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .U.S.B.3. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...4...0. .B.u.i.l.d. .1.0.2.3.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\NehalMEX.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	38794
Entropy (8bit):	3.6995314667536325
Encrypted:	false
SSDEEP:	384:RugE1B+kogWylivFwzBX2YsSDyOwnDnbEWFVR8A83aia+zoF2vrgQ0VRaQF:R5B1F
MD5:	2F8AE5A3D9A2AB40885BE7BD9796AA5D
SHA1:	966E3A7106B1FBE77FF2FA4DE998759039851D90
SHA-256:	9E1AB424978F96861D52899FB76F49DAA63F5B114E4F5A1C8564EE525F365755
SHA-512:	16B50D4EE672D756B331957C7FDE41F106B9599787D2B296521FB37F20A3348F83005F68E46EC2DCA240A1C6B72C81376C4AFB4964FF549B56D6D47471E46CED
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .N.e.h.a.l.M.E.X...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.0.0.0.,. .X.P.,. .2.0.0.3. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. .C.P.U. . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\PantAHCI.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7044
Entropy (8bit):	3.4305561636781348
Encrypted:	false
SSDEEP:	96:RI8CmmM/1z+VwB5ibdeveDalPJCFVWPOHSdaQ+wMy:tLZtgEzTlaQ2y
MD5:	28832BAD606C2852DD23B19C6D4606A6
SHA1:	460800BD6D45344235417A6FF035EED5A18F10D9
SHA-256:	C7AAA66D67E586CD39E1A252E7BFFBB77AD430B63624D2A3FD90E3330EB75EF0
SHA-512:	F687EF45828548AF56B9B3A42B1F8A78527FB03E78FC2943FFB7C7C0B8FB4DEB21D3B5FB3BA5AA92F1BADBF5AFBB7B96A5D91755912B51867DB0CD8CC811152A
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .P.a.n.t.A.H.C.I...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .A.H.C.I. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...3...0. .B.u.i.l.d. .1.0.2.9.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\PantCore.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	20482
Entropy (8bit):	3.7053631282499557
Encrypted:	false
SSDEEP:	384:wDgEtLiWKWg7tuchXsu/pKgYiLdvmxLiWKWg7tuchXsu/pKgYiLdvm4tZW9WtYgD:wE7tr7tuchXsu/pKgYiLdvmktr7tuchh
MD5:	8B07F112FAE9119FE92C76B6F253971D
SHA1:	122EDB961C585445DE50E3DA17B2F9598215CC07
SHA-256:	FC9979D20882B22D6CB7ED85B3D042C53411B9D90C2A71DB728CD2C24BAF48B1
SHA-512:	A30E588E1838847E1706BF793491E73BB99DE9306C9D8A92BF6026F7696FB946B4A21B48CE064EBCD6ECB8AE299EB52D14CA0AB997829980E6320C125B44E259
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .P.a.n.t.C.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .c.o.r.e. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...3...0. .B.u.i.l.d. .1.0.2.9.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\PantIDE.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8068
Entropy (8bit):	3.499762260730757
Encrypted:	false
SSDEEP:	96:RD2RNmM/1z+VIgkqe8QDPe8QDHI8QDvI8QDZalPJCFVWPOHSdaQ+wMy:E7ZtgIdTlaQ2y
MD5:	8654F5A3B1B91C7D0E6DEBD0FD209D9C
SHA1:	FA1078CF71DC97A0E2612C719FAF9DC2E0F61740
SHA-256:	513D135F31907BE149D1FDAF23D8BA992632485903E8836C537121D004AAD520
SHA-512:	BFFCC965B2929D8E348E4588A19382028D23FD2F4D81CB500DCCEF58AB68D9ECB5149B62DDCE07DE17B1B961CCC6BD6995ABCE674F2101B2F44E6C1E4B62ACC1
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .P.a.n.t.I.D.E...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .a.n.d. .2.0.0.3. .S.e.r.v.e.r.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .I.D.E. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...3...0. .B.u.i.l.d. .1.0.2.9.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\PantId2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8676
Entropy (8bit):	3.546883506286136
Encrypted:	false
SSDEEP:	96:R02FSmM/1z+VISwmQwmiuBPckqe8QDPe8QDHI8QDvI8QDZalPJCFVWPOHSdaQ+wX:TwZtgImkTTlaQ2y
MD5:	ACFE3DD8591562198940D95AE755CD1C
SHA1:	9CE86B1065059ADC1EC7FB8F97BF971EDFA4D321
SHA-256:	AC65274F0AA7FCC7DCC4C1903FD9C7EC0ECA3854F071E93CE69F28C939C75053
SHA-512:	ADB3A66DAB80AFDC6DEF9160E809EE5FF62FABEB12E2936F69AB91FDA0A6829FBFBA7756B83FFD4DEAED2A7384E8CCF5190AF27BC1DDEB523716E293EF8644E5
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .P.a.n.t.I.d.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .a.n.d. .2.0.0.3. .S.e.r.v.e.r.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .I.D.E. .d.e.v.i.c.e. .(.I.n.t.e.l.D.r.v.e.r.). . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...3...0. .B.u.i.l.d. .1.0.2.9.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\PantSMB.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6356
Entropy (8bit):	3.3738180848104524
Encrypted:	false
SSDEEP:	96:RvsXmM/1z+VwB52P0walPJCFVWPOHSdaQ+wMy:iXZtgEjTlaQ2y
MD5:	D08B5C2483D264C838F17DD1DCDDF3F4
SHA1:	6DC326785D1A5ED0261354439A2D806ABDAE4B62
SHA-256:	2F92007C0CE1F9C838CC89EA2BEBFDDFD2E057831FBBD2897B10786A6EB3EEB6
SHA-512:	95E1EA2902D6B710D3D9E4E81286E080FDB9C13FA342DA26AEB2610E27262F6D3B008A510A9AA19BB6B04561CB52AEAE6D5D5677D838D6D3A0A50EF23B9F9B7C
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .P.a.n.t.S.M.B...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .S.e.r.v.e.r. .I.N.F.,. .V.i.s.t.a. .F.i.l.e. .f.o.r. . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .S.M.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...3...0. .B.u.i.l.d. .1.0.2.9.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\PantUSB.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7852
Entropy (8bit):	3.5157022310316766
Encrypted:	false
SSDEEP:	192:6W5tgELUu787jhdkBdrdNL9NrQNDTlaQ2y:7jgELUu787jhdkBdrHLnr+DRaQF
MD5:	868FDC195F7626ED4A69054B68595608
SHA1:	2E43588354D6C5ED9C6FF17319CAFD002D74B8FB
SHA-256:	5F21D1FD7CBBDC2D12D8260955423385A1A854BF0A58D45A8646B44A7A556AA9
SHA-512:	4BB0AE7CE8315DE5241AE5AE912F948A20734BF16B7D29C354B0EE43D0CEC02C557F6B9A598432B015045810B057455E0DB66EEFAAC6A4D017650FB844875544
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .P.a.n.t.U.S.B...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .S.e.r.v.e.r. .I.N.F.,. .V.i.s.t.a.,. .W.i.n.7. .F.i.l.e. .f.o.r. .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .U.S.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...3...0. .B.u.i.l.d. .1.0.3.0.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\PantUSB3.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6546
Entropy (8bit):	3.4343719106043076
Encrypted:	false
SSDEEP:	96:RKmM/1z+VwB51uQFfFnve6alPJCFVWPOHSdaQ+wMy:cZtgErSTlaQ2y
MD5:	59B1641B1FC3FED9298CF5FB198602A1
SHA1:	85CC53B07129E8232567649DC7528314547F0D9E
SHA-256:	23351024354D8C4C126269CD67116FDB6F859850E990A863F4C1F983A7805BCB
SHA-512:	33B0B455A899803540B96DDF26ED8C40C6CEB52144AD319C63E3C3CF39D5DFE03E7E8D131B807B2A980A9E981905F4A6537780F9CBB0A1D1C35434AFD7ECE157
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .P.a.n.t.U.S.B.3...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .N.u.l.l. .d.r.i.v.e.r. .f.o.r. .I.n.t.e.l.(.R.). .U.S.B. .3...0. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...3...0. .B.u.i.l.d. .1.0.2.9.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\SNB2009.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9756
Entropy (8bit):	3.616291341649528
Encrypted:	false
SSDEEP:	96:R6iEnKM/1z+VwB5c94P94f8iiINiIBILiqi+ui+6si+VzalPJCFVWPOHSdaQ+wMy:MiENtgEui4icWiqiRiAiDTlaQ2y
MD5:	51AD4B757D87AE384B434805A567718E
SHA1:	3217B9A82A0DA65403CDBC1201521A5A89CA30B0
SHA-256:	3515622B03C8B933F37754FE899D27DF2110403E3F32618DB23253C78284F260
SHA-512:	BD1B5E999A2D205F9A15725BA23B2184E36FAE65FEA3A31AA231788C50B257F8E3762593BE1051F4BFEF17ADA39D5524127B6ABD909F575999F5E6F4715161BA
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .S.N.B.2.0.0.9...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .X.e.o.n. .E.3.-.1.2.0.0./.2.n.d. .G.e.n.e.r.a.t.i.o.n. .I.n.t.e.l.(.R.). .C.o.r.e.(.T.M.). .P.r.o.c.e.s.s.o.r. .F.a.m.i.l.y.......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...0. .B.u.i.l.d. .1.0.3.5.). . . . . . . . . . . . . . . .......;. .......................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\Tcreek.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	13374
Entropy (8bit):	3.676321297113655
Encrypted:	false
SSDEEP:	96:Rs3XVM/1z+VwB5ZZn3ZZZU8cvM+skNXTsmIRYabualPJCFVWPOHSdaQ+wMy:aH6tgE0M+skVTXIRY0TlaQ2y
MD5:	D4FC4B58E0AFA676D633B7BCC90B2E82
SHA1:	F3E9E9B7E8A70F26DCE7F5F7FD83A40D011BD4BD
SHA-256:	30A7512FDFE68937F0340EE819745AAC736A1D7E68F6AD42995052B0AB1A2AB5
SHA-512:	130E9846E6DAA6E74F5ECAC37212001D653DC2BF317B66410F34F2177A3ED294EE257B6546DB8C905180ED7EDA2B7A0D3E39D454BA62CCF78A7ED3784F8E239A
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .T.c.r.e.e.k...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .A.t.o.m.(.T.M.). .P.r.o.c.e.s.s.o.r. .E.6.x.x. . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .P.l.a.t.f.o.r.m. .C.o.n.t.r.o.l.l.e.r. .H.u.b. .E.G.2.0.T. . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\TcrkSD.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7280
Entropy (8bit):	3.473824011988193
Encrypted:	false
SSDEEP:	96:RpQVM/1z+VwB5Ah8XJASJkalPJCFVWPOHSdaQ+wMy:o6tgEjTlaQ2y
MD5:	B55554DCEBB7369E29B48EC037D16AA2
SHA1:	F00BF86444072916B2BD399D7C73DDEC92C67254
SHA-256:	A54319EF4A86D8D60B6B5AFA644DB33B6564B1D505ADD47022E464B4DAE27CDF
SHA-512:	7E60EED2FEC5DA082BC724F9EA02517608AF21A41A6F643E3CC2ADA81E0341BD2FFE04A698C2E3CDE41D7E6C82297D73996F16480D28F457D8675AEE2D355105
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .T.c.r.k.S.D...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.0.0.0. .a.n.d. .X.P. .I.N.F.,. .2.k.3. .&. .2.k.8. .S.e.r.v.e.r. .I.N.F.,. . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .T.c.r.e.e.k. .S.D.H.o.s.t. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\Tcrkahci.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6370
Entropy (8bit):	3.3853120100988416
Encrypted:	false
SSDEEP:	96:R2erVM/1z+VwB5yb0a+alPJCFVWPOHSdaQ+wMy:T6tgEGTlaQ2y
MD5:	E99872AE259FA8665164D61E058587AE
SHA1:	0889BCC2A21F8B83EBF13C7A2DEB9922B7B65285
SHA-256:	490BEE967487E75EF5B85CCED919BC46B8437B8A4E216120E0693CF274084D0A
SHA-512:	CE85E84F1555A2EB418356D40430D14D9814F30B8A83F2C69B505845C8694EA4263203C2C7E3BC2983EA7ACC576C3DDF5F433A386119998CFFCF1EECBF131221
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .T.c.r.k.a.h.c.i...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .P.l.a.t.f.o.r.m. .C.o.n.t.r.o.l.l.e.r. .H.u.b. .E.G.2.0.T. . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\cdvcore.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.5146468703356195
Encrypted:	false
SSDEEP:	1536:6IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9H:4m
MD5:	256077B82CB21B3110B170E6C9795648
SHA1:	9C31E2F41DCC7D8CEC9053BFA1DA654A17199810
SHA-256:	641725CCCBF343BAE5F1A86924F0D67BB8FE3FFC0CFD3EE4EEB4C9C0CB577117
SHA-512:	14551AFB80B01544E381D19145ABBFD46F9B9EFE1CD69D734479E58434FEB482B4EAB1BD40F59B1F581C67001B25DE1FEFD5CC1E739FE5D11CF8F52FFE881910
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......Z+.ZcB.....#.l..130801022914Z0...+.....7.....0...0....RF.A.E.0.5.F.E.B.7.2.2.2.6.E.6.3.B.0.2.8.D.3.0.F.9.4.D.7.C.A.8.D.B.D.0.B.0.A.E.3...1..e0:..+.....7...1,0...F.i.l.e........c.d.v.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........._.r"nc.(.........0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\cdvcore.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	10792
Entropy (8bit):	3.67411996670037
Encrypted:	false
SSDEEP:	96:RqB1wM/1z+VwB5ISn1yJiXr0tGRalPJCFVWPOHSdaQ+wMy:i1ztgEBQJiXr0tG8TlaQ2y
MD5:	B015F03AB216B47E84C60D00E9CF82AB
SHA1:	FAE05FEB72226E63B028D30F94D7CA8DBD0B0AE3
SHA-256:	B71F02BC68E82A747A5BBD13C77DB84C47D4677F7646655C7F3F946ACE1B5A14
SHA-512:	8072BD47485A194C1DBE2DEAA8D57ECE1F22DBBD876DB487D6B30D2D93DC61AD660728FC164674424DE3E0B97765B3BC1B48097BFC263777AF609EE59AE1C87F
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .c.d.v.c.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .f.o.r. .C.e.d.a.r.V.i.e.w. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\centcore.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.5143146106008585
Encrypted:	false
SSDEEP:	1536:TIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9t:P38
MD5:	0FA70EE89CE3CF42DFF90BAAA660531F
SHA1:	8DFB3D17B51B812488DA98A9D499413BC67B89F7
SHA-256:	31A05AF3C76D4D2B5278B4102A88DD49E245E7DDA350876BB77182486B0EC2C9
SHA-512:	9FF51B72890F65DFCF97EE9DFBB2551C54C9F8149D33DCD9604C24CDF486C1AFDAB4BD578EF74F0CEFF9A6CE0147C0AF29BD8299605AD7E2D96FA442CEBC9C47
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.......#3.8.E.........130801022914Z0...+.....7.....0...0....RA.9.4.F.4.9.5.D.A.7.2.7.6.4.8.5.8.C.B.A.B.C.3.4.5.6.3.0.8.E.A.5.8.2.0.5.5.4.4.8...1..g0<..+.....7...1.0,...F.i.l.e........c.e.n.t.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........OI].'d....4V0....TH0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\centsmb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513658967457855
Encrypted:	false
SSDEEP:	1536:UIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9l:a0
MD5:	08F306FCA0945D3F2B29403AF2CB9DB3
SHA1:	A2206C7F88C889EE0BAA4E23449F822DB8ADD2A6
SHA-256:	9E980F73D3024711130C63537FC46B686F39C8D97636286395300BCA15C60C42
SHA-512:	8E378BAFECAA85D41BBF52A80AD4FEBC90DC423C17A4B302C587DD647FBF17839011B19F6FDA7B5CB76454BD4F87B1268E2CB397170364512D7382EE9AF2883D
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7........7;..O...n1.'...130801022914Z0...+.....7.....0...0....R3.E.D.E.E.D.9.8.B.3.F.3.8.B.F.8.1.D.5.E.E.9.9.7.3.4.D.5.6.2.3.E.E.F.0.A.7.1.9.4...1..e0:..+.....7...1,0...F.i.l.e........c.e.n.t.s.m.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........>.....^.4.b>..q.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\centurt.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	146957
Entropy (8bit):	4.516676966474734
Encrypted:	false
SSDEEP:	1536:m2+vCIIgg7dSltC1Tp7QNpBFlO2geM+/wGCrbY2B2PzbHQjkM/RZ90KVDM0YVrXe:mrq
MD5:	7FDFDC4245CEDE1B48CE65453E292D05
SHA1:	1506B0D11E13DF6A7674F4C3DADAD5E2DFA448BF
SHA-256:	81EF0B38DAA1D3FF2FAFD56D080B717EB7F4098418BF1DC9A902E5FE14366AD9
SHA-512:	6DF61DEF1C0CE4CD6F30EE297E4300C22D871BF3AE5516DFC1DE22B3F192ED70927DAD68F6E865E14FB17AA4A1AA9CB156C5E05B2BCCD219AC85AB84252A1D36
Malicious:	false
Reputation:	low
Preview:	0..>....H.........=.0..=....1.0...+......0.."...+.....7.....".0..".0...+.....7........Yp..H....R3..130715214823Z0...+.....7.....0...0....R3.C.3.C.4.9.0.D.8.B.A.E.C.B.1.0.5.8.2.D.8.2.B.3.A.C.0.F.4.5.1.4.D.9.E.7.A.0.1.7...1..e0:..+.....7...1,0*...F.i.l.e........c.e.n.t.u.r.t...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........<<I.....X-....E....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3...... .0.. .0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.2.7.6.4...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\cougahci.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.514069276537974
Encrypted:	false
SSDEEP:	1536:kIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9V:qg
MD5:	2137D1E13865B02CBA5C0C3C98C6F13E
SHA1:	91FB3B08C45FDC6CF634845CE0CD9926D26281BA
SHA-256:	5CB845846870B8CA81DACA9A46BD441B6E7F670FB3EBF6524B2553D7BC5809FA
SHA-512:	29086128EBD09AAC9CC57332F59191301CFC94760964632142CEA8194BF46BA0B9B11601EA15A8294A5184F2B631E3548C6A90EB32BEBA11458C8795E75B4297
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....!.0....J.t.3W[....130801022914Z0...+.....7.....0...0....R0.5.D.7.D.D.C.9.9.D.2.5.F.B.4.0.5.6.C.9.1.B.5.8.1.D.C.5.0.3.E.5.D.9.C.2.2.3.B.8...1..g0<..+.....7...1.0,...F.i.l.e........c.o.u.g.a.h.c.i...i.n.f...0E..+.....7...17050...+.....7.......0!0...+............%.@V..X......#.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\cougahci.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6932
Entropy (8bit):	3.4454464855984877
Encrypted:	false
SSDEEP:	96:Rq7rnKM/1z+VwB5ibeMq6MqlalPJCFVWPOHSdaQ+wMy:0NtgEzTlaQ2y
MD5:	9BCADC4F9C78667E232F55E227003352
SHA1:	05D7DDC99D25FB4056C91B581DC503E5D9C223B8
SHA-256:	545C744A7523AA1CF2E2A1BE395A69888E779CEE3F32D3A90D7521AD86DD8DF7
SHA-512:	A17F22C35C63EF071F23A22DD6C7080219FE8E55D6DF0D41BE278936FA943F2712CEEADD081ECFD7A6B900C269B61FDE4AEA5CCBA15B142EFF6DEB66A28393EA
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .c.o.u.g.a.h.c.i...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .6. .S.e.r.i.e.s./.C.2.0.0. .S.e.r.i.e.s. .C.h.i.p.s.e.t. .F.a.m.i.l.y. . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...0. .B.u.i.l.d. .1.0.3.5.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\cougcore.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.51386581765464
Encrypted:	false
SSDEEP:	1536:YIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9A:+x
MD5:	E0C3CEE9AEF89B4446BD73434A42EC24
SHA1:	8D37CD510262D8EAEB48D14A376BEA5BF3BC2132
SHA-256:	7B55B198A729F558816A2425A3E0474606B5A13B026CBA7BD860839B6BEEEBB7
SHA-512:	0B2B0BF11988DF873AB7DA72524586A1F3AB424609CF495476AC195674E1AEC08770217105400842B2A3D85E47748FCB5063FFB2D0D552D2360540A3A53CD9DC
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.......m..d.N...y55W...130801022914Z0...+.....7.....0...0....RA.4.0.7.B.5.5.D.F.4.6.F.B.0.E.C.6.7.F.B.A.1.F.9.E.5.9.A.2.0.7.0.F.B.A.6.A.B.5.1...1..g0<..+.....7...1.0,...F.i.l.e........c.o.u.g.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........].o..g.... p...Q0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\cougcore.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	22708
Entropy (8bit):	3.706624575867439
Encrypted:	false
SSDEEP:	96:RqBnKM/1z+VwB51RQI3RQIE8cuxpzd0IX0RJ3XaDF+tMF+toF+tnF+tyF+tqF+tj:KNtgErRv3RvxyuTlaQ2y
MD5:	24F53B2423B5318234745D3878803228
SHA1:	A407B55DF46FB0EC67FBA1F9E59A2070FBA6AB51
SHA-256:	7E08F0C23E5B89D979226D5B12DDC22955C0CC80AF2FD2AF8F3743A190D50370
SHA-512:	8495B1E75CB446C35DE9646FA093C16CAA8E96D8711471AD0270A231986CBAD6533A25BBA07D8266222FD1B79E3CB416C1C540D44B0739465D442082D20B2B9C
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .c.o.u.g.c.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .6. .S.e.r.i.e.s./.C.2.0.0. .S.e.r.i.e.s. .C.h.i.p.s.e.t. .F.a.m.i.l.y. . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...0. .B.u.i.l.d. .1.0.3.5.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\cougide.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.512823525791104
Encrypted:	false
SSDEEP:	1536:qIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9U:oF
MD5:	8F671D027E518AA5742DE89E626D2112
SHA1:	F80C4DC14ED2CEBA9B0C4B3AC4AFBDBA547D9282
SHA-256:	523AF378ED224C3D2AFAC5FDECE5EABE3C9A79178D88DACA9623DBDBB8C397B0
SHA-512:	90212D59FD6602D92E1A40B5F1D88158D082ED801BDE40E2BB29B5BF5DC55E48E7F7A5F47DD478A16C93A0FC7AE617BB541CF4458D42A0B432373A12F34D84DC
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......E..'.F..W..c....130801022914Z0...+.....7.....0...0....RC.F.3.9.8.3.0.B.E.4.E.E.F.6.A.6.2.5.B.6.D.D.2.4.C.A.6.7.D.7.4.4.9.8.A.C.B.6.D.D...1..e0:..+.....7...1,0...F.i.l.e........c.o.u.g.i.d.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........9......%..$.g.D....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\cougide.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7956
Entropy (8bit):	3.504061655267565
Encrypted:	false
SSDEEP:	96:RR7onKM/1z+VIgkxe8QDae8QDiI8QD6I8QD/alPJCFVWPOHSdaQ+wMy:ENtgINTlaQ2y
MD5:	8EC36E73044BF7B1C3BBD7ACDFDFDCFF
SHA1:	CF39830BE4EEF6A625B6DD24CA67D74498ACB6DD
SHA-256:	D294D96D57A9E5D6CED5385BB7A5178A94D7D89CB65922CB501FD89BFDCE391F
SHA-512:	E6E587654361758C939B1069AEBE1F8273CACA4FC98A55AE9422E62A6E423314C43947119BA8F4632BEA8B2AB7CA6EDE7FA3F8D63BFA72E5FF1A9DCF3890CAFD
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .c.o.u.g.i.d.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .6. .S.e.r.i.e.s./.C.2.0.0. .S.e.r.i.e.s. .C.h.i.p.s.e.t. .F.a.m.i.l.y. . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...0. .B.u.i.l.d. .1.0.3.5.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\cougsmb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513680398322059
Encrypted:	false
SSDEEP:	1536:SUIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/M:rf
MD5:	B9C1E1B937088304598E85E7E3FBF10B
SHA1:	F4AD25BE5576ACCD2B7857D54366F7C5B5C82A56
SHA-256:	6F829688E32A2466F910A421EF17DF005E9353BD382CE222EAE13516F8B69773
SHA-512:	4FC6D3DD3CF87EAF8EBE703CF132DA7D851146DA0E6AC0B6B0BCE664B7C22D83808854E603D63EBAFDA6042EC25593E5E43D443CC993ABE0886DE9A07C1AEE95
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......b.#.cE...>.J....130801022915Z0...+.....7.....0...0....RF.9.8.9.6.E.3.5.7.2.C.6.7.0.F.7.3.5.0.5.C.C.C.7.9.D.E.5.C.1.C.A.F.D.3.3.2.3.B.E...1..e0:..+.....7...1,0...F.i.l.e........c.o.u.g.s.m.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........n5r.p.5.......3#.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\cougsmb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6192
Entropy (8bit):	3.3780934242000065
Encrypted:	false
SSDEEP:	96:RdenKM/1z+VwB528c2alPJCFVWPOHSdaQ+wMy:yNtgE+TlaQ2y
MD5:	FBE9B313FB51A6F6B63687FB6DE21B62
SHA1:	F9896E3572C670F73505CCC79DE5C1CAFD3323BE
SHA-256:	D12C68C3DB263A271D023ABA97CC2BE8BEB61F2A43B4E207742F5673D974F20A
SHA-512:	4FCACABF951FC1003ADB24332D2053697002DFE38742B814C6F231528B26348E720E356F0B97A266322F2E8253FD82101B692191F154082795BAD7983832982E
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .c.o.u.g.s.m.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .6. .S.e.r.i.e.s./.C.2.0.0. .S.e.r.i.e.s. .C.h.i.p.s.e.t. .F.a.m.i.l.y. . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...0. .B.u.i.l.d. .1.0.3.5.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\cougusb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513998847892706
Encrypted:	false
SSDEEP:	1536:IIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9f:u2
MD5:	CD3A90A9CE3CA04A2C606A9FE17013FC
SHA1:	94D28D8DFBCF08684EF04E2066A4C0119588FEB1
SHA-256:	D870EF82C0BC9D61657C0A79B3F413F7811457D323FA42DD4278A8ABF84CA5F3
SHA-512:	EBA026B4DD70F406AF9D22ACE42AB4FD786648541FB65DEA89028C0E2A9F900A813BAB66B1012E52AA4A9F3C40978A7F310316EAC704BE75F2DC3E800F3C1A3D
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....l..CJ..M.5[V..h...130801022915Z0...+.....7.....0...0....RF.7.1.B.E.E.8.2.5.9.1.F.5.A.2.C.6.F.C.F.7.B.2.1.6.0.B.F.A.3.2.B.4.2.C.E.F.2.2.D...1..e0:..+.....7...1,0...F.i.l.e........c.o.u.g.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........Y.Z,o.{!`..+B..-0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\cougusb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7712
Entropy (8bit):	3.517469943053321
Encrypted:	false
SSDEEP:	192:T0tgE9UO7s7VhdkBdrdNL9NrQNrTlaQ2y:TMgE9UO7s7VhdkBdrHLnr+rRaQF
MD5:	39105C1743306B7266901FEDB554427A
SHA1:	F71BEE82591F5A2C6FCF7B2160BFA32B42CEF22D
SHA-256:	46E1BCB7DF222B8F756555D68FCDCDDF504EFEC40BD1677F904BBB3B5E5881F6
SHA-512:	73148981FC9171FC542FF30B22B4A930A65C35D99B6CAD7E71B2818A7D5D173C4FE671E24ABB7B006E6526E88D2AA4F75E66FEF0DFD489223B61BB30E705745F
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .c.o.u.g.u.s.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .6. .S.e.r.i.e.s./.C.2.0.0. .S.e.r.i.e.s. .C.h.i.p.s.e.t. .F.a.m.i.l.y. . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...0. .B.u.i.l.d. .1.0.3.6.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\couide2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513786811507935
Encrypted:	false
SSDEEP:	1536:zIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9z:v2
MD5:	BC67F9E26BF7D7B84DFA8A75A35CFF13
SHA1:	AD2B7D575C2AF4F65DF0EB112C6A54E6D86DD2CE
SHA-256:	534A8AB8EAA089B298C31DA4B1BC6A2C4E4925C8FFE6AB2166F4F96F25C040EA
SHA-512:	A18B5506A38E835AFF58494B796CEC7399C5FAEE5FDFE319771A85D2C9B6C8B9606AD2F47C36B74C68900E4A727DBF45B61B37A2EDC59AA19B01EC8B7540FDB2
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......fj..B...N....130801022915Z0...+.....7.....0...0....RF.0.6.4.6.B.1.C.E.7.7.E.2.5.B.4.D.4.3.4.4.0.D.9.5.B.5.F.8.C.2.0.F.2.E.B.0.1.2.3...1..e0:..+.....7...1,0...F.i.l.e........c.o.u.i.d.e.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........dk..~%..4@.[_. ...#0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\couide2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8564
Entropy (8bit):	3.540130499407597
Encrypted:	false
SSDEEP:	96:R7NnKM/1z+VISwmQwmiuBPckxe8QDae8QDiI8QD6I8QD/alPJCFVWPOHSdaQ+wMy:3NtgImkjTlaQ2y
MD5:	87E867735372976FECBA1F4260E6A9D1
SHA1:	F0646B1CE77E25B4D43440D95B5F8C20F2EB0123
SHA-256:	D6D8125DA5C39F51419454091A41112FF04E7CBB3B46252DEC88DBF7B40F3D7E
SHA-512:	58456DC8B25ED3A71891977ECE79D77A0241FF410A2EDFEB182F42DB27B8C86EC3B1C9FD5D983BEFE98B83CD831E03E4E7C41B2E6F05B5612284A7BD1E151AD0
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .c.o.u.i.d.e.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l. .I.D.E. .D.r.i.v.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...0. .B.u.i.l.d. .1.0.3.5.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\cryswell.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513445849937441
Encrypted:	false
SSDEEP:	1536:fIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9F:LpK
MD5:	9C632FF7BD7A3F8A5B06A6B96B7D8A7D
SHA1:	7EECE7317EDE6B537F3B6277765552514D7076A9
SHA-256:	EC10EE326E770E9F20D8425FB24DD16CF016C83FC55D0AD47524F3077FDC133B
SHA-512:	E6F4D960794B90D0B69EA45E832E7B752A639E5D5C283CB4898E7528B8381DA581DE8B6ED8000D46670DCD83678C0F461DC971F63708A0D2BA187A016D80324D
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....0.h.[..E..21.r....130801022915Z0...+.....7.....0...0....R5.9.F.5.D.D.1.3.0.7.4.4.1.9.9.7.2.2.0.2.7.4.7.0.5.4.1.5.7.9.8.1.5.6.F.7.6.F.8.1...1..g0<..+.....7...1.0,...F.i.l.e........c.r.y.s.w.e.l.l...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........Y....D..".tpT.y.V.o.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\dh89xxcc-ahci.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148377
Entropy (8bit):	4.514119318005891
Encrypted:	false
SSDEEP:	1536:0IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9Y:6Ck
MD5:	7DD441A45A94E51FD6E72BEED65573DB
SHA1:	982CEE3984BDBBE991D8ED4620BD9377D9DC0493
SHA-256:	B97797B49CF6BC52EF8CEB6D3048ADD002FAC4E7A62E48EA47B1396ACB01CE32
SHA-512:	B4D017076A977DA303ED178BFA3A4E145675E78F34DDC13FCB9BC6593E86128A4ADB5426DC9B57A4E7FC8F7B21CFF22146C26F253CB2D26259A6827A83F175AE
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........C.0..C....1.0...+......0..(I..+.....7.....(90..(40...+.....7.....33.u.A.H...QbhF'..130801022915Z0...+.....7.....0...0....RE.D.B.4.5.4.C.2.0.1.D.E.2.0.4.9.D.6.E.8.1.1.7.2.E.F.2.C.E.E.4.0.5.8.A.9.1.0.C.2...1..q0E..+.....7...17050...+.....7.......0!0...+.........T... I...r.,.@X...0F..+.....7...1806...F.i.l.e.......$d.h.8.9.x.x.c.c.-.a.h.c.i...i.n.f...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\dh89xxcc-cor.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148375
Entropy (8bit):	4.513829335640103
Encrypted:	false
SSDEEP:	1536:9IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9Y:ZOI
MD5:	4B55DD21B4F7B1644E42E5D3F89F2D8F
SHA1:	89955CE0A5F0B6CBAD20950FBDA4D7AA867A46E2
SHA-256:	ED5CFAE6C353359FD4A7BE98A81A93088A9B119FE0ADC4C9638EC3523BF8E3B7
SHA-512:	58D19754DDF3DF1736456CF4E034A1FCACA41F7FBB20BBB4ABD216FA53B47596EB7278C0053E6EC1B71AAF5D9B8E1176A775F4E604C6864E84779B1A28CFA802
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........C.0..C}...1.0...+......0..(G..+.....7.....(70..(20...+.....7.....3~..qv.A..b...-D..130801022915Z0...+.....7.....0...0....R3.D.1.1.C.6.3.2.3.0.9.3.2.9.8.2.F.B.6.5.8.3.D.8.D.7.8.6.3.3.8.C.4.C.7.7.B.3.4.3...1..o0D..+.....7...1604...F.i.l.e......."d.h.8.9.x.x.c.c.-.c.o.r...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........=..20.)..e...3.Lw.C0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\dh89xxcc-id2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148375
Entropy (8bit):	4.513259277983852
Encrypted:	false
SSDEEP:	1536:TIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9Y:Pl
MD5:	880B5E3DA9696DCE12B12B49677C31D5
SHA1:	400D4F636FAEC899B4380030FFF7900E29D7453A
SHA-256:	7734DBC388E140146374A25E99A420E203581F82C06CC60F93486BD639ADC818
SHA-512:	C5EE02D33FB3450F00C9B7A507F2863A2428806BBCDF04F6516650BEA1F5C6F5FF98C835EC529849CDCC242AED92D3A9AF67A657070EB570DBC6BA8EFF9ED8F7
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........C.0..C}...1.0...+......0..(G..+.....7.....(70..(20...+.....7......4u.f6.H.sK9M..3..130801022915Z0...+.....7.....0...0....R5.D.8.7.1.A.4.5.6.1.8.8.E.9.B.7.2.F.4.1.6.1.8.4.B.B.3.A.7.8.9.5.5.0.C.F.0.5.B.5...1..o0D..+.....7...1604...F.i.l.e......."d.h.8.9.x.x.c.c.-.i.d.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........]..Ea../Aa..:x.P...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\dh89xxcc-ide.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148375
Entropy (8bit):	4.513924613458999
Encrypted:	false
SSDEEP:	1536:VIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9I:B1
MD5:	F0E91BBB5CF754211D0F8512B03BF9DA
SHA1:	273CA61D39EDEE2FE09944E3CC1C18C00EB99ED0
SHA-256:	94F85D6CBDED76CCDC42C78C4B20995574CE468CB367E266DF960CE31BFFBE43
SHA-512:	47166C3A954B46F606EF226588C43DA313ACC833CC447B9236EE500CE5257E7D1FB4AD992BDA4CF626C943A80E24E0E6AABC99D1CB51388122C71D0100D500A0
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........C.0..C}...1.0...+......0..(G..+.....7.....(70..(20...+.....7.....yrD....L.CU.2}....130801022916Z0...+.....7.....0...0....RA.3.6.C.F.B.2.E.9.4.A.C.9.C.C.6.B.3.D.2.C.0.0.2.3.9.8.1.E.6.6.E.9.B.9.6.E.D.A.B...1..o0D..+.....7...1604...F.i.l.e......."d.h.8.9.x.x.c.c.-.i.d.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........l.........9..n...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\dh89xxcc-me.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148373
Entropy (8bit):	4.514090550996422
Encrypted:	false
SSDEEP:	1536:KIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9C:In
MD5:	1B99780417E375A8E05CEEB964579050
SHA1:	B1702095FF04212B8D7B5A3865A2D6598C0F9D81
SHA-256:	07E9DE6917443F74FC39D52F07C53FDD87DF9262A487A5509C71C6B67E03CB01
SHA-512:	A3BA4B0BE26BB86C32BDA31A42D6626A60E9112A986A0BCF620784EFCC18725161723696B3A4EA54D906F9E52BDF7871E82E53A60B727F6D30AAFB172496685A
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........C.0..C{...1.0...+......0..(E..+.....7.....(50..(00...+.....7.....M.}8...L....P....130801022916Z0...+.....7.....0...0....R3.A.4.E.F.9.C.7.4.D.8.3.2.2.0.6.3.E.1.0.7.2.8.A.0.A.B.A.5.2.F.6.F.1.1.B.F.E.E.6...1..m0B..+.....7...1402...F.i.l.e....... d.h.8.9.x.x.c.c.-.m.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........:N..M.".>.r...R.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\dh89xxcc-smb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148375
Entropy (8bit):	4.5125417263285605
Encrypted:	false
SSDEEP:	1536:HIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9t:jk
MD5:	77D57C9A68879886630E7170876F3E96
SHA1:	FA34E2E5994987B92FFB23C9B415A882E887B938
SHA-256:	961789723AD11254895FE40FBDFCE72D4A79EA93A8C0F0FC605EF886000E5812
SHA-512:	4D3A3A7ADA626918E6A00C57E673C6C954F2E4825A742E359663A9F434AC4F92BC35E7384D3B94FDDD9E8A468AA444F64ACFED6EEC0AFFC57121F537F3AD3105
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........C.0..C}...1.0...+......0..(G..+.....7.....(70..(20...+.....7.....:.[~[..D..L..B.I..130801022916Z0...+.....7.....0...0....R0.3.E.6.3.3.8.F.9.2.3.A.C.5.3.E.0.3.F.2.2.C.4.6.6.F.7.2.5.4.0.2.F.D.3.C.F.4.E.A...1..o0D..+.....7...1604...F.i.l.e......."d.h.8.9.x.x.c.c.-.s.m.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........3..:.>..,ForT..<..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\dh89xxcc-usb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148375
Entropy (8bit):	4.514398355873162
Encrypted:	false
SSDEEP:	1536:+IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9F:ME
MD5:	BF3BA4887E63E09697B6EE295D26D183
SHA1:	198F8B3401AEC0AAEDB8002AF346DC295970F92C
SHA-256:	E38A8578B1C84FCA222BF912FCFE44CC3908F0150692A6C0C1E53D0B7CDA3416
SHA-512:	77C0E380AEA41E7B787A1716434E6648EBC399E6D654EF6C49D6D032BC78FD6CDB951A9FABD9EFB68578AD80D86A772D324B0000331670A4F703A60FE65C48BF
Malicious:	false
Reputation:	low
Preview:	0..C...*.H.........C.0..C}...1.0...+......0..(G..+.....7.....(70..(20...+.....7.....M.....F.w....s..130801022916Z0...+.....7.....0...0....R7.7.5.3.8.6.2.E.5.1.4.7.5.8.A.8.F.A.A.A.6.6.0.A.E.F.E.B.0.2.C.7.D.E.1.2.7.B.1.5...1..o0D..+.....7...1604...F.i.l.e......."d.h.8.9.x.x.c.c.-.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........wS..QGX...f.......{.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\haswell.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.512626731726999
Encrypted:	false
SSDEEP:	1536:dIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9D:5K
MD5:	40941619CB3DB0F51F6D4C32E3C3FD41
SHA1:	88396BADB69CE47C883C656238EC7D0BE3DE6018
SHA-256:	49BACC03DCF6B9A60BFA74C43624365A967AAC56472E110B2A44C8878BBEE07D
SHA-512:	9E5F96F8E1EB84CBD56B4866C2F40DA2E651AD2491848D93CE83927FF3BFD76E5B2F192AFB7124854E078C79BAA590986467F52DD937BD1FBBC3F83107D22007
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7...../d!...TF.F+bG.....130801022917Z0...+.....7.....0...0....R0.F.7.8.6.5.3.6.7.B.A.0.A.3.8.4.5.7.A.9.0.6.6.A.5.0.1.9.0.0.7.1.7.2.7.3.6.F.E.D...1..e0:..+.....7...1,0...F.i.l.e........h.a.s.w.e.l.l...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........xe6{...W..jP..qrso.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ibexahci.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513799310610962
Encrypted:	false
SSDEEP:	1536:FIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/90:xN
MD5:	327FDBD3697E5A5D176A71EE2455E77E
SHA1:	A4F3A40FE48ADCB11BDD4F34D9A75CF952314BD9
SHA-256:	7076911A9E290C5E3E3740E34CDF854C12A31013B956A1C6268ABEC714DDAED2
SHA-512:	6ED92A1C8E3E28962832E79533A183EF2E659B85154DBAD0AE4B51F4EEEF17A0F3617FAB46B86A0E900C9E3668CDC84411F646884F508E2CE2C2B56321522AA1
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....~......@.{...J....130801022918Z0...+.....7.....0...0....R6.3.C.6.6.B.A.D.D.3.7.4.2.5.C.9.8.A.0.7.9.D.8.4.1.B.8.1.D.1.5.C.E.7.6.0.D.3.A.6...1..g0<..+.....7...1.0,...F.i.l.e........i.b.e.x.a.h.c.i...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........c.k..t%.......\.`.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ibexahci.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	13002
Entropy (8bit):	3.6766746066386107
Encrypted:	false
SSDEEP:	96:Rd8PzfVM/1z+VwB5gtAtKbhd+iqitqobqTqQqQqwqkMqX+qc+qpMqBalPJCFVWP/:wr6tgEOtAt25WTlaQ2y
MD5:	2F7051D08DEA2B20510426C0C4C40115
SHA1:	63C66BADD37425C98A079D841B81D15CE760D3A6
SHA-256:	FA3B1F98FC7C1CDC8230921D9E5939B13C609ACA5F57744111EE47103CEC43DB
SHA-512:	BC1DEE06AF46A17941B95281AECEA9FCDC7B9EB6D726443A242CF483967BBF0A6513CFCB81E72CC8BC8DCBEC1AA497B58223E5B133E6169BEF502BDD156AB743
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.b.e.x.a.h.c.i...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .I.D.E. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ibexcore.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.512179261506319
Encrypted:	false
SSDEEP:	1536:bIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9j:nO
MD5:	E255D4083AE0911E07FE32F427E22915
SHA1:	EE2F46FB3877402F85921F9D7CC8FA9086F45224
SHA-256:	4E1088BAF5F29B6F21CDBB488FDCB21AB6C7BF5E398BA71C9F915E2C8270DA92
SHA-512:	83D066AEAA5199DFF83594B78C0D6E576FC784CD057B023BB947EF41BCC0C74140441861E26D85C45ED4DCD364E2189F7CE1EEAA48EA3FE4745D29501F7FE132
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....\|...\.yJ.zK.f!.L..130801022918Z0...+.....7.....0...0....RB.F.1.A.D.0.1.0.5.E.B.D.C.A.6.E.7.3.0.B.E.9.3.D.E.5.8.3.3.4.3.3.3.9.8.3.0.A.7.A...1..g0<..+.....7...1.0,...F.i.l.e........i.b.e.x.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+............^..ns..=.439..z0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ibexcore.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	28078
Entropy (8bit):	3.717187357286976
Encrypted:	false
SSDEEP:	96:RNFNfVM/1z+VwB5vt6xistft6xist28coF/ddxu0QzB+IIyAF+tXF+t6r+tNr+t9:Z96tgEhgvdgvZrHmFbTlaQ2y
MD5:	D16FDBB70E5C124AE1771EA189D09DAB
SHA1:	BF1AD0105EBDCA6E730BE93DE583343339830A7A
SHA-256:	EA3DD9A606D0A7F45E1BDCAC75A04AC9491A27C9BF91AA57EFE0FF4C4E30A9E8
SHA-512:	19098BE4BFD4FA3B9157F79CE882D71893BE34DD0F5CBCA0EF43FC148DA45209F39957D18571A0FFD83979DF4DE7743DA6AE1FD1A1A4461469C230801293E306
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.b.e.x.c.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .S.e.r.v.e.r.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .c.o.r.e. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ibexid2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513109619647383
Encrypted:	false
SSDEEP:	1536:RIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9+:tL
MD5:	7F93AD17EB2B461F657474173A79A6B7
SHA1:	1B74FFD4A80E714E546502EAF068665F094A3E42
SHA-256:	E58ACF7A3EA37C74E4195C488EB922F02B479413705E905C31CA3C7B96E4C61B
SHA-512:	13D32A34289C62450D4349E3228C67FE5D80082F663C92C266A5A772FD272603CC4C1CC7061CAB598292058F8BC97AA45B57DB4FBE7ECD83407DAA6260CA33E0
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.......S..C.D...a.L.,..130801022918Z0...+.....7.....0...0....R3.1.2.8.2.5.B.F.7.E.A.1.9.E.D.1.0.9.F.F.6.B.E.9.6.2.1.1.5.F.5.B.0.3.0.7.6.E.4.4...1..e0:..+.....7...1,0...F.i.l.e........i.b.e.x.i.d.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........1(%.~.....k.b._[..nD0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ibexid2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	14518
Entropy (8bit):	3.6810647713241966
Encrypted:	false
SSDEEP:	96:Rx2nzTVM/1z+VI4/b/jwmQwmiuBPckj8QDH8QD3x8QDtA8QDL8QDU8QDo8QDP8QQ:2v6tgI+k7TlaQ2y
MD5:	AD520A3A7486E7571FED5FD46CD7C5C1
SHA1:	312825BF7EA19ED109FF6BE962115F5B03076E44
SHA-256:	9F40A0CE67B6538318CBDF1A3ED6B1247633F309C69965E81D419F69EE8E803C
SHA-512:	503E766507B42E8AF3437E3E8988E633BA72E74B831EADAE730E45FFB860CC3FE04D1CCED147927A931C2C27FE30BBBEA5F5879D75BA69218AD61E83AFDA5500
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.b.e.x.i.d.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .a.n.d. .2.0.0.3. .S.e.r.v.e.r.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .I.D.E. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ibexide.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.5127728994758565
Encrypted:	false
SSDEEP:	1536:zIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9E:vB
MD5:	986794C79B174E688C056AF448E2F446
SHA1:	B5E68F8F9A988B779EE0938754F24720E2F8E82B
SHA-256:	3FBB0FEB3FE492B8C778CDB40CF961B1653D668E297D3C4CCB1E48694071B3C7
SHA-512:	71F6360E35035BF5663E38392A9D37C964ADA86F6BE0C480378CFA39C649437BC46239F9E0F5CC524083CCE449B3D3ED933E72A42F55040412614A8A9E19B5FE
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7........g..lM....5.....130801022918Z0...+.....7.....0...0....R4.5.E.1.5.2.4.3.F.F.2.2.9.D.0.F.0.6.6.7.0.A.5.B.2.6.2.C.A.9.C.7.8.8.7.0.8.5.F.6...1..e0:..+.....7...1,0...F.i.l.e........i.b.e.x.i.d.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........E.RC."...g.[&,..p..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ibexide.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	13822
Entropy (8bit):	3.66852808084733
Encrypted:	false
SSDEEP:	96:RG2nz8VM/1z+VI4fbfBkj8QDH8QD3x8QDtA8QDL8QDU8QDo8QDP8QDo8QDBe8QD8:hw6tgI9TlaQ2y
MD5:	6B0D146B82C8836F24141DD12F077917
SHA1:	45E15243FF229D0F06670A5B262CA9C7887085F6
SHA-256:	D1517338F7772AEDC0E807CA6622C34923DF68E504BF4BE93E4F804CCF36FF91
SHA-512:	0E16DC99BFC599CF8869FC6DCF57B8E8B43C0255C7A014276FA299DAB59BAF0A5702AD05614A64F07D004D862A21CE52E68FE049AAB1019DBBE4EB57D39AF2FA
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.b.e.x.i.d.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .a.n.d. .2.0.0.3. .S.e.r.v.e.r.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .I.D.E. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ibexsmb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513499245945604
Encrypted:	false
SSDEEP:	1536:kMIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/P:kCE
MD5:	179F96C2E689A2FB6E13E97429BDC0DB
SHA1:	EA1105CA2FC6FAE38668A55CA7C842F988657A42
SHA-256:	2F19E8BF519ED6D53FDE899863FA27CC5E587E6EE95FD66B524829990252C982
SHA-512:	8CA1D668D15AEC7DAAF5B35FF443E4477CABD84F393126A9640BF346AD0DE6CC1FF556B4435A2B1AA398C42DCD8D002870119F0401147479E955496B60B3B6A4
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7..... .ey,..N..0...L...130801022918Z0...+.....7.....0...0....RC.A.C.4.5.6.4.7.A.9.5.9.F.2.3.7.C.E.2.5.C.0.5.2.F.D.B.9.A.4.A.9.1.4.C.3.4.8.3.0...1..e0:..+.....7...1,0...F.i.l.e........i.b.e.x.s.m.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........VG.Y.7.%.R......H00b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ibexsmb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8148
Entropy (8bit):	3.556679397833379
Encrypted:	false
SSDEEP:	96:RqsaAVM/1z+VwB5GhleSIcualPJCFVWPOHSdaQ+wMy:3L6tgEiTlaQ2y
MD5:	8408B220CFDD24CB36270B3F631750F7
SHA1:	CAC45647A959F237CE25C052FDB9A4A914C34830
SHA-256:	B83D609CBAC0B406F616F2A11EAAA4072303690806ACCF8709AE60BC87BED243
SHA-512:	56B8D5EC0B0889674E471F93710BE1F421D3F75D60BC2BFE1FCE939DC35E2B56886C692B1C1AAD02AA864EB3F3B43A4BC8393A30CD0796DC0EA46A2FE91F07A8
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.b.e.x.s.m.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .S.e.r.v.e.r. .I.N.F.,. .V.i.s.t.a. .F.i.l.e. .f.o.r. . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .c.o.r.e. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ibexusb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513533800150837
Encrypted:	false
SSDEEP:	1536:aIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9y:YT
MD5:	451019EF214A1FACB63DE640E31E0279
SHA1:	E15092C1CC76788061685BB35E03DD7B0E42716C
SHA-256:	11E68DAA28A34FE161C0601EFBEB52177CB0F2AC4F43E1AC463288DC8006CF78
SHA-512:	456AB3A05433F50DA722FC8455B4961FD494135E9E8D8B8DDE7CD81C5E279FAA06AF69A6348B0E29FA11ED4DDB302FD9489580A76EC7284C1DCD4B22A256120C
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......0`...J..e(.G5I..130801022918Z0...+.....7.....0...0....RE.1.B.1.0.D.E.C.A.B.A.8.A.2.3.1.D.5.3.B.9.5.2.4.2.A.D.5.9.F.C.5.6.7.8.6.E.A.A.0...1..e0:..+.....7...1,0...F.i.l.e........i.b.e.x.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+............1.;.$*..g..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ibexusb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	18904
Entropy (8bit):	3.702275635418851
Encrypted:	false
SSDEEP:	384:9NgEpE9DNCXdYXVJJQKgrW+1WYaJQKgrW+1WY/JQKgrW+1WYeJQKgrW+1WYihdkr:96sC/F
MD5:	7AA816AA616FE50D44CBE7F8B37F0842
SHA1:	E1B10DECABA8A231D53B95242AD59FC56786EAA0
SHA-256:	9320FC5F47ED3A1A26581AF3FA1052035A8076DED2047869F9045A27619511E5
SHA-512:	B6EB4F119D425B3D502ADC1F053211F04FF612FE7D27791C69DEDB0E4714A25A580DCDDA76677804CAD5563D39248EFFC01FA86049CB96AD23A2B8C717EEDD7F
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.b.e.x.u.s.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .F.i.l.e. .f.o.r. .I.n.t.e.l.(.R.). .8.2.8.0.1. .U.S.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.6.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ich78id2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513138533748444
Encrypted:	false
SSDEEP:	1536:8IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9j:yC
MD5:	FE2A94D8D6F9C673714F95F992DF0BAA
SHA1:	FE5CED51E10762CCBA87260DEEBBAAD8A2BEC646
SHA-256:	ACD451D9B9677103C7C33FF73A80B66D652E4B1912FCCCFAB171AB8B0FA942AB
SHA-512:	1F35BCE6BAF36DB0C55C4B0943DF1451B26E7EA73A8327CFFAAC79E0AE84078DF04E08BBBCCD7161E039B71F0AE8ED7168D691B4DE778B5EC43CBF6A03214922
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....^..:,C.E..P.J...130801022919Z0...+.....7.....0...0....R0.A.B.4.E.7.B.4.5.F.B.E.B.7.D.4.C.4.1.5.5.D.1.E.8.A.7.0.E.E.F.4.9.4.5.B.1.B.E.9...1..g0<..+.....7...1.0,...F.i.l.e........i.c.h.7.8.i.d.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........._.....]..p...[..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ich78id2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9820
Entropy (8bit):	3.6099063936049993
Encrypted:	false
SSDEEP:	96:RKQz4VM/1z+VIawmQwmiuBPcktQDHQD/Dq8QD98QDR8QDRDYalPJCFVWPOHSdaQF:Y6tgI+k4TlaQ2y
MD5:	E7E6982824515456FDCC5F8C22DEC966
SHA1:	0AB4E7B45FBEB7D4C4155D1E8A70EEF4945B1BE9
SHA-256:	E057E3EE6660E5A9017967681F51184CF86D9DF01A32F23B49728E390C0133DE
SHA-512:	52E65B08A30821FC1B49D1522253CF9ED4440896FDAD8CC594EA174A6F36C396B4D7D116FE34E886DF4B7D8CEAB5499574DD2D61DBAABB0EB155A1F878EE9010
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.7.8.i.d.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .F.i.l.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ich78ide.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.512913103447628
Encrypted:	false
SSDEEP:	1536:MIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9d:CI
MD5:	15C7ABDB7B9F8CA0D8E76C5FE13D9F2F
SHA1:	CC7769D79E56A2BCA88A40BAFBFDB7C543F82F44
SHA-256:	8347256B785B87015A34FDE4DF5FD143B62673F65A91D4FDE0D9D20407638C5C
SHA-512:	5E25B02C8EA9934A13568204D55956CE6AC829DD082148BB7F678DA5FA25DC6E7377AC40E84D09774DD73B91AA060FA9B8548D09C4D025F35A8E274086666F8C
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......,U.W.DJ.!U..D..130801022920Z0...+.....7.....0...0....R0.F.C.8.9.E.F.2.5.B.8.E.7.E.B.4.E.6.D.E.C.6.8.A.A.B.6.F.C.0.8.D.9.7.0.0.1.8.E.8...1..g0<..+.....7...1.0,...F.i.l.e........i.c.h.7.8.i.d.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........[.~.....o......0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ich78ide.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9736
Entropy (8bit):	3.6177001850533808
Encrypted:	false
SSDEEP:	96:R1QzXVM/1z+VIawmQwmiuBP8ktQDHQD/Dq8QD98QDR8QDRDYalPJCFVWPOHSdaQF:g6tgI+kYTlaQ2y
MD5:	513FEA56E19397C8D767FC15FF398D8F
SHA1:	0FC89EF25B8E7EB4E6DEC68AAB6FC08D970018E8
SHA-256:	F5A75E9968F93AFC6F1F3144C3AE81A4CD285F70D4D5718ECC9361A2426E4D38
SHA-512:	BEC3B5F642A37A80E99A0F637D7FFD101347392B3E9353EFC8DFE0A23CF16504C63520D0E0A7C28300B216DCEE5E5AC94DF1111071E1A3807533716E7FE73CB1
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.7.8.i.d.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .F.i.l.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ich78usb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513004159193995
Encrypted:	false
SSDEEP:	1536:YIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9n:+G
MD5:	4F04A6C0FA5F4F4A1A69D33BEF24E54C
SHA1:	43075E702112A6BAF2365A75B055F2938D09358A
SHA-256:	9204BC008FC906889283F023953A85D6C61A68ECDDDC00243E8CE8ACC5D9D2DE
SHA-512:	5CB7C68B3AA50ABCE9E6BA4403023B1DFC1D572EEE20A232766CCEDD23550F5AB57AA947991908273D40AA17707E37AA95649E731AB16D03EC9359DC4EF98328
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.......m...H....:.p...130801022920Z0...+.....7.....0...0....RA.3.F.7.A.D.3.9.2.6.5.B.E.E.C.1.C.C.0.F.1.5.4.1.D.C.7.6.0.F.6.A.6.7.2.A.A.B.9.4...1..g0<..+.....7...1.0,...F.i.l.e........i.c.h.7.8.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........9&[.....A.v.jg*..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ich78usb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	17314
Entropy (8bit):	3.7063559331131977
Encrypted:	false
SSDEEP:	384:nNgEldiHd2tXotXrcwLG+XAWlAYkywLG+XAWlAYk+wLG+XAWlAYkhhdkBdJlJFpa:n6cCqF
MD5:	496E4546EB9CA8E12E58023E08B29906
SHA1:	A3F7AD39265BEEC1CC0F1541DC760F6A672AAB94
SHA-256:	1AAEA88A241CF633FEB16FECED4525A6605329B58AA3D5D07E84A2F57293D4D0
SHA-512:	9A101DA0474F730049DEF81610DD7B273912D443ABAC99623FC8B9D00EB69BFFD387427BA2A21B4FE53BA49E30D562E46D82E461372696D8620B4CCEE824DBF3
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.7.8.u.s.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .U.p.d.a.t.e. .F.i.l.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .U.S.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.6.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ich7core.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.514261947623607
Encrypted:	false
SSDEEP:	1536:EIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9H:Khg
MD5:	17E47F8558CAFFCE856571C7E482D8A3
SHA1:	2A073113BCE5F9A0E574EA0F207A80B1A5A66BA2
SHA-256:	6CBC92C2F847923F35FD95E355E0ED16CDE552C359B605B752824DBE1EB5908D
SHA-512:	DCF7414EB0E9C65EA77D232195D30A60EB509F7EE9375FD08786990C379A5F9848150E1987381194CA3BBC9E0EFECFF01B4BA46F4685A38C3462ECC430BCDC87
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....7).C./.N...=.I4...130801022920Z0...+.....7.....0...0....RD.C.6.2.C.B.6.6.B.4.C.D.4.4.9.7.A.E.A.4.9.E.9.9.8.3.3.B.1.C.0.3.F.7.3.B.C.8.A.C...1..g0<..+.....7...1.0,...F.i.l.e........i.c.h.7.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........b.f..D......;...;.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ich7core.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	11498
Entropy (8bit):	3.6637460381183784
Encrypted:	false
SSDEEP:	96:ROgsVM/1z+VwB5c4hWu4hWU8cs8m+tv6+tC+tq+t/alPJCFVWPOHSdaQ+wMy:u6tgESEWuEWS76TlaQ2y
MD5:	CA370FFA5C2948414EA2F529BDB28182
SHA1:	DC62CB66B4CD4497AEA49E99833B1C03F73BC8AC
SHA-256:	EEE8A7B482E6583F7A4E46EFC2C8D409F2B8862C6995D643A63BAE2AA96B1AAE
SHA-512:	19392F421D16768A4146D0A5FE45ADCE1158270647F83528C466341EC8710283079950CDF594764FF6858BE3F52FCD13B554A42888F9BD6AD906FBB45E209EAC
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .i.c.h.7.c.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .F.i.l.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.5.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\intelcp2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513873604676116
Encrypted:	false
SSDEEP:	1536:EIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9g:KN
MD5:	B462016F4461AF4405207E8D0DE0EED7
SHA1:	B8EDF975A9C05E23DDF17B3A280A10BD7DEFCA90
SHA-256:	63C008B92C0B912CF1ADA6F66F272987FEA13068F0086798C586AB9748C1C226
SHA-512:	6273C9B15D2066F512CA45F9D72760728692932A67D2479824316D6E3E338B367BC9D144A235E6D467C859AC43C44FD55BAC9D94C8DC51FDFB7F37C2FE02F44C
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......PEh...C..w.i....130801022921Z0...+.....7.....0...0....R0.3.5.5.8.E.E.0.2.6.C.7.D.1.0.1.9.B.4.A.1.3.8.D.D.4.B.5.8.B.8.A.E.3.9.2.1.1.C.4...1..g0<..+.....7...1.0,...F.i.l.e........i.n.t.e.l.c.p.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........U..&....J........0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\intelioh.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513975505181807
Encrypted:	false
SSDEEP:	1536:wIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9c:mt
MD5:	F6A43E22A506A260ECADE2035E081794
SHA1:	3FDDFFE3DE224507E1C5E4BA62D731394B179C7A
SHA-256:	5EF8A8104F108D00DF6F3C7469EFF465B7588C1D39194829F9DB47C277E733A4
SHA-512:	77BD9AABE76C1EBEA801002D314B1F4D438655DFA4AA077398D7A217CCB69898B180698B9BA1278D3D06F582E79C1A028279A08DD7C54C207E58B2ADA7BC93C4
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......+.....C....I.....130801022921Z0...+.....7.....0...0....RE.D.8.1.0.F.F.B.4.1.5.B.A.4.4.C.F.F.B.F.D.E.4.E.3.A.8.0.F.A.4.D.6.7.8.4.2.D.6.1...1..g0<..+.....7...1.0,...F.i.l.e........i.n.t.e.l.i.o.h...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........A[.L...N:..Mg.-a0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ivybridg.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.514118897292868
Encrypted:	false
SSDEEP:	1536:4IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9S:e/
MD5:	876FF80F5021C5E2E780D2326110FEFF
SHA1:	7FAE9DEECA1CF861377CF278001FEEB45CF76E61
SHA-256:	936A72F33EE35AC31EE033C67205A2D9F12A89918DE6E48DE65E84A704076922
SHA-512:	9085B356E2B550A0E90C37A32912517AA5887D54FDF68841482D44F7D08C9BA4EE393A533FDA014636D3E5D9FF17E6A8401BA3771A3BA973BA1DC729FD8F9A28
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....).@..^kL..9.N.)..130801022921Z0...+.....7.....0...0....R8.3.B.D.0.0.C.7.1.6.F.1.1.6.9.D.2.0.B.3.1.4.2.1.6.E.9.D.9.D.7.6.4.2.D.0.E.2.E.C...1..g0<..+.....7...1.0,...F.i.l.e........i.v.y.b.r.i.d.g...i.n.f...0E..+.....7...17050...+.....7.......0!0...+................ ..!n..vB...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\ivytown.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148191
Entropy (8bit):	4.5138319580492015
Encrypted:	false
SSDEEP:	1536:T3CIIgg7dSltC1Tp7QNpBFlO2geM+/wGCrbY2B2PzbHQjkM/RZ90KVDM0YVrX0ha:D/
MD5:	AFF652D9909C162124E2C4B1649162F4
SHA1:	C0DFE9F47BDCD6E542171B9AA4A33F9083261F16
SHA-256:	2837A0A6716B33DAF53DE0D0ECDB5431ECDDA293775393B35F3EC7D0C92E712D
SHA-512:	7CE5BEE2FB0CF0793E8D8BC987EB97AF5D081233BEE1BDF18DC55BD44AC5992DB5F36A9356CA2705BBAE148A294EA67021D6CDBBB64DB56A5C058CBC4E28B85A
Malicious:	false
Reputation:	low
Preview:	0..B....H.........B.0..B....1.0...+......0..'...+.....7.....'.0..'z0...+.....7..........<.G....}.....130709203822Z0...+.....7.....0...0....RD.4.9.5.F.B.7.D.E.C.8.D.0.8.7.4.2.D.C.A.A.C.7.7.0.A.F.4.4.8.A.7.3.6.6.F.5.2.0.A...1..e0:..+.....7...1,0...F.i.l.e........i.v.y.t.o.w.n...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........}..t-.w..H.6oR.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......%q0..%l0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.1.7.9.1...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\jaketown.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513385490875967
Encrypted:	false
SSDEEP:	1536:TIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9A:P5
