Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
cfrv_4_0_setup_ALL.exe

Overview

General Information

Sample name:cfrv_4_0_setup_ALL.exe
Analysis ID:1379637
MD5:9197aeadf996dd8cd3885a205927671e
SHA1:3bf1368b4dae680e580d3958299f9636e255cba8
SHA256:94e6740812caeb857ef6065984ab4138d56ad4b517c62f2611f303eab519676c
Infos:

Detection

Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

DLL side loading technique detected
Injects code into the Windows Explorer (explorer.exe)
May use the Tor software to hide its network traffic
Checks for available system drives (often done to infect USB drives)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to detect virtual machines (STR)
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to query locales information (e.g. system language)
Creates Visual Basic Runtime Dlls
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Drops certificate files (DER)
Drops files with a non-matching file extension (content does not match file extension)
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after checking a module file name)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file contains strange resources
PE file does not import any functions
Queries keyboard layouts
Queries the volume information (name, serial number etc) of a device
Registers a DLL
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic

Classification

Process Tree

  • System is w10x64
  • cfrv_4_0_setup_ALL.exe (PID: 6948 cmdline: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe MD5: 9197AEADF996DD8CD3885A205927671E)
    • cfrv_4_0_setup_ALL.exe (PID: 6252 cmdline: .\cfrv_4_0_setup_ALL.exe /m="C:\Users\user\Desktop\CFRV_4~1.EXE" /k="" MD5: 3B2D532673D1567116105D04C621CDBA)
      • regsvr32.exe (PID: 3452 cmdline: "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\mscomctl.ocx" /s MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
      • regsvr32.exe (PID: 1196 cmdline: "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\COMDLG32.OCX" /s MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
      • regsvr32.exe (PID: 7080 cmdline: "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\COMCT332.OCX" /s MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
      • regsvr32.exe (PID: 7140 cmdline: "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\TABCTL32.OCX" /s MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
      • regsvr32.exe (PID: 3372 cmdline: "C:\Windows\system32\regsvr32.exe" "C:\Program Files (x86)\Common Files\microsoft shared\DAO\DAO350.DLL" /s MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
      • regsvr32.exe (PID: 4600 cmdline: "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_CR_control.dll" /s MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
      • regsvr32.exe (PID: 5004 cmdline: "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_DB_Connect.dll" /s MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
      • regsvr32.exe (PID: 2004 cmdline: "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_File_Data.dll" /s MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
      • regsvr32.exe (PID: 6312 cmdline: "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_File_Export.dll" /s MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
      • regsvr32.exe (PID: 5228 cmdline: "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_Rmt_DB4_Update.dll" /s MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
      • explorer.exe (PID: 6920 cmdline: "C:\Windows\explorer.exe" /separate /root,::{21ec2020-3aea-1069-a2dd-08002b30309d} MD5: 662F4F92FDE3557E86D110526BB578D5)
  • msiexec.exe (PID: 1028 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)
    • msiexec.exe (PID: 5496 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 9F821CD8835F26EFA91C6F67DA97DD7D MD5: 9D09DC1EDA745A5F87553048E57620CF)
    • msiexec.exe (PID: 6544 cmdline: C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\craxdrt.dll MD5: 9D09DC1EDA745A5F87553048E57620CF)
    • msiexec.exe (PID: 6920 cmdline: C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crviewer.dll MD5: 9D09DC1EDA745A5F87553048E57620CF)
    • msiexec.exe (PID: 6972 cmdline: C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\Crystal\Cdo32.dll MD5: 9D09DC1EDA745A5F87553048E57620CF)
    • msiexec.exe (PID: 7048 cmdline: C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crtslv.dll MD5: 9D09DC1EDA745A5F87553048E57620CF)
    • msiexec.exe (PID: 2208 cmdline: C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\ExportModeller.dll MD5: 9D09DC1EDA745A5F87553048E57620CF)
  • explorer.exe (PID: 7072 cmdline: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding MD5: 662F4F92FDE3557E86D110526BB578D5)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.exeJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
    C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      00000001.00000000.1735223416.0000000000401000.00000020.00000001.01000000.00000004.sdmpJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
        Process Memory Space: cfrv_4_0_setup_ALL.exe PID: 6948JoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          1.0.cfrv_4_0_setup_ALL.exe.400000.0.unpackJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security

            Sigma Signatures

            ⊘No Sigma rule has matched

            Snort Signatures

            ⊘No Snort rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results
            Source: cfrv_4_0_setup_ALL.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: c:\tmp\log\installs\CF_Remote\install.logJump to behavior
            Source: Binary string: MsiHnd.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005965000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: MsiHnd.pdbV source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005965000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: shfolder.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: rF,c:\Windows\System32\ImgXTwain61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052F4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: shfolder.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: GameuxInstallHelper.pdb source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735771372.0000000000842000.00000002.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp
            Source: Binary string: gacutil.pdb source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735771372.0000000000842000.00000002.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2062442144.00000000055A1000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: c:\Windows\System32\ImgX61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052DD000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000681A000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: gacutil.pdb(0 source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735771372.0000000000842000.00000002.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2062442144.00000000055A1000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: sdbapiu.pdbU source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: usp10.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: msisip.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005965000.00000004.00000020.00020000.00000000.sdmp, msisip.dll.0.dr
            Source: Binary string: c:\Windows\System32\ImgXPrint61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052F4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: rFXc:\Windows\System32\ImgX61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000681A000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: sdbapiu.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: riched20.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: mspatcha.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005BC6000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: Y:\EPFXlate\HTML\ReleaseSym\exlate32.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000515D000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: msi.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000057A7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: c:\Windows\System32\ImgXTwain61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052F4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: rFWc:\Windows\System32\ImgX61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052DD000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: gacutil.pdb, AH/@ source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735771372.0000000000842000.00000002.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp
            Source: Binary string: sdbapi.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: msi_l.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: usp10.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: imagehlp.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000515D000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: msi.pdbh source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000057A7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: mspatcha.pdbtvbl01\LOCALS~1\Temp\2\DBGtoPDB\mspatcha.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005BC6000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: imagehlp.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000515D000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: riched20.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: Y:\EPFXlate\HTML\ReleaseSym\exlate32.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000515D000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: sdbapi.pdbU source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: tvbl01\LOCALS~1\Temp\2\DBGtoPDB\mspatcha.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005BC6000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: msisip.pdb3 source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005965000.00000004.00000020.00020000.00000000.sdmp, msisip.dll.0.dr
            Source: Binary string: rF,c:\Windows\System32\ImgXPrint61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052F4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: gacutlrc.pdb source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735771372.0000000000842000.00000002.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2062442144.00000000055A1000.00000004.00000020.00020000.00000000.sdmp
            Source: C:\Windows\System32\msiexec.exeFile opened: z:
            Source: C:\Windows\System32\msiexec.exeFile opened: x:
            Source: C:\Windows\System32\msiexec.exeFile opened: v:
            Source: C:\Windows\System32\msiexec.exeFile opened: t:
            Source: C:\Windows\System32\msiexec.exeFile opened: r:
            Source: C:\Windows\System32\msiexec.exeFile opened: p:
            Source: C:\Windows\System32\msiexec.exeFile opened: n:
            Source: C:\Windows\System32\msiexec.exeFile opened: l:
            Source: C:\Windows\System32\msiexec.exeFile opened: j:
            Source: C:\Windows\System32\msiexec.exeFile opened: h:
            Source: C:\Windows\System32\msiexec.exeFile opened: f:
            Source: C:\Windows\System32\msiexec.exeFile opened: b:
            Source: C:\Windows\System32\msiexec.exeFile opened: y:
            Source: C:\Windows\System32\msiexec.exeFile opened: w:
            Source: C:\Windows\System32\msiexec.exeFile opened: u:
            Source: C:\Windows\System32\msiexec.exeFile opened: s:
            Source: C:\Windows\System32\msiexec.exeFile opened: q:
            Source: C:\Windows\System32\msiexec.exeFile opened: o:
            Source: C:\Windows\System32\msiexec.exeFile opened: m:
            Source: C:\Windows\System32\msiexec.exeFile opened: k:
            Source: C:\Windows\System32\msiexec.exeFile opened: i:
            Source: C:\Windows\System32\msiexec.exeFile opened: g:
            Source: C:\Windows\System32\msiexec.exeFile opened: e:
            Source: C:\Windows\explorer.exeFile opened: c:
            Source: C:\Windows\System32\msiexec.exeFile opened: a:
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_00407E20 FindNextFileW,FindClose,FindFirstFileW,FindFirstFileW,0_2_00407E20
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CEC2A30 _memset,FindFirstFileW,LoadLibraryW,FindClose,FindResourceW,LoadLibraryW,1_2_6CEC2A30
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CEB2470 FindClose,FindFirstFileW,FindFirstFileW,1_2_6CEB2470
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile opened: C:\ProgramData\Microsoft\Windows\Start MenuJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile opened: C:\ProgramData\Microsoft\Windows\Start Menu\ProgramsJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile opened: C:\ProgramData\MicrosoftJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile opened: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Campaign Finance\CF Remote.lnkJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile opened: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Campaign FinanceJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile opened: C:\ProgramData\Microsoft\WindowsJump to behavior
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2239438491.0000000002874000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: HTTP://WWW.MYWEBSITE.COM/NEW
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2239438491.0000000002833000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: HTTP://WWW.NCSBE.GOVMICROSOFT
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.certum.pl/ctnca.crl0k
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052DD000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052F4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000681A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawteCodeSigningCA.crl0
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052DD000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052F4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000681A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawtePremiumServerCA.crl0
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052DD000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052F4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000681A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.thawte.com0
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://repository.certum.pl/ctnca.cer09
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://repository.certum.pl/ctnca2.cer09
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://repository.certum.pl/ctsca2021.cer0
            Source: explorer.exe, 00000018.00000002.2879083790.0000000008DF7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.mi
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735223416.0000000000418000.00000020.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://standards.iso.org/iso/19770/-2/2008/schema.xsd
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://subca.ocsp-certum.com01
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://subca.ocsp-certum.com02
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://subca.ocsp-certum.com05
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ImgX.net/
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ImgX.net/ImgX/purchase.asp
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.certum.pl/CPS0
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735223416.0000000000418000.00000020.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.installaware.com/
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.installaware.com/0
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.installaware.com/InstallAware
            Source: cfrv_4_0_setup_ALL.exeString found in binary or memory: http://www.installaware.comz
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2062442144.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2239438491.0000000002874000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.mywebsite.com/New
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2239438491.0000000002874000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ncsbe.gov
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2062442144.00000000055A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ncsbe.govMicrosoft
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000065AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.seagatesoftware.com/xml/schema.xsdxsddtdw
            Source: explorer.exe, 00000018.00000003.2060166385.00000000067A5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000003.2060001241.00000000067A1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2878512791.00000000067A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/Vh5j3k
            Source: explorer.exe, 00000018.00000003.2060166385.00000000067A5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000003.2060001241.00000000067A1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2878512791.00000000067A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/odirm
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sectigo.com/CPS0C
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735223416.00000000007AE000.00000020.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FFC7D000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.installaware.com/buydirect.aspopen
            Source: Yara matchFile source: Process Memory Space: cfrv_4_0_setup_ALL.exe PID: 6948, type: MEMORYSTR
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.catJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\msvbvm60.dllJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: C:\Windows\NCSBOEJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\MSI3C42.tmp
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_0040B1D00_2_0040B1D0
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_00419D200_2_00419D20
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_0041FF600_2_0041FF60
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_004010000_2_00401000
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_004011000_2_00401100
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_004011C00_2_004011C0
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_004011D80_2_004011D8
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_004091800_2_00409180
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_004042D00_2_004042D0
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_0040F2F00_2_0040F2F0
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_004013F00_2_004013F0
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_004234D00_2_004234D0
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_004105D00_2_004105D0
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_004055E00_2_004055E0
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_004045A00_2_004045A0
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_004015B00_2_004015B0
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_0040E7400_2_0040E740
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_004037600_2_00403760
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_00425AE70_2_00425AE7
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_00401AB00_2_00401AB0
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_00412B500_2_00412B50
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_0040DC000_2_0040DC00
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055D887D1_3_055D887D
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_0568EAC01_3_0568EAC0
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055AD4C41_3_055AD4C4
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_056033111_3_05603311
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_0560326F1_3_0560326F
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055D92651_3_055D9265
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_0560321C1_3_0560321C
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_100010001_2_10001000
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_100090281_2_10009028
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_100173301_2_10017330
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_100153E01_2_100153E0
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_1000D4501_2_1000D450
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_100177101_2_10017710
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_100178D01_2_100178D0
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_10017DC01_2_10017DC0
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_1001E5C31_2_1001E5C3
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_1001E7511_2_1001E751
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_1000E7701_2_1000E770
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_100127E01_2_100127E0
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_1001E82B1_2_1001E82B
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_1000C8E01_2_1000C8E0
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_10014A401_2_10014A40
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_1000EB101_2_1000EB10
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_1000CCA01_2_1000CCA0
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_1001AD1A1_2_1001AD1A
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_10016D801_2_10016D80
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_10012F001_2_10012F00
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_10016F801_2_10016F80
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CEB4C001_2_6CEB4C00
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CEAAE701_2_6CEAAE70
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CEA8AB01_2_6CEA8AB0
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CEA64601_2_6CEA6460
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CEB35F01_2_6CEB35F0
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CEC8E1B1_2_6CEC8E1B
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CEBE9501_2_6CEBE950
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CECE6B01_2_6CECE6B0
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CEAE6701_2_6CEAE670
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CECE78B1_2_6CECE78B
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CEBFEE01_2_6CEBFEE0
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CEBB9C01_2_6CEBB9C0
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CEAB4471_2_6CEAB447
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CEAD1B01_2_6CEAD1B0
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055CE64B1_3_055CE64B
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055CE6F11_3_055CE6F1
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055C288E1_3_055C288E
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: String function: 6CEC7AA4 appears 37 times
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: String function: 10018EB0 appears 94 times
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: String function: 6CEA4C80 appears 39 times
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: String function: 00405140 appears 35 times
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: String function: 00423A98 appears 36 times
            Source: cfrv_4_0_setup_ALL.exe.0.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
            Source: cfrv_4_0_setup_ALL.exe.0.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
            Source: cfrv_4_0_setup_ALL.exe.0.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows
            Source: cfrv_4_0_setup_ALL.exe.0.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
            Source: cfrv_4_0_setup_ALL.exe.0.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (console) Intel 80386, for MS Windows
            Source: cfrv_4_0_setup_ALL.exe.0.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
            Source: cfrv_4_0_setup_ALL.exe.0.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (console) Intel 80386, for MS Windows
            Source: msi.dll.0.drStatic PE information: Resource name: None type: DOS executable (COM)
            Source: msi.dll0.0.drStatic PE information: Resource name: None type: DOS executable (COM)
            Source: crviewer.dll.0.drStatic PE information: Resource name: None type: GLS_BINARY_LSB_FIRST
            Source: crviewer.dll.0.drStatic PE information: Resource name: None type: GLS_BINARY_LSB_FIRST
            Source: crviewer.dll.0.drStatic PE information: Resource name: None type: GLS_BINARY_LSB_FIRST
            Source: crviewer.dll.0.drStatic PE information: Resource name: None type: GLS_BINARY_LSB_FIRST
            Source: crviewer.dll.0.drStatic PE information: Resource name: None type: GLS_BINARY_LSB_FIRST
            Source: crviewer.dll.0.drStatic PE information: Resource name: None type: GLS_BINARY_LSB_FIRST
            Source: crviewer.dll.0.drStatic PE information: Resource name: None type: GLS_BINARY_LSB_FIRST
            Source: stdole2.tlb.0.drStatic PE information: No import functions for PE file found
            Source: CRxmlx07r.dll.0.drStatic PE information: No import functions for PE file found