MD5:	D5AECDC5C32CFAD983C35DC850D799BB
SHA1:	68B6EE76BBA80517FC6185638D21883D29D95EFD
SHA-256:	D5871F5132CFFC152C72205294F9375C1FCA2A34AC5636B280C0EF48FD1F25D0
SHA-512:	BF9F996F0D8E32B9FAD1FD0463E5407FFD453C7B7DBF18E9F5732A5C3EBE07BE34E6F84E77AA4966ABCC275E2D315D9D9F9B61B283E21455A2EFA1CAB26BB2BB
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......,.Y\|..A.... q.Z..130801022922Z0...+.....7.....0...0....R9.F.4.2.6.E.5.0.3.6.C.5.7.A.2.5.6.5.3.6.3.7.F.7.D.5.0.4.B.C.3.F.C.D.B.D.4.E.A.C...1..g0<..+.....7...1.0,...F.i.l.e........j.a.k.e.t.o.w.n...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........BnP6.z%e67....?.N.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\jasperfo.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.51456288041575
Encrypted:	false
SSDEEP:	1536:NIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9/:pS
MD5:	CA334590C26EB275855BD81AE7584BD7
SHA1:	20B14E3418E8A0149696E2B95652A18A857BE69F
SHA-256:	AFD190E206A0265F6ED6C4ED115CA23A5382BAC8C253227699B69B3CB687F8F2
SHA-512:	BFF19E5762AE38DF62CF27FEB979784DF893EBF0F9EC3E776760B884270E42CBD6D4C64D77FFCA9F750CDBFEAB45123DBCAE446A92679F6D143353E8CD29ED7C
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......z.WKfaJ...s..\x..130801022922Z0...+.....7.....0...0....R0.A.8.4.1.6.D.D.2.E.C.A.4.6.A.C.8.7.C.4.4.C.2.7.5.6.F.0.8.3.A.9.C.5.2.E.E.1.F.D...1..g0<..+.....7...1.0,...F.i.l.e........j.a.s.p.e.r.f.o...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..............F...L'V.......0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\lxlpahci.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.514228098056477
Encrypted:	false
SSDEEP:	1536:qIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9C:of
MD5:	83FC3960EFAE6F7C537B3F4851E651DD
SHA1:	109E892A80CEE1B20E74624DA479AD04F070A222
SHA-256:	E8F17601BF0764959CB848D197D6D2EA8F584181CE02EC6C06F3DEF5E44D084F
SHA-512:	D535C197AADBD5A14660D69FAF34457E75F428501AF14672DF91EC2B69AA461AB15954F4EC197129B664E9993960F5800BF27A7F8191DD667F78B37CC9AA76FB
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.......U..o.I.b.9.}.a..130801022922Z0...+.....7.....0...0....R8.7.4.0.3.F.F.3.A.D.D.F.A.1.7.7.0.9.3.6.C.9.4.3.6.A.1.8.7.A.C.3.B.9.F.B.C.8.D.E...1..g0<..+.....7...1.0,...F.i.l.e........l.x.l.p.a.h.c.i...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........@?..w.6.Cj.z....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\lxlpcore.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513990256882763
Encrypted:	false
SSDEEP:	1536:vIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/93:bi
MD5:	71EF9BD6BA3610BAA5176703183E2B6A
SHA1:	9B2D323D139C33B87FCD7CAA6D34DF8E1A4AC9C8
SHA-256:	681F55A5D7956594348DD9FE879B1807618273F37D13F6B475C7AAC366AFD449
SHA-512:	0E532B2E8BFE98B770C613726C3DCF2749F64E5B5CB57CF5BEB1AB535F41AA6670B23F9EEFCE4B80BD0A868CFBDA2410E1DD1F54B13DE841B7572DDA3D9326B9
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....2..u.^A....h."...130801022922Z0...+.....7.....0...0....R0.7.8.A.7.2.E.D.3.5.1.A.0.D.1.9.B.F.4.6.3.C.D.5.7.F.C.D.8.1.9.F.0.5.D.9.B.C.F.D...1..g0<..+.....7...1.0,...F.i.l.e........l.x.l.p.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........r.5....F<.......0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\lxlpid2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513213891476564
Encrypted:	false
SSDEEP:	1536:bIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9+:n3
MD5:	8C6CA3303C4133D1CA298F679076186E
SHA1:	FF7DB62E4948439230C883DDBEECA4DC040208E2
SHA-256:	0B6F829D6C747EB4FF4FCFF9033773A2310624923C2248069D4599C020244124
SHA-512:	57E5FC53DAD9177B4D95A560B1EAA004BE9A707440E25CD4A19C5BCB09F1655319E9375DCBC5CF5D6FBDC73EAC60FAE29079359D84AFACF05CA2C831F3C5C89D
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....)....v.J.....+....130801022922Z0...+.....7.....0...0....R0.2.0.8.D.7.C.A.D.9.5.3.2.9.7.6.7.4.1.0.8.F.A.E.7.D.F.E.3.C.9.B.C.6.E.2.3.8.2.A...1..e0:..+.....7...1,0...F.i.l.e........l.x.l.p.i.d.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.............S)vt...}.<...8*0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\lxlpide.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513197389125169
Encrypted:	false
SSDEEP:	1536:3IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9b:TO
MD5:	58E14B5EB263261819347F75DBC01539
SHA1:	CE73C6C477D86C0043A74FAC41041138F9F15CD5
SHA-256:	F391945DE33F4A363489DBFA3EAB2904B6B992B54E5CDCD9DA95812F65FCE08A
SHA-512:	46B06E3E985DBC4FFC91153D6C8229EDBAE016F1489090D52FB87E59D2E5A6E26B0B07190A1F274F6275D7A4E32B1CFE813E6896D4592E736DBA18C4EF27A256
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.......g6{.=F.f..}.....130801022922Z0...+.....7.....0...0....R6.7.F.8.6.6.0.7.4.0.0.1.E.D.7.7.B.F.3.E.5.7.1.5.5.8.A.C.C.B.1.8.D.9.B.D.4.D.9.5...1..e0:..+.....7...1,0...F.i.l.e........l.x.l.p.i.d.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........g.f.@..w.>W.X....M.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\lxlpsens.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.512983375962746
Encrypted:	false
SSDEEP:	1536:cdIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/Q:o/
MD5:	69B463C1FD7B543697AFABAE08F8D8F3
SHA1:	D347329626A6C4D8162C4C2E89DF53DBFC2BBB78
SHA-256:	AAEF6B37D5AEAFE1275E12AB83E302D65A9FFE168273C3DA12D21B9087425C1B
SHA-512:	5AC730BF5C72505485E0BE26747710DB20D60FC424C8B076FE2873632E77DAB12D5671B4E939ADEBE007D2783D1EE04A8D81B178C09A1130C0A395EBB755F9E3
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....u\|..!9.@....]b.~..130801022922Z0...+.....7.....0...0....R4.1.7.2.F.1.7.C.9.7.A.6.5.5.D.5.4.4.2.4.E.6.A.C.2.A.9.D.5.7.3.D.7.5.A.7.4.0.1.2...1..g0<..+.....7...1.0,...F.i.l.e........l.x.l.p.s.e.n.s...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........Ar.\|..U.D$.*.W=u.@.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\lxlpsmb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513695473964375
Encrypted:	false
SSDEEP:	1536:BIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/97:de
MD5:	E2F0A09C8712A5405DE8A4677E09C3E2
SHA1:	DB351412182C8E8F87B11361FD2C6CD4E52B84EE
SHA-256:	FAD8175DDA8F6A40DB3BE84ABA306D904A1477D72DA6B3110159125DB9E0F6BE
SHA-512:	D33AA18E052E3EA05EF427EACEA090EEF72D715E1FA737CE41CC677A039C556AB468270E8E04FFCD73E2838426F1D27C51E1C098CC1D74D990B86DE1F907A665
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....^O.....H..5..9.<..130801022922Z0...+.....7.....0...0....RB.D.B.D.4.0.0.4.7.2.7.3.5.9.3.2.E.1.5.2.8.6.A.C.D.0.0.A.1.D.A.1.8.5.6.D.2.B.6.D...1..e0:..+.....7...1,0...F.i.l.e........l.x.l.p.s.m.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........@.rsY2.R.......m+m0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\lxlpthrm.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513251085176305
Encrypted:	false
SSDEEP:	1536:WIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/97:U2
MD5:	8232938E3AF079AACA221BDDB23E2E5B
SHA1:	F34CCD651AB114DB3922706887F3CA4A6AA110ED
SHA-256:	4E7AD9F3DED7E19EA6F21EC98B6C5E65921A2E1F38F78C54FB2A5D1E3E8FBBB9
SHA-512:	023886C3A3DBFBB17976BBB345238A6E8073DE8DAB1A5F9FF2E574C6A5873933226E777CD003A2F2C02927D27B829756E0C7F8C727F8CFED8C7F6E30197FEA26
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....L.F...L.SN..>....130801022923Z0...+.....7.....0...0....R8.7.7.B.5.6.2.2.4.9.D.0.D.6.A.3.6.3.4.4.8.F.1.F.E.E.0.D.2.9.1.7.7.E.7.6.0.0.6.1...1..g0<..+.....7...1.0,...F.i.l.e........l.x.l.p.t.h.r.m...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........{V"I..cD....).~v.a0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\lxlpusb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513457699671097
Encrypted:	false
SSDEEP:	1536:0IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9M:6V
MD5:	F1C87150C66B612C9EDAFBD1757C238A
SHA1:	C14CCF73E41BAB53DE548BD33DDB390179B9C2E3
SHA-256:	2363BF995CC74E95E952B048865BE42C901F46C69D4B71D7542ADD97BB236E05
SHA-512:	2426E9069C0DD73A73511D5312AE47A622BAE2961661DC73972405429CAB08F022A926B4D3E8B0F9643807B0EA753267ACFDF160E23F67592135A45CF6360F08
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.......2.{I.J..\|..+...130801022923Z0...+.....7.....0...0....RA.6.9.9.5.A.7.7.D.2.6.D.0.B.0.2.9.2.A.9.C.3.B.4.8.7.8.8.3.6.D.2.3.2.8.9.9.F.E.0...1..e0:..+.....7...1,0...F.i.l.e........l.x.l.p.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........Zw.m.......6.2...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\lxlpusb3.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.5131086739018675
Encrypted:	false
SSDEEP:	1536:KIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9W:ID
MD5:	012AE1BF52D15A8BDAB4DCBFEE58980D
SHA1:	7B31A94CAB0A5EB71A055CC0B1150216D727CE56
SHA-256:	BA0F0C3F145626A3E187D63D7512A243B7AF397776F968157C45E9D35F740FB3
SHA-512:	635A6FFA237AB3A2CF7AFEFE3DB804F76324EAF684E2CEAEA089E3A26FB0581C98265F379BEFB77125E8A3F19273A5E301881D05B1B631842EE8D0725C25117A
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......l.=Y..H..q.2.....130801022923Z0...+.....7.....0...0....R0.7.6.A.9.5.3.D.3.C.2.4.4.F.B.C.8.3.9.0.E.F.4.2.F.8.2.8.5.4.A.3.9.F.7.9.6.A.6.F...1..g0<..+.....7...1.0,...F.i.l.e........l.x.l.p.u.s.b.3...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........j.=<$O....B.(T..yjo0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\lxptahci.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513998771617217
Encrypted:	false
SSDEEP:	1536:gIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9o:WV
MD5:	099DCD7E95EF2ECA45208AD0E6FDC9D0
SHA1:	26051B30A03B0B23D43269E32244E4811601902C
SHA-256:	8DAAA0A937B57543B06DA7721F614802D1F6624520A438072B3D8FC6AADC78F8
SHA-512:	9B97AE7BEA64E45046D828DB799A44E00CFEE61272C09BFB2365977618B5C0F9C0457CC1FDB675D5BA557DB41969209AD6FBFC98740BBCDFFF334E0DA5F42ADA
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......R..ZE...,.....130801022923Z0...+.....7.....0...0....RB.E.F.4.C.1.2.F.0.2.C.F.6.6.3.0.D.E.9.9.8.A.2.0.B.5.4.9.4.D.E.3.A.D.5.5.E.0.F.2...1..g0<..+.....7...1.0,...F.i.l.e........l.x.p.t.a.h.c.i...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........../..f0.. .IM.U..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\lxptcore.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.514278857781245
Encrypted:	false
SSDEEP:	1536:9IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9r:ZC
MD5:	5EDFCECCB19D635F54650444E08AC853
SHA1:	C365D882645D4BB130B88655628AE67BC9F50A1F
SHA-256:	62E6C6580DBBDFE09613B0B01C55CDDC850FA7C1A8413986A9B02B25377082ED
SHA-512:	5FD6E4CDB8D0EE0CBEAB5B94AD678D31E4F00AE94EB792E05E855F4400E91379A92CCEFBC3EC688CA8EB1E8F07484EAE39B581F002AB79336FF57C4643B5927C
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....E..{i7.M.../zx....130801022923Z0...+.....7.....0...0....R2.6.9.F.A.B.A.2.7.3.C.F.C.B.A.D.5.6.C.A.C.4.B.3.C.B.C.1.1.A.F.D.F.0.4.A.E.A.2.B...1..g0<..+.....7...1.0,...F.i.l.e........l.x.p.t.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........&...s..V.......J.+0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\lxptid2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513749673276953
Encrypted:	false
SSDEEP:	1536:6IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9l:4E
MD5:	7575145CBBA8AE1D2EB7E65194F28DE2
SHA1:	467CD311826E86E769D470DD071DEFA43F2D46FE
SHA-256:	F6EAD97AE37138057BD135F435DECA1B48EAE86C59E99E9D594A760D3150102F
SHA-512:	756956A6C561F5163F58BED8EEB231562634A0B5FE5B281AA9C0E29B2FFBA43779BA170DA32DFE6FCFB9C1E72A380736B9537DF4D528BD163537C53F6A2F1448
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....+...0.@....i....130801022923Z0...+.....7.....0...0....R5.1.8.0.F.C.3.F.0.D.F.C.B.3.D.D.D.F.E.0.C.6.6.4.A.7.E.5.0.6.5.7.4.A.B.F.7.E.6.B...1..e0:..+.....7...1,0...F.i.l.e........l.x.p.t.i.d.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........Q..?.......d...WJ.~k0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\lxptide.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513464213663126
Encrypted:	false
SSDEEP:	1536:2IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9/:02
MD5:	35FB95DCBDBA333FEB71A8EC753CABC6
SHA1:	8EFF24ADBC047FE52DAEE4BB29AAF4D0858E90AF
SHA-256:	FA1E36B973701398615FEACD3AED2D98CCA257C9A0FF669A5179820F6A6E492B
SHA-512:	25DCE25FE8CA731560E3564874A45BABDBC38CEAB5E01F3D7002EACE75E61D8D4DE229509B0DD7797D412D284B9DE8A84A991A833EFF16284E6D69BAC75AA421
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....E.-.X..D.7. i>....130801022923Z0...+.....7.....0...0....R8.6.6.F.2.A.E.8.0.9.F.E.F.D.C.5.7.7.3.D.E.1.5.2.7.B.1.0.9.8.A.A.E.E.8.7.E.D.9.6...1..e0:..+.....7...1,0...F.i.l.e........l.x.p.t.i.d.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........o*.....w=.R{.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\lxptsmb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.514182950631902
Encrypted:	false
SSDEEP:	1536:PIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/93:7q
MD5:	8A9D102A05B758D1C120892ABB4D6AB5
SHA1:	233D9BF1051C79E92BD42E24AC45CFDF494288F1
SHA-256:	2290681817281618ED85193765FF6E5F8F4E78A8F92F853EC9D7C97AD2BF6F55
SHA-512:	D20A9E7EC95C8F55B4D05C0ED99F8820BD5F61919DA094519B09948769E13EBB4F00B91105D30AC82833260F59D935DED9C6654B75F792EBF35C3A74732533D8
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7........D.U.F.3..Ljz@..130801022924Z0...+.....7.....0...0....R7.A.0.8.E.0.F.8.2.E.6.B.7.E.3.4.A.D.6.0.5.1.3.4.B.D.9.2.3.E.9.0.3.C.8.9.3.B.F.4...1..e0:..+.....7...1,0...F.i.l.e........l.x.p.t.s.m.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........z....k~4.`Q4..>.<.;.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\lxptusb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.514043749124207
Encrypted:	false
SSDEEP:	1536:XIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9j:zC
MD5:	DCBC02A73C034147AD86098C97273C67
SHA1:	3E30EDB6AE1C820E34DA1AA722200A2AD51F971F
SHA-256:	B439C529C64D49B187BEE76619415C07CA99C13214D1D3992EFD1A80597EC8F3
SHA-512:	D36148D6FF13E4D6202A2DF3817E028098ECC8339F971A8E6FA97C7C71BE02416E0F604E4EBC1810CBA3AE1C8917593BD6218FECD8EFB23B492ACFAFA0D66700
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......MX..JoK.>K.Vf...130801022924Z0...+.....7.....0...0....R4.A.C.0.F.F.1.C.A.4.C.E.C.0.0.C.4.9.C.2.C.3.E.D.5.9.9.D.9.4.F.8.6.8.0.D.E.A.5.D...1..e0:..+.....7...1,0*...F.i.l.e........l.x.p.t.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........J.......I...Y...h..]0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\lxptusb3.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513679617058208
Encrypted:	false
SSDEEP:	1536:OIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9Y:c7TR
MD5:	FE07F44EB8DDEE817A8C7DDE7E4BEA82
SHA1:	ECB9B45C871080050382A148DDE21B6BA34EA1C9
SHA-256:	028A109A4B6F173FDA347AC13D8F7C7C9891EEAD55F4A8EDB302E651CC760990
SHA-512:	6AA730AC3631519DA935FEED822F2F54A60AE86242E070016AEEDAE2ED4C290708E3271F7CCC16CA7DBD49D1A9EEF8FAA1DB7376C81E4BDE960437E93DC39AD1
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....]..i0..N.7...X%{..130801022924Z0...+.....7.....0...0....R0.F.E.F.7.F.D.D.0.9.D.9.C.A.F.C.A.2.3.B.A.D.D.5.0.3.2.B.6.5.2.3.D.3.0.F.D.2.0.7...1..g0<..+.....7...1.0,...F.i.l.e........l.x.p.t.u.s.b.3...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.................;...+e#....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\nehalmex.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513641824911754
Encrypted:	false
SSDEEP:	1536:1IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9D:he
MD5:	C8D964C47A992C028B70DF461754F61B
SHA1:	38FE001696E68D27C6B86CEE3A14E207994B6A71
SHA-256:	88B290BFC9963F5049B80D996363A8DF0DA8732CBDEC0C4F3925EE4D0A5B33EF
SHA-512:	A978BC72523C84D9C8A50E5FA1F379A51C4DC61BF0E09F22AA38A9BFB5E1381A168391546E48E8D3D4B894944282448EF74E46CCC9BCD61CFB72351C932A34EA
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.....G..H..J...x+.[..130801022924Z0...+.....7.....0...0....R9.6.6.E.3.A.7.1.0.6.B.1.F.B.E.7.7.F.F.2.F.A.4.D.E.9.9.8.7.5.9.0.3.9.8.5.1.D.9.0...1..g0<..+.....7...1.0,...F.i.l.e........n.e.h.a.l.m.e.x...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........n:q.......M.u.9...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\pantahci.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.512783810174099
Encrypted:	false
SSDEEP:	1536:uIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9X:8K
MD5:	7BAA5D4D0BA9AC10D8FCD693831BFFB4
SHA1:	00226182490CEC21AC33D9F05A524165ED7AFA5E
SHA-256:	6C31F0855ED9EE77DF2F0E0DF7701F37331EA66FE32F1D6CF21E79C210216407
SHA-512:	2BD25F5C3545660FE13325C3CC08483625EDF439DEBB9592AD607E64DA633B6614E693F689451457A70D807C09697D2B2C0D6444479396D29C14B7C185613A82
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......@ab.JA.m...5...130801022924Z0...+.....7.....0...0....R4.6.0.8.0.0.B.D.6.D.4.5.3.4.4.2.3.5.4.1.7.A.6.F.F.0.3.5.E.E.D.5.A.1.8.F.1.0.D.9...1..g0<..+.....7...1.0,...F.i.l.e........p.a.n.t.a.h.c.i...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........F...mE4B5Azo.5.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\pantcore.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513834276233813
Encrypted:	false
SSDEEP:	1536:fIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/97:Lm
MD5:	1D6B07B61EAEF14121728223EA97E57A
SHA1:	15013C4580EDD5B0D816C08F7DC12BA76522681F
SHA-256:	9B9D9AA7BBBEABD37D684B91D10485EB6E26C55D9077A258B8D1ABCD22DF0503
SHA-512:	8252E4E482893271047E553425645BFD1D0429241585CAD9D38C77BCA4DE01E8557E8149D1724DF4E9739D8C3964B25FBA8344247423820D1962D26C0C8FD256
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.........IW@....V..Z..130801022924Z0...+.....7.....0...0....R1.2.2.E.D.B.9.6.1.C.5.8.5.4.4.5.D.E.5.0.E.3.D.A.1.7.B.2.F.9.5.9.8.2.1.5.C.C.0.7...1..g0<..+.....7...1.0,...F.i.l.e........p.a.n.t.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+............XTE.P.....Y....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\pantid2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.514428523744979
Encrypted:	false
SSDEEP:	1536:+IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9R:MU
MD5:	508A071A3A26B7A9BEC0F61E89E4BBD0
SHA1:	0312AD015C24297FF73F851EB5654E0FED0710DD
SHA-256:	13FE2AFB591B3C980DCB8F9D1E41E9B96B19FE536807A72FAD53E281F6BADE62
SHA-512:	9C4EE7D41E11FD98BF1C362E28FA9DE0317DF3A5871CE6C0E9E2DB85BBDD781F103361C1A2F63EB835196B7FF0E159CC070C33A2BFA311573F5CF9BE3E06F8B4
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....0...rp.F....$._..130801022924Z0...+.....7.....0...0....R9.C.E.8.6.B.1.0.6.5.0.5.9.A.D.C.1.E.C.7.F.B.8.F.9.7.B.F.9.7.1.E.D.F.A.4.D.3.2.1...1..e0:..+.....7...1,0...F.i.l.e........p.a.n.t.i.d.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........k.e.............!0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\pantide.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513786184240789
Encrypted:	false
SSDEEP:	1536:iIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9W:QL
MD5:	1718A0136F9F10D530B2FE272D1BFA91
SHA1:	F50503EFC3429146A2227B33D204B8566179FEAC
SHA-256:	1FB03AC2C376919307360736F0CED98C8DC8B07FA386CBE7CB2BACD243B5ECFF
SHA-512:	36796E9FF8EBA61349FCD19A7E81DEB9DF750D6BACF5065E7DE0E936535B1D92394E8F3A5B96D89164831DD86DFBD1EC81C3053F176023CE5D84BE7975F98D67
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......V.7.B.I...!..A2..130801022924Z0...+.....7.....0...0....RF.A.1.0.7.8.C.F.7.1.D.C.9.7.A.0.E.2.6.1.2.C.7.1.9.F.A.F.9.D.C.2.E.0.F.6.1.7.4.0...1..e0:..+.....7...1,0...F.i.l.e........p.a.n.t.i.d.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........x.q...a,q.......@0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\pantsmb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.512855492734815
Encrypted:	false
SSDEEP:	1536:rIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9l:3A
MD5:	5D07574BB89B13EADE2DAE8FFA5A4DE0
SHA1:	C52DB5E10E35A7D8E57C6DC613BF755F51183837
SHA-256:	B36783477EAE088B1DD24B0E7355429927769ED8DCC5E619FBF40E7A43052CF9
SHA-512:	7958478443F12CD8C3142AA4AFBE1AE4357FFAFB67B20767166A1738400A8009258879E6A8151AEF6AE050F1B3A683884022F92909DAD199F97A451F7B97A3C9
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....x..V.CI.kK.Jb....130801022925Z0...+.....7.....0...0....R6.D.C.3.2.6.7.8.5.D.1.A.5.E.D.0.2.6.1.3.5.4.4.3.9.A.2.D.8.0.6.A.B.D.A.E.4.B.6.2...1..e0:..+.....7...1,0...F.i.l.e........p.a.n.t.s.m.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........m.&x].^.&.TC.-.j..Kb0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\pantusb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513292819167988
Encrypted:	false
SSDEEP:	1536:zYIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/V:z+2r
MD5:	62570DF85A149ACFFFD7843E86E3E948
SHA1:	75737C10A0F578A589AA3A29AD9C9911A3CE8200
SHA-256:	0F5FF862C563D32595BE3FE1864C05E8F7A9482BF6C5792D62CD82435A7FFF9D
SHA-512:	63E0F0D328BA662460788624BF83F5179CFEB6A99D18E60E31FFB048B98502FA6F2DDDA099BD6E8941289AE451B477BD7D7D22152F0D55486DECB5125F5E73BB
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7........{.".A..q.1{....130801022925Z0...+.....7.....0...0....R2.E.4.3.5.8.8.3.5.4.D.6.C.5.E.D.9.C.6.F.F.1.7.3.1.9.C.A.F.D.0.0.2.D.7.4.B.8.F.B...1..e0:..+.....7...1,0...F.i.l.e........p.a.n.t.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........CX.T...o.s....-t..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\pantusb3.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.5138355755117585
Encrypted:	false
SSDEEP:	1536:DIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9q:/L
MD5:	EA2D0AC9A544D6B8628A593690C06102
SHA1:	D0AD7847FFFFB8E7F4E9129C8A9DEC7D6C93A042
SHA-256:	B981E91BC0CCD083C94F15A3FE38E470D1CF6624BA0382566CD697FF324718D1
SHA-512:	D26068E9D58A01B9B32EA70F26D93B7DB84669FBEF34925F42567397C95104CFB82B52A875172F7197A3805EF7B2E06D0CD0AFB87B474D8CBEBA83D7B8A75DA1
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7......G.@..G.....<.I..130801022925Z0...+.....7.....0...0....R8.5.C.C.5.3.B.0.7.1.2.9.E.8.2.3.2.5.6.7.6.4.9.D.C.7.5.2.8.3.1.4.5.4.7.F.0.D.9.E...1..g0<..+.....7...1.0,...F.i.l.e........p.a.n.t.u.s.b.3...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........S.q).#%gd..R..T...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\patahci.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513668465128195
Encrypted:	false
SSDEEP:	1536:UIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/90:aQ5w
MD5:	052AFFD04909DC8486C7C84C32E58F62
SHA1:	97A76A957F49084379551D879A2B54D4F97591D5
SHA-256:	7CCC10EA509F8DD6FE34D626F5B4F8E6CCE53474CF15855DA3058F7DE8DF1C37
SHA-512:	FDD57265235067CE3BCA02CBBA2EAFFBE6EC7E3685DB52E8DC8EA97BBD39074A2E592F6699F87E19A6D7888B9FE7A1BDFEB16BEADE92BC811FBC5E51E32DD623
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.......$.rtgI...{\....130801022925Z0...+.....7.....0...0....R8.D.C.6.3.6.E.6.3.1.6.E.A.4.9.A.1.8.C.E.E.A.F.A.7.3.0.E.E.1.D.0.0.0.3.D.B.D.D.A...1..e0:..+.....7...1,0...F.i.l.e........p.a.t.a.h.c.i...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........6.1n......s....=..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\patahci.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6370
Entropy (8bit):	3.3759395793655207
Encrypted:	false
SSDEEP:	96:RG8EQ2M/1z+VwB5SbmvqzalPJCFVWPOHSdaQ+wMy:DjptgErTlaQ2y
MD5:	0CE57DCD3451B531E7C1D06A317B42ED
SHA1:	8DC636E6316EA49A18CEEAFA730EE1D0003DBDDA
SHA-256:	75A73C06404E9247E2F020E21501F82E7357D8D376EC4683AA764DDA3723A171
SHA-512:	40615E3C4D07E603D6B8C698A5A19CF617DB0B7F7AC7A08065BA9A6F00C2DBCDCDE3A99F0F1D4FB182FADB264F92F3E3B6EA46E3219947EDE3F3B6A52D6ADC4A
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .p.a.t.a.h.c.i...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...3. .B.u.i.l.d. .1.0.3.2.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\patcore.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513618862789318
Encrypted:	false
SSDEEP:	1536:6IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9S:47
MD5:	20B8824B739720E297E70ACA45931A6C
SHA1:	9921943A6225F21AB73D2429A2B870EF7F662DFE
SHA-256:	F69753C933994E4BBA1BD88666D5AB672FE0862746501D68918CEAF03CB058B1
SHA-512:	62F94029DE5B6EC55371AFF6F32140A34B5EE9BEA986F51B8DE03E9CAA7F72EC155A0920275FED274AA8336CF7C8A0B95485DE51F081B4463A752AE18CACA25D
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......N.y..HN..8..$f...130801022925Z0...+.....7.....0...0....RB.4.0.6.5.5.E.E.B.1.1.0.B.9.F.7.D.5.5.8.4.6.9.9.1.2.2.A.A.4.2.F.5.F.2.6.1.8.C.D...1..e0:..+.....7...1,0...F.i.l.e........p.a.t.c.o.r.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+..........U.....XF..*./_&..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\patcore.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	19078
Entropy (8bit):	3.688496887228576
Encrypted:	false
SSDEEP:	96:R2FF2M/1z+VwB5zYkBxR2YkBxRt8c2P4UKeeJJjEGj9KtqAsvK1Kn/x+/q89asBn:yFptgE3xsxFPI4WTTlaQ2y
MD5:	78BE0B6895CC9C710ECCA1B51491D498
SHA1:	B40655EEB110B9F7D5584699122AA42F5F2618CD
SHA-256:	644A6003FBC86D3419291BB60E78EB2ECE69FF2D6D64EFD32CD25A0CC10C5768
SHA-512:	C19BD070F1FC37BEB6D09ABC0C35730934D9AD3CDB0BCB0762FA9B65235F8104E9AEFE73F12D00AB9093483CC92A91F78F960464E9F7D3726A9A526CB82AE786
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .p.a.t.c.o.r.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .S.e.r.v.e.r.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...3. .B.u.i.l.d. .1.0.3.2.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\patid2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148363
Entropy (8bit):	4.513626115825693
Encrypted:	false
SSDEEP:	1536:FIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9Y:xt
MD5:	0B5048AC772498692AE1AF49294BF7DC
SHA1:	18E2CD143A29B86A60308244A049E56D7C5A027E
SHA-256:	FBF6EF237AA0F1A8C8F4EA3DB6BDDC11208982409BB883A5DB659E7CAA4F211B
SHA-512:	28D1CDB9D07DB9BBF2F6A37265CBCC49E9FE0265C6A78F4F60BC261FC30AC242AAEC3B11C16A5BC4DA85856C258EC7B56BAF54553BFFD10271D24CFC0589FBA9
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cv0..Cq...1.0...+......0..(;..+.....7.....(+0..(&0...+.....7......{..p.ED..O.(R.K..130801022925Z0...+.....7.....0...0....RD.C.7.D.0.D.B.7.6.3.B.E.0.D.0.A.B.F.A.7.6.F.4.E.5.1.8.4.3.5.1.3.2.B.6.E.0.6.C.2...1..c08..+.....7...10(...F.i.l.e........p.a.t.i.d.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........}..c.....oNQ.5.+n..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\patid2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7518
Entropy (8bit):	3.4778524284328567
Encrypted:	false
SSDEEP:	96:Rq2hU2M/1z+VISwmQwmiuBPckB1XfcuCfJalPJCFVWPOHSdaQ+wMy:dCptgImkB7TlaQ2y
MD5:	BDE0C72E56E43B681F9C0337662B0A47
SHA1:	DC7D0DB763BE0D0ABFA76F4E518435132B6E06C2
SHA-256:	FD17EE347F800AF79FFDA2E751537A0B3FAF77405D34604616273A6491555418
SHA-512:	7EB535C62BB2A025A53207A9FC9394F8D922DB2DB7A1EE423E30377295DBDBB33F58C0D9C18EADAF217C6EE82DF6B9997F71F67EFBF417BECE3DBDCF90CA54F4
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .p.a.t.i.d.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .a.n.d. .2.0.0.3. .S.e.r.v.e.r.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .I.D.E. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...3. .B.u.i.l.d. .1.0.3.2.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\patide.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148363
Entropy (8bit):	4.513025547601642
Encrypted:	false
SSDEEP:	1536:3IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9U:T5
MD5:	5B31E63BA435B08B3905E531946B99FE
SHA1:	AB546A7592FF45D70FDE81C59B2CAB2082B5C2D2
SHA-256:	049B8F7D95BAFA6B10F3D3CCD80C517B2B2FC6E3D245E0734E3086BAA30FB999
SHA-512:	A6EAAE2EADAD2082F46A3C12D5D52F8E3133C831AA70550552FFDC0803412785BFD0567A3DAAFD233851E87128050331D0FB18895D0D54433DBDB2178806153B
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cv0..Cq...1.0...+......0..(;..+.....7.....(+0..(&0...+.....7.....+.]...J...,j.....130801022925Z0...+.....7.....0...0....R9.D.8.B.8.4.2.1.D.6.B.8.5.7.7.7.7.0.3.A.E.4.D.0.8.3.6.A.A.5.C.2.2.C.E.9.7.4.8.3...1..c08..+.....7...10(...F.i.l.e........p.a.t.i.d.e...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........!.Wwp:..j..,.t.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\patide.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6926
Entropy (8bit):	3.4170980333186702
Encrypted:	false
SSDEEP:	96:Rl2hL2M/1z+VIgkB1XfcuCfJalPJCFVWPOHSdaQ+wMy:CdptgI/7TlaQ2y
MD5:	D91FE38B4619B2DD16E8CEB8C8987224
SHA1:	9D8B8421D6B85777703AE4D0836AA5C22CE97483
SHA-256:	47F022E0EB5C822497E2BD7D1A951979F97E7EC440B4A4FC72113347B39B3817
SHA-512:	43AD2D773276004531EB7146958D31BAB896801BC73214A5734BAD94B7EE9394B8C242FB677F48DF716265B5DCAA04ED75AE6328807B68C84FE0914CD5EF8455
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .p.a.t.i.d.e...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .a.n.d. .2.0.0.3. .S.e.r.v.e.r.,. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .I.D.E. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...3. .B.u.i.l.d. .1.0.3.2.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\patsmb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148363
Entropy (8bit):	4.51382330465323
Encrypted:	false
SSDEEP:	1536:cIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/99:SI
MD5:	73ABC50BF7EBEEB3162D6BBCEBE4D57F
SHA1:	91A3557903FA14E7CB70C3DDA4A366663FA1627F
SHA-256:	6C49574DB2589526E2D4C72222B6ABED08108AEC5FE4D074E49C1A429693BB69
SHA-512:	235DA01C84776BC685B8F7070CE86F6ED94BF9BF4B27BB9B0CD69CDED0594E05DB9A1D175824CE966D42D16EF4133384B519EA57E41785669EC8551ABA0A9F63
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cv0..Cq...1.0...+......0..(;..+.....7.....(+0..(&0...+.....7.......!v...E.I.......130801022925Z0...+.....7.....0...0....R3.F.F.F.4.C.B.6.9.5.2.2.3.C.9.A.9.A.A.8.A.7.3.3.5.C.7.0.9.6.4.C.0.E.4.6.4.F.3.6...1..c08..+.....7...10(...F.i.l.e........p.a.t.s.m.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........?.L.."<....3\p.L.FO60b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\patsmb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7740
Entropy (8bit):	3.51968959192463
Encrypted:	false
SSDEEP:	96:Rpsj2M/1z+VwB5uU2Tuyu0uualPJCFVWPOHSdaQ+wMy:EjptgEFTlaQ2y
MD5:	E1AD4D0821CE59975FCE4F2DFE301EDF
SHA1:	3FFF4CB695223C9A9AA8A7335C70964C0E464F36
SHA-256:	85A2C075B7F7F60E2F954E51803952C6C7E60B8F4621A3940A76C181818BFA76
SHA-512:	89359B8A631301B66DA7CC4972F2A7CA152A9DC1E5B91FE345FBCCDAF06081D63BE903B26031CEFCDEE8018D02B99907BFD7EDF44EE2C1479BECC30CE2A9AA79
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .p.a.t.s.m.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.K.,. .X.P.,. .2.0.0.3. .S.e.r.v.e.r. .I.N.F.,. .V.i.s.t.a. .F.i.l.e. .f.o.r. . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .P.a.t.s.b.u.r.g. .C.o.r.e. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...3. .B.u.i.l.d. .1.0.3.2.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\patusb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148363
Entropy (8bit):	4.514578844944956
Encrypted:	false
SSDEEP:	1536:AIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9g:2Z
MD5:	A7D5E7BF4BB4C8909A4DD21760980FA0
SHA1:	95B690EFA53BE4C89B67E6882F6BCB35B4D47C9C
SHA-256:	C7DC0E6D0BBAD6BFBFF7D4B1AAC30435DAE0CF16E93FC848A0084AC39BEC7A89
SHA-512:	2A4618E76F469C2932E6AA9097A58178E9186BB5DF3251719F1112B6DA4A75B3E712E7E8C3231C61FE56C030F2D7F1869D232D9BFEE23941F7B20145FF318F04
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cv0..Cq...1.0...+......0..(;..+.....7.....(+0..(&0...+.....7.........,7C....W....130801022926Z0...+.....7.....0...0....R0.3.1.A.8.F.2.6.A.2.E.B.6.B.C.C.4.A.8.6.E.4.E.B.5.3.A.C.9.B.5.3.9.5.A.B.8.E.B.3...1..c08..+.....7...1*0(...F.i.l.e........p.a.t.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........&..k.J...S..S....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\patusb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7846
Entropy (8bit):	3.5106013972990375
Encrypted:	false
SSDEEP:	192:1WtgEoEurUrghdkBdrdNL9NrQNgTlaQ2y:1ygEoEurUrghdkBdrHLnr+gRaQF
MD5:	1FAF6852B794A3B7DEFE8A3F34BDDE4A
SHA1:	031A8F26A2EB6BCC4A86E4EB53AC9B5395AB8EB3
SHA-256:	E23DFB9673894E4033616EF8A80262CD6D75CDB189D9B59990A33C06786BFD95
SHA-512:	288B1BBF88B3BE3295332F07524BA31D8D064B794971003B57507183294A05542DA890C76CF7FA2AB416105686AA23815B9EC1F04E86494796C2D7225366958E
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .p.a.t.u.s.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.0.0.0. .a.n.d. .X.P. .I.N.F.,. .2.k.3. .&. .2.k.8. .S.e.r.v.e.r. .I.N.F.,. . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .U.S.B. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...3. .B.u.i.l.d. .1.0.3.3.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\snb2009.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.514448576389999
Encrypted:	false
SSDEEP:	1536:EIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9L:Kf+
MD5:	9DA5CF293C99E1B925B29A2C056D51D8
SHA1:	872D8168BC731E13703A0B1700C73F3BB5AA988C
SHA-256:	94AA7CFA13F8979999D7D41D2592B0CFA3650152E6F6E992D1CBCB6CFE222706
SHA-512:	D27773070BAB98E08C87C2ECFCBB6367D194308C620CF9261156E67A9EAC85F1A1D42C05F6DBEC9FE6C3A7EF49325753A9E681B7E42F38EACD25C352A9F6BA96
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....O....f.G..U.0A!c..130801022926Z0...+.....7.....0...0....R3.2.1.7.B.9.A.8.2.A.0.D.A.6.5.4.0.3.C.D.B.C.1.2.0.1.5.2.1.A.5.A.8.9.C.A.3.0.B.0...1..e0:..+.....7...1,0...F.i.l.e........s.n.b.2.0.0.9...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........2...*..T....R.Z..0.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\tcreek.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148363
Entropy (8bit):	4.513010177891821
Encrypted:	false
SSDEEP:	1536:EIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9W:Kn
MD5:	2DD156C58A89232A3E43E3A47F4ED2BE
SHA1:	8EAFFDAAEBADF2D8EA79B745F36E596C5375C76D
SHA-256:	0E49B7BF3422D0D21ED3482B6B5B806A48C872E3E418EEA2B0CACB491D27DE12
SHA-512:	F51B273044299520C3E5F679C45A078F3BA8654D2968EBB69C3CE785668BD752B6510FB5E2C765716C7C2849F6127D2B904B3F307984C755ACE0BFD98281F475
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cv0..Cq...1.0...+......0..(;..+.....7.....(+0..(&0...+.....7.....h>..h.M.....Nx...130801022926Z0...+.....7.....0...0....RF.3.E.9.E.9.B.7.E.8.A.7.0.F.2.6.D.C.E.7.F.5.F.7.F.D.8.3.A.4.0.D.0.1.1.B.D.4.B.D...1..c08..+.....7...10(...F.i.l.e........t.c.r.e.e.k...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.............&...........0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\tcrkahci.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.514039217958842
Encrypted:	false
SSDEEP:	1536:rIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9A:3B
MD5:	1A7D1E225B95B5D7902328A6942849F0
SHA1:	AFAE3128C48930A284AFA6FF8D97AEC06F4DC67E
SHA-256:	99EC18963C6496852A76660AC48CBB42B8CB64C3BB024862EDFBC0AEC4BDA3D2
SHA-512:	8DCAD9B3FD90611FD6BE5CF025C8F166AC34CE77032C0A19EE8C12B50B5B6EBD91811E581EE3AF3B895F1E06BE3D9AE4365785BCEE763E4DC2C3CB3F93A500B3
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.......8.8wI...t^.pp..130801022926Z0...+.....7.....0...0....R0.8.8.9.B.C.C.2.A.2.1.F.8.B.8.3.E.B.F.1.3.C.7.A.2.D.E.B.9.9.2.2.B.7.B.6.5.2.8.5...1..g0<..+.....7...1.0,...F.i.l.e........t.c.r.k.a.h.c.i...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.................<z-."..R.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\tcrksd.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148363
Entropy (8bit):	4.512773000013317
Encrypted:	false
SSDEEP:	1536:uIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9S:8/
MD5:	DD82F473798C5833604F16566A3E6BAC
SHA1:	7CC63C88014184FFE09284636B4D8F068BE599B3
SHA-256:	05DBECE9E22396317074B20A374D425699A4183F3DFE0E2ECEB8D16369CE8EA6
SHA-512:	16ABBD4457E4D5D866C3DD1B94B92EB40671BF545FB546A79B5F08D47753342223CA0180617AF1442E0FBF591BA30F30D6F1189686330A9C1E1243D94E8680EE
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cv0..Cq...1.0...+......0..(;..+.....7.....(+0..(&0...+.....7...........B....H.I`..130801022926Z0...+.....7.....0...0....RF.0.0.B.F.8.6.4.4.4.0.7.2.9.1.6.B.2.B.D.3.9.9.D.7.C.7.3.D.D.E.C.9.2.C.6.7.2.5.4...1..c08..+.....7...10(...F.i.l.e........t.c.r.k.s.d...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........dD.)...9.\|s...rT0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\tcrkusb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.51353385072559
Encrypted:	false
SSDEEP:	1536:zIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9p:vA
MD5:	BBD63948628F6BBE40557CDE361EF30C
SHA1:	AB02815CD04A3FE77404AD37BB950753AA6DCA06
SHA-256:	F2DEFE69E1ADC170602D7FEEB763D5629885293BC7D4BEA73B08A134F5E3E17F
SHA-512:	C3F7BFAE7B62D8FAF20DC581D092B2B31FA454D3B76E3BBD9EACEA863B171C2ECD2FEF40C08635A405B91608888B2B00AD47B67E155B9F59DB5DAFE4F0580FB3
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7......F..99.F.xV.\M....130801022926Z0...+.....7.....0...0....R1.7.8.B.D.E.9.3.6.A.7.0.D.8.7.6.2.5.9.8.8.1.6.4.D.8.D.A.6.4.1.1.F.5.6.6.6.8.8.0...1..e0:..+.....7...1,0...F.i.l.e........t.c.r.k.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........jp.v%..d..d..fh.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\tcrkusb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	12552
Entropy (8bit):	3.6601571804572814
Encrypted:	false
SSDEEP:	384:cNgEvdnB79E9QwmsSQL+qwmsSQL+HhdkBdJlJFpwiHLnr+bRaQF:c6HCcF
MD5:	CA56FB297EA0F8AB37E3CDFC58302187
SHA1:	178BDE936A70D87625988164D8DA6411F5666880
SHA-256:	3172945D544D0F6DD5A68DD48F44C27CEA0C432BD4743BEA6881E613EF287173
SHA-512:	48F7A3EFF760A736B4D1F0FC53D038847C9F7BFCD52D8B9E464FACCF4A5B14CA29CD559F89D23CB79F99772571C1D83C6CB3201C9D380069067BA4A6A9B7CAFF
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .t.c.r.k.u.s.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .I.n.t.e.l.(.R.). .P.l.a.t.f.o.r.m. .C.o.n.t.r.o.l.l.e.r. .H.u.b. .E.G.2.0.T. . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...1...9. .B.u.i.l.d. .1.0.0.6.). . . . . . . . . . . . . . . .......;. .............................................................................*.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\whtpI2C.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6920
Entropy (8bit):	3.481029050519518
Encrypted:	false
SSDEEP:	96:R7dfwM/1z+VwB5ASXujalPJCFVWPOHSdaQ+wMy:vztgEJTlaQ2y
MD5:	E495D0157D8245AA0DFFDE923FAA3E1D
SHA1:	AB306CD85D81ABBA805D2D441CDF71CB4D2CEC62
SHA-256:	CD170474AC3FE5289870ADE63FE21D4056A496AA5C075584FDD6B0206BD548DE
SHA-512:	5751E8E6B378204F89A08379E7B933D28FA42E8D6F04F48C78C0D4B0701930E3CF4DD1D522D929BCED0CB71A1304439CEF0BC8F2664DA9CCDE4E8C145651C700
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .w.h.t.p.I.2.C...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .f.o.r. .I.n.t.e.l.(.R.). .S.M.3.5. .E.x.p.r.e.s.s. .C.h.i.p.s.e.t. . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\whtpI2C2.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6338
Entropy (8bit):	3.411702904545476
Encrypted:	false
SSDEEP:	96:RBdVwM/1z+VwB5OKm3alPJCFVWPOHSdaQ+wMy:PztgE3TlaQ2y
MD5:	77746201806558AD0D4BD5A92433B628
SHA1:	DF9CB30137B3EE3985B4A6287ED5D067B28078C6
SHA-256:	C2B341284D91423878C0AB62AB886C963A4925775003D6CFED0608869F2C336D
SHA-512:	31921AFE868577EC50445E9346843D318DE064791C4EB2B6DE259E31A21A8DFBB4920B356C5A40A83154C11AF7F4C810CACEEF52E2E36CF8FD2EBE386E6652AB
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .w.h.t.p.I.2.C.2...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .f.o.r. .I.n.t.e.l.(.R.). .S.M.3.5. .E.x.p.r.e.s.s. .C.h.i.p.s.e.t. . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\whtpi2c.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.513666212304721
Encrypted:	false
SSDEEP:	1536:ERIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/F:kC
MD5:	003CE3936B5961E3AA0526694C84BFBC
SHA1:	36952612168295204360B6C94992E85BAFF466B4
SHA-256:	C4ECF8E6A7C92A94835A45E27104BD96AFB0FB3763FCAC9641E83910910B0825
SHA-512:	53D2F14152B2D2261A487DD48B91AF60FA1DB7CE8E09EF3F09F15AB614DF6E0BF632FDB78EE21AF6C9C8B474D3C3B231DD66F14D08931CD0F252F0733DF5A841
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....E.!r...H.........130801022929Z0...+.....7.....0...0....RA.B.3.0.6.C.D.8.5.D.8.1.A.B.B.A.8.0.5.D.2.D.4.4.1.C.D.F.7.1.C.B.4.D.2.C.E.C.6.2...1..e0:..+.....7...1,0...F.i.l.e........w.h.t.p.i.2.c...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........0l.]....]-D..q.M,.b0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\whtpi2c2.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.513382863678816
Encrypted:	false
SSDEEP:	1536:bIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9Q:n5
MD5:	FECFD599CD6BC660063E7C546241C909
SHA1:	4723FA9D7C8EBF73FA90B45509EEE0AED2EC3816
SHA-256:	6444345EF97CD44C8776BC7A7108BEF84476542C3A6B455EB43FCBFDB06FE99C
SHA-512:	84E00BDE1CA465503DA872991DAA95609DC2D7993288C7E999F4FA1A8590BBEC74BF2674A2A839E58DB0793C144D039BC7F021A826114F9ADD7C38E3BD6520D7
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.......j...N...u.....130801022929Z0...+.....7.....0...0....RD.F.9.C.B.3.0.1.3.7.B.3.E.E.3.9.8.5.B.4.A.6.2.8.7.E.D.5.D.0.6.7.B.2.8.0.7.8.C.6...1..g0<..+.....7...1.0,...F.i.l.e........w.h.t.p.i.2.c.2...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........7..9...(~..g..x.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\whtpoint.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148367
Entropy (8bit):	4.51411165208097
Encrypted:	false
SSDEEP:	1536:PIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9s:7h
MD5:	466645854058983CC34ABF927CA44CA6
SHA1:	F0CD624117BB30C24BFE0F29C37127EA017F6A1C
SHA-256:	7A0776DDCAF6E742152CA5DBA69635E6BA4BC21DC831B8C9053F3497E723A53D
SHA-512:	4E13E0206D503B85823D4CD88C4B43A017F1D1616459D14E7128FBCBC27B0EFA935E0DF209A8C772310A44814FC93FD7621988FB729025753152DB09FD54AA3B
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cz0..Cu...1.0...+......0..(?..+.....7.....(/0..(0...+.....7.......<...4L.q.=.....130801022929Z0...+.....7.....0...0....RF.C.B.5.9.9.D.4.B.5.8.8.5.9.5.6.3.C.7.D.2.5.D.A.8.9.5.C.D.4.1.2.4.5.B.6.B.4.F.0...1..g0<..+.....7...1.0,...F.i.l.e........w.h.t.p.o.i.n.t...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.............YV<}%.\..E...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\whtpoint.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	10246
Entropy (8bit):	3.6313861807521914
Encrypted:	false
SSDEEP:	96:R/ewM/1z+VwB5x9x7X9xcf9x7X9xO9x7X9xNzExn6nH2jkFCin2Agr+tBsalPJCs:gztgECWTlaQ2y
MD5:	76EF74772844E50734F26782FD550C3C
SHA1:	FCB599D4B58859563C7D25DA895CD41245B6B4F0
SHA-256:	9F35ED69003AB550CCB681BA12616A2D62A3EF6C816BEB715944B1DA02936F8F
SHA-512:	86AAEFC26959840C8ADAFD9F23005DA9D1C9537BDF005BF2150BE3C0E4AFF56128128C874883F9035613B15C4FCBF5896A611B9BCF68E5F7D59C240210396CFD
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .w.h.t.p.o.i.n.t...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .f.o.r. .W.h.i.t.n.e.y. .P.o.i.n.t. . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\whtptsd.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.5133814950725695
Encrypted:	false
SSDEEP:	1536:3IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/96:T/
MD5:	3D416CB331B1D4BFF4419C7C64122DCE
SHA1:	F34596E6149EABDDC606F3C58C762F62F6DC2F8E
SHA-256:	0E88983650DE53EBD700FBEDC6C3D4C9345CD24D5AE65DA37255454B3F74DD7B
SHA-512:	A18E28A73B2CB24BCDF6F58D5B75892593B74CE4E16B07B8DC6C243E5B9EAE6C876F6C61D93D43D455847A0D938743AC242600E51B227AE7C191C53A2401E69A
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.....A`.mA..O..I..4R...130801022929Z0...+.....7.....0...0....R2.F.D.1.2.3.C.5.C.7.1.6.D.3.2.2.9.7.1.6.D.7.4.4.9.C.8.9.2.0.7.4.8.9.6.B.D.0.1.B...1..e0:..+.....7...1,0...F.i.l.e........w.h.t.p.t.s.d...i.n.f...0E..+.....7...17050...+.....7.......0!0...+......../.#...."...D.. t.k..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\whtptsd.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7802
Entropy (8bit):	3.5192713045369355
Encrypted:	false
SSDEEP:	96:RIMwM/1z+VwB5DJLNJ/JT8xxcV6JalPJCFVWPOHSdaQ+wMy:tztgEpTlaQ2y
MD5:	B801CCD79E91E1C649772DA44066C004
SHA1:	2FD123C5C716D3229716D7449C892074896BD01B
SHA-256:	A4C79375EFF4FA88DDFF861DD5433D35C96E927560FBE828040767A380211472
SHA-512:	A8AADFCC3B16B3983663D51C8FAC7F9A8D0A7B5EAE99E8FCF8A389F8F1C5BC77E7BD3C820AA111344F7C53A64530FB6325C20F1C8301C15FA1A6B25077E430D9
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .w.h.t.p.t.s.d...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .2.0.0.0. .a.n.d. .X.P. .I.N.F.,. .2.k.3. .&. .2.k.8. .S.e.r.v.e.r. .I.N.F.,. . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .W.h.i.t.n.e.y. .P.o.i.n.t. .S.D.H.o.s.t. .d.e.v.i.c.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\wptahci.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148365
Entropy (8bit):	4.512691828097179
Encrypted:	false
SSDEEP:	1536:/IKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/9t:rBu
MD5:	AF78A4115CF50A1197EBD962344FC0AC
SHA1:	52AC138E9629D93EE769FCCCF71AF5F376D179E9
SHA-256:	F2DC140BABDD92F7F99EFFBEDAB2D64755D58C46E1DE3C4C7566496231B06155
SHA-512:	330FC8489F7A57BF3DEED4AD902275577A0F998EFFFBA80971449FB1267873E2F58F3EF891098099214402EF319D8DDC32A30956045F801E2A8D49A832ED20A1
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cx0..Cs...1.0...+......0..(=..+.....7.....(-0..((0...+.....7.......k.._.A....u....130801022930Z0...+.....7.....0...0....RB.5.1.B.0.6.9.2.C.0.5.2.8.2.A.3.0.7.1.8.9.7.E.7.D.9.C.6.F.C.6.5.9.E.8.2.2.D.8.1...1..e0:..+.....7...1,0...F.i.l.e........w.p.t.a.h.c.i...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.............R.........e..-.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\wptahci.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	6518
Entropy (8bit):	3.3671821134452786
Encrypted:	false
SSDEEP:	96:Ro8AOwM/1z+VwB55mDm4blRMBNalPJCFVWPOHSdaQ+wMy:tJztgEsTlaQ2y
MD5:	E13EE71CAEF5E107BDDAF087C7D677B4
SHA1:	B51B0692C05282A3071897E7D9C6FC659E822D81
SHA-256:	42041F9D084E4E53D5BF07B160D26CB85C6CC6BD3A33A34766AE57B851E36296
SHA-512:	1F41550BF7327F891F20073528F85EA6FC9FC7434A7975DDBE81644849982EF999651448487841BA3A2A101DCF648AB115E5595E1E6353846A561AF4F0FE48C4
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .w.p.t.a.h.c.i...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .V.i.s.t.a. .I.N.F. .F.i.l.e. .f.o.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . . . . . . . . . . . .I.n.t.e.l.(.R.). .8.2.8.0.1. .I.D.E. .d.e.v.i.c.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ..*. . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .2.5.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.3.9.). . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\wptusb.cat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	148363
Entropy (8bit):	4.5146037835911
Encrypted:	false
SSDEEP:	1536:oIKoPhnt/BH1vzWmSdAsuQe74dMjlndzyfYRpvJCSumvas33R4DMUgtdBZd9Z/91:Os
MD5:	7591596D1CC8FB76F7E504653C23783E
SHA1:	6368E92A0F6493A435C0007A3CE81104179F246F
SHA-256:	0A128E71674658F40C967370A3C775D58B81CB7218C2E92A27CD383FFB17340D
SHA-512:	A6921D6B147966AD4DB93131000245268630362A613AD0795A1470C062160D4FE59FE7AF7D8C89EE0A7B030094087C74F7AEBD91E44E982129BEA4C66B663182
Malicious:	false
Reputation:	low
Preview:	0..C....H.........Cv0..Cq...1.0...+......0..(;..+.....7.....(+0..(&0...+.....7..........S.B.M/.9..G..130801022930Z0...+.....7.....0...0....R7.C.B.9.1.C.7.8.A.7.9.C.F.D.D.5.8.8.D.1.6.D.C.5.E.0.9.9.3.7.6.2.C.5.E.9.F.B.7.F...1..c08..+.....7...10(...F.i.l.e........w.p.t.u.s.b...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........\|..x.....m...7b....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0\|..+.....7...1n0l...O.S.A.t.t.r.......V2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3......&.0..&.0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........5.0.0.0...0$..+.....7.....0....D.T.C........1...0D..+.....7....604...S.u.b.m.i.s.s.i.o.n. .I.D........1.5.9.6.9.1.8...0..F..+.....7......60..2...O.S........."2.0.0.0.,.X.P.X.8.6.,.X.P.X.6.4.,.V.i.s.t.a.X.8.6.,.V.i.s.t.a.X.6.4.,.7.X.8.6.,.7.X.6.4.,.S.e.r.v.e.r.2.0.0.8.R.2.X.6.4.,.8.X.8.6.,.8.X.6.4.,.S.e.r.v.e.r.2.0.1.2.X.6.4.,.S.e.r.v.e.r.2.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\WIN7\wptusb.inf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7670
Entropy (8bit):	3.521336131391875
Encrypted:	false
SSDEEP:	192:DVtgE9gy/Y/xhdkBdrdNL9NrQNoTlaQ2y:DXgE9gy/Y/xhdkBdrHLnr+oRaQF
MD5:	20E1FFE99BC6DBCE8545E52ACEC9F71C
SHA1:	7CB91C78A79CFDD588D16DC5E0993762C5E9FB7F
SHA-256:	2BBC35B6E4BAB5FFAF5FC7F10D473C0F81451C83E609EE9EA4F17CB2A8264442
SHA-512:	66C4D541E043E6790B5E0204F155EDC4A7BBA303AB6442EE37606C749737FE384B7F38BC4451855554BB3CF57052F98254BCA98357D93CA8278F5BFE4DD049C5
Malicious:	false
Reputation:	low
Preview:	..;. .....................................................................................;. .....................................................................................;. ... . . . . . . . . . . .F.i.l.e.N.a.m.e.:. .w.p.t.u.s.b...i.n.f. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .......;. ... . . . . . . . . . . .A.b.s.t.r.a.c.t.:. .W.i.n.d.o.w.s.. .I.N.F. .f.o.r. .I.n.t.e.l.(.R.). .S.M.3.5. .E.x.p.r.e.s.s. .C.h.i.p.s.e.t. . . . . . . . . .......;. ... . . . . . . . .L.a.s.t. .U.p.d.a.t.e.:. .J.u.l.y. .3.1.,. .2.0.1.3. .(.V.e.r.s.i.o.n. .9...2...2. .B.u.i.l.d. .1.0.4.0.). . . . . . . . . . . . . . . .......;. ..............................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\difxapi.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	323464
Entropy (8bit):	6.307333820189823
Encrypted:	false
SSDEEP:	6144:T3+rEo4fNwSQCT4YNjtMWDnYPWsjfVnnSSNbVQqbySUB:r+rEo4lWYNjJbYtdnpWhS6
MD5:	CF73C3A03582408D422D4F7A01190D00
SHA1:	4582875874D066E8975B8A04488422419137FCE4
SHA-256:	DD12D00CA9C9B1013091E733EAE021347BA52DCD69173A7E5E4FD80B45EE60F6
SHA-512:	C3D82121C0535FC819329B8C6E29078F7E71245528658093ED98DD72AF8AF1200EEDE951388D938E9B27C049A0874F5CF686A42AA880DA34390A72BC1112C8AA
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............................................%......................Rich............................PE..L...&.pK...........!.....l..........<..............a......................... ......E.....@..........................x.......b..................................4+......................................@...............x............................text...<j.......l.................. ..`.data....4...........p..............@....rsrc...............................@..@.reloc...E.......F..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\ia64\Difx64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (GUI) Intel Itanium, for MS Windows
Category:	dropped
Size (bytes):	193104
Entropy (8bit):	5.193939620283646
Encrypted:	false
SSDEEP:	3072:ZvAPQJ0usSc6FVrzwAH13jHmSxyA3Y1hrDRpuktFojxrcpdpJCvXH8TfLWhjHx:ZvdKuG6HnwAHhDzxVXktGuzSHmYx
MD5:	1FE9FBAEF5DF0BCC351A3F1D3E841D41
SHA1:	E4B66433D28DE92FC9EE1052155F3AA97FA3522D
SHA-256:	E740AF44CABEE706969C37B6E279F6708F1E87AA16C26188AF4CD5D8528349F2
SHA-512:	DAC7F8E4FE582A06C19D18E2669E7E66E3B63336D9E669D7AC8ADAD8023C60D3566A0B89C08E00153708F03F0460CD26B7B3AF0FEB1C221E5BE9E9EA9065F3EA
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........'..t..t..tC..t..t..t..t...t..t...t..t.V.t..t...t..t..t..t...t..t...t..tRich..t........PE......O..G..........#......B............... .....@..... ...............................5........@......@............... ..........................P...............T.......P............................ #..............................@..H............................text....A... ...B.................. ..`.rdata...e.......f...F..............@..@.pdata..T...........................@..@.srdata...... ......................@..@.sdata..0....@......................@....data...@&...`......................@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\ia64\difxapi.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) Intel Itanium, for MS Windows
Category:	dropped
Size (bytes):	704904
Entropy (8bit):	5.086374836717244
Encrypted:	false
SSDEEP:	6144:GsYB2o/9Yj6GLnBcbIYY2yXmCQd0HaeoyrWqVlBVySqISrCEouKA0oC0E/SSHHr1:Tqc+wtQdaIpoJyg8F50cGz
MD5:	73C188D05CFD6C61C270DA38B71CA7DF
SHA1:	EB4A19D33655ACAFB23EFC20B69486AB9466489E
SHA-256:	9207B717F08C56B60A51E74CB4399D425F8D623DA1370022FE3F41DE89E05FC6
SHA-512:	1383B15F91F29BA7FE40EF4BEAA9224F3813E186F70E76877D39368C7B9D4160E40B2DE747B1168583E7E58A2D0D37278E522E4B33760ADC7E092874FFFE2204
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4w jp.N9p.N9p.N9yn.9O.N9p.O9B.N9yn.9k.N9p.N9t.N9yn.9c.N9yn.9q.N9yn.9j.N9W.09q.N9yn.9q.N9yn.9q.N9Richp.N9........................PE........pK.........." .....\|...6......`"... .....a..... ....................... ............@.......................... ..........................................O..................P ................*..............................................................text....{... ...\|.................. ..`.pdata...O.......P..................@..@.srdata.............................@..@.sdata.. ............p..............@....data...`............\|..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\mup.xml