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000050D1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCS40_CA.DLLj% vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005965000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsihnd.dllX vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005965000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsihnd.dllD vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005965000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsimsg.dllX vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005965000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMSISIP.DLLX vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005965000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMSISIP.DLLD vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1731016611.00000000074F9000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCS40_CA.DLLj% vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052F4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameImgXPrint61.dll, vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052F4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameImgXTwain61.dll, vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052F4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameimplode.dllL vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1731328809.0000000007170000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCS40_CA.DLLj% vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006546000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSSCsdk32.dll vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005331000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLogFile.dll, vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000515D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameExportModeller.DLL vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000515D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameimagehlp.dllz- vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000515D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameImgX61.dll, vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006999000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMSCOMCTL.OCX2 vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006804000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameImgX61.ocx, vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000050F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCS40_CA.DLLj% vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000050F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameEXLATE32.DLL" vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005BC6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMSLS31.DLLR vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005BC6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemspatcha.dll: vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005BA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMSLS31.DLLR vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000663D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameu2fxml.dll vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000663D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameu2l2000.dllP vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000663D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameu2lcom.dll@ vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000654C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSSubTmr6.dll, vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000654C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameu252000.dllP vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000654C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameU25dts.dll vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000654C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameuxdapp.dllP vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000654C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameuxddisk.dllDisk file vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000654C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameuxdmapi.dll" vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000654C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameuxdnotes.dll vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000058C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsi.dllD vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1731328809.0000000007150000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCS40_CA.DLLj% vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameOLEPRO32.DLL( vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamep2ixbse.dll vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepdlodbc.dll vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamep2smon.dll@ vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamep2sodbc.dll" vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameriched20.dllp( vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VerQueryValueAGetFileVersionInfoAGetFileVersionInfoSizeALegalCopyrightInternalNameOriginalFilenameFileVersionProductNameCompanyNameFileDescriptionProductVersionDOSWIN32WIN16NONETAGIDTAGSTRTAB_ITEMINDEX_BITSINDEX_KEYINDEX_TAGINDEXINDEXESSTRINGTABLEMATCH_MODEDATABASE_ID(GUID)MSI_PACKAGE_ID(GUID)DATA_BITSEXE_ID(GUID)FILE_BITSPATCH_BITSFLAGS_NTVDM3FLAGS_NTVDM2FLAGS_NTVDM1DATA_QWORDUPTO_BIN_FILE_VERSIONUPTO_BIN_PRODUCT_VERSIONFLAG_MASK_SHELLFLAG_MASK_USERFLAG_MASK_KERNELMODTIMEBIN_PRODUCT_VERSIONBIN_FILE_VERSIONTIMEAPPLY_ALL_SHIMSMATCH_LOGIC_NOTGENERALINCLUDERUNTIME_PLATFORMMSI_TRANSFORM_TAGIDDATA_DWORDVALUETYPEFLAGSENGINEAPPHELP_LANGIDINDEXFLAGSHTMLHELPIDPROBLEM_SEVERITYPREVOSBUILDNOPREVOSPLATFORMIDPREVOSMINORVERSIONPREVOSMAJORVERSIONVER_LANGUAGEOS_SERVICE_PACKUPTO_LINK_DATELINK_DATELINKER_VERSIONPE_CHECKSUMVERFILETYPEVERFILEOSVERFILEDATELOVERFILEDATEHIMODULE_TYPEFLAG_TAGIDLAYER_TAGIDPATCH_TAGIDSHIM_TAGIDCHECKSUMOFFSETSIZECOMPILER_VERSIONLAYER_DISPLAYNAMES16BIT_MODULE_NAMEMSI_TRANSFORM_FILEDATA_STRINGSXS_MANIFESTAPPHELP_CONTACTAPPHELP_TITLELINK_TEXTLINK_URLPROBLEM_DETAILSS16BIT_DESCRIPTIONLEGAL_COPYRIGHTINTERNAL_NAMEORIGINAL_FILENAMEFILE_VERSIONFILE_DESCRIPTIONPRODUCT_VERSIONPRODUCT_NAMEWILDCARD_NAMECOMPANY_NAMECOMMAND_LINEDLLFILEAPP_NAMEVENDORAPIMODULEDESCRIPTIONNAMEMSI CUSTOM ACTIONMSI PACKAGEMSI TRANSFORM REFMSI TRANSFORMDATALINKAPPHELPFILELAYERFLAG_REFPATCH_REFSHIM_REFMATCHING_FILEEXEAPPFLAGPATCHSHIMINEXCLUDELIBRARYDATABASETagToIndexInvalid attribute 0x%x. vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesdbapi.dll vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VerQueryValueWGetFileVersionInfoWGetFileVersionInfoSizeWLegalCopyrightInternalNameOriginalFilenameFileVersionProductNameCompanyNameFileDescriptionProductVersionDOSWIN32WIN16NONETAGIDTAGSTRTAB_ITEMINDEX_BITSINDEX_KEYINDEX_TAGINDEXINDEXESSTRINGTABLEMATCH_MODEDATABASE_ID(GUID)MSI_PACKAGE_ID(GUID)DATA_BITSEXE_ID(GUID)FILE_BITSPATCH_BITSFLAGS_NTVDM3FLAGS_NTVDM2FLAGS_NTVDM1DATA_QWORDUPTO_BIN_FILE_VERSIONUPTO_BIN_PRODUCT_VERSIONFLAG_MASK_SHELLFLAG_MASK_USERFLAG_MASK_KERNELMODTIMEBIN_PRODUCT_VERSIONBIN_FILE_VERSIONTIMEAPPLY_ALL_SHIMSMATCH_LOGIC_NOTGENERALINCLUDERUNTIME_PLATFORMMSI_TRANSFORM_TAGIDDATA_DWORDVALUETYPEFLAGSENGINEAPPHELP_LANGIDINDEXFLAGSHTMLHELPIDPROBLEM_SEVERITYPREVOSBUILDNOPREVOSPLATFORMIDPREVOSMINORVERSIONPREVOSMAJORVERSIONVER_LANGUAGEOS_SERVICE_PACKUPTO_LINK_DATELINK_DATELINKER_VERSIONPE_CHECKSUMVERFILETYPEVERFILEOSVERFILEDATELOVERFILEDATEHIMODULE_TYPEFLAG_TAGIDLAYER_TAGIDPATCH_TAGIDSHIM_TAGIDCHECKSUMOFFSETSIZECOMPILER_VERSIONLAYER_DISPLAYNAMES16BIT_MODULE_NAMEMSI_TRANSFORM_FILEDATA_STRINGSXS_MANIFESTAPPHELP_CONTACTAPPHELP_TITLELINK_TEXTLINK_URLPROBLEM_DETAILSS16BIT_DESCRIPTIONLEGAL_COPYRIGHTINTERNAL_NAMEORIGINAL_FILENAMEFILE_VERSIONFILE_DESCRIPTIONPRODUCT_VERSIONPRODUCT_NAMEWILDCARD_NAMECOMPANY_NAMECOMMAND_LINEDLLFILEAPP_NAMEVENDORAPIMODULEDESCRIPTIONNAMEMSI CUSTOM ACTIONMSI PACKAGEMSI TRANSFORM REFMSI TRANSFORMDATALINKAPPHELPFILELAYERFLAG_REFPATCH_REFSHIM_REFMATCHING_FILEEXEAPPFLAGPATCHSHIMINEXCLUDELIBRARYDATABASETagToIndexInvalid attribute 0x%x. vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshfolder.dll~/ vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005707000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsi.dllX vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000532A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLogFile.dll, vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006A3F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevbalColumnTreeView6.ocx, vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000065AD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUXDPOST.dll vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000065AD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameuxdvim.dllP vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000065AD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameuxfcr.dll vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000065AD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameu2fhtml.dll vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000065AD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameuxfsepv.dllD vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000065AD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUxfxls.dll" vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameU2ldts.dll vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameu2lexch.dll vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameu2lfinra.dll2FRCurrentRatio(CurrentAssets, CurrentLiabilities)=FRQuickRatio(CurrentAssets, Inventories, CurrentLiabilities)1FRDebtEquityRatio(TotalLiabilities, TotalEquity)0FREquityVsTotalAssets(TotalEquity, TotalAssets)$FRNetProfitMargin(NetProfit, Sales)(FRGrossProfitMargin(GrossProfit, Sales)0FROperatingProfitMargin(OperatingProfit, Sales)/FRInterestCoverage(CashFlow, InterestExpenses)+FRCashFlowVsTotalDebt(CashFlow, TotalDebt))FRReturnOnEquity(NetProfit, TotalEquity)4FRReturnOnNetFixedAssets(NetProfit, NetFixedAssets).FRReturnOnTotalAssets(NetProfit, TotalAssets)BFRReturnOnInvestedCapital(NetProfit, TotalBankDebts, TotalEquity)CFRReturnOnCommonEquity(NetProfit, PreferredDividend, CommonEquity)IFREarningsPerCommonShare(NetProfit, PreferredDividend, NumOfCommonShare)6FRAccRecTurnover(AccountReceivable, Sales, NumOfDays)1FRInventoryTurnover(Inventory, Sales, NumOfDays)4FRPriceEarningsRatio(MarketPrice, EarningsPerShare)'FRDividendYield(Dividend, MarketPrice) vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameu2lsamp1.dll vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUniscribe vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevbalFlBr6.dll, vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameW95INF16.DLL5%ProductNameMicrosoft vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameW95INF32.DLLj% vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCF_Login.ocx, vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCF_Transaction.ocx, vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamecomct332.ocx, vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCOMDLG32.OCX2 vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000068AD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMSChart.ocx@ vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006B00000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename7zxa.dll, vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2240854022.0000000000CBC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFileNameram FilHiU vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2067031263.0000000005517000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename7zxa.dll, vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilename7zxa.dll, vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735771372.0000000000842000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenameahadmin_wrapper.dll4 vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735771372.0000000000842000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenameahadmin_.dll4 vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735771372.0000000000842000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenameGameuxInstallHelper.DLLb! vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735771372.0000000000842000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenameManagedVCL.Utils.dll8 vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735771372.0000000000842000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenamegacutil.exeT vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735771372.0000000000842000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenamegacutlrc.dllT vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735771372.0000000000842000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenamez vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilename7zxa.dll, vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameahadmin_wrapper.dll4 vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameahadmin_.dll4 vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameGameuxInstallHelper.DLLb! vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameManagedVCL.Utils.dll8 vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegacutil.exeT vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegacutlrc.dllT vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamez vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2062002599.0000000000CA8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFileNameram FilHiU vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2241393232.0000000005498000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameEXPLORER.EXEj% vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1740941529.00000000FFE03000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilename7zxa.dll, vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2062442144.00000000055A1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegacutil.exeT vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2062442144.00000000055A1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamez vs cfrv_4_0_setup_ALL.exe
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2062442144.00000000055A1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegacutlrc.dllT vs cfrv_4_0_setup_ALL.exe
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeSection loaded: tsappcmp.dllJump to behavior
            Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: msvcrt40.dll
            Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dll
            Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: craxdrt_res_zzz.dll
            Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: craxdrt_res_zz.dll
            Source: cfrv_4_0_setup_ALL.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmp, vbalFlBr6.dll.0.drBinary or memory string: 4*\AC:\SteveMac\VB6\Develop\vbalFolderBrowse\vbalFolderBrowse6.vbp,
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000654C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .*\AC:\SteveMac\VB6\XHELPE~1\SSubTmr\SubTimer6.vbp
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2062442144.00000000055A1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TRUE|*.wse;*.zip;*.vbp;*.vbw;*.vbg;*.frm;*.frx;*.bas;*.cls;*.ctl;*.ctx
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006A3F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: GD*\AC:\SteveMac\VB6\Controls\vbalTreeView6\MultiColumn\vbalColumnTreeViewLib6.vbp
            Source: classification engineClassification label: mal52.evad.winEXE@39/565@0/0
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_0041B110 GetLastError,FormatMessageW,LocalFree,0_2_0041B110
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_0041F320 GetVersion,CoCreateInstance,0_2_0041F320
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CEC2980 LoadResource,SizeofResource,LockResource,CreateFileW,WriteFile,FindCloseChangeNotification,DeleteFileW,1_2_6CEC2980
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\SBoE
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: C:\Users\user\AppData\Local\IIIQFJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: C:\Users\user\AppData\Local\Temp\mia1Jump to behavior
            Source: Yara matchFile source: 1.0.cfrv_4_0_setup_ALL.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000001.00000000.1735223416.0000000000401000.00000020.00000001.01000000.00000004.sdmp, type: MEMORY
            Source: Yara matchFile source: C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.exe, type: DROPPED
            Source: Yara matchFile source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe, type: DROPPED
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\explorer.exe
            Source: unknownProcess created: C:\Windows\explorer.exe
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCommand line argument: kernel32.dll0_2_0041FF60
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCommand line argument: SetDllDirectory0_2_0041FF60
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCommand line argument: "-k=0_2_0041FF60
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCommand line argument: "/k=0_2_0041FF60
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCommand line argument: -k=0_2_0041FF60
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCommand line argument: /k=0_2_0041FF60
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCommand line argument: Title0_2_0041FF60
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCommand line argument: BeginPrompt0_2_0041FF60
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCommand line argument: Progress0_2_0041FF60
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCommand line argument: Directory0_2_0041FF60
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCommand line argument: RunProgram0_2_0041FF60
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCommand line argument: ExecuteFile0_2_0041FF60
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCommand line argument: `A0_2_0041FF60
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCommand line argument: setup.exe0_2_0041FF60
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCommand line argument: %%T0_2_0041FF60
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCommand line argument: %%T\0_2_0041FF60
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCommand line argument: mia.lib0_2_0041FF60
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCommand line argument: runas0_2_0041FF60
            Source: cfrv_4_0_setup_ALL.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
            Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dll
            Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dll
            Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dll
            Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dll
            Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dll
            Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dll
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000050D1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1731328809.0000000007150000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000506D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1731328809.00000000070F0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: select * from CS_ErrorDescription'select * from sysdatabases where name='masterSQLSERVER_FATAL_ERROR1ValidateDB;Network Library=dbmssocnNetwork Library=dbmssocnd:\cs40\private\cs40\setup\ca_dll\database.cppCommitDB%s
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000068AD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Selects the chart legend.W9Returns/sets the number of data columns in the data grid.WMReturns/sets the number of levels of labels on data columns in the data grid.WJReturns/sets the number of levels of labels on data rows in the data grid.6Returns/sets the number of data rows in the data grid.GDeletes columns of data and their associated labels from the data grid.WWW/Adds one or more data columns to the data grid.WWW>Deletes levels of labels from the data columns in a data grid.GAdds one or more levels of labels to the data columns in the data grid.WWWDDeletes rows of data and their associated labels from the data grid.WW,Adds one or more data rows to the data grid.WW;Deletes levels of labels from the data rows in a data grid.WWWDAdds one or more levels of labels to the data rows in the data grid.WW1Fills the data grid with randomly generated data.W4Sets the number and levels of data columns and rows.WWNAssigns each label in the first level of data grid labels a unique identifier.HFills one or more columns of the data grid with randomly generated data.WWEFills one or more rows of the data grid with randomly generated data.W(Moves a block of cells on the data grid.WW#Gets the value of a data grid cell.WWW#Sets the value of a data grid cell.WWW9Returns/sets the label on a data column in the data grid.WHReturns the multi-level label that identifies a column in the data grid.WWEReturns the multi-level label that identifies a row in the data grid.W6Returns/sets the label on a data row in the data grid.EReturns/sets the strength of the light coming from the light source.WCReturns/sets the X coordinate for the location of the LightSource.WWWCReturns/sets the Y coordinate for the location of the LightSource.WWWCReturns/sets the Z coordinate for the location of the LightSource.WWW]Sets the X,Y,Z coordinates for the LightSource location and the intensity of the LightSource.W
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile read: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeProcess created: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe .\cfrv_4_0_setup_ALL.exe /m="C:\Users\user\Desktop\CFRV_4~1.EXE" /k=""
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\mscomctl.ocx" /s
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\COMDLG32.OCX" /s
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\COMCT332.OCX" /s
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\TABCTL32.OCX" /s
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Program Files (x86)\Common Files\microsoft shared\DAO\DAO350.DLL" /s
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_CR_control.dll" /s
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_DB_Connect.dll" /s
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_File_Data.dll" /s
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_File_Export.dll" /s
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_Rmt_DB4_Update.dll" /s
            Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 9F821CD8835F26EFA91C6F67DA97DD7D
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\craxdrt.dll
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crviewer.dll
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\Crystal\Cdo32.dll
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crtslv.dll
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\ExportModeller.dll
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" /separate /root,::{21ec2020-3aea-1069-a2dd-08002b30309d}
            Source: unknownProcess created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeProcess created: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe .\cfrv_4_0_setup_ALL.exe /m="C:\Users\user\Desktop\CFRV_4~1.EXE" /k=""Jump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\mscomctl.ocx" /sJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\COMDLG32.OCX" /sJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\COMCT332.OCX" /sJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\TABCTL32.OCX" /sJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Program Files (x86)\Common Files\microsoft shared\DAO\DAO350.DLL" /sJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_CR_control.dll" /sJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_DB_Connect.dll" /sJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_File_Data.dll" /sJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_File_Export.dll" /sJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_Rmt_DB4_Update.dll" /sJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crviewer.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 9F821CD8835F26EFA91C6F67DA97DD7D
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\craxdrt.dll
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crviewer.dll
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\Crystal\Cdo32.dll
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crtslv.dll
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\ExportModeller.dll
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32Jump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Windows\SysWOW64\regsvr32.exeKey value created or modified: HKEY_CURRENT_USER\Control Panel\Mouse MouseHoverTimeJump to behavior
            Source: cfrv_4_0_setup_ALL.exeStatic file information: File size 14277760 > 1048576
            Source: Binary string: MsiHnd.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005965000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: MsiHnd.pdbV source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005965000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: shfolder.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: rF,c:\Windows\System32\ImgXTwain61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052F4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: shfolder.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: GameuxInstallHelper.pdb source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735771372.0000000000842000.00000002.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp
            Source: Binary string: gacutil.pdb source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735771372.0000000000842000.00000002.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2062442144.00000000055A1000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: c:\Windows\System32\ImgX61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052DD000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000681A000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: gacutil.pdb(0 source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735771372.0000000000842000.00000002.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2062442144.00000000055A1000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: sdbapiu.pdbU source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: usp10.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: msisip.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005965000.00000004.00000020.00020000.00000000.sdmp, msisip.dll.0.dr
            Source: Binary string: c:\Windows\System32\ImgXPrint61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052F4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: rFXc:\Windows\System32\ImgX61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000681A000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: sdbapiu.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: riched20.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: mspatcha.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005BC6000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: Y:\EPFXlate\HTML\ReleaseSym\exlate32.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000515D000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: msi.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000057A7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: c:\Windows\System32\ImgXTwain61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052F4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: rFWc:\Windows\System32\ImgX61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052DD000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: gacutil.pdb, AH/@ source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735771372.0000000000842000.00000002.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp
            Source: Binary string: sdbapi.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: msi_l.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: usp10.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: imagehlp.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000515D000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: msi.pdbh source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000057A7000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: mspatcha.pdbtvbl01\LOCALS~1\Temp\2\DBGtoPDB\mspatcha.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005BC6000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: imagehlp.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000515D000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: riched20.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: Y:\EPFXlate\HTML\ReleaseSym\exlate32.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000515D000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: sdbapi.pdbU source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006292000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: tvbl01\LOCALS~1\Temp\2\DBGtoPDB\mspatcha.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005BC6000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: msisip.pdb3 source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005965000.00000004.00000020.00020000.00000000.sdmp, msisip.dll.0.dr
            Source: Binary string: rF,c:\Windows\System32\ImgXPrint61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052F4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: gacutlrc.pdb source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735771372.0000000000842000.00000002.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2062442144.00000000055A1000.00000004.00000020.00020000.00000000.sdmp
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_0041F0E0 GetSystemDefaultUILanguage,GetSystemDefaultUILanguage,LoadLibraryW,GetProcAddress,FreeLibrary,_malloc,__CxxThrowException@8,LoadLibraryW,GetProcAddress,FreeLibrary,_swscanf,GetSystemDefaultUILanguage,SetThreadUILanguage,GetUserDefaultUILanguage,SetThreadUILanguage,SetThreadLocale,0_2_0041F0E0
            Source: stdole2.tlb.0.drStatic PE information: real checksum: 0x0 should be: 0x52af
            Source: sscsdk80.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x128651
            Source: Crpe32.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x4d2dd3
            Source: CRxmlx07r.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x1dd3a
            Source: u2lcom.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x29105
            Source: exlate32.dll.0.drStatic PE information: real checksum: 0x0 should be: 0xaffcb
            Source: u2fsepv.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x19f64
            Source: u2ddisk.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x103c1
            Source: Crpaig80.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x9e40f
            Source: u2dnotes.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x149ee
            Source: crxf_rtf.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x32017
            Source: AtalaImaging.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x136494
            Source: cfrv_4_0_setup_ALL.exe.0.drStatic PE information: real checksum: 0x0 should be: 0x56e113
            Source: CRxmlx07.dll.0.drStatic PE information: real checksum: 0x0 should be: 0xea5a8
            Source: u2fxls.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x41a2a
            Source: ExportModeller.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x4ae62
            Source: Implode.dll.0.drStatic PE information: real checksum: 0xb8c2 should be: 0x104a3
            Source: craxdrt.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x4f77f9
            Source: u2dmapi.dll.0.drStatic PE information: real checksum: 0x0 should be: 0xdf55
            Source: u2fhtml.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x10ea0
            Source: cfrv_4_0_setup_ALL.exe.0.drStatic PE information: section name: .didata
            Source: usp10.dll.0.drStatic PE information: section name: Shared
            Source: usp10.dll0.0.drStatic PE information: section name: Shared
            Source: craxdrt.dll.0.drStatic PE information: section name: _CODE
            Source: Crpe32.dll.0.drStatic PE information: section name: _CODE
            Source: exlate32.dll.0.drStatic PE information: section name: _CODE
            Source: mDownExec.dll.0.drStatic PE information: section name: .didata
            Source: mMSIExec.dll.0.drStatic PE information: section name: .didata
            Source: msi.dll.0.drStatic PE information: section name: .orpc
            Source: msi.dll0.0.drStatic PE information: section name: .orpc
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Program Files (x86)\Common Files\microsoft shared\DAO\DAO350.DLL" /s
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_00434168 pushad ; iretd 0_2_00434169
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_00423ADD push ecx; ret 0_2_00423AF0
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_00437F08 push ecx; retf 0_2_00437F09
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_0561C473 push ecx; mov dword ptr [esp], edx1_3_0568F50D
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055BE440 push 51115D0Eh; ret 1_3_055BE4B2
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055BE444 push 51115D0Eh; ret 1_3_055BE4B2
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055BE466 push 51115D0Eh; ret 1_3_055BE4B2
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055BE4F7 push 51115D8Ah; ret 1_3_055BE52E
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055BE759 push 51115FDFh; ret 1_3_055BE783
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_0568E76A push ecx; ret 1_3_0568E76E
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_0568E744 push ecx; ret 1_3_0568E74A
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055BE76C push 51115FDFh; ret 1_3_055BE783
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055C6678 push 5111ED52h; ret 1_3_055C66F6
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_0566C17C push 510C3A08h; ret 1_3_0566C1AC
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055BE1D1 push 51115D0Eh; ret 1_3_055BE4B2
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_056061D6 push ecx; mov dword ptr [esp], ecx1_3_056061D9
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055BE00A push 51115D0Eh; ret 1_3_055BE4B2
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055BE0EF push 51115D0Eh; ret 1_3_055BE4B2
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055BE0E7 push 51115D0Eh; ret 1_3_055BE4B2
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055BE09C push 51115D0Eh; ret 1_3_055BE4B2
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055BE094 push 51115D0Eh; ret 1_3_055BE4B2
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055BE357 push 51115D0Eh; ret 1_3_055BE4B2
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055BE327 push 51115D0Eh; ret 1_3_055BE4B2
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055BE3D1 push 51115D0Eh; ret 1_3_055BE4B2
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055BE2FE push 51115D0Eh; ret 1_3_055BE4B2
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_05602D73 push ecx; ret 1_3_05602D74
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055BED90 push 51116630h; ret 1_3_055BEDD4
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055BEDBA push 51116630h; ret 1_3_055BEDD4
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_05606F5C push 5105E808h; ret 1_3_05606FAC
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055BEEE9 push 51116752h; ret 1_3_055BEEF6
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_055BEEBC push 51116752h; ret 1_3_055BEEF6
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\5A4D542C\7204BF44\CRUTL15R.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\shfolder.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1A28DE63\34510A4\dao360.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2lexch.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\mVB.dll\mVBExec.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2lsamp1.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\D71275EF\1517B7F7\CF_org_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msihnd.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\DAE69E8\7204BF44\craxdrt.dllJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: C:\Users\user\AppData\Local\Temp\mia1\pPin32.cplJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\shfolder.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B2966187\1517B7F7\CF_File_Data.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\DCDC5FB4\1517B7F7\CF_File_Import.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\stdole2.tlbJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\p2ixbse.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\9F0CE7B6\7204BF44\CRxmlx07.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\47C10F79\7204BF44\CRxmlx07r.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2lfinra.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\DF17326D\1835CB68\Crxlat32.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\msvbvm60.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1D5631E8\1517B7F7\CF_Login.ocxJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\E76BBEDE\7204BF44\crviewer.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI3C42.tmpJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\487DDF\1835CB68\u2ddisk.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\DD3D7189\34510A4\COMCT332.OCXJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2fxml.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\FBA4A636\1835CB68\p2lodbc.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\832FC268\1517B7F7\LogFile.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\EEBF1E87\7204BF44\exlate32.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\DC878553\34510A4\AtalaImaging.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\Crxlat32.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A297C06E\1517B7F7\CF_audit_review_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\63200452\1835CB68\u2dpost.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\474E307D\1835CB68\u2lsamp1.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\CRXML15R.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\6D4D0E7\34510A4\ImgX61.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A8299B92\7204BF44\CRXML15R.DLLJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2dapp.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\ED7284FA\1517B7F7\CF_report_export_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1DF81C7A\34510A4\ImgXPrint61.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\Crpaig80.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\6DEA5FF3\7204BF44\CRXML15.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\usp10.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\51868479\1517B7F7\CF_report_main_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\68965F3A\1835CB68\u2fhtml.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\EABD308B\1835CB68\u2dnotes.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\imagehlp.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\CRxmlx07.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msi.dllJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: C:\Users\user\AppData\Local\Temp\mia1\pPin64.cplJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\CRBAS15R.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\usp10.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\crwrap32.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\Implode.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\mVBExec.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\880D11DF\1835CB68\P2smon.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\526A560A\1835CB68\u2lcom.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiinst.exeJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\mWinRun.dll\mWinRunExec.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\4D29780E\1835CB68\u2fsepv.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\olepro32.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiexec.exeJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\E3BD0475\1517B7F7\LogFile.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1F62DE62\1517B7F7\CF_File_Import_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\cabinet.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\CBB1E6D9\1517B7F7\CF_Transaction.ocxJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u252000.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\p2sodbc.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\205EBC50\34510A4\ImgXTwain61.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\F7CFC206\7204BF44\Implode.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\riched20.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\mDown.dll\mDownExec.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\C847D812\1835CB68\Cdo32.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2E5B6414\1835CB68\u2fcr.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msimsg.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B3FFCC7F\1835CB68\u2dmapi.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\crxf_pdf.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\CRUTL15R.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\3E323407\1835CB68\u2fxls.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2dvim.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2ddisk.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\CRxmlx07r.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A9695CDF\1517B7F7\CF_Rmt_DB4_Update.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\AB3A15F4\34510A4\TABCTL32.OCXJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\161F85F0\7204BF44\CRUTL15.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\mspatcha.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\oleaut32.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\E2BBEE13\1835CB68\p2ixbse.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2dpost.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2l2000.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\ExportModeller.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\W95INF32.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msisip.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\3D003E72\1835CB68\u2fxml.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\asycfilt.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2fxls.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI3D7C.tmpJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msihnd.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2ldts.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\Crpe32.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\craxdrt.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msls31.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\FE57A718\1517B7F7\CF_DB_Connect.