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	161270
Entropy (8bit):	4.53630090793565
Encrypted:	false
SSDEEP:	1536:Go52dWkT7Cdc3eZoDKyNMnOl07Cdc3eZoDKyNMnOm:4
MD5:	BD5588DEC3A5C9D9FD98455E386235D1
SHA1:	6647449FC01CC6E184A15C63E2438C0CB63B734B
SHA-256:	B00D6DC2B22CE8F49C6A85B3CD0A79F14C9A1FBBB9DD80A1F2D1139E00E1707C
SHA-512:	8B6F32911A0869637F140F696209DC400685CB9B90E385017D552631C081D737D8371196461DC4D53C27E8352BCEE423AD853917C13F89271C25BCFCC1134B8E
Malicious:	false
Reputation:	low
Preview:	.<?xml version="1.0" encoding="UTF-8"?>.. Created With CreateMup.exe Version 06.05.2013.1414-->..<MUPDefinition xmlns="http://schemas.dell.com/openmanage/cm/2/0/mupdefinition.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://schemas.dell.com/openmanage/cm/2/0/mupdefinition.xsd mupdefinition.xsd">.. <packageinformation>.. <installertype>installshield installscript</installertype>.. <packagegrouping>single_package</packagegrouping>.. <packagingtype>zip</packagingtype>.. <releasetype>DRVR</releasetype>.. <mupspecificationversion>2.4.1</mupspecificationversion>.. <version>9.4.0.1025</version>.. <name>Intel(R) Chipset INF</name>.. <supportedoperatingsystems>.. <osidentifier name="XP" architecture="x64" />.. <osidentifier name="XP" architecture="x86" />.. <osidentifier name="W2K3" architecture="x64" />.. <osidentifier name="W2K3" architecture="x86" />.. <osidentifier name="Vista" architecture="x64" />.