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\BA3E37E4\1517B7F7\CF_CR_control.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\crviewer.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\D4B1A979\1835CB68\u2l2000.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\80B1517D\1835CB68\u2dvim.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\C2C59FBE\1517B7F7\CF_File_Export.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\33BB160B\1835CB68\u2dapp.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\E04462E5\1517B7F7\CF_Report_Verify_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2E81A74\34510A4\vbalColumnTreeView6.ocaJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A52CA551\7204BF44\CRXML15S.DLLJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\CRBAS15.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msisip.dllJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: C:\Users\user\AppData\Local\Temp\mia1\mWinRunExec.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\pg32conv.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\sscsdk80.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\CE1E931F\7204BF44\sscsdk80.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2dmapi.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\C8E76B1B\1835CB68\u2lexch.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\496179\1517B7F7\CF_rs_browse_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2D3E0D90\7204BF44\Crpe32.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\exlate32.dllJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: C:\Users\user\AppData\Local\Temp\mia1\mDownExec.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\C964AC44\1835CB68\u2lfinra.dllJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: C:\Windows\System32\myah0.cplJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A157FA05\1835CB68\crxf_rtf.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\90E4D581\1517B7F7\CF_ref_report_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\W95INF16.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2EC6F5ED\34510A4\vbalColumnTreeView6.ocxJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\3B44007A\1835CB68\u252000.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1BF788A5\1517B7F7\CF_Name_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\mia.libJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\43981525\7204BF44\pg32conv.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\496C80D6\34510A4\MSCHRT20.OCXJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\92CEEA92\34510A4\DAO350.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\F0E0F85C\1517B7F7\cf_rpt_link_bus.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2fsepv.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\p2lodbc.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\184596D6\1517B7F7\CF_login_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\BB709D56\1517B7F7\CF_Trans_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\mWinRunExec.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\D77E7C08\7204BF44\crwrap32.dllJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\mia.libJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\CRUTL15.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\sdbapi.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\83ED17B7\1517B7F7\CF_report_history_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\BED664EA\7204BF44\Crpaig80.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\imagehlp.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\crxf_rtf.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2lcom.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\FAAEA181\7204BF44\ExportModeller.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\P2smon.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\701CB7F7\34510A4\mscomctl.ocxJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2ADC2324\1835CB68\u25dts.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\comcat.dllJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: C:\Users\user\AppData\Local\IIIQF\7z.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\83C5D67\7204BF44\crtslv.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2dnotes.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiinst.exeJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\7DB1D6B0\7204BF44\CRBAS15R.DLLJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u25dts.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\Cdo32.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A95AB0B4\34510A4\ImgX61.ocxJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\6C6652B9\1517B7F7\CF_report_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\riched20.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI3DAC.tmpJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI3CDF.tmpJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\7A300D31\1835CB68\crxf_pdf.dllJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: C:\Users\user\AppData\Local\Temp\mia1\mMSIExec.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\ADVPACK.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\D25B4F4E\7204BF44\CRBAS15.DLLJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\CRXML15.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiexec.exeJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msimsg.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\D63D429\1517B7F7\CF_document_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\416B4F42\1517B7F7\CF_org_history_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\8BAE8D59\7204BF44\p2sodbc.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\crtslv.dllJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: C:\Users\user\AppData\Local\Temp\mia1\mVBExec.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\cabinet.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\4B371E22\34510A4\vbalFlBr6.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msls31.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\mspatcha.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2fhtml.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\FCE647BF\1835CB68\u2ldts.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\7CC1D691\34510A4\TABCTL32.OCXJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2fcr.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\CRXML15S.DLLJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.exeJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\CF_Remote.exeJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\C7D8D83E\34510A4\SSubTmr6.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\7C02DA3A\CF_Remote.exeJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\sdbapiU.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\679B857\34510A4\COMDLG32.OCXJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\5A4D542C\7204BF44\CRUTL15R.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\shfolder.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1A28DE63\34510A4\dao360.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msls31.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\FE57A718\1517B7F7\CF_DB_Connect.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\BA3E37E4\1517B7F7\CF_CR_control.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\D4B1A979\1835CB68\u2l2000.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\mVB.dll\mVBExec.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\D71275EF\1517B7F7\CF_org_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msihnd.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\80B1517D\1835CB68\u2dvim.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\C2C59FBE\1517B7F7\CF_File_Export.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\DAE69E8\7204BF44\craxdrt.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\shfolder.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B2966187\1517B7F7\CF_File_Data.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\33BB160B\1835CB68\u2dapp.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\DCDC5FB4\1517B7F7\CF_File_Import.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\stdole2.tlbJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\E04462E5\1517B7F7\CF_Report_Verify_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2E81A74\34510A4\vbalColumnTreeView6.ocaJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A52CA551\7204BF44\CRXML15S.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\9F0CE7B6\7204BF44\CRxmlx07.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\47C10F79\7204BF44\CRxmlx07r.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msisip.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\DF17326D\1835CB68\Crxlat32.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\msvbvm60.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\CE1E931F\7204BF44\sscsdk80.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1D5631E8\1517B7F7\CF_Login.ocxJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\E76BBEDE\7204BF44\crviewer.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\487DDF\1835CB68\u2ddisk.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\C8E76B1B\1835CB68\u2lexch.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\496179\1517B7F7\CF_rs_browse_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2D3E0D90\7204BF44\Crpe32.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\DD3D7189\34510A4\COMCT332.OCXJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\FBA4A636\1835CB68\p2lodbc.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\832FC268\1517B7F7\LogFile.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\C964AC44\1835CB68\u2lfinra.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\EEBF1E87\7204BF44\exlate32.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\DC878553\34510A4\AtalaImaging.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A157FA05\1835CB68\crxf_rtf.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A297C06E\1517B7F7\CF_audit_review_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\90E4D581\1517B7F7\CF_ref_report_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\63200452\1835CB68\u2dpost.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2EC6F5ED\34510A4\vbalColumnTreeView6.ocxJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\W95INF16.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\474E307D\1835CB68\u2lsamp1.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\3B44007A\1835CB68\u252000.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1BF788A5\1517B7F7\CF_Name_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\mia.libJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\6D4D0E7\34510A4\ImgX61.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\43981525\7204BF44\pg32conv.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A8299B92\7204BF44\CRXML15R.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\496C80D6\34510A4\MSCHRT20.OCXJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\ED7284FA\1517B7F7\CF_report_export_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\92CEEA92\34510A4\DAO350.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1DF81C7A\34510A4\ImgXPrint61.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\6DEA5FF3\7204BF44\CRXML15.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\F0E0F85C\1517B7F7\cf_rpt_link_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\usp10.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\51868479\1517B7F7\CF_report_main_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\68965F3A\1835CB68\u2fhtml.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\EABD308B\1835CB68\u2dnotes.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\imagehlp.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msi.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\184596D6\1517B7F7\CF_login_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\usp10.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\mVBExec.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\BB709D56\1517B7F7\CF_Trans_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\D77E7C08\7204BF44\crwrap32.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\mWinRunExec.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\880D11DF\1835CB68\P2smon.dllJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\mia.libJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\sdbapi.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\526A560A\1835CB68\u2lcom.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiinst.exeJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\83ED17B7\1517B7F7\CF_report_history_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\BED664EA\7204BF44\Crpaig80.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\imagehlp.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\mWinRun.dll\mWinRunExec.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\4D29780E\1835CB68\u2fsepv.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\olepro32.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\FAAEA181\7204BF44\ExportModeller.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiexec.exeJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\701CB7F7\34510A4\mscomctl.ocxJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2ADC2324\1835CB68\u25dts.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\comcat.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\E3BD0475\1517B7F7\LogFile.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\83C5D67\7204BF44\crtslv.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1F62DE62\1517B7F7\CF_File_Import_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\cabinet.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\CBB1E6D9\1517B7F7\CF_Transaction.ocxJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiinst.exeJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\205EBC50\34510A4\ImgXTwain61.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\F7CFC206\7204BF44\Implode.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\riched20.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\7DB1D6B0\7204BF44\CRBAS15R.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\mDown.dll\mDownExec.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A95AB0B4\34510A4\ImgX61.ocxJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\C847D812\1835CB68\Cdo32.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2E5B6414\1835CB68\u2fcr.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\6C6652B9\1517B7F7\CF_report_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\riched20.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msimsg.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\7A300D31\1835CB68\crxf_pdf.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B3FFCC7F\1835CB68\u2dmapi.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\3E323407\1835CB68\u2fxls.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\ADVPACK.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\D25B4F4E\7204BF44\CRBAS15.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiexec.exeJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msimsg.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\D63D429\1517B7F7\CF_document_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\416B4F42\1517B7F7\CF_org_history_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\8BAE8D59\7204BF44\p2sodbc.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A9695CDF\1517B7F7\CF_Rmt_DB4_Update.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\cabinet.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\AB3A15F4\34510A4\TABCTL32.OCXJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\4B371E22\34510A4\vbalFlBr6.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\161F85F0\7204BF44\CRUTL15.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\mspatcha.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\oleaut32.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\E2BBEE13\1835CB68\p2ixbse.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msls31.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\W95INF32.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\mspatcha.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msisip.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\FCE647BF\1835CB68\u2ldts.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\7CC1D691\34510A4\TABCTL32.OCXJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\3D003E72\1835CB68\u2fxml.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\asycfilt.dllJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.exeJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\C7D8D83E\34510A4\SSubTmr6.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msihnd.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\7C02DA3A\CF_Remote.exeJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\sdbapiU.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\679B857\34510A4\COMDLG32.OCXJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\crwrap32.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\Implode.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2lexch.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\crviewer.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2lsamp1.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\CRUTL15.DLLJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\crxf_rtf.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2lcom.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\P2smon.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\p2ixbse.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\CRBAS15.DLLJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2dnotes.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u252000.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2lfinra.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\p2sodbc.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u25dts.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\Cdo32.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\pg32conv.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\sscsdk80.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI3DAC.tmpJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI3CDF.tmpJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2dmapi.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI3C42.tmpJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\crxf_pdf.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\CRUTL15R.DLLJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2dvim.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\exlate32.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\CRXML15.DLLJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2fxml.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2ddisk.dllJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: C:\Windows\System32\myah0.cplJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\CRxmlx07r.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\Crxlat32.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\crtslv.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2dpost.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\CRXML15R.DLLJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2l2000.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\ExportModeller.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2dapp.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2fhtml.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\Crpaig80.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2fcr.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2fxls.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\CRXML15S.DLLJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2fsepv.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI3D7C.tmpJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\u2ldts.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Crystal\p2lodbc.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\CRxmlx07.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\Crpe32.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\CRBAS15R.DLLJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\craxdrt.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\mia.libJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2E81A74\34510A4\vbalColumnTreeView6.ocaJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: C:\Users\user\AppData\Local\Temp\mia1\pPin64.cplJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: C:\Windows\System32\myah0.cplJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\mia.libJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: C:\Users\user\AppData\Local\Temp\mia1\pPin32.cplJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile created: c:\tmp\log\installs\CF_Remote\install.logJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Campaign Finance
            Source: C:\Windows\System32\msiexec.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Campaign Finance\CF Remote.lnk

            Hooking and other Techniques for Hiding and Protection

            barindex
            May use the Tor software to hide its network traffic
            Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: torConnect
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOGPFAULTERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_3_056A068D str word ptr [ebx+40F6FC45h]1_3_056A068D
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\5A4D542C\7204BF44\CRUTL15R.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\shfolder.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1A28DE63\34510A4\dao360.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msls31.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\u2lexch.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\D4B1A979\1835CB68\u2l2000.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\mVB.dll\mVBExec.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\u2lsamp1.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msihnd.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\D71275EF\1517B7F7\CF_org_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\80B1517D\1835CB68\u2dvim.dllJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia1\pPin32.cplJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\shfolder.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\33BB160B\1835CB68\u2dapp.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\DCDC5FB4\1517B7F7\CF_File_Import.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\p2ixbse.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A52CA551\7204BF44\CRXML15S.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\E04462E5\1517B7F7\CF_Report_Verify_bus.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\CRBAS15.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\9F0CE7B6\7204BF44\CRxmlx07.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\47C10F79\7204BF44\CRxmlx07r.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\u2lfinra.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msisip.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\DF17326D\1835CB68\Crxlat32.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\pg32conv.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\sscsdk80.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\CE1E931F\7204BF44\sscsdk80.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1D5631E8\1517B7F7\CF_Login.ocxJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\u2dmapi.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\487DDF\1835CB68\u2ddisk.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\C8E76B1B\1835CB68\u2lexch.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\496179\1517B7F7\CF_rs_browse_bus.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\exlate32.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2D3E0D90\7204BF44\Crpe32.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\u2fxml.dllJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia1\mDownExec.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\FBA4A636\1835CB68\p2lodbc.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\832FC268\1517B7F7\LogFile.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\C964AC44\1835CB68\u2lfinra.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\EEBF1E87\7204BF44\exlate32.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A157FA05\1835CB68\crxf_rtf.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\DC878553\34510A4\AtalaImaging.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\Crxlat32.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A297C06E\1517B7F7\CF_audit_review_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\90E4D581\1517B7F7\CF_ref_report_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\63200452\1835CB68\u2dpost.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\3B44007A\1835CB68\u252000.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\W95INF16.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2EC6F5ED\34510A4\vbalColumnTreeView6.ocxJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\474E307D\1835CB68\u2lsamp1.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\CRXML15R.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1BF788A5\1517B7F7\CF_Name_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\43981525\7204BF44\pg32conv.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\6D4D0E7\34510A4\ImgX61.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A8299B92\7204BF44\CRXML15R.DLLJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\u2dapp.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\496C80D6\34510A4\MSCHRT20.OCXJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\ED7284FA\1517B7F7\CF_report_export_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1DF81C7A\34510A4\ImgXPrint61.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\Crpaig80.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\6DEA5FF3\7204BF44\CRXML15.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\F0E0F85C\1517B7F7\cf_rpt_link_bus.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\u2fsepv.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\usp10.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\51868479\1517B7F7\CF_report_main_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\68965F3A\1835CB68\u2fhtml.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\EABD308B\1835CB68\u2dnotes.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\CRxmlx07.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\p2lodbc.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\184596D6\1517B7F7\CF_login_bus.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\CRBAS15R.DLLJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia1\pPin64.cplJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\usp10.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\crwrap32.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\Implode.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\mVBExec.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\BB709D56\1517B7F7\CF_Trans_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\880D11DF\1835CB68\P2smon.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\D77E7C08\7204BF44\crwrap32.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\CRUTL15.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\526A560A\1835CB68\u2lcom.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\sdbapi.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\83ED17B7\1517B7F7\CF_report_history_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\BED664EA\7204BF44\Crpaig80.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiinst.exeJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\crxf_rtf.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\4D29780E\1835CB68\u2fsepv.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\u2lcom.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\P2smon.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiexec.exeJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\comcat.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2ADC2324\1835CB68\u25dts.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\E3BD0475\1517B7F7\LogFile.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\cabinet.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\u2dnotes.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1F62DE62\1517B7F7\CF_File_Import_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\CBB1E6D9\1517B7F7\CF_Transaction.ocxJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiinst.exeJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\u252000.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\p2sodbc.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\205EBC50\34510A4\ImgXTwain61.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\riched20.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\F7CFC206\7204BF44\Implode.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\mDown.dll\mDownExec.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\7DB1D6B0\7204BF44\CRBAS15R.DLLJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\u25dts.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A95AB0B4\34510A4\ImgX61.ocxJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2E5B6414\1835CB68\u2fcr.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\riched20.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\6C6652B9\1517B7F7\CF_report_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msimsg.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI3DAC.tmpJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\7A300D31\1835CB68\crxf_pdf.dllJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia1\mMSIExec.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B3FFCC7F\1835CB68\u2dmapi.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\crxf_pdf.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\CRUTL15R.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\3E323407\1835CB68\u2fxls.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\u2dvim.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\ADVPACK.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\D25B4F4E\7204BF44\CRBAS15.DLLJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\CRXML15.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiexec.exeJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msimsg.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\u2ddisk.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\D63D429\1517B7F7\CF_document_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\416B4F42\1517B7F7\CF_org_history_bus.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\8BAE8D59\7204BF44\p2sodbc.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\CRxmlx07r.dllJump to dropped file
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia1\mVBExec.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\cabinet.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\4B371E22\34510A4\vbalFlBr6.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\161F85F0\7204BF44\CRUTL15.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\mspatcha.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\E2BBEE13\1835CB68\p2ixbse.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\u2dpost.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msls31.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\u2l2000.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\mspatcha.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\W95INF32.DLLJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msisip.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\u2fhtml.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\FCE647BF\1835CB68\u2ldts.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\u2fcr.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\3D003E72\1835CB68\u2fxml.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\asycfilt.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\CRXML15S.DLLJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\u2fxls.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\CF_Remote.exeJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI3D7C.tmpJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\C7D8D83E\34510A4\SSubTmr6.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msihnd.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Crystal\u2ldts.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\7C02DA3A\CF_Remote.exeJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\Crpe32.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeDropped PE file which has not been started: C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\sdbapiU.dllJump to dropped file
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcessgraph_0-20219
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeEvasive API call chain: GetModuleFileName,DecisionNodes,Sleepgraph_0-20122
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeEvasive API call chain: GetModuleFileName,DecisionNodes,Sleepgraph_1-39044
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeAPI coverage: 9.8 %
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809Jump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809Jump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809Jump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809Jump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809Jump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
            Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
            Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
            Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
            Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
            Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_00407E20 FindNextFileW,FindClose,FindFirstFileW,FindFirstFileW,0_2_00407E20
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CEC2A30 _memset,FindFirstFileW,LoadLibraryW,FindClose,FindResourceW,LoadLibraryW,1_2_6CEC2A30
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CEB2470 FindClose,FindFirstFileW,FindFirstFileW,1_2_6CEB2470
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_10001B41 GetSystemInfo,1_2_10001B41
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile opened: C:\ProgramData\Microsoft\Windows\Start MenuJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile opened: C:\ProgramData\Microsoft\Windows\Start Menu\ProgramsJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile opened: C:\ProgramData\MicrosoftJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile opened: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Campaign Finance\CF Remote.lnkJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile opened: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Campaign FinanceJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeFile opened: C:\ProgramData\Microsoft\WindowsJump to behavior
            Source: explorer.exe, 00000018.00000003.2057826843.0000000008D13000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_
            Source: explorer.exe, 00000018.00000003.2057512082.0000000008CE3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}@psQ
            Source: explorer.exe, 00000018.00000002.2879083790.0000000008DF7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2239438491.0000000002825000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: NC:\Windows\system32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563
            Source: explorer.exe, 00000018.00000003.2057512082.0000000008CE3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}@
            Source: explorer.exe, 00000018.00000003.2060166385.00000000067A5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000003.2060001241.00000000067A1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2878512791.00000000067A1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlls
            Source: explorer.exe, 00000018.00000002.2878818194.0000000008C86000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b}1
            Source: explorer.exe, 00000018.00000002.2879083790.0000000008DF7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}id3=
            Source: explorer.exe, 00000017.00000002.1993887879.0000000000E75000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: fb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_D0
            Source: explorer.exe, 00000018.00000002.2879083790.0000000008DF7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}}.
            Source: explorer.exe, 00000018.00000002.2877884579.0000000001004000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Prod_VMware_SATA{
            Source: explorer.exe, 00000018.00000002.2878818194.0000000008C86000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\
            Source: explorer.exe, 00000018.00000003.2057789670.0000000008D84000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rod_VMware_SATA_CD00#4&224f42ef&0&00000a
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeAPI call chain: ExitProcess graph end nodegraph_1-37450
            Source: C:\Windows\System32\msiexec.exeProcess information queried: ProcessInformation
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_00424C1E _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00424C1E
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_0041F0E0 GetSystemDefaultUILanguage,GetSystemDefaultUILanguage,LoadLibraryW,GetProcAddress,FreeLibrary,_malloc,__CxxThrowException@8,LoadLibraryW,GetProcAddress,FreeLibrary,_swscanf,GetSystemDefaultUILanguage,SetThreadUILanguage,GetUserDefaultUILanguage,SetThreadUILanguage,SetThreadLocale,0_2_0041F0E0
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_004251D4 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_004251D4
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_00424C1E _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00424C1E
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_00426C2A SetUnhandledExceptionFilter,0_2_00426C2A
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_00421DDF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00421DDF
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_1001B723 SetUnhandledExceptionFilter,1_2_1001B723
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_1001B735 SetUnhandledExceptionFilter,1_2_1001B735
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CEC6CD8 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_6CEC6CD8
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CEC5A8A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_6CEC5A8A
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: 1_2_6CEC51C7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_6CEC51C7