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\readme.txt

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	96225
Entropy (8bit):	4.753134329478563
Encrypted:	false
SSDEEP:	1536:D5f8IOw88g4g1hBsI4uohBsS4uKhBsQ4uEhBs+4ufhBsB4u8hBs94uNy:Da8g4g1fZqfFMfRGfztfimf6+
MD5:	2624FE0B863C073D3AAD226EEA09D230
SHA1:	4947CC66E0A47FB974C5AF2FEEC006891CCBFCEF
SHA-256:	FB422810BAF54F617099C34E45795D00AB3933CB10537A39BBAAE09A614041D7
SHA-512:	B3F59FFE5B60275CE5027DDE5995A1937E0541309C814F4F1BB4A928E730BB948D841F08F2E104785C740543F190740C004AF297B32B41E163F5F433D5125710
Malicious:	false
Reputation:	low
Preview:	***********************************************************.. Product: Intel(R) Chipset Device Software..* Release: Production Version..* Version: 9.4.0.1026..* Target PCH/Chipset: Xeon(R) processor E3-1200 v3,Intel(R) 4th Gen Core processor..* .. Intel(R) 8 Series,C220 Series..* Date: August 05 2013..**********************************************************.... NOTE: .. For the list of supported chipsets, please refer.. to the Release Notes....*********************************************************.. CONTENTS OF THIS DOCUMENT..************************************************************..This document contains the following sections:....1. Overview..2. System Requirements..3. Contents of the Distribution Package..4. List of Available Command Line Flag Options ..5. Contents of the Extracted Files..6. Installing the Software in Interactive Mode..7. Installing the Software in Silent Mode..8. Installing the INF Files Prior to OS Inst