            HIPS / PFW / Operating System Protection Evasion

            barindex
            DLL side loading technique detected
            Source: C:\Windows\explorer.exeSection loaded: C:\Windows\System32\msi.dll
            Injects code into the Windows Explorer (explorer.exe)
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeMemory written: PID: 6920 base: B20000 value: 00Jump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeMemory written: PID: 6920 base: D212D8 value: 00Jump to behavior
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_0041FF60 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,MessageBoxW,CoInitialize,_memset,GetVersionExW,GetCommandLineW,_malloc,__CxxThrowException@8,MessageBoxW,_malloc,__CxxThrowException@8,MessageBoxW,MessageBoxW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,ShellExecuteExW,SetCurrentDirectoryW,SetCurrentDirectoryW,CreateProcessW,GetLastError,GetLastError,CoInitializeEx,ShellExecuteExW,GetLastError,SetCurrentDirectoryW,SetCurrentDirectoryW,CloseHandle,WaitForSingleObject,GetExitCodeProcess,CloseHandle,SetCurrentDirectoryW,SetCurrentDirectoryW,0_2_0041FF60
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\mscomctl.ocx" /sJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\COMDLG32.OCX" /sJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\COMCT332.OCX" /sJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\TABCTL32.OCX" /sJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Program Files (x86)\Common Files\microsoft shared\DAO\DAO350.DLL" /sJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_CR_control.dll" /sJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_DB_Connect.dll" /sJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_File_Data.dll" /sJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_File_Export.dll" /sJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_Rmt_DB4_Update.dll" /sJump to behavior
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crviewer.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\craxdrt.dll
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crviewer.dll
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\Crystal\Cdo32.dll
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crtslv.dll
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\ExportModeller.dll
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735223416.0000000000418000.00000020.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: Progmanadvapi32.dllCreateProcessWithTokenW
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735223416.0000000000418000.00000020.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: ProgmanU
            Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735223416.0000000000418000.00000020.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: Shell_TrayWndU
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: GetLocaleInfoA,0_2_0042C5C6
            Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exeCode function: GetLocaleInfoA,1_2_6CECDEDB
            Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_004273A1 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,0_2_004273A1
            Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exeCode function: 0_2_0041F320 GetVersion,CoCreateInstance,0_2_0041F320

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpactResource DevelopmentReconnaissance
            1
            Replication Through Removable Media            		2
            Command and Scripting Interpreter            		1
            Registry Run Keys / Startup Folder            		1
            Exploitation for Privilege Escalation            		32
            Masquerading            		OS Credential Dumping1
            System Time Discovery            		1
            Replication Through Removable Media            		1
            Archive Collected Data            		Exfiltration Over Other Network Medium1
            Encrypted Channel            		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationAbuse Accessibility FeaturesAcquire InfrastructureGather Victim Identity Information
            Default Accounts2
            Native API            		11
            DLL Side-Loading            		112
            Process Injection            		1
            Virtualization/Sandbox Evasion            		LSASS Memory11
            Security Software Discovery            		Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
            Multi-hop Proxy            		SIM Card SwapObtain Device Cloud BackupsNetwork Denial of ServiceDomainsCredentials
            Domain AccountsAtLogon Script (Windows)1
            Registry Run Keys / Startup Folder            		112
            Process Injection            		Security Account Manager1
            Virtualization/Sandbox Evasion            		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
            Proxy            		Data Encrypted for ImpactDNS ServerEmail Addresses
            Local AccountsCronLogin Hook11
            DLL Side-Loading            		1
            Deobfuscate/Decode Files or Information            		NTDS2
            Process Discovery            		Distributed Component Object ModelInput CaptureTraffic DuplicationProtocol ImpersonationData DestructionVirtual Private ServerEmployee Names
            Cloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
            Obfuscated Files or Information            		LSA Secrets11
            Peripheral Device Discovery            		SSHKeyloggingScheduled TransferFallback ChannelsData Encrypted for ImpactServerGather Victim Network Information
            Replication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
            Regsvr32            		Cached Domain Credentials2
            System Owner/User Discovery            		VNCGUI Input CaptureData Transfer Size LimitsMultiband CommunicationService StopBotnetDomain Properties
            External Remote ServicesSystemd TimersStartup ItemsStartup Items11
            DLL Side-Loading            		DCSync3
            File and Directory Discovery            		Windows Remote ManagementWeb Portal CaptureExfiltration Over C2 ChannelCommonly Used PortInhibit System RecoveryWeb ServicesDNS
            Drive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
            File Deletion            		Proc Filesystem35
            System Information Discovery            		Cloud ServicesCredential API HookingExfiltration Over Alternative ProtocolApplication Layer ProtocolDefacementServerlessNetwork Trust Dependencies

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 process2 2 Behavior Graph ID: 1379637 Sample: cfrv_4_0_setup_ALL.exe Startdate: 23/01/2024 Architecture: WINDOWS Score: 52 6 cfrv_4_0_setup_ALL.exe 1 501 2->6         started        10 msiexec.exe 2->10         started        12 explorer.exe 2->12         started        file3 34 C:\ProgramData\...\cfrv_4_0_setup_ALL.exe, PE32 6->34 dropped 36 C:\ProgramData\miaDC6F.tmp\mia.lib, PE32 6->36 dropped 38 C:\ProgramData\...\mWinRunExec.dll, PE32 6->38 dropped 46 133 other files (none is malicious) 6->46 dropped 58 May use the Tor software to hide its network traffic 6->58 14 cfrv_4_0_setup_ALL.exe 24 91 6->14         started        40 C:\Windows\SysWOW64\sscsdk80.dll, PE32 10->40 dropped 42 C:\Windows\SysWOW64\pg32conv.dll, PE32 10->42 dropped 44 C:\Windows\SysWOW64\p2sodbc.dll, PE32 10->44 dropped 48 49 other files (none is malicious) 10->48 dropped 18 msiexec.exe 10->18         started        20 msiexec.exe 10->20         started        22 msiexec.exe 10->22         started        24 3 other processes 10->24 60 DLL side loading technique detected 12->60 signatures4 process5 file6 50 C:\Windows\System32\myah0.cpl, PE32+ 14->50 dropped 52 C:\Users\user\AppData\Local\...\pPin64.cpl, PE32+ 14->52 dropped 54 C:\Users\user\AppData\Local\...\pPin32.cpl, PE32 14->54 dropped 56 7 other files (none is malicious) 14->56 dropped 62 Injects code into the Windows Explorer (explorer.exe) 14->62 26 regsvr32.exe 45 14->26         started        28 regsvr32.exe 483 14->28         started        30 regsvr32.exe 14->30         started        32 8 other processes 14->32 signatures7 process8

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            cfrv_4_0_setup_ALL.exe0%ReversingLabs

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\CF_Remote.exe0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\ADVPACK.DLL0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\W95INF16.DLL0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\W95INF32.DLL0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\asycfilt.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\comcat.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\mVBExec.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\msvbvm60.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\oleaut32.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\olepro32.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\stdole2.tlb0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\cabinet.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\imagehlp.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msi.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiexec.exe0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msihnd.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiinst.exe0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msimsg.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msisip.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msls31.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\mspatcha.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\riched20.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\sdbapi.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\shfolder.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\usp10.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\mWinRunExec.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\cabinet.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\imagehlp.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiexec.exe0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msihnd.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiinst.exe0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msimsg.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msisip.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msls31.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\mspatcha.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\riched20.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\sdbapiU.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\shfolder.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\usp10.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\161F85F0\7204BF44\CRUTL15.DLL0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\184596D6\1517B7F7\CF_login_bus.dll2%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1A28DE63\34510A4\dao360.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1BF788A5\1517B7F7\CF_Name_bus.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1D5631E8\1517B7F7\CF_Login.ocx0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1DF81C7A\34510A4\ImgXPrint61.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1F62DE62\1517B7F7\CF_File_Import_bus.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\205EBC50\34510A4\ImgXTwain61.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2ADC2324\1835CB68\u25dts.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2D3E0D90\7204BF44\Crpe32.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2E5B6414\1835CB68\u2fcr.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2E81A74\34510A4\vbalColumnTreeView6.oca0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2EC6F5ED\34510A4\vbalColumnTreeView6.ocx0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\33BB160B\1835CB68\u2dapp.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\3B44007A\1835CB68\u252000.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\3D003E72\1835CB68\u2fxml.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\3E323407\1835CB68\u2fxls.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\416B4F42\1517B7F7\CF_org_history_bus.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\43981525\7204BF44\pg32conv.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\474E307D\1835CB68\u2lsamp1.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\47C10F79\7204BF44\CRxmlx07r.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\487DDF\1835CB68\u2ddisk.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\496179\1517B7F7\CF_rs_browse_bus.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\496C80D6\34510A4\MSCHRT20.OCX0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\4B371E22\34510A4\vbalFlBr6.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\4D29780E\1835CB68\u2fsepv.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\51868479\1517B7F7\CF_report_main_bus.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\526A560A\1835CB68\u2lcom.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\5A4D542C\7204BF44\CRUTL15R.DLL0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\63200452\1835CB68\u2dpost.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\679B857\34510A4\COMDLG32.OCX0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\68965F3A\1835CB68\u2fhtml.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\6C6652B9\1517B7F7\CF_report_bus.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\6D4D0E7\34510A4\ImgX61.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\6DEA5FF3\7204BF44\CRXML15.DLL0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\701CB7F7\34510A4\mscomctl.ocx0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\7A300D31\1835CB68\crxf_pdf.dll0%ReversingLabs
            C:\ProgramData\miaDC6F.tmp\data\OFFLINE\7CC1D691\34510A4\TABCTL32.OCX0%ReversingLabs

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            http://schemas.mi0%URL Reputationsafe
            http://ocsp.sectigo.com00%URL Reputationsafe
            http://ocsp.thawte.com00%URL Reputationsafe
            http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s0%URL Reputationsafe
            http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#0%URL Reputationsafe
            http://subca.ocsp-certum.com050%URL Reputationsafe
            http://subca.ocsp-certum.com020%URL Reputationsafe
            http://subca.ocsp-certum.com010%URL Reputationsafe
            http://www.ncsbe.govMicrosoft0%Avira URL Cloudsafe
            http://www.ImgX.net/0%Avira URL Cloudsafe
            http://www.mywebsite.com/New0%Avira URL Cloudsafe
            http://www.seagatesoftware.com/xml/schema.xsdxsddtdw0%Avira URL Cloudsafe
            http://www.ImgX.net/ImgX/purchase.asp0%Avira URL Cloudsafe
            https://sectigo.com/CPS0C0%Avira URL Cloudsafe
            https://www.installaware.com/buydirect.aspopen0%Avira URL Cloudsafe
            http://www.installaware.com/0%Avira URL Cloudsafe
            http://www.installaware.com/00%Avira URL Cloudsafe
            http://www.installaware.com/InstallAware0%Avira URL Cloudsafe
            http://www.installaware.comz0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            ⊘No contacted domains info