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\x64\Difx64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	113912
Entropy (8bit):	6.15479871660097
Encrypted:	false
SSDEEP:	3072:E4KV859j8XftmPmTPoBKpJhLsTtXNIPJ1mquPgbf5zNJtc:EcmbO2o98J1pdNs
MD5:	FBE932D3851875E9AF2DCBE235EEA865
SHA1:	2E8EA3530A1FD7C3BE9DEDCAC94544B55A3CE030
SHA-256:	CB613A1A65A8DDE348D706DB40098D4DDE833789F37E6027E2A656093DC99B3E
SHA-512:	F9B01ABD720CE6844D019A60E5B483BA71B0433CF4AA0B4416A3C970CD092708655C35B3E990D93607B6C6F105FF834AE3347DBBACDB4640DCA1972C5C62EC9C
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g...............................................................Rich...................PE..d.....sK..........#...........................@.....................................3........................................................w..P....................................2...............................................0..P............................text...Z........................... ..`.rdata...O...0...P..."..............@..@.data....$...........r..............@....pdata..............................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\Chipset\x64\difxapi.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	519048
Entropy (8bit):	6.042930086191067
Encrypted:	false
SSDEEP:	6144:1uS8iJgEjHlmbGQGt20CZPbPBtqd0xYP2MJL:1u8JgfGQrIPfZ
MD5:	1A2E5109C2BB5C68D499E17B83ACB73A
SHA1:	EFA15CFA23606DFC355D11580B509E768A50DDBB
SHA-256:	E70BBCEE0D01658CCD201EBE0F0E547B9DAFF01B7C593A0FDD0C64E5F45D6F11
SHA-512:	47317D24D02C4122FE175BCD7F5B3DD8823063E7EA63F83961E40F10872642D2D6F6E6ABAF5FB7630CF0E9D8CEC0D112889600B14ECB8698B81597F52D54815B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........h...;...;...;..6;...;...;...;..0;...;..';...;.. ;...;..1;...;..);...;.0.;...;..7;...;..2;...;Rich...;........................PE..d.....pK.........." .................W.........a....................................x>....@..................................................................@.........................................................................0............................text............................... ..`.data...X.... ......................@....pdata......@......................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\IntelEthernetInstaller64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	950812
Entropy (8bit):	7.943665840261448
Encrypted:	false
SSDEEP:	24576:KzYXUe0SACd9cdfD0VKAXzyflRX7CeCo6CEaEW83QXea:bkerACXED0VKAXzyD7zmYGQua
MD5:	1BE6B7190C265762697050E3BBBA3E4E
SHA1:	77C9587460753F77E3D7EAA8E914650A49118C6A
SHA-256:	2FEBC4C84277C3617C737373CCB4B9E95A25C372FEDD5358E39C43FE9C084A5D
SHA-512:	9AF632338B3F07B49F1BBC359528D42C0299AB843BED4A30129B4951CBB1DDA9F6E6A87F091BB9D53C6D9B8CFD538FF7A6EA568BF813BF837980A835CA44A4F5
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L...\|.rE.................0...p...............@....@.............................................. .......................................<...........................................................................................................text....0.......................... ..`.data....p...@.......4..............@....idata...............>..............@..@.rsrc....@.......<...N..............@..@................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Intel\IntelMgmtEngine.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	55040255
Entropy (8bit):	7.9997522879124725
Encrypted:	true
SSDEEP:	1572864:judRPOBQLXZuJLahxL5xmHztD1+J6JJTuOCpp:jetPJu9ah15xiztDISBuOA
MD5:	5A3518E4A1AE1D2D068F6AE6EFF6C2F9
SHA1:	5BDCFA51B1302B0B13D6F7CBDCC7C42AE85ED332
SHA-256:	DF3679692B68D63B801A8F86B1E15FB36D2E231F2F9E1B5F11171ABD6D587B33
SHA-512:	82F41B37042C2D2C9D41A34FA007E6FDB3CBBE9EFA0D077DD6B53DA740B491B7FD942FA018ED40BAB5400364BFD3CEE44E322F41D8300C7DF5219851EAF8C7A4
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L...\|.rE.................0...p...............@....@.............................................. .......................................<...........................................................................................................text....0.......................... ..`.data....p...@.......4..............@....idata...............>..............@..@.rsrc....@.......<...N..............@..@................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Microsoft\vcredist_x64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7157496
Entropy (8bit):	7.990866736150015
Encrypted:	true
SSDEEP:	196608:rys4f9Mktq6q5VX3BWS4UOEjxwZNp5VyA/kD:cf9Mktq7tWS4UjjxwHrwp
MD5:	CCAE0434AC161E2FF081A13985C801FD
SHA1:	60727CA083E3625A76C3EDBBA22B40D8A35FFD6B
SHA-256:	AA065E8498AC2B8483A5398F847AA26FEB72D99F24474C00E6B6D784BB6379C2
SHA-512:	17229249A42D606FE2467ABAB019A3C9171758B4477C02745F8F8FD696FAB282C52E45493AFB7C381DDA171290B34247AD2083A8F77A8307E3CB4D897F612457
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0..t...t...t...}.n.]...}...g...}.i.....}.y.k...t...8.....A.7.....p.u...t.}.u.....w.u...Richt...........PE..L......O............................kG............@..................................!n...@.....................................,....@..H1..........8.l..=..................................(D.......C..@............................................text............................... ..`.data...\|...........................@....wixburn8.... ......................@..@.tls.........0......................@....rsrc...H1...@...2..................@..@.reloc..8A.......B...*..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\Microsoft\vcredist_x86.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5074200
Entropy (8bit):	7.998816806703486
Encrypted:	true
SSDEEP:	98304:EuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0g:V7wq1W6HqULS8djZDTaNNeCKVP5ORsgP
MD5:	47B9F8ADFE03E46D919351B85174873E
SHA1:	0D41C4BBDBF4F1420ECE886D1616F980EDCC4F4E
SHA-256:	70758635731EDA106EC6D75D07654D6ADC1D201ED460CCF5DEF70E86386B2366
SHA-512:	C0815DCB9FA6196DD5B5936D40D817BF5728C4781FDE0DF1FBE90DC549EBE1658B88F2CF019ADBC0F76A3E36E85A04E7CCF034361C1DD5FBBDC9BB38E93E3E49
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#pA.B...B...B..gM...B...B...B..gMC..B..gMA..B..gM@..B..gMD..B..Rich.B..........................PE..L....jkG.............................c... ........... ...............................M.......... ...................................................RM............. "...............................&..@............ ...............................text........ ...................... ..`.data...............................@....rsrc.............L.................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\bootcamp5.1.5769.zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	542286415
Entropy (8bit):	7.99886502427705
Encrypted:	true
SSDEEP:
MD5:	CE3D6A4AF0448B868497499F86A79D7B
SHA1:	52D29FE339815AD8C18C6839EE7BB37453D6C73B
SHA-256:	4EDE2C8EF240708C850237A3E5911094ED6ADAE1734258E4639BC9069A814B1E
SHA-512:	96ECC8E55A74DE85FBB3026A05EB49AD4DBC8A48F0AAFEBD3B27A6A47CE53DF1179B8442CE77320F643DF7E67075D8430E197DC43258B0A6BA47F58CFA947132
Malicious:	true
Reputation:	low
Preview:	PK........D.ZF................BootCamp/UT.../..TH..Uux....c....c...PK........$.ZF.u...!...4......BootCamp/BootCamp.xmlUT......T...Tux....c....c....]ks...<[....Vj.]..F7^......F.5.l.f.R.@SDL............$H...d<.2I..s..s......<...g.F~0...v.._...?...\|...I4 $......<.... $}.>.;......x.r.....q..=.b.pF..7.....t....%..NG=..t".z...7u...t2k~B..pv....{..Yv.3...7..$<.&.!...n..t..b.....b.v.W.Z...'..G.......!.UQ.U..^.. AA4EI...:I.."F0..c2.....n..1.gr........O.....g^].t.B..j....U.g.p..y.q..9muv.....Q.#t@....?L.%.({}K..(._..?...........Z._]}?c)....{...e.sv.\|......~.?~<;M.d.>8.)9.........^.{........kx[C..\|{W..YM0.i..^..@v..{g]_.3....U...t.cK:.?"...Z=..j.F...mt.k...(.......<E..4....E.o...?.?....p8....:...q..o.1......P..,V...<O.....E.....q.....!.G0..............H.?.g/e..pRIf(...:7n..Y..B.i....DC...7.E..^W....j).......sL..1y$.<..M..z..C.q..I.mQ.[..._.[.1.{.cE...O......?v_...ni?..}..F.}7v.x:.L?..q'..d..Y.8t..dC.-...+..k.A^...(.a!....m.Z.^+p..L....I...*..

C:\Users\user\Downloads\bootcamp5.1.5769.zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	542286415
Entropy (8bit):	7.99886502427705
Encrypted:	true
SSDEEP:
MD5:	CE3D6A4AF0448B868497499F86A79D7B
SHA1:	52D29FE339815AD8C18C6839EE7BB37453D6C73B
SHA-256:	4EDE2C8EF240708C850237A3E5911094ED6ADAE1734258E4639BC9069A814B1E
SHA-512:	96ECC8E55A74DE85FBB3026A05EB49AD4DBC8A48F0AAFEBD3B27A6A47CE53DF1179B8442CE77320F643DF7E67075D8430E197DC43258B0A6BA47F58CFA947132
Malicious:	false
Reputation:	low
Preview:	PK........D.ZF................BootCamp/UT.../..TH..Uux....c....c...PK........$.ZF.u...!...4......BootCamp/BootCamp.xmlUT......T...Tux....c....c....]ks...<[....Vj.]..F7^......F.5.l.f.R.@SDL............$H...d<.2I..s..s......<...g.F~0...v.._...?...\|...I4 $......<.... $}.>.;......x.r.....q..=.b.pF..7.....t....%..NG=..t".z...7u...t2k~B..pv....{..Yv.3...7..$<.&.!...n..t..b.....b.v.W.Z...'..G.......!.UQ.U..^.. AA4EI...:I.."F0..c2.....n..1.gr........O.....g^].t.B..j....U.g.p..y.q..9muv.....Q.#t@....?L.%.({}K..(._..?...........Z._]}?c)....{...e.sv.\|......~.?~<;M.d.>8.)9.........^.{........kx[C..\|{W..YM0.i..^..@v..{g]_.3....U...t.cK:.?"...Z=..j.F...mt.k...(.......<E..4....E.o...?.?....p8....:...q..o.1......P..,V...<O.....E.....q.....!.G0..............H.?.g/e..pRIf(...:7n..Y..B.i....DC...7.E..^W....j).......sL..1y$.<..M..z..C.q..I.mQ.[..._.[.1.{.cE...O......?v_...ni?..}..F.}7v.x:.L?..q'..d..Y.8t..dC.-...+..k.A^...(.a!....m.Z.^+p..L....I...*..

C:\Users\user\Downloads\fef1fb72-cd98-4729-b46e-4089c4828746.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	52240
Entropy (8bit):	7.9923218033509364
Encrypted:	true
SSDEEP:	1536:MIT9O0YJZt56aOBTDbLcEvc/KhXxO8cgFp53KckxVMyzYajRg2T2K:VdlNVcE4mX0yFpNFk/vYajCrK
MD5:	0276E145E429005E86FDB3A0468C3F2A
SHA1:	C5B63257F4BA8913210A111B592A88F3A4BD3560
SHA-256:	D30E24082534DF7C339FAC03F47EFA843F2725D67D4FFB6276E3C5ADE04379C3
SHA-512:	47C2E0C30574E75C0F65A4E97E8CFBD37F4F1B1E606DA7E73FDD7A42FCAB8C0526B7E399025ADEE59A985C4EA3E62BD06431F75E2BC16997EFA752E12A4141E3
Malicious:	false
Reputation:	low
Preview:	PK........D.ZF................BootCamp/UT.../..TH..Uux....c....c...PK........$.ZF.u...!...4......BootCamp/BootCamp.xmlUT......T...Tux....c....c....]ks...<[....Vj.]..F7^......F.5.l.f.R.@SDL............$H...d<.2I..s..s......<...g.F~0...v.._...?...\|...I4 $......<.... $}.>.;......x.r.....q..=.b.pF..7.....t....%..NG=..t".z...7u...t2k~B..pv....{..Yv.3...7..$<.&.!...n..t..b.....b.v.W.Z...'..G.......!.UQ.U..^.. AA4EI...:I.."F0..c2.....n..1.gr........O.....g^].t.B..j....U.g.p..y.q..9muv.....Q.#t@....?L.%.({}K..(._..?...........Z._]}?c)....{...e.sv.\|......~.?~<;M.d.>8.)9.........^.{........kx[C..\|{W..YM0.i..^..@v..{g]_.3....U...t.cK:.?"...Z=..j.F...mt.k...(.......<E..4....E.o...?.?....p8....:...q..o.1......P..,V...<O.....E.....q.....!.G0..............H.?.g/e..pRIf(...:7n..Y..B.i....DC...7.E..^W....j).......sL..1y$.<..M..z..C.q..I.mQ.[..._.[.1.{.cE...O......?v_...ni?..}..F.}7v.x:.L?..q'..d..Y.8t..dC.-...+..k.A^...(.a!....m.Z.^+p..L....I...*..

Target ID:	0
Start time:	14:06:32
Start date:	04/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	14:06:34
Start date:	04/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=2024,i,4500164741189345867,16917234656794013603,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	14:06:37
Start date:	04/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "https://download.info.apple.com/Mac_OS_X/031-30890-20150812-ea191174-4130-11e5-a125-930911ba098f/bootcamp5.1.5769.zip
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:07:20
Start date:	04/01/2024
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\bootcamp5.1.5769.zip
Imagebase:	0xc70000
File size:	12'800 bytes
MD5 hash:	16FF3CC6CC330A08EED70CBC1D35F5D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	14:07:20
Start date:	04/01/2024
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges" "C:\Users\user\Downloads\bootcamp5.1.5769.zip
Imagebase:	0x3b0000
File size:	289'792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:07:20
Start date:	04/01/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:07:52
Start date:	04/01/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe" /C "C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	14:07:52
Start date:	04/01/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	14:07:52
Start date:	04/01/2024
Path:	C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Setup.exe
Imagebase:	0x140000000
File size:	1'300'800 bytes
MD5 hash:	D45E19599BE570DDE85F757051AB3E69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	22.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0125B1D6 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0125B208

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: eff1b95280f8cb1a68aded67361f40252b847d577452d79b1f82e02b470e32c3
Instruction ID: 129a22b68804382f5f6bac337b5401fa38741839fb641937746a3e7d373e76a9
Opcode Fuzzy Hash: eff1b95280f8cb1a68aded67361f40252b847d577452d79b1f82e02b470e32c3
Instruction Fuzzy Hash: 8001AD719242408FDB60DF15D889B69FBE4EF44324F08C4AADD48CF256D279A404CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 05430C99 Relevance: 5.1, Strings: 4, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P~j, xrefs: 05430CC8
`|j, xrefs: 05430D62
e] j^, xrefs: 05430D6E, 05430D73
`|j, xrefs: 05430D37

Memory Dump Source

Source File: 00000007.00000002.2563362540.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5430000_unarchiver.jbxd

Similarity

API ID:
String ID: P~j$`|j$`|j$e] j^
API String ID: 0-2476311011
Opcode ID: 6bb5973b304fd99c2e49031b3ca5aa71c09cb23f8b2657e1249fe3456b0aabda
Instruction ID: a0e2791b482b89191969f34c71a0e82388e93935ce23ef65a386e4570ef822e0
Opcode Fuzzy Hash: 6bb5973b304fd99c2e49031b3ca5aa71c09cb23f8b2657e1249fe3456b0aabda
Instruction Fuzzy Hash: D42127307006449FCB55EA7989487BEBAD7EBC9248B45843DD44ADB382DF39DE028792

Uniqueness

Uniqueness Score: -1.00%

Function 05430CA8 Relevance: 5.1, Strings: 4, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P~j, xrefs: 05430CC8
`|j, xrefs: 05430D62
e] j^, xrefs: 05430D6E, 05430D73
`|j, xrefs: 05430D37

Memory Dump Source

Source File: 00000007.00000002.2563362540.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5430000_unarchiver.jbxd

Similarity

API ID:
String ID: P~j$`|j$`|j$e] j^
API String ID: 0-2476311011
Opcode ID: e98f2db850a5127ab488ca5edf54c7f6da0499133dbaad57188ad29d0f9482ad
Instruction ID: 3fcf4b2645aa5ecc84ff5df74cdf4e140970ccdb85d3eefff05ea8f1e2022474
Opcode Fuzzy Hash: e98f2db850a5127ab488ca5edf54c7f6da0499133dbaad57188ad29d0f9482ad
Instruction Fuzzy Hash: 0421F1307006449BCB14EB3A85487AEB6D7AFC9248B44843DD08ADB382DF79ED0687D2

Uniqueness

Uniqueness Score: -1.00%

Function 0125B246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0125B2F3

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cc260a04f8bad874e35b4e76cfa53dae3eda678b7bcdebbb286101180909ce29
Instruction ID: cc1fba754a54e75836e55696bada3403c91d19efd8a9e089fc8b6f81d8c3cda4
Opcode Fuzzy Hash: cc260a04f8bad874e35b4e76cfa53dae3eda678b7bcdebbb286101180909ce29
Instruction Fuzzy Hash: 5431B472404344AFEB228B25DC45FA6BFBCEF45314F04849AE985DB162D324A919CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0125AD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0125ADA7

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ee6c47cb0d5821bcaf0cbe008855488d4b5556ff32926fefbeb17f701599fcd6
Instruction ID: d207fbdcf2dead09fe78f4e1489b13c6e913420fc89193a319be9127aa1e2d8a
Opcode Fuzzy Hash: ee6c47cb0d5821bcaf0cbe008855488d4b5556ff32926fefbeb17f701599fcd6
Instruction Fuzzy Hash: 5731A172404384AFEB228B65CC45FA7BFACEF45314F04899EE985CB152D724A919CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0125AB76 Relevance: 1.6, APIs: 1, Instructions: 92
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E24,?,?), ref: 0125AC36

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 67683f8818b1df60e737040d2dc6cc37ed09e92538aa9999ed2fe8a6a333d460
Instruction ID: f5069c9b83daf74d09ceff71aecd6d26ba8293c7b39a352d0403dba45a444f60
Opcode Fuzzy Hash: 67683f8818b1df60e737040d2dc6cc37ed09e92538aa9999ed2fe8a6a333d460
Instruction Fuzzy Hash: 9D318C6250E3C06FD3038B318C65B65BFB4AF47610F1A84CBD8C4CF1A3D6296909C762

Uniqueness

Uniqueness Score: -1.00%

Function 0125A5DC Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0125A67D

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ad39bcfbed3152e3d27b698cce76168b9aa2281a898dc93769211fe06e8dce6b
Instruction ID: 784d875da6916f934908d4112943333a201114dfbea7fd5fa76edd01f78eb84d
Opcode Fuzzy Hash: ad39bcfbed3152e3d27b698cce76168b9aa2281a898dc93769211fe06e8dce6b
Instruction Fuzzy Hash: 5B318171505340AFEB21CF25CC85F66BFE8EF45214F08859EEA858B252D375E409CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0125A120 Relevance: 1.6, APIs: 1, Instructions: 82
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 0125A1C2

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 5319034e62faa1fa42a5932280ed7d3c863dc4f371d456ac1a5135e301bc694d
Instruction ID: bc567b62db1c19bec2609d31970f5451b9868523f7dab3ae039817f7833d8bad
Opcode Fuzzy Hash: 5319034e62faa1fa42a5932280ed7d3c863dc4f371d456ac1a5135e301bc694d
Instruction Fuzzy Hash: 4C21A17150D3C06FD3128B258C51BA2BFB4EF47610F0945CBE884DF293D225A91AC7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0125AD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0125ADA7

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b5b4c7edcb4ce407faa8595ad05b107b19628372c758ca324752925fce924c8d
Instruction ID: 14138ca45e95fb65f97392d7fe66ac1e035fab0588705ddcce0b46316558c301
Opcode Fuzzy Hash: b5b4c7edcb4ce407faa8595ad05b107b19628372c758ca324752925fce924c8d
Instruction Fuzzy Hash: 3421B272500204AFEB219F64CC86FABFBECEF04314F04856AEA45CB655D774A509CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0125B276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0125B2F3

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a970db6fafeaa3dc39a224ae0038ee2c3dc06f06d8d295d85c2fef0600274142
Instruction ID: e5fa777c1f730d865b2aecfd92784ed3ddeb3befbc893b76debe3423fe63bee3
Opcode Fuzzy Hash: a970db6fafeaa3dc39a224ae0038ee2c3dc06f06d8d295d85c2fef0600274142
Instruction Fuzzy Hash: BE21E072500204AFEB219F25CC85FAABBECEF04314F04886AEE45DA252D774A508CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0125A370 Relevance: 1.6, APIs: 1, Instructions: 80
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,5F87D9F4,00000000,00000000,00000000,00000000), ref: 0125A40C

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 221df3a2f5ecd62241b2b5ba8997ce980c4db84d15940b00aa149d4c652f306e
Instruction ID: ff5b3e053c89e493816b99e7a845affca0a2b84c29a40af355c78a6a26ad8d55
Opcode Fuzzy Hash: 221df3a2f5ecd62241b2b5ba8997ce980c4db84d15940b00aa149d4c652f306e
Instruction Fuzzy Hash: C1218D72504340AFE721CF25CC85FA2BBF8EF05714F08859AEA85CB252D364E909CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0125A850 Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E24,5F87D9F4,00000000,00000000,00000000,00000000), ref: 0125A8DE

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: c58b235db751dd281d19e4e69535138e22195a3e2c6e6559ebf276a9367bc103
Instruction ID: b60b40f80d2d37557a8b797e9447ab3c845c04cf0dae4408f77c1c179ad25c5b
Opcode Fuzzy Hash: c58b235db751dd281d19e4e69535138e22195a3e2c6e6559ebf276a9367bc103
Instruction Fuzzy Hash: 0B21B6714093806FEB228B24DC45F66BFB8EF46714F0985DAE984CF153C275A909C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 0125A933 Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E24,5F87D9F4,00000000,00000000,00000000,00000000), ref: 0125A9C1

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4b492b2245d4489c4cf849658844f8791553a67737aa34fce22bebd8f20c39d9
Instruction ID: da4b5584cf38adefd9136d347c97dab6fdfb7ead1e29fc41afd410459bff483b
Opcode Fuzzy Hash: 4b492b2245d4489c4cf849658844f8791553a67737aa34fce22bebd8f20c39d9
Instruction Fuzzy Hash: 42218371409380AFDB228F65DC45FA6BFB8EF46314F0885DAE9849F152C375A509CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0125A5FE Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0125A67D

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 990f83c2942d481c324dbc0ddc4b7cc6f5e7cccfa5324252ac5e7b699010415c
Instruction ID: 948d81d8cb0ab975e476a6b5bcc625672bcdcd1747a16d06d4163dae9de6c65b
Opcode Fuzzy Hash: 990f83c2942d481c324dbc0ddc4b7cc6f5e7cccfa5324252ac5e7b699010415c
Instruction Fuzzy Hash: 22216B71510200AFEB21DF25CD86F66FBE8EF48310F04856EEA858B252D775E408CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0125A78F Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,5F87D9F4,00000000,00000000,00000000,00000000), ref: 0125A815

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 034bb96e1ce8b46a309f63e602f5aa385f7b63cdab4fdf54f9fbecff9bf48552
Instruction ID: 275edf8a8c60afc717d24735a1d8e2de09d2aafae734d94def7e0cb3b1e0632e
Opcode Fuzzy Hash: 034bb96e1ce8b46a309f63e602f5aa385f7b63cdab4fdf54f9fbecff9bf48552
Instruction Fuzzy Hash: BE21D8B54093806FE7128B25DC45FA2BFB8DF46314F0881DBE9848B153D268A90AC775

Uniqueness

Uniqueness Score: -1.00%

Function 0125AA0B Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0125AA8B

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: b07aaf4ea8b4663ba440c903ed83a5c61c30511e5c7263b4ad510f922158b001
Instruction ID: d4e016f70cb5f8c3c453946b16038231c71ff9ae1b8ed839ee9c6fb06cce9191
Opcode Fuzzy Hash: b07aaf4ea8b4663ba440c903ed83a5c61c30511e5c7263b4ad510f922158b001
Instruction Fuzzy Hash: 802180715093C05FEB12CB29DC95B92BFE8AF06314F0D85EAE984CF253D225D949CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0125A392 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,5F87D9F4,00000000,00000000,00000000,00000000), ref: 0125A40C

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: b8ee0124fdce2678908cb91af518f4ad842643c7b2dbf807af586d09a4f160fb
Instruction ID: 17ec471ddfc96ebac226ae930f33566e4c2fa42ee085185f3596383a362ea810
Opcode Fuzzy Hash: b8ee0124fdce2678908cb91af518f4ad842643c7b2dbf807af586d09a4f160fb
Instruction Fuzzy Hash: 9F218E75510204AFE761CF65CC86FA6BBECEF04714F04856AEE458B252D774E809CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0125A6D4 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0125A748

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: bd5ded2aa5af33192a4f2dd0e89e5465ba5b17e2c844421757768866c3d2041b
Instruction ID: a5ff45d896f078c80aefc503d310b34b1c2f3e62898648f1b96260fd7c6f4dc1
Opcode Fuzzy Hash: bd5ded2aa5af33192a4f2dd0e89e5465ba5b17e2c844421757768866c3d2041b
Instruction Fuzzy Hash: 6821C5B55097C15FD7128B25DC95792BFB4EF06324F0980DBDC858F193D2249908C771

Uniqueness

Uniqueness Score: -1.00%

Function 0125A962 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E24,5F87D9F4,00000000,00000000,00000000,00000000), ref: 0125A9C1

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f6d1855a0dadcfdbd5f863a974b0e115c96d0ce95c597835fc6a4ea588353675
Instruction ID: 18ac40c69172a482c8ae2ad4b0a380759a7713d83678bc6eafd594fa9b6688eb
Opcode Fuzzy Hash: f6d1855a0dadcfdbd5f863a974b0e115c96d0ce95c597835fc6a4ea588353675
Instruction Fuzzy Hash: 82110471410200AFEB21CF25CC86FA6FBE8EF44324F04855AEE458B241C379A404CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0125A882 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000E24,5F87D9F4,00000000,00000000,00000000,00000000), ref: 0125A8DE

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7ad4281b85ae5234b8bca9a0f78b2b4a73f02b05c1900de06ac92decf9752e23
Instruction ID: 38e18133b1bde2e828c4f888553797219f4fa65b39446c9a30391a7fc5d7044b
Opcode Fuzzy Hash: 7ad4281b85ae5234b8bca9a0f78b2b4a73f02b05c1900de06ac92decf9752e23
Instruction Fuzzy Hash: DB11E371510300AFEB21DF64DC86FA6FBE8EF44324F0485AAEE499B245C779A505CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0125A2AE Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0125A30C

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: dd98b992e4a71240b55ecc483f774b11cf49aef74b77f8367b40c0ac81f0ffb8
Instruction ID: 696831f3283174e5b5ee4d55a7c7e11dd8bd16139cb7c7e9ef590798dc6ac63f
Opcode Fuzzy Hash: dd98b992e4a71240b55ecc483f774b11cf49aef74b77f8367b40c0ac81f0ffb8
Instruction Fuzzy Hash: FC115E754093C0AFDB228B25DC95A92BFB4DF47224F0981DBDD858F263D275A809CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0125B1B4 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0125B208

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: d5729f2a7ecc508206590248a53360d4b3c464cd92a0e96267b65725925ed81e
Instruction ID: 860d51495a4d45bb4e0ee54b1f80ea5c13d548b4902f63d6aa378b297c5b3aa8
Opcode Fuzzy Hash: d5729f2a7ecc508206590248a53360d4b3c464cd92a0e96267b65725925ed81e
Instruction Fuzzy Hash: 541170714093C09FDB128F15DC88B56BFA4DF46224F0884EAED849F253D275A908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0125AF8B Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0125AFE4

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: cc9e63c0b208f68c41925dc3c2df7fe053a44c1265b82915fed01f6f281c7194
Instruction ID: 43122efa971f03f68a678ea3d1ff09fad47adefbac138ffbfc1e7d6bca19011c
Opcode Fuzzy Hash: cc9e63c0b208f68c41925dc3c2df7fe053a44c1265b82915fed01f6f281c7194
Instruction Fuzzy Hash: 291170755093C09FDB228B25DC85B52BFF4EF06220F0984DBED858B263D275A848DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0125AA46 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0125AA8B

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 1ee1308056ddcba7a36dfe6529450b1fff9b00aac828b3ca681fabb7517653d2
Instruction ID: b6b56c50b5c305a7e03897493b44fef48ac629d8444a012c50d7ffa9294e42e6
Opcode Fuzzy Hash: 1ee1308056ddcba7a36dfe6529450b1fff9b00aac828b3ca681fabb7517653d2
Instruction Fuzzy Hash: 8A11C8716102419FEB60CF29D986B66FBE8EF04220F08C5AAEE45CB346D375D504CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0125A7C2 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,5F87D9F4,00000000,00000000,00000000,00000000), ref: 0125A815

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: f018d517335346c6aa90f90550ffacc3ba02e2f95a91550fd041830bac8ce257
Instruction ID: 53559d8da9b7f6cd0c6cf1d6fffa453a790c1c15783cee31006c4a5dd5f95ba3
Opcode Fuzzy Hash: f018d517335346c6aa90f90550ffacc3ba02e2f95a91550fd041830bac8ce257
Instruction Fuzzy Hash: 3E01D671514200AEE760DB25DC8AFB6F7D8DF44728F04C19AEE058B242D778E905CAF5

Uniqueness

Uniqueness Score: -1.00%

Function 0125ABE6 Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E24,?,?), ref: 0125AC36

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 00a5b17e19060b617f309eeb6cc20310a26f8898789de5c9994cad886af670f4
Instruction ID: 984a54e6894cd182f1997e5295611f0e42ad8fe1458456c6e3d6a30f2b1aa528
Opcode Fuzzy Hash: 00a5b17e19060b617f309eeb6cc20310a26f8898789de5c9994cad886af670f4
Instruction Fuzzy Hash: 32015E71640200ABD310DF16DC46B36FBE8EB88B20F14855AED489B645D635B915CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 0125A172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 0125A1C2

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 53564915610b8c3e0f862073ed53539e2a19f788691a89dcb62055925367b54c
Instruction ID: 4220992db17f4d48850ad9a4c73267ebd30cdfd30db7c31bebbf67eb94de10a3
Opcode Fuzzy Hash: 53564915610b8c3e0f862073ed53539e2a19f788691a89dcb62055925367b54c
Instruction Fuzzy Hash: C0017171640200ABD310DF16DC46B36FBE8EB88B20F14855AED489B745D735B915CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 0125A716 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0125A748

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 22a84749e6e58492e148778c6b4cfba13fa2d221425fa56f73983cf60b61253d
Instruction ID: 7b4f4a885fbd2a9da83da25c411587c1f0d79d2dc730cbfd2f94e6c1c432d969
Opcode Fuzzy Hash: 22a84749e6e58492e148778c6b4cfba13fa2d221425fa56f73983cf60b61253d
Instruction Fuzzy Hash: FA01DF719102418FDB608F29D886BAAFBE4DF04320F08C4AADD4A8F246D279E404CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0125AFB2 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0125AFE4

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 852edb55d642ae60662570fe1cb3864cd2d0e5055487420efd4cf6fdcc7b5cd9
Instruction ID: 278a3f0ffa8b38502e1128c9ccc7cef6b7dd5b7f4c52e3b0bea164289ec2de9e
Opcode Fuzzy Hash: 852edb55d642ae60662570fe1cb3864cd2d0e5055487420efd4cf6fdcc7b5cd9
Instruction Fuzzy Hash: C501F4755102408FDB608F19DC86B62FBD4EF04324F08C0AEDD458B392D67AE848CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0125A2DA Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0125A30C

Memory Dump Source

Source File: 00000007.00000002.2561220754.000000000125A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_125a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 906068252ccf347d346518ef4d1791389afaa86b0a71f532f54a5643e3e51d8a
Instruction ID: 04387fc1e028b046c8e321745eb8dda2d61eea1283af1ace4b18bfaa2351313c
Opcode Fuzzy Hash: 906068252ccf347d346518ef4d1791389afaa86b0a71f532f54a5643e3e51d8a
Instruction Fuzzy Hash: F8F0AF758242409FDB609F16D886B61FBE0EF44728F08C1AADD494F357D3B9E408CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 017E0808 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

g, xrefs: 017E080C

Memory Dump Source

Source File: 00000007.00000002.2562139899.00000000017E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17e0000_unarchiver.jbxd

Similarity

API ID:
String ID: g
API String ID: 0-30677878
Opcode ID: 354296e1181553cb5fa3619aabe9f3a2f1249c3307f8ce1469fe550195395aca
Instruction ID: 069dcf9d42531633622178035fe84f181ebb0df9c7eba06178e926b4c8cfc176
Opcode Fuzzy Hash: 354296e1181553cb5fa3619aabe9f3a2f1249c3307f8ce1469fe550195395aca
Instruction Fuzzy Hash: 610184B28093446FD701DB15AC45C56FBECDF86524F04856EEC4887206E266AD198BB2

Uniqueness

Uniqueness Score: -1.00%

Function 054302C0 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563362540.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5430000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d6edfe322eb596fc82dfa8bfc9c8fdbb8103861f1ecd88a17e145de7f518a6c
Instruction ID: 45f9357d10dd5b530197dae80b42e5209479ea73a37e26ce0e1dfae9e132fa60
Opcode Fuzzy Hash: 5d6edfe322eb596fc82dfa8bfc9c8fdbb8103861f1ecd88a17e145de7f518a6c
Instruction Fuzzy Hash: ECB15238701110CFC714DB6AF95DA6E7BF2FFE9280B1091A5E90A973A5DB359C05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05430799 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563362540.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5430000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec37579c74ad3a408b26cca56e41c79d350c6d909028c5e44a254d555359b5f
Instruction ID: 12ae857a9f78ad69c8d421b35df8baea583fa3a6176788f8e56135a41a246fb9
Opcode Fuzzy Hash: 0ec37579c74ad3a408b26cca56e41c79d350c6d909028c5e44a254d555359b5f
Instruction Fuzzy Hash: 10A15E34B05201CBDB14ABB5A45D7BE77B3EBC8348F148069D90A97396DF798C42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05430B8F Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563362540.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5430000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 497386a8b33338d0b01643a5bf40e4d9780253b4fccf9a43c4f06e756fb2eb95
Instruction ID: e6091461c09838c667e29c87fcca615764dafc46c4ed3183cba0ff5a2536f3cd
Opcode Fuzzy Hash: 497386a8b33338d0b01643a5bf40e4d9780253b4fccf9a43c4f06e756fb2eb95
Instruction Fuzzy Hash: A911D335B11158AFCF04CBB8E8488AE7BF2FF88214B154579E509D7262DF319C159B90

Uniqueness

Uniqueness Score: -1.00%

Function 05430BA0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563362540.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5430000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eada582d29f1a3061e07df7d7b4af6ff4c78115f619baddabd8a519686c5981
Instruction ID: 416a40de6032c145870ff5667b0b1a21474ac6d4e2633f323364f3f99ca0dcce
Opcode Fuzzy Hash: 6eada582d29f1a3061e07df7d7b4af6ff4c78115f619baddabd8a519686c5981
Instruction Fuzzy Hash: 04119135B11158AFCF049BB8E84899E7BF6FF88214B164575E209E7262DF31AC059B90

Uniqueness

Uniqueness Score: -1.00%

Function 017E05E1 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2562139899.00000000017E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17e0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 458c616318d009a134c8ee5bfec38c294b1b4f1f1f0475194b929bd2d9f240ef
Instruction ID: 36edb8e7f1572c672d33304125cf086a27e7ff8d1ad594793262d98fab0d1017
Opcode Fuzzy Hash: 458c616318d009a134c8ee5bfec38c294b1b4f1f1f0475194b929bd2d9f240ef
Instruction Fuzzy Hash: 1BF0A9B65097805FD7118F169C45C62FFE8DF86620709C0AFFC898B612D125A908CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 017E082E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2562139899.00000000017E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17e0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa994667a0156076572a118020aff79aecbd6c53900574ef9fb1f11037802b24
Instruction ID: c7aa24c3ed75c0b2180e73bd9873b587d1a4bc0fd3c92b88c7b73554ac42a687
Opcode Fuzzy Hash: fa994667a0156076572a118020aff79aecbd6c53900574ef9fb1f11037802b24
Instruction Fuzzy Hash: D7F082F28152046BD340DF15ED46866F7ECDFC4625F04C52AEC488B305E676AD154BE6

Uniqueness

Uniqueness Score: -1.00%

Function 017E0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2562139899.00000000017E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17e0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5af7b09517c3b652dfa2818bf3b6bf64de1b1a0eb0f23b92f3695a69542a60dc
Instruction ID: 2289abe6996b612d30d22f9f7f48a33d64833585675cf6285365df7d9161fcaa
Opcode Fuzzy Hash: 5af7b09517c3b652dfa2818bf3b6bf64de1b1a0eb0f23b92f3695a69542a60dc
Instruction Fuzzy Hash: 92E092B66016004B9750CF0AEC41862F7D8EB84630708C07FDC0D8B701D63AB504CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05430C50 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563362540.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5430000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ed32feadc79519e3999ba026f0a5ce0559f8e360619e35fa6e88a1bc18c228
Instruction ID: 44f3b63d81ecaf43a0ec798f8a89679ef1e024c7ffd186742e840bdb3b4d72f2
Opcode Fuzzy Hash: e8ed32feadc79519e3999ba026f0a5ce0559f8e360619e35fa6e88a1bc18c228
Instruction Fuzzy Hash: A7E0DF72F152541FCB48DBF988405AEBFE5EB82260B0645BAC008C7282EF348C428780

Uniqueness

Uniqueness Score: -1.00%

Function 05430C60 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563362540.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5430000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 426e325985ef5e7dfa6e9d328ec4620158bc4ec90b62a2718ededf70c40e8d69
Instruction ID: 8dc78487b0e6b235b877b1bdab20d28659165d4440ed1938284bff9f6a1b8508
Opcode Fuzzy Hash: 426e325985ef5e7dfa6e9d328ec4620158bc4ec90b62a2718ededf70c40e8d69
Instruction Fuzzy Hash: 9BD0C731F002182B8B48EBF988446AEBFEA9B81064B4684BAD00CD3301EE30AC428780

Uniqueness

Uniqueness Score: -1.00%

Function 05430DD1 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563362540.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5430000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52fa0c72d887a32885109fcc1452886f5647ec36534f8acc3cd2a98a2c24d0b0
Instruction ID: 93b27d14c3aea6e76d5814beef496140f17d4b645ed1ffb9868f83f8e248a92e
Opcode Fuzzy Hash: 52fa0c72d887a32885109fcc1452886f5647ec36534f8acc3cd2a98a2c24d0b0
Instruction Fuzzy Hash: C9E012302493408FC706C774D41D5A97BB5AFD5325F4682AAC44D8B2A6C6789C44D750

Uniqueness

Uniqueness Score: -1.00%

Function 012523F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2561169745.0000000001252000.00000040.00000800.00020000.00000000.sdmp, Offset: 01252000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1252000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca9e9a3d3fdf23d5314bd53c6a234bf7d27af27384a8317af4854984af0d1ee
Instruction ID: c337ad2681611e73c43a20d588464e015c748c2b8f2cbc897875300fe587a76a
Opcode Fuzzy Hash: 4ca9e9a3d3fdf23d5314bd53c6a234bf7d27af27384a8317af4854984af0d1ee
Instruction Fuzzy Hash: 39D02E39200792CFE3128A1CC1A4F893FE4AB61704F0A00FDAC008B3A3C328D480C200

Uniqueness

Uniqueness Score: -1.00%

Function 012523BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2561169745.0000000001252000.00000040.00000800.00020000.00000000.sdmp, Offset: 01252000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1252000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85565659ad750530c1abdedbc51fa945e075d19558568bdedbc9f32540e7261a
Instruction ID: bfab5c51d756ec557d4318d269e4365b55ee2c39d585721a71d7c083c2f1b027
Opcode Fuzzy Hash: 85565659ad750530c1abdedbc51fa945e075d19558568bdedbc9f32540e7261a
Instruction Fuzzy Hash: DDD05E34200282CBD725DB1CC2D4F5937D4AB40714F0644ECBD108B3A6C7B8E8C0CA40

Uniqueness

Uniqueness Score: -1.00%

Function 05430DE0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2563362540.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5430000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 503a6b93baf27f37ddfb59e4400558745f2faf52728db3676f6943759b5acacd
Instruction ID: 0645816673f668346abad788a5ea5066fe013638b01c0850b1c9522906151f0f
Opcode Fuzzy Hash: 503a6b93baf27f37ddfb59e4400558745f2faf52728db3676f6943759b5acacd
Instruction Fuzzy Hash: 1EC012303002048BD70497B9D41EA6A7396ABC4714F45C1A5940D0B362CA74EC40D680

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Setup.exePID: 2136, Parent PID: 1448COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26.5%
Total number of Nodes:	1673
Total number of Limit Nodes:	13

Executed Functions

Function 00000001400013C0 Relevance: 153.1, APIs: 60, Strings: 27, Instructions: 801stringwindowsynchronizationCOMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNELBASE ref: 0000000140001506

Part of subcall function 00000001400070F0: RegOpenKeyExA.KERNELBASE ref: 0000000140007129
Part of subcall function 00000001400070F0: RegQueryValueExA.ADVAPI32 ref: 0000000140007159
Part of subcall function 00000001400070F0: RegCloseKey.ADVAPI32 ref: 0000000140007177

lstrlenA.KERNEL32 ref: 0000000140001554
LoadStringA.USER32 ref: 00000001400015CF
LoadStringA.USER32 ref: 00000001400015EA
MessageBoxA.USER32 ref: 0000000140001615

Part of subcall function 0000000140007190: GetModuleFileNameA.KERNEL32 ref: 00000001400071EE
Part of subcall function 0000000140007190: swprintf.LIBCMT ref: 0000000140007258
Part of subcall function 0000000140007190: GetFileAttributesA.KERNEL32 ref: 0000000140007265

OutputDebugStringA.KERNEL32 ref: 0000000140001625
lstrcpyA.KERNEL32 ref: 000000014000165C
LoadStringA.USER32 ref: 0000000140001677
GetModuleFileNameA.KERNEL32 ref: 000000014000168D
GetLastError.KERNEL32 ref: 0000000140001697
lstrlenA.KERNEL32 ref: 00000001400016D2
lstrlenA.KERNEL32 ref: 00000001400016E2
OutputDebugStringA.KERNEL32 ref: 00000001400016FA
LoadStringA.USER32 ref: 0000000140001741
MessageBoxA.USER32 ref: 000000014000175D
CloseHandle.KERNEL32 ref: 0000000140001778
ExitWindowsEx.USER32 ref: 00000001400017A4
CreateMutexA.KERNEL32 ref: 0000000140001860
GetLastError.KERNEL32 ref: 0000000140001872
lstrlenA.KERNEL32 ref: 00000001400018DF
lstrlenA.KERNEL32 ref: 0000000140001926

Part of subcall function 0000000140006AA0: GetEnvironmentVariableA.KERNEL32 ref: 0000000140006AFF

Part of subcall function 0000000140006370: LoadStringA.USER32 ref: 00000001400063C1
Part of subcall function 0000000140006370: MessageBoxA.USER32 ref: 00000001400063D8

Part of subcall function 0000000140006760: LoadStringA.USER32 ref: 0000000140006795
Part of subcall function 0000000140006760: MessageBoxA.USER32 ref: 00000001400067AC

Strings

DEFAULT, xrefs: 00000001400018D8, 000000014000191F, 000000014000192C
NOCHECK=1, xrefs: 0000000140001F5A, 0000000140001FD2
PRODUCTNAME, xrefs: 0000000140001981
TEST, xrefs: 0000000140001FEC
[Info] The product version is '%s'. Build version is %s, xrefs: 0000000140001E6A
REINSTALL=ALL REINSTALLMODE=vomus, xrefs: 0000000140001EDE, 0000000140001F89
OPERATION, xrefs: 0000000140001888
[Info] Unable to process product code. Will treat as first time install..., xrefs: 0000000140001F06
SELECT `Value` FROM `Property` WHERE `Property`='BUILDVERSION', xrefs: 0000000140001E0C
[Info] MsiQueryProductState returned %d, xrefs: 0000000140001D6A
[Info] Calling MsiInstallProduct with szInstallPath = %s, xrefs: 0000000140001CB4
SELECT `Value` FROM `Property` WHERE `Property`='ProductCode', xrefs: 0000000140001CFD
{null}, xrefs: 0000000140001CC6
ACTION=ADMIN, xrefs: 0000000140001F28, 0000000140001FB1
and szCommandLine = %s, xrefs: 0000000140001CCD
WIXFAILWHENDEFERRED=1, xrefs: 0000000140001F3F, 00000001400020A5
[Info] Setting Internal UI level to None..., xrefs: 0000000140001C96
[Info]The $WinPEDriver$ folder is missing., xrefs: 000000014000154D, 0000000140001572
[Info] MsiInstallProduct returned %d, xrefs: 0000000140002070
[Info] we are running from --> %s, xrefs: 00000001400016CB, 00000001400016F3, 00000001400017ED
Global\_MSISETUP_{2956EBA1-9B5A-4679-8618-357136DA66CA}, xrefs: 0000000140001855
[Info] The product code '%s' is unknown. Will use first time install logic..., xrefs: 0000000140001D92
[Info] The product code '%s' is known. Will use QFE recache and reinstall upgrade logic..., xrefs: 0000000140001EEF
DATABASE, xrefs: 0000000140001A29
SELECT `Value` FROM `Property` WHERE `Property`='BOOTCAMPVERSION', xrefs: 0000000140001DA7
[Info]Tried to install on non-supported machine., xrefs: 00000001400015AC
[Info] Setup exit code is %d, xrefs: 000000014000177E

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: String$Load$lstrlen$Message$File$CloseDebugErrorLastModuleNameOutput$AttributesCreateDefaultEnvironmentExitHandleLangMutexOpenQueryUserValueVariableWindowslstrcpyswprintf
String ID: ACTION=ADMIN$ NOCHECK=1$ WIXFAILWHENDEFERRED=1$ and szCommandLine = %s$DATABASE$DEFAULT$Global\_MSISETUP_{2956EBA1-9B5A-4679-8618-357136DA66CA}$OPERATION$PRODUCTNAME$REINSTALL=ALL REINSTALLMODE=vomus$SELECT `Value` FROM `Property` WHERE `Property`='BOOTCAMPVERSION'$SELECT `Value` FROM `Property` WHERE `Property`='BUILDVERSION'$SELECT `Value` FROM `Property` WHERE `Property`='ProductCode'$TEST$[Info] Calling MsiInstallProduct with szInstallPath = %s$[Info] MsiInstallProduct returned %d$[Info] MsiQueryProductState returned %d$[Info] Setting Internal UI level to None...$[Info] Setup exit code is %d$[Info] The product code '%s' is known. Will use QFE recache and reinstall upgrade logic...$[Info] The product code '%s' is unknown. Will use first time install logic...$[Info] The product version is '%s'. Build version is %s$[Info] Unable to process product code. Will treat as first time install...$[Info] we are running from --> %s$[Info]The $WinPEDriver$ folder is missing.$[Info]Tried to install on non-supported machine.${null}
API String ID: 3776285345-3652649882
Opcode ID: 492a93d4bf35a87ad2e6c9ee2a1dcfabbb31ed722c222eb3353a663bf44b9147
Instruction ID: 5dd39874a2594e5935f62990b0c4f50523e7494580dc72ee93de613c1e7da8f5
Opcode Fuzzy Hash: 492a93d4bf35a87ad2e6c9ee2a1dcfabbb31ed722c222eb3353a663bf44b9147
Instruction Fuzzy Hash: C8824CB1304B8286FB62DF62E8507E963A1B78D7C8F444025FB4A5BAB5EF39C645C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006CC0 Relevance: 40.5, APIs: 16, Strings: 7, Instructions: 286
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.LIBCMT ref: 0000000140006CE7

Part of subcall function 0000000140009184: _FF_MSGBANNER.LIBCMT ref: 00000001400091B4
Part of subcall function 0000000140009184: _NMSG_WRITE.LIBCMT ref: 00000001400091BE
Part of subcall function 0000000140009184: HeapAlloc.KERNEL32(?,?,00000000,000000014000BAD4,?,?,?,00000001400124A8,?,?,?,00000001400123A7,?,?,00000000,000000014000DC86), ref: 00000001400091D9
Part of subcall function 0000000140009184: _callnewh.LIBCMT ref: 00000001400091F2
Part of subcall function 0000000140009184: _errno.LIBCMT ref: 00000001400091FD
Part of subcall function 0000000140009184: _errno.LIBCMT ref: 0000000140009208

CoInitializeEx.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0000000140006D1B
CoInitializeSecurity.OLE32 ref: 0000000140006D4E
CoCreateInstance.OLE32 ref: 0000000140006D71

Part of subcall function 000000014000870C: malloc.LIBCMT ref: 0000000140008726

_com_util::ConvertStringToBSTR.COMSUPP ref: 0000000140006DA5
SysFreeString.OLEAUT32 ref: 0000000140006E05
CoSetProxyBlanket.OLE32 ref: 0000000140006E57
_com_util::ConvertStringToBSTR.COMSUPP ref: 0000000140006E8D
_com_util::ConvertStringToBSTR.COMSUPP ref: 0000000140006ED6
SysFreeString.OLEAUT32 ref: 0000000140006F2F
SysFreeString.OLEAUT32 ref: 0000000140006F61
VariantInit.OLEAUT32 ref: 0000000140006FC3
SysStringLen.OLEAUT32 ref: 0000000140006FF7
WideCharToMultiByte.KERNEL32 ref: 000000014000702F
VariantClear.OLEAUT32 ref: 000000014000708B

Part of subcall function 0000000140008F4C: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000000140008F7A
Part of subcall function 0000000140008F4C: _errno.LIBCMT ref: 0000000140008F8C
Part of subcall function 0000000140008F4C: _invalid_parameter_noinfo.LIBCMT ref: 0000000140008F97

free.LIBCMT ref: 00000001400070D0

Strings

Macmini7,1, xrefs: 0000000140006CFA
WQL, xrefs: 0000000140006ECF
Model, xrefs: 0000000140006FE1
SELECT * FROM Win32_ComputerSystem, xrefs: 0000000140006E86
ROOT\CIMV2, xrefs: 0000000140006D9E
MacPro6,1, xrefs: 000000014000705F
iMac15,1, xrefs: 0000000140006CEF

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: String$ConvertFree_com_util::_errno$InitializeLocaleVariantmalloc$AllocBlanketByteCharClearCreateHeapInitInstanceMultiProxySecurityUpdateUpdate::_Wide_callnewh_invalid_parameter_noinfofree
String ID: MacPro6,1$Macmini7,1$Model$ROOT\CIMV2$SELECT * FROM Win32_ComputerSystem$WQL$iMac15,1
API String ID: 3943282721-444484393
Opcode ID: 29419a901a661d50f3510c044d0b2aa8136d287a5bd46daeaf82df3cb8b2725a
Instruction ID: 5f9d45a053653e6728a337dd63a395dcb8e0be3b6e36e16bb48e48c3fe817ebf
Opcode Fuzzy Hash: 29419a901a661d50f3510c044d0b2aa8136d287a5bd46daeaf82df3cb8b2725a
Instruction Fuzzy Hash: C5C15872601B4086EB26DF22E490BED73A1FB88BC8F444225AF8E57BA4DF39C554C300

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000E56C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 000000014000E5AF

Strings

csm, xrefs: 000000014000E573

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: csm
API String ID: 3192549508-1018135373
Opcode ID: ffd4a30d5eb4e163ae67f0ab2f52308d7bf341d6e1f32ab6675892d0b3948657
Instruction ID: 60b24a33e0f8141b85781ddd1bda887ff8f5d68df9531bc4d8f89ddc60323a1f
Opcode Fuzzy Hash: ffd4a30d5eb4e163ae67f0ab2f52308d7bf341d6e1f32ab6675892d0b3948657
Instruction Fuzzy Hash: 48E06571A10481C6DB5AEB27AC853DC2AE0A75C749FA00C12E309536B1F639C992CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000973C Relevance: 24.1, APIs: 16, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__security_init_cookie.LIBCMT ref: 0000000140009740

Part of subcall function 000000014000EF68: GetSystemTimeAsFileTime.KERNEL32 ref: 000000014000EF94
Part of subcall function 000000014000EF68: GetCurrentThreadId.KERNEL32 ref: 000000014000EFA2
Part of subcall function 000000014000EF68: GetTickCount64.KERNEL32 ref: 000000014000EFAE
Part of subcall function 000000014000EF68: GetTickCount64.KERNEL32 ref: 000000014000EFBC
Part of subcall function 000000014000EF68: QueryPerformanceCounter.KERNEL32 ref: 000000014000EFCA

__crtGetShowWindowMode.LIBCMT ref: 000000014000975F

Part of subcall function 000000014000E498: GetStartupInfoW.KERNEL32 ref: 000000014000E4A4

_heap_init.LIBCMT ref: 00000001400097BF
_FF_MSGBANNER.LIBCMT ref: 00000001400097D1
_NMSG_WRITE.LIBCMT ref: 00000001400097DB
_mtinit.LIBCMT ref: 00000001400097EA
_FF_MSGBANNER.LIBCMT ref: 00000001400097FC
_NMSG_WRITE.LIBCMT ref: 0000000140009806
_RTC_Initialize.LIBCMT ref: 0000000140009815
_ioinit0.LIBCMT ref: 000000014000981B
GetCommandLineA.KERNEL32 ref: 0000000140009820
__crtGetEnvironmentStringsA.LIBCMT ref: 000000014000982D
__setargv.LIBCMT ref: 0000000140009839
_setenvp.LIBCMT ref: 000000014000984C
_cinit.LIBCMT ref: 0000000140009864
_wincmdln.LIBCMT ref: 0000000140009874

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: Count64TickTime__crt$CommandCounterCurrentEnvironmentFileInfoInitializeLineModePerformanceQueryShowStartupStringsSystemThreadWindow__security_init_cookie__setargv_cinit_heap_init_ioinit0_mtinit_setenvp_wincmdln
String ID:
API String ID: 3395840663-0
Opcode ID: f08b4946686aaf6c71722fed97c829b586fb45c40814c5f8341f0389e2757bc5
Instruction ID: 623e9ce3e5e3abab2b507cea21361e2669f3c141c310b490facaa68f0baa66e5
Opcode Fuzzy Hash: f08b4946686aaf6c71722fed97c829b586fb45c40814c5f8341f0389e2757bc5
Instruction Fuzzy Hash: E7415CF1A0468282FB57FBA3B4553E922A5AB8D3C4F004439F749577F3EE3988819751

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400070F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE ref: 0000000140007129
RegQueryValueExA.ADVAPI32 ref: 0000000140007159
RegCloseKey.ADVAPI32 ref: 0000000140007177

Strings

SOFTWARE\Apple Inc.\Boot Camp, xrefs: 00000001400070FB
NoCheck, xrefs: 000000014000713D

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: NoCheck$SOFTWARE\Apple Inc.\Boot Camp
API String ID: 3677997916-2444921057
Opcode ID: 2943187bdb7876eae1ded913c2db0ea076d8e2897698d91fa99db3f0b87d6817
Instruction ID: 9eb318e93d322d3040fcd00918335920723c63381bb3d6f0aa14842851e016d4
Opcode Fuzzy Hash: 2943187bdb7876eae1ded913c2db0ea076d8e2897698d91fa99db3f0b87d6817
Instruction Fuzzy Hash: 8D015E71314A4586EB61CB25F854B9AB3B4FB893D8F800111FB8C47AB4EB7DC248CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140007B9F Relevance: 7.6, APIs: 5, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32 ref: 0000000140007BD3
free.LIBCMT ref: 0000000140007BE8
GetLastError.KERNEL32 ref: 0000000140007BED
SysAllocString.OLEAUT32 ref: 0000000140007C0A
free.LIBCMT ref: 0000000140007C1E

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: free$AllocByteCharErrorLastMultiStringWide
String ID:
API String ID: 2461177162-0
Opcode ID: e198960d4ae3b605b6f74f4c749734dcc6320042adbe29efb01151741a6328ee
Instruction ID: d1e77b57303dc56b3fb4972db07ff16c5181c6475266d6f9857bad4be707a737
Opcode Fuzzy Hash: e198960d4ae3b605b6f74f4c749734dcc6320042adbe29efb01151741a6328ee
Instruction Fuzzy Hash: 51114271B0068586FB16EF23A855BD82391A74CBD8F184439BF0D57BA9CE7CC5814340

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0000000140003220 Relevance: 73.7, APIs: 41, Strings: 1, Instructions: 237
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongPtrA.USER32 ref: 00000001400032A5
GetParent.USER32 ref: 00000001400032F2
PostMessageA.USER32 ref: 0000000140003309
GetParent.USER32 ref: 0000000140003314
PostMessageA.USER32 ref: 0000000140003328
GetModuleHandleA.KERNEL32 ref: 0000000140003330
LoadStringA.USER32 ref: 0000000140003349
GetParent.USER32 ref: 0000000140003352
SetWindowLongPtrA.USER32 ref: 000000014000336E
GetDlgItem.USER32 ref: 000000014000337C
GetFileAttributesA.KERNEL32 ref: 000000014000338C
PostMessageA.USER32 ref: 00000001400033B2
PostMessageA.USER32 ref: 00000001400033C7
GetDlgItem.USER32 ref: 00000001400033D5
SendMessageA.USER32 ref: 00000001400033EB
GetObjectA.GDI32 ref: 00000001400033FE
CreateFontIndirectA.GDI32 ref: 0000000140003411
SendMessageA.USER32 ref: 0000000140003424
GetModuleHandleA.KERNEL32 ref: 000000014000343F
LoadStringA.USER32 ref: 000000014000345B
SetDlgItemTextA.USER32 ref: 0000000140003471
GetModuleHandleA.KERNEL32 ref: 0000000140003479
LoadStringA.USER32 ref: 0000000140003495
SetDlgItemTextA.USER32 ref: 00000001400034AB
GetDlgItem.USER32 ref: 00000001400034B9
SendMessageA.USER32 ref: 00000001400034D2
SendMessageA.USER32 ref: 00000001400034E6
PostMessageA.USER32 ref: 00000001400034FB
GetModuleHandleA.KERNEL32 ref: 000000014000351D
LoadStringA.USER32 ref: 0000000140003536
GetParent.USER32 ref: 000000014000353F
SendMessageA.USER32 ref: 0000000140003556
GetParent.USER32 ref: 000000014000355F
SetDlgItemTextA.USER32 ref: 0000000140003572
GetUserDefaultLangID.KERNEL32 ref: 000000014000358A
GetModuleHandleA.KERNEL32 ref: 0000000140003595
LoadStringA.USER32 ref: 00000001400035B1
GetModuleHandleA.KERNEL32 ref: 00000001400035B9
LoadStringA.USER32 ref: 00000001400035D5
GetParent.USER32 ref: 00000001400035F3
MessageBoxA.USER32 ref: 000000014000360F

Strings

1033, xrefs: 0000000140003431

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: Message$HandleItemLoadModuleParentString$PostSend$Text$LongWindow$AttributesCreateDefaultFileFontIndirectLangObjectUser
String ID: 1033
API String ID: 3656578107-100901230
Opcode ID: 6443dccf40f6c3e5592d29f9a095559880a82c33e2823e1e22ef6dce1ca5b3db
Instruction ID: ee1b9297825838a9e50aadfe08036640eeeb11e0cbabc014e03eb3852e539063
Opcode Fuzzy Hash: 6443dccf40f6c3e5592d29f9a095559880a82c33e2823e1e22ef6dce1ca5b3db
Instruction Fuzzy Hash: A2A16F71304A8583FB669B63E8547EA2361E78DBD5F404125EF1A4BBB4CF3EC64A8701

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140003660 Relevance: 63.2, APIs: 34, Strings: 2, Instructions: 223
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongPtrA.USER32 ref: 00000001400036E3
GetModuleHandleA.KERNEL32 ref: 0000000140003723
LoadStringA.USER32 ref: 0000000140003739
SetDlgItemTextA.USER32 ref: 000000014000374B
GetModuleHandleA.KERNEL32 ref: 0000000140003753
LoadStringA.USER32 ref: 0000000140003769
SetDlgItemTextA.USER32 ref: 000000014000377B
GetDlgItem.USER32 ref: 0000000140003789
SendMessageA.USER32 ref: 000000014000379F
GetObjectA.GDI32 ref: 00000001400037B2
CreateFontIndirectA.GDI32 ref: 00000001400037C5
SendMessageA.USER32 ref: 00000001400037D8
GetParent.USER32 ref: 00000001400037E1
GetWindowRect.USER32 ref: 00000001400037FB
SystemParametersInfoA.USER32 ref: 0000000140003822
GetSystemMetrics.USER32 ref: 0000000140003833
GetSystemMetrics.USER32 ref: 0000000140003842
GetParent.USER32 ref: 00000001400038A4
MoveWindow.USER32 ref: 00000001400038C2
GetParent.USER32 ref: 00000001400038F5
PostMessageA.USER32 ref: 000000014000390C
GetModuleHandleA.KERNEL32 ref: 0000000140003914
LoadStringA.USER32 ref: 000000014000392C
GetParent.USER32 ref: 0000000140003935
SetDlgItemTextA.USER32 ref: 0000000140003947
GetUserDefaultLangID.KERNEL32 ref: 0000000140003952
GetModuleHandleA.KERNEL32 ref: 000000014000395D
LoadStringA.USER32 ref: 0000000140003978
GetModuleHandleA.KERNEL32 ref: 0000000140003980
LoadStringA.USER32 ref: 000000014000399B
GetParent.USER32 ref: 00000001400039B9
MessageBoxA.USER32 ref: 00000001400039D3
SetWindowLongPtrA.USER32 ref: 00000001400039E6
SetWindowLongA.USER32 ref: 00000001400039FE

Strings

1033, xrefs: 0000000140003705
N, xrefs: 00000001400036E9

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: HandleLoadModuleParentStringWindow$ItemMessage$LongSystemText$MetricsSend$CreateDefaultFontIndirectInfoLangMoveObjectParametersPostRectUser
String ID: 1033$N
API String ID: 1125170688-2080001178
Opcode ID: 0818285ab519e9123fc0727e0551c8f2eb3491f82f12f291312593e14e6a4086
Instruction ID: 6980b23c8a5f9ac8363c888ef59c0f49eddd0b7d6e55a63c38ee6d50d062dcc8
Opcode Fuzzy Hash: 0818285ab519e9123fc0727e0551c8f2eb3491f82f12f291312593e14e6a4086
Instruction Fuzzy Hash: 0DA15B72614B8186EB26CB66E8547EE7761F78DBC8F400025EF4A5BBA4CF3DD6498700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002E20 Relevance: 61.5, APIs: 34, Strings: 1, Instructions: 232
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongPtrA.USER32 ref: 0000000140002EA6
SetWindowLongPtrA.USER32 ref: 0000000140002EDD
GetParent.USER32 ref: 0000000140002EE6
GetWindowRect.USER32 ref: 0000000140002F00
SystemParametersInfoA.USER32 ref: 0000000140002F27
GetSystemMetrics.USER32 ref: 0000000140002F38
GetSystemMetrics.USER32 ref: 0000000140002F47
GetParent.USER32 ref: 0000000140002FA9
MoveWindow.USER32 ref: 0000000140002FC7
GetDlgItem.USER32 ref: 0000000140002FD5
SendMessageA.USER32 ref: 0000000140002FEB
GetObjectA.GDI32 ref: 0000000140002FFE
CreateFontIndirectA.GDI32 ref: 0000000140003011
SendMessageA.USER32 ref: 0000000140003024
GetModuleHandleA.KERNEL32 ref: 000000014000302C
LoadStringA.USER32 ref: 0000000140003044
SetDlgItemTextA.USER32 ref: 0000000140003081
GetModuleHandleA.KERNEL32 ref: 00000001400030B0
LoadStringA.USER32 ref: 00000001400030C8
SetDlgItemTextA.USER32 ref: 00000001400030DA
GetModuleHandleA.KERNEL32 ref: 00000001400030E2
LoadStringA.USER32 ref: 00000001400030FA
SetDlgItemTextA.USER32 ref: 000000014000310C
GetParent.USER32 ref: 000000014000312F
PostMessageA.USER32 ref: 0000000140003146
GetUserDefaultLangID.KERNEL32 ref: 0000000140003151
GetModuleHandleA.KERNEL32 ref: 000000014000315C
LoadStringA.USER32 ref: 0000000140003177
GetModuleHandleA.KERNEL32 ref: 000000014000317F
LoadStringA.USER32 ref: 000000014000319A
GetParent.USER32 ref: 00000001400031B8
MessageBoxA.USER32 ref: 00000001400031D2
SetWindowLongPtrA.USER32 ref: 00000001400031E5
SetWindowLongA.USER32 ref: 00000001400031FD

Strings

1033, xrefs: 000000014000309E

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: Window$HandleLoadModuleString$ItemLongMessageParent$SystemText$MetricsSend$CreateDefaultFontIndirectInfoLangMoveObjectParametersPostRectUser
String ID: 1033
API String ID: 450560297-100901230
Opcode ID: b562b7e381174e37cae1488aeaa09a682d1f55df1b0474dd787eb923b07e6a53
Instruction ID: 565d74ed33ec9206636f7fc2d17f9765e62b4ff72c00127a4323559cca3b5df4
Opcode Fuzzy Hash: b562b7e381174e37cae1488aeaa09a682d1f55df1b0474dd787eb923b07e6a53
Instruction Fuzzy Hash: 5AA16B72614A8187EB66CB66E8547DE3761F78DB88F400025EF4A5BBA4DF3DC64AC700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140003A30 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 220
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongPtrA.USER32 ref: 0000000140003AB3
GetDlgItem.USER32 ref: 0000000140003AED
SendMessageA.USER32 ref: 0000000140003B03
GetObjectA.GDI32 ref: 0000000140003B16
CreateFontIndirectA.GDI32 ref: 0000000140003B29
SendMessageA.USER32 ref: 0000000140003B3C
GetParent.USER32 ref: 0000000140003B45
GetParent.USER32 ref: 0000000140003B55
GetWindowRect.USER32 ref: 0000000140003B6F
SystemParametersInfoA.USER32 ref: 0000000140003B96
GetSystemMetrics.USER32 ref: 0000000140003BA7
GetSystemMetrics.USER32 ref: 0000000140003BB6
GetParent.USER32 ref: 0000000140003C18
MoveWindow.USER32 ref: 0000000140003C36
GetModuleHandleA.KERNEL32 ref: 0000000140003C3E
LoadStringA.USER32 ref: 0000000140003C56
SetDlgItemTextA.USER32 ref: 0000000140003C7C
GetModuleHandleA.KERNEL32 ref: 0000000140003C84
LoadStringA.USER32 ref: 0000000140003C9C
SetDlgItemTextA.USER32 ref: 0000000140003CB6
GetParent.USER32 ref: 0000000140003CD9
PostMessageA.USER32 ref: 0000000140003CED
GetDlgItem.USER32 ref: 0000000140003CFF
EnableWindow.USER32 ref: 0000000140003D0A
GetUserDefaultLangID.KERNEL32 ref: 0000000140003D15
GetModuleHandleA.KERNEL32 ref: 0000000140003D20
LoadStringA.USER32 ref: 0000000140003D3B
GetModuleHandleA.KERNEL32 ref: 0000000140003D43
LoadStringA.USER32 ref: 0000000140003D5E
GetParent.USER32 ref: 0000000140003D7C
MessageBoxA.USER32 ref: 0000000140003D96
SetWindowLongPtrA.USER32 ref: 0000000140003DA9
SetWindowLongA.USER32 ref: 0000000140003DC1

Strings

N, xrefs: 0000000140003AB9

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: Window$Parent$HandleItemLoadMessageModuleString$LongSystem$MetricsSendText$CreateDefaultEnableFontIndirectInfoLangMoveObjectParametersPostRectUser
String ID: N
API String ID: 3059970044-1130791706
Opcode ID: ee79735b909b4cfa6d9420a29c1c2d934b4a44e1a0edaeda5a3be89b04aaacd9
Instruction ID: 5711482b17b0264abfc5ebb2a9b0f549109c2e77f3ac9d239ccd4c096537ebe8
Opcode Fuzzy Hash: ee79735b909b4cfa6d9420a29c1c2d934b4a44e1a0edaeda5a3be89b04aaacd9
Instruction Fuzzy Hash: A1A13971314A818BE726CB66A8547DA77A5EB8DBC8F400025EF4A4BBA4DF3DD649C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140003DF0 Relevance: 58.7, APIs: 39, Instructions: 245
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongPtrA.USER32 ref: 0000000140003E6E
SetWindowLongPtrA.USER32 ref: 0000000140003EA5
GetParent.USER32 ref: 0000000140003EAE
GetWindowRect.USER32 ref: 0000000140003EC8
SystemParametersInfoA.USER32 ref: 0000000140003EF5
GetSystemMetrics.USER32 ref: 0000000140003F06
GetSystemMetrics.USER32 ref: 0000000140003F13
GetParent.USER32 ref: 0000000140003F75
MoveWindow.USER32 ref: 0000000140003F90
GetParent.USER32 ref: 0000000140003F99
GetDlgItem.USER32 ref: 0000000140003FA7
ShowWindow.USER32 ref: 0000000140003FC7
GetModuleHandleA.KERNEL32 ref: 0000000140003FDB
LoadStringA.USER32 ref: 0000000140003FF4
SetDlgItemTextA.USER32 ref: 0000000140004007
GetModuleHandleA.KERNEL32 ref: 000000014000400F
LoadStringA.USER32 ref: 0000000140004028
SetDlgItemTextA.USER32 ref: 000000014000403B
GetModuleHandleA.KERNEL32 ref: 0000000140004043
LoadStringA.USER32 ref: 000000014000405C
SetDlgItemTextA.USER32 ref: 000000014000406F
GetModuleHandleA.KERNEL32 ref: 000000014000407A
LoadStringA.USER32 ref: 0000000140004093
SetDlgItemTextA.USER32 ref: 00000001400040A6
GetModuleHandleA.KERNEL32 ref: 00000001400040AE
LoadStringA.USER32 ref: 00000001400040C7
SetDlgItemTextA.USER32 ref: 00000001400040DA
GetModuleHandleA.KERNEL32 ref: 00000001400040E2
LoadStringA.USER32 ref: 00000001400040FB
SetDlgItemTextA.USER32 ref: 000000014000410E
GetParent.USER32 ref: 0000000140004131
PostMessageA.USER32 ref: 0000000140004148
GetUserDefaultLangID.KERNEL32 ref: 0000000140004160
GetModuleHandleA.KERNEL32 ref: 000000014000416B
LoadStringA.USER32 ref: 0000000140004186
GetModuleHandleA.KERNEL32 ref: 000000014000418E
LoadStringA.USER32 ref: 00000001400041A6
GetParent.USER32 ref: 00000001400041C4
MessageBoxA.USER32 ref: 00000001400041DB

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: HandleLoadModuleString$Item$Text$ParentWindow$System$LongMessageMetrics$DefaultInfoLangMoveParametersPostRectShowUser
String ID:
API String ID: 106919445-0
Opcode ID: 4906a6a1368ef5b703a990cd7f5aa2b8881a4c6c2a5ad130bb51c36222df8acd
Instruction ID: 9435ec0c1f28fe93f2c519bb9c82fcce937ffb0bb444456770fcb312c7a883ef
Opcode Fuzzy Hash: 4906a6a1368ef5b703a990cd7f5aa2b8881a4c6c2a5ad130bb51c36222df8acd
Instruction Fuzzy Hash: FAB17D71618A8587EB268B66E8047EA7361F78DBC4F400025EF4A5BBA4CF3DD64AC740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140005020 Relevance: 46.0, APIs: 22, Strings: 4, Instructions: 548
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000000014000511F
LoadStringA.USER32 ref: 000000014000513A
SetDlgItemTextA.USER32 ref: 0000000140005153

Part of subcall function 00000001400028B0: GetDlgItem.USER32 ref: 00000001400028C4
Part of subcall function 00000001400028B0: SendMessageA.USER32 ref: 00000001400028DD
Part of subcall function 00000001400028B0: PeekMessageA.USER32 ref: 00000001400028FE
Part of subcall function 00000001400028B0: IsDialogMessageA.USER32(?,?,?,?,?,?,?,0000000140005163), ref: 000000014000291C
Part of subcall function 00000001400028B0: TranslateMessage.USER32 ref: 000000014000292B
Part of subcall function 00000001400028B0: DispatchMessageA.USER32 ref: 0000000140002936
Part of subcall function 00000001400028B0: PeekMessageA.USER32 ref: 0000000140002951

#8.MSI ref: 000000014000516B
#91.MSI ref: 0000000140005180
#8.MSI ref: 00000001400051A4
#31.MSI ref: 00000001400051BD
#159.MSI ref: 00000001400051C9
#8.MSI ref: 00000001400051EB
#160.MSI ref: 00000001400051FF
#116.MSI ref: 0000000140005219
#117.MSI ref: 0000000140005247
#117.MSI ref: 00000001400056F3
#31.MSI ref: 0000000140005728
#159.MSI ref: 000000014000573C
#160.MSI ref: 0000000140005753
#117.MSI ref: 000000014000577C
#8.MSI ref: 0000000140005858
#8.MSI ref: 000000014000586A
#8.MSI ref: 00000001400058CD
#8.MSI ref: 00000001400058DC
#8.MSI ref: 00000001400058EB

Strings

vector<T> too long, xrefs: 0000000140005875, 0000000140005882, 000000014000588F, 000000014000589C
select * from PreInstalls where `Condition`='1', xrefs: 0000000140005186
select `Action`,`Description` from ActionText where `Action`='%s', xrefs: 0000000140005708
MsiRecordGetString failed with %u, xrefs: 00000001400058AC

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: Message$#117$#159#160ItemPeek$#116DialogDispatchHandleLoadModuleSendStringTextTranslate
String ID: MsiRecordGetString failed with %u$select * from PreInstalls where `Condition`='1'$select `Action`,`Description` from ActionText where `Action`='%s'$vector<T> too long
API String ID: 465515157-1220850285
Opcode ID: 66150aa4105d8d98d0a759c5a3ce2c42815ae629bf45140cc0ff4c390bb29798
Instruction ID: a3e08a819708c09b703566e556a7ab1df278e87d94b6b040e4694e77595f06fb
Opcode Fuzzy Hash: 66150aa4105d8d98d0a759c5a3ce2c42815ae629bf45140cc0ff4c390bb29798
Instruction Fuzzy Hash: 6742BDB2204B8586EB26DF26F8443DA77A1F38E7D5F844125EB5A07AB8DF78C584C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140007780 Relevance: 38.7, APIs: 11, Strings: 11, Instructions: 216
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?), ref: 00000001400077B9
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?), ref: 00000001400077EA
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?), ref: 0000000140007802
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?), ref: 000000014000783A
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?), ref: 0000000140007876
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?), ref: 0000000140007883

Strings

CertCompareCertificate, xrefs: 00000001400077D3
FALSE, xrefs: 0000000140007903
[WVT] step 1: silently call WinVerifyTrust on szSetupExe, ignoring return value, xrefs: 00000001400078B4
crypt32.dll, xrefs: 000000014000779C
[WVT] step3: last call to WinVerifyTrust using full UI, xrefs: 0000000140007A55
[WVT] step3: last call to WinVerifyTrust showing UI only if something is wrong, xrefs: 0000000140007A37
TRUE, xrefs: 00000001400078FC, 00000001400079F0
[WVT] fSetupExeIsSigned = %s, xrefs: 0000000140007910
[WVT] step2: silently call WinVerifyTrust on szPackage, ignoring return value, xrefs: 00000001400079AD
CertFreeCertificateContext, xrefs: 00000001400077F0
[WVT] fPackageIsSigned = %s, xrefs: 00000001400079F7

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: AddressByteCharLibraryMultiProcWide$FreeLoad
String ID: CertCompareCertificate$CertFreeCertificateContext$FALSE$TRUE$[WVT] fPackageIsSigned = %s$[WVT] fSetupExeIsSigned = %s$[WVT] step 1: silently call WinVerifyTrust on szSetupExe, ignoring return value$[WVT] step2: silently call WinVerifyTrust on szPackage, ignoring return value$[WVT] step3: last call to WinVerifyTrust showing UI only if something is wrong$[WVT] step3: last call to WinVerifyTrust using full UI$crypt32.dll
API String ID: 52142658-3633285563
Opcode ID: 229fc2ae9984a55e5f56726c456325e817b1ff9245de8f381b7910bba86fa1ae
Instruction ID: f84759423301e748d48d085546b0897b0432b768cdafb792bd31e24f13d1492e
Opcode Fuzzy Hash: 229fc2ae9984a55e5f56726c456325e817b1ff9245de8f381b7910bba86fa1ae
Instruction Fuzzy Hash: C081C3B270468185EB66DB27B810BEA6391B78DBE4F440225BF9D4B7E5EF3DC5448700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140004480 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 70fileCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32 ref: 00000001400044CB
FindResourceA.KERNEL32 ref: 00000001400044E2
LoadResource.KERNEL32 ref: 0000000140004502
LockResource.KERNEL32 ref: 000000014000450B
SizeofResource.KERNEL32 ref: 000000014000451A
CreateFileA.KERNEL32 ref: 000000014000456A
WriteFile.KERNEL32 ref: 000000014000458A
CloseHandle.KERNEL32 ref: 000000014000459F
CloseHandle.KERNEL32 ref: 00000001400045A9

Strings

EULA, xrefs: 00000001400044D8
EULA_RESOURCE, xrefs: 00000001400044D1
%s\License.rtf, xrefs: 0000000140004525

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: Resource$CloseFileHandle$CreateFindLoadLockPathSizeofTempWrite
String ID: %s\License.rtf$EULA$EULA_RESOURCE
API String ID: 1266430326-3951416758
Opcode ID: 62e14cefd11ee29ccb3dee7ee1d76f8c15a2bde785221d676fbf323c7434a3d2
Instruction ID: aec14630bc0ee82a69860cfb9b9f59af7bd74c196becaa1e5e7114b5b8077034
Opcode Fuzzy Hash: 62e14cefd11ee29ccb3dee7ee1d76f8c15a2bde785221d676fbf323c7434a3d2
Instruction Fuzzy Hash: D9316DB1204A8592EB62DB52F8547DA73A0FB8DBC8F444015EF8D0BB69DF7DC1498B40

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400045E0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 60stringwindowmemoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000000140004616
FormatMessageA.KERNEL32 ref: 0000000140004643
lstrlenA.KERNEL32 ref: 0000000140004650
lstrlenA.KERNEL32 ref: 000000014000465D
LocalAlloc.KERNEL32 ref: 0000000140004670
LocalSize.KERNEL32 ref: 000000014000467C
MessageBoxA.USER32 ref: 00000001400046B8
LocalFree.KERNEL32 ref: 00000001400046C3
LocalFree.KERNEL32 ref: 00000001400046CC

Strings

Error, xrefs: 00000001400046A9
%s failed with error %d: %s, xrefs: 0000000140004689
SetDlgItemText, xrefs: 0000000140004649, 0000000140004682

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: Local$FreeMessagelstrlen$AllocErrorFormatLastSize
String ID: %s failed with error %d: %s$Error$SetDlgItemText
API String ID: 3240617171-1564305964
Opcode ID: 6ea0bbb2742123050dc3e0aa37afa94a384e47974b9cab03e9958e9ce504da1e
Instruction ID: 8c0ddf78a377917c62d2d58498ff89943aa198d80c436818499fe9bd6d124291
Opcode Fuzzy Hash: 6ea0bbb2742123050dc3e0aa37afa94a384e47974b9cab03e9958e9ce504da1e
Instruction Fuzzy Hash: 31212B72218A4596EB22DB62F8547DA73A1F78DB84F440025EB8E4B774EF3DC249CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400068A0 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00000001400068D8

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: e296b1268b2937f41358b9d73c1484dc1f0fe95aa1c8ee732b900886a53f2a35
Instruction ID: 9a6056c440d4c7c081bcd8bbd600809093bdff8ee569538038abac384940bfbf
Opcode Fuzzy Hash: e296b1268b2937f41358b9d73c1484dc1f0fe95aa1c8ee732b900886a53f2a35
Instruction Fuzzy Hash: ED1182B650014486FA71EB22E411BE9B351FB9D38CF804211E749176A6DF3DD61ECF00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140004700 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 246windowstringCOMMON

Download Yara Rule

APIs

#141.MSI ref: 0000000140004743
#117.MSI ref: 00000001400047EC
MessageBoxA.USER32 ref: 0000000140004803
#117.MSI ref: 000000014000481F
MessageBeep.USER32 ref: 000000014000482E
MessageBoxExA.USER32 ref: 0000000140004851
#117.MSI ref: 0000000140004A54
#117.MSI ref: 0000000140004A6C
SetDlgItemTextA.USER32 ref: 0000000140004ABF
strstr.LIBCMT ref: 0000000140004AD0

Strings

CA_, xrefs: 0000000140004AC5
Error, xrefs: 000000014000483B
FatalError, xrefs: 000000014000485C
Warning, xrefs: 00000001400047F2
Rollback, xrefs: 0000000140004A76

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: #117$Message$#141BeepItemTextstrstr
String ID: CA_$Error$FatalError$Rollback$Warning
API String ID: 2774621727-968721647
Opcode ID: 8f5920fbfb64fb4c34f1e9c02dba620b09f10989986a58e337f9c9c458203d8c
Instruction ID: e3779beb72ad6745464998d622353ef91583e88b5cb1212a878dfd9090c0cef9
Opcode Fuzzy Hash: 8f5920fbfb64fb4c34f1e9c02dba620b09f10989986a58e337f9c9c458203d8c
Instruction Fuzzy Hash: 6BC168B120464197FB26CB66F8403EA33A1F78D7C8F50452AFB0657AB5DB39C945CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400074C0 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 173libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000000140007583
GetProcAddress.KERNEL32 ref: 00000001400075AF
GetProcAddress.KERNEL32 ref: 00000001400075C2
GetProcAddress.KERNEL32 ref: 00000001400075D5
GetProcAddress.KERNEL32 ref: 00000001400075ED
LoadLibraryA.KERNEL32 ref: 00000001400076BD
GetProcAddress.KERNEL32 ref: 00000001400076D5
FreeLibrary.KERNEL32 ref: 00000001400076EC
FreeLibrary.KERNEL32 ref: 000000014000771B
FreeLibrary.KERNEL32 ref: 0000000140007745

Strings

wintrust.dll, xrefs: 0000000140007554
WTHelperGetProvSignerFromChain, xrefs: 00000001400075C8
WTHelperProvDataFromStateData, xrefs: 00000001400075B5
crypt32.dll, xrefs: 00000001400076B6
CertDuplicateCertificateContext, xrefs: 00000001400076CB
, xrefs: 000000014000755B
WinVerifyTrust, xrefs: 0000000140007595
WTHelperGetProvCertFromChain, xrefs: 00000001400075DB
[WVT] WVT returned 0x%X, xrefs: 0000000140007632

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: AddressLibraryProc$Free$Load
String ID: $CertDuplicateCertificateContext$WTHelperGetProvCertFromChain$WTHelperGetProvSignerFromChain$WTHelperProvDataFromStateData$WinVerifyTrust$[WVT] WVT returned 0x%X$crypt32.dll$wintrust.dll
API String ID: 3262421712-1985688610
Opcode ID: fc9780279c5b3e706ef62bbd8d5c42d733abdb250b672fe55ea0bd4185a28d35
Instruction ID: d4cae42a300953b182e2575d846bee2d0e4e88283cca6f7958817b0490f94b5f
Opcode Fuzzy Hash: fc9780279c5b3e706ef62bbd8d5c42d733abdb250b672fe55ea0bd4185a28d35
Instruction Fuzzy Hash: C7717A72B05B4189FB66CF66E850BED37A5BB487D8F444015AE1E5B7A8EF39C50AC300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140005DB0 Relevance: 25.7, APIs: 17, Instructions: 183COMMON

Download Yara Rule

APIs

CharNextA.USER32(00000000,?,00000000,0000000140001723), ref: 0000000140005DE4
CharNextA.USER32(?,00000000,0000000140001723), ref: 0000000140005E01
CharNextA.USER32(?,00000000,0000000140001723), ref: 0000000140005E13
CharPrevA.USER32(?,00000000,0000000140001723), ref: 0000000140005E48
CharNextA.USER32(00000000,?,00000000,0000000140001723), ref: 0000000140005E5D
CharNextA.USER32(?,00000000,0000000140001723), ref: 0000000140005E7E
CharNextA.USER32(?,00000000,0000000140001723), ref: 0000000140005EA4
CharNextA.USER32(?,00000000,0000000140001723), ref: 0000000140005EB3
CharPrevA.USER32(?,00000000,0000000140001723), ref: 0000000140005EE8
CharNextA.USER32(?,00000000,0000000140001723), ref: 0000000140005EF4
CharNextA.USER32(?,00000000,0000000140001723), ref: 0000000140005F0B
CharNextA.USER32(?,00000000,0000000140001723), ref: 0000000140005F14
CharNextA.USER32(?,00000000,0000000140001723), ref: 0000000140005F34
CharNextA.USER32(?,00000000,0000000140001723), ref: 0000000140005F51
CharNextA.USER32(?,00000000,0000000140001723), ref: 0000000140005F63
CharPrevA.USER32(?,00000000,0000000140001723), ref: 0000000140005F98
CharNextA.USER32(?,00000000,0000000140001723), ref: 0000000140005FBF

Part of subcall function 0000000140007780: LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?), ref: 00000001400077B9

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: Char$Next$Prev$LibraryLoad
String ID:
API String ID: 739622482-0
Opcode ID: a765e41fe1edae87fb50b48d3c8c7224cae0aa945552de73b4671e1bbe4fb75d
Instruction ID: 45366f6df0ad493a1b2b8eb02e8cbbfce3fd113b30fb12abb7f0643972f95b85
Opcode Fuzzy Hash: a765e41fe1edae87fb50b48d3c8c7224cae0aa945552de73b4671e1bbe4fb75d
Instruction Fuzzy Hash: 4A61BFF120474549FA7AA723A4643BB63D25B4FFD2F884021BFD64B3B4EA3DC6848210

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006960 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 77libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000000140006985
GetProcAddress.KERNEL32 ref: 00000001400069BF
GetProcAddress.KERNEL32 ref: 00000001400069D2
GetProcAddress.KERNEL32 ref: 00000001400069E5
GetCurrentProcess.KERNEL32 ref: 00000001400069FD
GetLastError.KERNEL32 ref: 0000000140006A59
FreeLibrary.KERNEL32 ref: 0000000140006A66

Strings

SeShutdownPrivilege, xrefs: 0000000140006A1B
LookupPrivilegeValueA, xrefs: 00000001400069C5
AdjustTokenPrivileges, xrefs: 00000001400069D8
OpenProcessToken, xrefs: 00000001400069AB
advapi32.dll, xrefs: 0000000140006975

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: AddressProc$Library$CurrentErrorFreeLastLoadProcess
String ID: AdjustTokenPrivileges$LookupPrivilegeValueA$OpenProcessToken$SeShutdownPrivilege$advapi32.dll
API String ID: 3659620572-514100766
Opcode ID: d93a4abeccbeac6c4512533efaf4456e8026a4c578d81052150517d8995e361f
Instruction ID: a60719eabe544375a3e907e95e857d475479822581691613d29d113066f563c3
Opcode Fuzzy Hash: d93a4abeccbeac6c4512533efaf4456e8026a4c578d81052150517d8995e361f
Instruction Fuzzy Hash: 1E3129B5619B4586EA52DB22B85439A73A1FB8DBC4F441015FF8E1BB68EF3DC106CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002AF0 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 45libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000000140002B20
CreatePropertySheetPageA.COMCTL32 ref: 0000000140002B7F
PropertySheetA.COMCTL32 ref: 0000000140002BEE

Strings

f}, xrefs: 0000000140002B73
`, xrefs: 0000000140002BBA
:}, xrefs: 0000000140002B67
f}, xrefs: 0000000140002BDD
Riched20, xrefs: 0000000140002B11
g}, xrefs: 0000000140002BD4
H}, xrefs: 0000000140002B5B
h, xrefs: 0000000140002B3D

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: PropertySheet$CreateLibraryLoadPage
String ID: :}$H}$Riched20$`$f}$f}$g}$h
API String ID: 2368788801-2549730897
Opcode ID: 337b6c39579da7c1172e8091a61b04042cca9a1998388d92ebcfc8dcc4dc9d67
Instruction ID: a07102ee4a4a3ac5c54df2695d2ab7db718db387f80726fb2f36aa21c32041b1
Opcode Fuzzy Hash: 337b6c39579da7c1172e8091a61b04042cca9a1998388d92ebcfc8dcc4dc9d67
Instruction Fuzzy Hash: DF21E272519B8596EB72CF11F4443DAB7A4F789388F40412AE6CD47AA8EF7DC259CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140007290 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 100fileCOMMON

Download Yara Rule

APIs

#67.MSI ref: 000000014000738E
#263.MSI ref: 00000001400073DD

Part of subcall function 0000000140007490: _wcsftime_l.LIBCMT ref: 00000001400074B3

GetFileAttributesA.KERNEL32 ref: 0000000140007413
#67.MSI ref: 0000000140007436
CopyFileA.KERNEL32 ref: 000000014000744B

Strings

PackageName, xrefs: 000000014000735E
%s\%s, xrefs: 00000001400073F5
), xrefs: 0000000140007386
{ADA3F9C8-A6D3-4FCF-BFBB-EAD69AC0884E}, xrefs: 00000001400072B6
LocalPackage, xrefs: 000000014000742A

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: File$#263AttributesCopy_wcsftime_l
String ID: %s\%s$)$LocalPackage$PackageName${ADA3F9C8-A6D3-4FCF-BFBB-EAD69AC0884E}
API String ID: 3115660760-4124452534
Opcode ID: 638ad648794a6d9f476ac0c95d481d3305b3be1374aab63bffaea44f8f0cea7b
Instruction ID: fbba2073fef03d6cbdb54a04b955d758d0dca3a368f7e705d24f90c13d0ef870
Opcode Fuzzy Hash: 638ad648794a6d9f476ac0c95d481d3305b3be1374aab63bffaea44f8f0cea7b
Instruction Fuzzy Hash: 62514172618A85DAE721CF66F8507D977B5F789388F400116EB8C4BA69DF7DC249CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140004C50 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 223COMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32 ref: 0000000140004D15
GetCurrentDirectoryA.KERNEL32 ref: 0000000140004D27
SetDlgItemTextA.USER32 ref: 0000000140004E04
SetDlgItemTextA.USER32 ref: 0000000140004F2D

Strings

%s\Drivers\%s, xrefs: 0000000140004D92
invalid vector<T> subscript, xrefs: 0000000140004FDD, 0000000140004FEA, 0000000140004FF7, 0000000140005004
%s\msiexec /i "%s\Drivers\%s" /qn, xrefs: 0000000140004EC0
%s\msiexec /i "%s\Drivers\Apple\AppleSoftwareUpdate.msi" /qn, xrefs: 0000000140004F82

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: DirectoryItemText$CurrentSystem
String ID: %s\Drivers\%s$%s\msiexec /i "%s\Drivers\%s" /qn$%s\msiexec /i "%s\Drivers\Apple\AppleSoftwareUpdate.msi" /qn$invalid vector<T> subscript
API String ID: 3331512895-1768142057
Opcode ID: 5890f7303a1acece772c4b666898bd49de95c6af71ed18f15a02149e0817b2cf
Instruction ID: 071361f6c5b704c87f0aada182fba538d8653f4f2ec685a38c4829211445461d
Opcode Fuzzy Hash: 5890f7303a1acece772c4b666898bd49de95c6af71ed18f15a02149e0817b2cf
Instruction Fuzzy Hash: BAA13AB1220A85A5EB22EFA6E8847D92365F78D7C4F940416FB0D47BB5DF79C64AC300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002970 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 78libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00000001400029C2
CreatePropertySheetPageA.COMCTL32 ref: 00000001400029FF
CreatePropertySheetPageA.COMCTL32 ref: 0000000140002A4A
PropertySheetA.COMCTL32 ref: 0000000140002AAE
DestroyPropertySheetPage.COMCTL32 ref: 0000000140002AC3

Strings

j}, xrefs: 0000000140002A41
Riched20, xrefs: 000000014000299E
h, xrefs: 00000001400029DC

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: PropertySheet$Page$Create$DestroyLibraryLoad
String ID: Riched20$h$j}
API String ID: 140345642-3854420312
Opcode ID: ebe74ccf9e65268c0e5355832c25662ac201fda6de0abf07f24a2db00fcadafe
Instruction ID: 300d97951788a654814f4de23eca3f007d8d3cd9f84278824824b8621a1ac81a
Opcode Fuzzy Hash: ebe74ccf9e65268c0e5355832c25662ac201fda6de0abf07f24a2db00fcadafe
Instruction Fuzzy Hash: 1C411432605B449AE762CF61F44439E77B4F788388F540119EA8D47B68EF79C259CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000A738 Relevance: 13.6, APIs: 9, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

_ioinit.LIBCMT ref: 000000014000A752

Part of subcall function 000000014000E788: InitOnceExecuteOnce.KERNEL32(?,?,?,?,000000014000A757,?,?,00000000,000000014000894D), ref: 000000014000E7A0

_fileno.LIBCMT ref: 000000014000A768
_errno.LIBCMT ref: 000000014000A778
_errno.LIBCMT ref: 000000014000A78E

Part of subcall function 000000014000B49C: _getptd_noexit.LIBCMT ref: 000000014000B4A0

_isatty.LIBCMT ref: 000000014000A7ED
_getbuf.LIBCMT ref: 000000014000A7F9
_write.LIBCMT ref: 000000014000A82C
_lseeki64.LIBCMT ref: 000000014000A87B
_write.LIBCMT ref: 000000014000A8A5

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: Once_errno_write$ExecuteInit_fileno_getbuf_getptd_noexit_ioinit_isatty_lseeki64
String ID:
API String ID: 1773431880-0
Opcode ID: 49150d7f2d3bba7bb2292de1950d87ce2ac4206c1bafee48c07389017be9a10d
Instruction ID: 9e41581bbfe77a9674afef52a899a9c64e198e41c5da1e3c330d57142f338a1c
Opcode Fuzzy Hash: 49150d7f2d3bba7bb2292de1950d87ce2ac4206c1bafee48c07389017be9a10d
Instruction Fuzzy Hash: 5B41A0B2614B408AEB5ADF2AE8413E937E0E78DBD4F188215FB19473E6DE38C941C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006170 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32 ref: 000000014000618B
LoadResource.KERNEL32 ref: 00000001400061A0
LockResource.KERNEL32 ref: 00000001400061C1
WideCharToMultiByte.KERNEL32 ref: 00000001400061F5
WideCharToMultiByte.KERNEL32 ref: 0000000140006248

Strings

[Resource] lpName = %s NOT FOUND, xrefs: 000000014000628A
[Resource] lpName = %s, lpBuf = %s, xrefs: 0000000140006274

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: Resource$ByteCharMultiWide$FindLoadLock
String ID: [Resource] lpName = %s NOT FOUND$[Resource] lpName = %s, lpBuf = %s
API String ID: 2058388790-2841785867
Opcode ID: d235f2eef1c679cb02bd4fb3f189f9b50a234ba490e6a4d794b462639c759afa
Instruction ID: 48922ec75995b07aca87442686d017a4e9255d2a7b08c99772891969e64eae0a
Opcode Fuzzy Hash: d235f2eef1c679cb02bd4fb3f189f9b50a234ba490e6a4d794b462639c759afa
Instruction Fuzzy Hash: 0E316EB2215B8086E762CF27B84079A7695F78DBD0F088519FF8A5BBA4DF38C5518B04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140004220 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 73processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32 ref: 00000001400042DB
GetLastError.KERNEL32 ref: 00000001400042E5
GetExitCodeProcess.KERNEL32 ref: 0000000140004329
CloseHandle.KERNEL32 ref: 0000000140004339
CloseHandle.KERNEL32 ref: 0000000140004349

Strings

h, xrefs: 00000001400042C4
CreateProcess failed with %d, xrefs: 00000001400042EB

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLast
String ID: CreateProcess failed with %d$h
API String ID: 549633946-3704878989
Opcode ID: 48741a6a7671b17983f32f169af9b2f2e77c6c9689b53ebe2913d80e09248671
Instruction ID: a496fa6eb2495614d226b45de166b3586a16cf94781e37fef715513df38a2219
Opcode Fuzzy Hash: 48741a6a7671b17983f32f169af9b2f2e77c6c9689b53ebe2913d80e09248671
Instruction Fuzzy Hash: 11311A72608AC186EB62DB66F4547DBB7A4F7C8784F404125AB8947A69DF7CC144CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000FF7B Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

__DestructExceptionObject.LIBCMT ref: 000000014000FFA6
RaiseException.KERNEL32 ref: 000000014000FFCF
__DestructExceptionObject.LIBCMT ref: 0000000140010030
_getptd.LIBCMT ref: 000000014000FF83

Part of subcall function 000000014000DB80: _getptd_noexit.LIBCMT ref: 000000014000DB86

_getptd.LIBCMT ref: 0000000140010035
_getptd.LIBCMT ref: 0000000140010041

Strings

csm, xrefs: 0000000140010003

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: Exception_getptd$DestructObject$Raise_getptd_noexit
String ID: csm
API String ID: 2851507484-1018135373
Opcode ID: 7b9bf6fc4f9d2887994b2b975da9d53170e19a6cd4ce2861c7246f2e55e98e1d
Instruction ID: b3cf5f8e1861b89a92b9a7f643020ca68986f4b32fa08cb39d36bfbce334b955
Opcode Fuzzy Hash: 7b9bf6fc4f9d2887994b2b975da9d53170e19a6cd4ce2861c7246f2e55e98e1d
Instruction Fuzzy Hash: DA212B7620465586E632DF12E0403AEB7A0F38DBE5F054212EF9907BA5CF3AD486DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400026A0 Relevance: 12.1, APIs: 8, Instructions: 72windowCOMMON

Download Yara Rule

APIs

InitCommonControlsEx.COMCTL32(?,?,?,00000000,000000014000201A), ref: 00000001400026D0
GetUserDefaultUILanguage.KERNEL32(?,?,?,00000000,000000014000201A), ref: 00000001400026D6
_itow_s.LIBCMT ref: 00000001400026F0

Part of subcall function 0000000140008778: xtoa_s.LIBCMT ref: 0000000140008795

Part of subcall function 0000000140004480: GetTempPathA.KERNEL32 ref: 00000001400044CB
Part of subcall function 0000000140004480: FindResourceA.KERNEL32 ref: 00000001400044E2
Part of subcall function 0000000140004480: LoadResource.KERNEL32 ref: 0000000140004502
Part of subcall function 0000000140004480: LockResource.KERNEL32 ref: 000000014000450B
Part of subcall function 0000000140004480: SizeofResource.KERNEL32 ref: 000000014000451A
Part of subcall function 0000000140004480: CreateFileA.KERNEL32 ref: 000000014000456A
Part of subcall function 0000000140004480: WriteFile.KERNEL32 ref: 000000014000458A
Part of subcall function 0000000140004480: CloseHandle.KERNEL32 ref: 000000014000459F

PeekMessageA.USER32 ref: 000000014000274D
IsDialogMessageA.USER32 ref: 0000000140002769
TranslateMessage.USER32 ref: 0000000140002778
DispatchMessageA.USER32 ref: 0000000140002783
PeekMessageA.USER32 ref: 000000014000279E

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: Message$Resource$FilePeek$CloseCommonControlsCreateDefaultDialogDispatchFindHandleInitLanguageLoadLockPathSizeofTempTranslateUserWrite_itow_sxtoa_s
String ID:
API String ID: 2793686828-0
Opcode ID: 935868f236f795a53e6b8ea330581a9e2d7e63a625e0d4be446fc85044f17353
Instruction ID: 51c5e8c1cb6150488b7377bf22145cecc7ab757df4cf6a19701354cc4a92e046
Opcode Fuzzy Hash: 935868f236f795a53e6b8ea330581a9e2d7e63a625e0d4be446fc85044f17353
Instruction Fuzzy Hash: 33318D7262464182FB62DB26F5447E977A0FB98BC8F444011FF4907AB5DF38C68ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400027D0 Relevance: 12.0, APIs: 8, Instructions: 49windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00000001400027F4
SendMessageA.USER32 ref: 000000014000280F
SendMessageA.USER32 ref: 0000000140002823
PeekMessageA.USER32 ref: 000000014000283E
IsDialogMessageA.USER32 ref: 0000000140002859
TranslateMessage.USER32 ref: 0000000140002868
DispatchMessageA.USER32 ref: 0000000140002873
PeekMessageA.USER32 ref: 000000014000288E

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: Message$PeekSend$DialogDispatchItemTranslate
String ID:
API String ID: 2635934026-0
Opcode ID: f881311bba1af611c0fa4330128f2f5890ca0923ad3d808240c3d8f5c5c195f2
Instruction ID: cbffabb75d1797e85815945474ff64847ab6bfc66a416a7db5a93490f185aef8
Opcode Fuzzy Hash: f881311bba1af611c0fa4330128f2f5890ca0923ad3d808240c3d8f5c5c195f2
Instruction Fuzzy Hash: CC11517172495283F7218B26F959BDA7360FB9CF88F445020FB4A47A74DF39C64A8B44

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140008F4C Relevance: 10.6, APIs: 7, Instructions: 136COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000000140008F7A

Part of subcall function 0000000140008E28: _getptd.LIBCMT ref: 0000000140008E3E
Part of subcall function 0000000140008E28: __updatetlocinfo.LIBCMT ref: 0000000140008E73
Part of subcall function 0000000140008E28: __updatetmbcinfo.LIBCMT ref: 0000000140008E9A

_errno.LIBCMT ref: 0000000140008F8C
_invalid_parameter_noinfo.LIBCMT ref: 0000000140008F97
_stricmp_l.LIBCMT ref: 0000000140008FB5
__crtLCMapStringA.LIBCMT ref: 0000000140009019
__crtLCMapStringA.LIBCMT ref: 00000001400090AB
_errno.LIBCMT ref: 00000001400090FE

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: LocaleString__crt_errno$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_getptd_invalid_parameter_noinfo_stricmp_l
String ID:
API String ID: 234474540-0
Opcode ID: 56c13370d6cd260ef4ff40a7e42fb0f96dc875956b40577584f18031915a187a
Instruction ID: e4115077fe513c593931348eb24e2c297066722db1c9f1b360553a9fe2e8aba1
Opcode Fuzzy Hash: 56c13370d6cd260ef4ff40a7e42fb0f96dc875956b40577584f18031915a187a
Instruction Fuzzy Hash: 575193B22086A499E767CF22A4847ED7BA1F3497D8F244112FF96476F9CB39C582D700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400028B0 Relevance: 10.5, APIs: 7, Instructions: 43windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00000001400028C4
SendMessageA.USER32 ref: 00000001400028DD
PeekMessageA.USER32 ref: 00000001400028FE
IsDialogMessageA.USER32(?,?,?,?,?,?,?,0000000140005163), ref: 000000014000291C
TranslateMessage.USER32 ref: 000000014000292B
DispatchMessageA.USER32 ref: 0000000140002936
PeekMessageA.USER32 ref: 0000000140002951

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: Message$Peek$DialogDispatchItemSendTranslate
String ID:
API String ID: 1032557731-0
Opcode ID: fc44f39880d10889e1296933a2cf18b9b812d844b8f267f044f4768dfc562143
Instruction ID: f15901ad34c2b6eee32ab5caf960633bbff0e65faa3e048de85366eb26ebb231
Opcode Fuzzy Hash: fc44f39880d10889e1296933a2cf18b9b812d844b8f267f044f4768dfc562143
Instruction Fuzzy Hash: B411707172094283FB62CF66F854B967360FB9CB88F445014BB0A47974DF39C6458740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140010078 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000000140010099
_getptd.LIBCMT ref: 00000001400100A7
_getptd.LIBCMT ref: 00000001400100B9

Strings

RCC, xrefs: 000000014001007F
MOC, xrefs: 0000000140010087
csm, xrefs: 000000014001008F

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 71a00a7f86f819c5cf4b36655c441c189d16364af692ad33ef5b372f6aed567a
Instruction ID: e5cfa7318d4b01d6ad3b5a3631ff86066502e100976e73f5cc067beb78b34f1a
Opcode Fuzzy Hash: 71a00a7f86f819c5cf4b36655c441c189d16364af692ad33ef5b372f6aed567a
Instruction Fuzzy Hash: 03F06579500214C9E7277B6690153EC3194E79C7D5F869461E3840B3B3CBFD4484DA13

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400064D0 Relevance: 9.1, APIs: 6, Instructions: 67windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32 ref: 0000000140006537
FormatMessageA.KERNEL32 ref: 0000000140006565
LoadStringA.USER32 ref: 0000000140006589
MessageBoxA.USER32 ref: 00000001400065A1
MessageBoxA.USER32 ref: 00000001400065B5
LocalFree.KERNEL32 ref: 00000001400065C0

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: Message$LoadString$FormatFreeLocal
String ID:
API String ID: 2115485297-0
Opcode ID: 0d4543b5b0f1a638084e7e26aa0be4b34a4b35c6ba59c02560f5f81fd925b428
Instruction ID: 7737697ae55f2781d10618f7bd9690a3c686183f1e16117c52020883b225972a
Opcode Fuzzy Hash: 0d4543b5b0f1a638084e7e26aa0be4b34a4b35c6ba59c02560f5f81fd925b428
Instruction Fuzzy Hash: A7218172704A8187EB219B52F8407DAB760F789BD9F544025EF8917B68DF3DC60ACB44

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006BD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,OPERATION,?,OPERATION,000000014000629C), ref: 0000000140006C17
lstrlenA.KERNEL32(?,?,OPERATION,?,OPERATION,000000014000629C), ref: 0000000140006C2A
lstrlenA.KERNEL32(?,?,OPERATION,?,OPERATION,000000014000629C), ref: 0000000140006C3F
OutputDebugStringA.KERNEL32(?,?,OPERATION,?,OPERATION,000000014000629C), ref: 0000000140006C52

Part of subcall function 0000000140006AA0: GetEnvironmentVariableA.KERNEL32 ref: 0000000140006AFF

Strings

OPERATION, xrefs: 0000000140006BD0, 0000000140006BD3

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: lstrlen$DebugEnvironmentOutputStringVariable
String ID: OPERATION
API String ID: 2165651305-1564719234
Opcode ID: 57d4e5a3d1d2cf92375fa70d7d4e4b7c524c35cf0be6e9f12b99e533d3f8e850
Instruction ID: 9b6ef44824a148dd24ef185260bef5ad327f88fd89b02cb6193cfcaff09a5bae
Opcode Fuzzy Hash: 57d4e5a3d1d2cf92375fa70d7d4e4b7c524c35cf0be6e9f12b99e533d3f8e850
Instruction Fuzzy Hash: 16217AB1305B9086FA67DB67B8407F9A7A5AB8CBD0F084024BF8957BB5DF39C6458700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002C00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000000140002C4A
CreatePropertySheetPageA.COMCTL32 ref: 0000000140002C91
PropertySheetA.COMCTL32 ref: 0000000140002CF6

Strings

Riched20, xrefs: 0000000140002C26
`, xrefs: 0000000140002CC5

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: PropertySheet$CreateLibraryLoadPage
String ID: Riched20$`
API String ID: 2368788801-3188635142
Opcode ID: 18be382838b2c03c6a18ea70814877a03688e4ed5f4c362ed735878594b28549
Instruction ID: 53a976cc4821110fff4c084704b322e819caa054b492e2c225b1febf685e2bbf
Opcode Fuzzy Hash: 18be382838b2c03c6a18ea70814877a03688e4ed5f4c362ed735878594b28549
Instruction Fuzzy Hash: CF31B132A19B449AE761CFA1E8403DE77B4F788358F54012AEA8D47B68EF78C558CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002D10 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000000140002D5A
CreatePropertySheetPageA.COMCTL32 ref: 0000000140002D9F
PropertySheetA.COMCTL32 ref: 0000000140002E04

Strings

Riched20, xrefs: 0000000140002D36
`, xrefs: 0000000140002DD3

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: PropertySheet$CreateLibraryLoadPage
String ID: Riched20$`
API String ID: 2368788801-3188635142
Opcode ID: d0c32bb1c0198a01352dcbecd1db1ab2a1b5ac5a2c4773ffb558d2449f6de7d5
Instruction ID: c7001a60d354f14763c6a7a25121d0967dc01adf1e7d36b907c4a31884037e2a
Opcode Fuzzy Hash: d0c32bb1c0198a01352dcbecd1db1ab2a1b5ac5a2c4773ffb558d2449f6de7d5
Instruction Fuzzy Hash: 5031C432615B849AE761CFA1E8403DE77B4F788358F54022AEB8D47B68DF79C559CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140007190 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00000001400071EE

Part of subcall function 00000001400094A8: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00000001400094CE
Part of subcall function 00000001400094A8: _errno.LIBCMT ref: 00000001400094D8
Part of subcall function 00000001400094A8: _invalid_parameter_noinfo.LIBCMT ref: 00000001400094E3

swprintf.LIBCMT ref: 0000000140007258
GetFileAttributesA.KERNEL32 ref: 0000000140007265

Strings

$WinPEDriver$, xrefs: 0000000140007233
%s\%s, xrefs: 000000014000723F

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: FileLocale$AttributesModuleNameUpdateUpdate::__errno_invalid_parameter_noinfoswprintf
String ID: $WinPEDriver$$%s\%s
API String ID: 4231285443-784365818
Opcode ID: 1cf60942ed21dc0c89d3e47b000172498b93e51268a456758bc51a8771741bcc
Instruction ID: ccee5f2566c1bab3fcd703312097053ec4735780e2116bc2dc5f4d022403a9e4
Opcode Fuzzy Hash: 1cf60942ed21dc0c89d3e47b000172498b93e51268a456758bc51a8771741bcc
Instruction Fuzzy Hash: 02219371628A8582EB62D722F4957EA6350FBCD384F800115F78E47AA5DF7CC209CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140014210 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000000140014272
_isleadbyte_l.LIBCMT ref: 00000001400142A2
MultiByteToWideChar.KERNEL32 ref: 00000001400142E1
MultiByteToWideChar.KERNEL32 ref: 000000014001432F
_errno.LIBCMT ref: 0000000140014339

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::__errno_isleadbyte_l
String ID:
API String ID: 2998201375-0
Opcode ID: ea16ff7904704906881ceed9a0f4bc6b2593fb83b3a2ce7785fc5e14389fb305
Instruction ID: 2d6b075054cf58a17570f0c8465843e8b7ee17a3bd74ef751b6aa9e1bfc174b0
Opcode Fuzzy Hash: ea16ff7904704906881ceed9a0f4bc6b2593fb83b3a2ce7785fc5e14389fb305
Instruction Fuzzy Hash: 7F41E672214780C6E7628F16E1807ADBBA5F789FC4F184125FF985BBB5CB3AC9818700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006000 Relevance: 7.6, APIs: 5, Instructions: 82COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,00000000,0000000140001708), ref: 0000000140006023
CharNextA.USER32(?,?,00000000,0000000140001708), ref: 000000014000604A
CharNextA.USER32(?,?,00000000,0000000140001708), ref: 0000000140006060
CharPrevA.USER32(?,?,00000000,0000000140001708), ref: 0000000140006096
CharNextA.USER32(?,?,00000000,0000000140001708), ref: 00000001400060A2

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: Char$Next$Prev
String ID:
API String ID: 589700163-0
Opcode ID: 7fae594d83cd3e86475e27109661ae14f4ae7f3a7953a3221cc9924f77fd873a
Instruction ID: 9a6a001b80f1762c7953a294a4f8ad804ba46aa9c2e4fd2431f8018ee0c94b74
Opcode Fuzzy Hash: 7fae594d83cd3e86475e27109661ae14f4ae7f3a7953a3221cc9924f77fd873a
Instruction Fuzzy Hash: BF310EB164564489FA66CB77B8603FA3BD29B4EBD4F8C0011FB96473A6DA39C9858600

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140005CA0 Relevance: 7.5, APIs: 5, Instructions: 40windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32 ref: 0000000140005CE8
PeekMessageA.USER32 ref: 0000000140005D0B
TranslateMessage.USER32 ref: 0000000140005D1A
DispatchMessageA.USER32 ref: 0000000140005D25
GetLastError.KERNEL32 ref: 0000000140005D2D

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: Message$DispatchErrorLastMultipleObjectsPeekTranslateWait
String ID:
API String ID: 2669921780-0
Opcode ID: 99bfdcab94a3677e08f6089aaa0b7134d26756fc8e47b523a347d11ffe4427e4
Instruction ID: e8ed8073feb781f716cd9bf06bab9980b5a58e3fabd5b4f7844034d03af691ba
Opcode Fuzzy Hash: 99bfdcab94a3677e08f6089aaa0b7134d26756fc8e47b523a347d11ffe4427e4
Instruction Fuzzy Hash: 2E11AD32624E4086E760EF21F849B9E33E0F74C784F910124EB9D836A0EF39C619CB10

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140009C94 Relevance: 7.5, APIs: 5, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000000140009CA1

Part of subcall function 000000014000DB80: _getptd_noexit.LIBCMT ref: 000000014000DB86

_inconsistency.LIBCMT ref: 0000000140009CAF

Part of subcall function 00000001400106D4: DecodePointer.KERNEL32(?,?,?,?,0000000140010681,?,?,?,00000001400098FA), ref: 00000001400106DF

_getptd.LIBCMT ref: 0000000140009CB4
_inconsistency.LIBCMT ref: 0000000140009CD0
_getptd.LIBCMT ref: 0000000140009CE0

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: _getptd$_inconsistency$DecodePointer_getptd_noexit
String ID:
API String ID: 3566995948-0
Opcode ID: cceb6b8d6dce8d7819b48659386abcccdab9452d61012d2ed5a630c66be13b8c
Instruction ID: 027a821d1af5b9f3555670d95c7dd01ea02dbbf653ea271e34eb7f702fb2363d
Opcode Fuzzy Hash: cceb6b8d6dce8d7819b48659386abcccdab9452d61012d2ed5a630c66be13b8c
Instruction Fuzzy Hash: F0F0FEB260558081FA62EB93F0417ED7694A75CBD0F0D4021F7851B2A79E70C890D351

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140016B38 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140009C94: _getptd.LIBCMT ref: 0000000140009CA1
Part of subcall function 0000000140009C94: _inconsistency.LIBCMT ref: 0000000140009CAF
Part of subcall function 0000000140009C94: _getptd.LIBCMT ref: 0000000140009CB4
Part of subcall function 0000000140009C94: _inconsistency.LIBCMT ref: 0000000140009CD0

__DestructExceptionObject.LIBCMT ref: 0000000140016B85
_getptd.LIBCMT ref: 0000000140016B8B
_getptd.LIBCMT ref: 0000000140016B9E

Part of subcall function 0000000140009D24: _getptd.LIBCMT ref: 0000000140009D2D

Strings

csm, xrefs: 0000000140016B58

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: _getptd$_inconsistency$DestructExceptionObject
String ID: csm
API String ID: 2821275340-1018135373
Opcode ID: 3edeef25c9289266fbb840530db96de972cfc4ea2cef62f104c4b580a5091517
Instruction ID: 1ad63f45ccd7a931d6f568ce95ab9258cc5310b9adffb52e744c472a24bbcb21
Opcode Fuzzy Hash: 3edeef25c9289266fbb840530db96de972cfc4ea2cef62f104c4b580a5091517
Instruction Fuzzy Hash: D701627214164189E722EF32D8C13EC33A8E758BE8F055021FB098B666CF31C8C5C380

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000870C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 000000014000871A
malloc.LIBCMT ref: 0000000140008726

Part of subcall function 0000000140009184: _FF_MSGBANNER.LIBCMT ref: 00000001400091B4
Part of subcall function 0000000140009184: _NMSG_WRITE.LIBCMT ref: 00000001400091BE
Part of subcall function 0000000140009184: HeapAlloc.KERNEL32(?,?,00000000,000000014000BAD4,?,?,?,00000001400124A8,?,?,?,00000001400123A7,?,?,00000000,000000014000DC86), ref: 00000001400091D9
Part of subcall function 0000000140009184: _callnewh.LIBCMT ref: 00000001400091F2
Part of subcall function 0000000140009184: _errno.LIBCMT ref: 00000001400091FD
Part of subcall function 0000000140009184: _errno.LIBCMT ref: 0000000140009208

_CxxThrowException.LIBCMT ref: 000000014000876F

Part of subcall function 000000014000A090: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140008774), ref: 000000014000A11F
Part of subcall function 000000014000A090: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140008774), ref: 000000014000A15E

Strings

bad allocation, xrefs: 0000000140008736

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: Exception_callnewh_errno$AllocFileHeaderHeapRaiseThrowmalloc
String ID: bad allocation
API String ID: 1214304046-2104205924
Opcode ID: 98a664da9b82a8005c799093d3be91627a4329cfe787799e5cb4564bd725dc55
Instruction ID: 23bdd4f411b80b7b5351f86fbdb408a0b070b5295f5decbf193ea62377b54e50
Opcode Fuzzy Hash: 98a664da9b82a8005c799093d3be91627a4329cfe787799e5cb4564bd725dc55
Instruction Fuzzy Hash: 9AF09AB520574A91EE26DB52B4043D96390BB8D3C4F980420BB8D0BBBAEE3DC249CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400094A8 Relevance: 6.1, APIs: 4, Instructions: 60stringCOMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00000001400094CE

Part of subcall function 0000000140008E28: _getptd.LIBCMT ref: 0000000140008E3E
Part of subcall function 0000000140008E28: __updatetlocinfo.LIBCMT ref: 0000000140008E73
Part of subcall function 0000000140008E28: __updatetmbcinfo.LIBCMT ref: 0000000140008E9A

_errno.LIBCMT ref: 00000001400094D8

Part of subcall function 000000014000B49C: _getptd_noexit.LIBCMT ref: 000000014000B4A0

_invalid_parameter_noinfo.LIBCMT ref: 00000001400094E3
strrchr.LIBCMT ref: 00000001400094FA

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrrchr
String ID:
API String ID: 3640024801-0
Opcode ID: 73b83e9688d1214dffd9b749be8a8300e4d287ec20d7a233d4a1d6a147dbecee
Instruction ID: cd8f7f45ab931e8ba4e25034f0c4e086bac3e8c36cf93028d7623123b7ec88ed
Opcode Fuzzy Hash: 73b83e9688d1214dffd9b749be8a8300e4d287ec20d7a233d4a1d6a147dbecee
Instruction Fuzzy Hash: 9A1124F2208A8041FB63CA17B9503EDA791A389BD5F588125FFDA177E9CA38C9458B00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400043B0 Relevance: 6.0, APIs: 4, Instructions: 48windowfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00000001400043F5
SendMessageA.USER32 ref: 0000000140004431
SendMessageA.USER32 ref: 0000000140004448
CloseHandle.KERNEL32 ref: 000000014000445D

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: MessageSend$CloseCreateFileHandle
String ID:
API String ID: 1635307869-0
Opcode ID: 42d21ba4b30ca0c9fdd6dba231f0b98eedc3c351a47d1d7966f538ad3812d3a6
Instruction ID: 2ed08fe1717d4e861da827480bef9f06300b3aecba5339a4e68fab69e59cefcc
Opcode Fuzzy Hash: 42d21ba4b30ca0c9fdd6dba231f0b98eedc3c351a47d1d7966f538ad3812d3a6
Instruction Fuzzy Hash: 17115E71704B4487E7618F56F48078AB7A0F388BD4F544629EBA907FA8DF3DC6498B04

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400067E0 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 0000000140006839
VerSetConditionMask.KERNEL32 ref: 000000014000684A
VerSetConditionMask.KERNEL32 ref: 000000014000685B
VerifyVersionInfoA.KERNEL32 ref: 000000014000686E

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: 096839d049e3dae2c9311b6a7d628239c251be46b4c32322a45ccd40b3d997c3
Instruction ID: 5cb8b123b36da6abeb68f05dce8bac56140a4cb4f1e13606fcdbe21c451f62f6
Opcode Fuzzy Hash: 096839d049e3dae2c9311b6a7d628239c251be46b4c32322a45ccd40b3d997c3
Instruction Fuzzy Hash: 1B014C76A0564092F731DB26F82979AB3A0FB8C784F404129EF4D4BBA5DE3DC6468B04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140008674 Relevance: 6.0, APIs: 4, Instructions: 13COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 000000014000867F
_NMSG_WRITE.LIBCMT ref: 0000000140008691
_set_abort_behavior.LIBCMT ref: 000000014000869D
abort.LIBCMT ref: 00000001400086A2

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: DecodePointer_set_abort_behaviorabort
String ID:
API String ID: 2382794621-0
Opcode ID: 9c56c6cc8838b1f404654c6f26a5a5be60afc7dc49e1b1e70733b95c95917cf9
Instruction ID: 43bb9f83f3485f97b2a39dc592c05ce8928d51243f3589d7f1e97872282b7093
Opcode Fuzzy Hash: 9c56c6cc8838b1f404654c6f26a5a5be60afc7dc49e1b1e70733b95c95917cf9
Instruction Fuzzy Hash: 1FD0C9B021214182FA5AB7B3B8667FD02105F8DBC0F5C4829772A473F2CD3A89459722

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006AA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32 ref: 0000000140006AFF

Strings

_MSI_WEB_BOOTSTRAP_DEBUG, xrefs: 0000000140006AE1
1, xrefs: 0000000140006B0F

Memory Dump Source

Source File: 0000000D.00000002.2561707168.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000D.00000002.2561646396.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561763083.0000000140018000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561805020.0000000140020000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140024000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.0000000140056000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2561850623.00000001400A3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_140000000_Setup.jbxd

Similarity

API ID: EnvironmentVariable
String ID: 1$_MSI_WEB_BOOTSTRAP_DEBUG
API String ID: 1431749950-2168896536
Opcode ID: c5adac22bcd17e485c58ca8a2b6ff0d57b271865f5456779dd8bf6add1a29561
Instruction ID: 6547b07f07b44e86f21b0141c2d76e87a7ec4b76e33733c419b47acc5332e0a3
Opcode Fuzzy Hash: c5adac22bcd17e485c58ca8a2b6ff0d57b271865f5456779dd8bf6add1a29561
Instruction Fuzzy Hash: E4013572619B80CAE751CB62F84838977E5F79C384F410169E68C83365EB7AC825CB04

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://download.info.apple.com/Mac_OS_X/031-30890-20150812-ea191174-4130-11e5-a125-930911ba098f/bootcamp5.1.5769.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\unarchiver.log

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\BootCamp.xml

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ATILog.dll

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ATIManifestDLMExt.dll

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ATISetup.exe

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\CRCVerDLMExt.dll

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\CompressionDLMExt.dll

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\ControlCenterActions.dll

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\DLMCom.dll

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\DetectionManager.dll

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\EncryptionDLMExt.dll

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\InstallManager.dll

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\InstallManagerApp.exe

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\LanguageMgr.dll

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\PackageManager.dll

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\Setup.exe

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\atdcm64a.sys

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\difxapi.dll

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\mfc110u.dll

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\msvcp110.dll

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\msvcr110.dll

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\xerces-c_2_6.dll

C:\Users\user\AppData\Local\Temp\xsq4cqzh.ges\BootCamp\Drivers\ATI\ATIGraphics\Bin64\zlibwapi.dll

Windows Analysis Report
https://download.info.apple.com/Mac_OS_X/031-30890-20150812-ea191174-4130-11e5-a125-930911ba098f/bootcamp5.1.5769.zip