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            http://schemas.miexplorer.exe, 00000018.00000002.2879083790.0000000008DF7000.00000004.00000020.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://crl.certum.pl/ctsca2021.crl0ocfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpfalse
              		high
              http://repository.certum.pl/ctnca.cer09cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpfalse
                		high
                http://www.ncsbe.govMicrosoftcfrv_4_0_setup_ALL.exe, 00000001.00000003.2062442144.00000000055A1000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://ocsp.sectigo.com0cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                http://crl.certum.pl/ctnca.crl0kcfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpfalse
                  		high
                  http://ocsp.thawte.com0cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052DD000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052F4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000681A000.00000004.00000020.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://standards.iso.org/iso/19770/-2/2008/schema.xsdcfrv_4_0_setup_ALL.exe, 00000001.00000000.1735223416.0000000000418000.00000020.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmpfalse
                    		high
                    http://www.installaware.com/0cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.installaware.comzcfrv_4_0_setup_ALL.exefalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0scfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    http://www.ImgX.net/cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    http://www.installaware.com/cfrv_4_0_setup_ALL.exe, 00000001.00000000.1735223416.0000000000418000.00000020.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.mywebsite.com/Newcfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2062442144.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2239438491.0000000002874000.00000004.00001000.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://aka.ms/Vh5j3kexplorer.exe, 00000018.00000003.2060166385.00000000067A5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000003.2060001241.00000000067A1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2878512791.00000000067A1000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      HTTP://WWW.NCSBE.GOVMICROSOFTcfrv_4_0_setup_ALL.exe, 00000001.00000003.2239438491.0000000002833000.00000004.00001000.00020000.00000000.sdmpfalse
                        		unknown
                        http://crl.thawte.com/ThawteCodeSigningCA.crl0cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052DD000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052F4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000681A000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://aka.ms/odirmexplorer.exe, 00000018.00000003.2060166385.00000000067A5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000003.2060001241.00000000067A1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.2878512791.00000000067A1000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            HTTP://WWW.MYWEBSITE.COM/NEWcfrv_4_0_setup_ALL.exe, 00000001.00000003.2239438491.0000000002874000.00000004.00001000.00020000.00000000.sdmpfalse
                              		unknown
                              http://repository.certum.pl/ctsca2021.cer0cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpfalse
                                		high
                                http://subca.ocsp-certum.com05cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.ncsbe.govcfrv_4_0_setup_ALL.exe, 00000001.00000003.2239438491.0000000002874000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		high
                                  http://subca.ocsp-certum.com02cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.seagatesoftware.com/xml/schema.xsdxsddtdwcfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000065AD000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://subca.ocsp-certum.com01cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  https://sectigo.com/CPS0Ccfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://www.installaware.com/buydirect.aspopencfrv_4_0_setup_ALL.exe, 00000001.00000000.1735223416.00000000007AE000.00000020.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FFC7D000.00000004.00001000.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://crl.certum.pl/ctnca2.crl0lcfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpfalse
                                    		high
                                    http://repository.certum.pl/ctnca2.cer09cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.installaware.com/InstallAwarecfrv_4_0_setup_ALL.exe, 00000001.00000003.1738862165.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.ImgX.net/ImgX/purchase.aspcfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000006661000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://crl.thawte.com/ThawtePremiumServerCA.crl0cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052DD000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000052F4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.000000000681A000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.certum.pl/CPS0cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000060D3000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005D3E000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000031F1000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005E70000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005FA2000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.0000000005348000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1720906727.00000000054B4000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748764589.0000000003400000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1748704146.0000000003560000.00000004.00001000.00020000.00000000.sdmpfalse
                                          		high

                                          World Map of Contacted IPs

                                          ⊘No contacted IP infos

                                          General Information

                                          Joe Sandbox version:39.0.0 Ruby
                                          Analysis ID:1379637
                                          Start date and time:2024-01-23 16:42:14 +01:00
                                          Joe Sandbox product:CloudBasic
                                          Overall analysis duration:0h 10m 3s
                                          Hypervisor based Inspection enabled:false
                                          Report type:full
                                          Cookbook file name:default.jbs
                                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                          Number of analysed new started processes analysed:27
                                          Number of new started drivers analysed:0
                                          Number of existing processes analysed:0
                                          Number of existing drivers analysed:0
                                          Number of injected processes analysed:0
                                          Technologies:
                                          • HCA enabled
                                          • EGA enabled
                                          • AMSI enabled
                                          Analysis Mode:default
                                          Analysis stop reason:Timeout
                                          Sample name:cfrv_4_0_setup_ALL.exe
                                          Detection:MAL
                                          Classification:mal52.evad.winEXE@39/565@0/0
                                          EGA Information:
                                          • Successful, ratio: 100%
                                          HCA Information:
                                          • Successful, ratio: 99%
                                          • Number of executed functions: 127
                                          • Number of non-executed functions: 122
                                          Cookbook Comments:
                                          • Found application associated with file extension: .exe

                                          Warnings

                                          • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                          • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                          • Not all processes where analyzed, report is missing behavior information
                                          • Report size exceeded maximum capacity and may have missing behavior information.
                                          • Report size getting too big, too many NtCreateFile calls found.
                                          • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                          • Report size getting too big, too many NtOpenFile calls found.
                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                          • Report size getting too big, too many NtQueryAttributesFile calls found.
                                          • Report size getting too big, too many NtQueryValueKey calls found.
                                          • Report size getting too big, too many NtSetInformationFile calls found.
                                          • Report size getting too big, too many NtSetValueKey calls found.
                                          • VT rate limit hit for: cfrv_4_0_setup_ALL.exe

                                          Simulations

                                          Behavior and APIs

                                          TimeTypeDescription
                                          16:43:39API Interceptor1x Sleep call for process: explorer.exe modified
                                          16:43:41API Interceptor24x Sleep call for process: cfrv_4_0_setup_ALL.exe modified

                                          Joe Sandbox View / Context

                                          IPs

                                          ⊘No context

                                          Domains

                                          ⊘No context

                                          ASNs

                                          ⊘No context

                                          JA3 Fingerprints

                                          ⊘No context

                                          Dropped Files

                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\ADVPACK.DLLTextSpeaker.exeGet hashmaliciousUnknownBrowse
                                            TextSpeaker.exeGet hashmaliciousUnknownBrowse
                                              TextSpeaker.exeGet hashmaliciousUnknownBrowse
                                                MXrpqIRV2z.exeGet hashmaliciousUnknownBrowse
                                                  MXrpqIRV2z.exeGet hashmaliciousUnknownBrowse
                                                    Bonzify.exeGet hashmaliciousUnknownBrowse
                                                      C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\W95INF16.DLLfile.exeGet hashmaliciousUnknownBrowse
                                                        1diWXDlHzi.exeGet hashmaliciousXWormBrowse
                                                          TextSpeaker.exeGet hashmaliciousUnknownBrowse
                                                            TextSpeaker.exeGet hashmaliciousUnknownBrowse
                                                              TextSpeaker.exeGet hashmaliciousUnknownBrowse
                                                                MXrpqIRV2z.exeGet hashmaliciousUnknownBrowse
                                                                  MXrpqIRV2z.exeGet hashmaliciousUnknownBrowse
                                                                    Bonzify.exeGet hashmaliciousUnknownBrowse
                                                                      nusb320-Eng-98FE.exeGet hashmaliciousUnknownBrowse

                                                                        Created / dropped Files

                                                                        C:\Config.Msi\4e3b0b.rbs

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):225941
                                                                        Entropy (8bit):5.035174661405164
                                                                        Encrypted:false
                                                                        SSDEEP:768:AbYJDHm0NZ/DVtVtVt1tVtVtVtVtVtVtVtVtVtVtVtVtVtVtVtVtVtltVtVtVtIp:gYocZ/DePXcx/qZa7FHa2Ufo2PoV+
                                                                        MD5:D66A1B83063EEEC50D7C02180C859B36
                                                                        SHA1:61B713E4D761BF0377B696877EE8FFE86491D01B
                                                                        SHA-256:8775ACE9D2E07DAC0DA8F4E74F7A556070D8FA58CBEDF0E2625A8597FD65C0F6
                                                                        SHA-512:C1F8278EB81E8689D8A9DABB6724F61F5DE993698BFFF0EE6840CCD6E89CF4D7CE8DADC8AF99B59E37877EFAC1C8464C74BCC7AD7075D26AEE59B5F2C672CEAE
                                                                        Malicious:false
                                                                        Preview:...@IXOS.@.....@n.7X.@.....@.....@.....@.....@.....@......&.{152D390A-DD7B-4E57-B3A5-14CADE7E1207}..CF Remote..cfrv_4_0_setup_ALL.msi.@.....@!....@.....@........\PROGRA~3\miaDC6F.tmp\&.{D529246B-78E5-4E65-A3A2-8E1040E91E59}.....@.....@.....@.....@.......@.....@.....@.......@......CF Remote......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{DBAF7F90-6797-4BCB-8426-E799FE0D75FA}&.{152D390A-DD7B-4E57-B3A5-14CADE7E1207}.@......&.{10B1E2F4-E12B-4D18-847D-3579632C4DA0}&.{152D390A-DD7B-4E57-B3A5-14CADE7E1207}.@......&.{70233733-63B7-4686-8B22-F467B98A5511}&.{152D390A-DD7B-4E57-B3A5-14CADE7E1207}.@......&.{100D9843-4837-4C77-9382-C4AB79C16EC6}&.{152D390A-DD7B-4E57-B3A5-14CADE7E1207}.@......&.{360CA8FA-B89D-40E5-8E5D-E0358F8448B5}&.{152D390A-DD7B-4E57-B3A5-14CADE7E1207}.@......&.{AAA707EE-74C6-4091-8DF1-A6063B1CAF22}&.{152D390A-DD7B-4E57-B3A5-14CADE7E1207}.@......&.{9C72C003-1DC2-41F4-AD0C-E99FEB6

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\CF_Remote.exe

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4243456
                                                                        Entropy (8bit):5.904631501447873
                                                                        Encrypted:false
                                                                        SSDEEP:98304:j24cB0pukTqkRXBpPw0l3mpkaL8vmN0sPVYaCKlOO5BRBwqyPQbgZ5WEVMRJT3VB:fcB0pukTqkRXBpPw0l3mpkaL8vmN0sPn
                                                                        MD5:8963AF52B51008AA64C0DFC38978E561
                                                                        SHA1:C76A9A66AFDB305791674B365B078B48343B7C98
                                                                        SHA-256:F8D68F5A2685B78B8AD9B7FF3C1BD720AFC1F337EAE521AB8AAB6ACB5E5337BE
                                                                        SHA-512:C2EF66D6AB3D075C706DCFC85B67DDDA7261A052B037B0E1854B64A9D58054503EB25214B62AFE565A9A7EDE8A981B280F4CCBCF253336000A7D42C3F6E19C06
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y....................................Rich............PE..L...a.ie..................@......... .........@...@...........................B.....{.@......................................{@.(.....A.~...................................................................(... .......d............................text....z@.......@................. ..`.data...`T....@.......@.............@....rsrc...~.....A.. ....@.............@..@..^............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\CF_Remote.exe.manifest

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):525
                                                                        Entropy (8bit):5.0713464478909565
                                                                        Encrypted:false
                                                                        SSDEEP:12:MMHdt4N5SgVQ9TNRRgAhxAQkrEHUi95Jz:Jdt4XSgOTNRyADAQkrEHUiDt
                                                                        MD5:E9CECB1E5CFDDF82CE102D096FC6DB92
                                                                        SHA1:EEA233E02455050A95B7AD30FA42E077ED473293
                                                                        SHA-256:499E0178C9C74ACC9DED7E9F66A99C2915C6ADEBF08D33907538180466D1535B
                                                                        SHA-512:B61B1B718B9FF3F84174E3BA8CC2B6F1135659AADDA8C0FE1CFE3561F206A1746C48F16DD669C7E36AC960B0A4B1404739DADED074956A7454B738E37E1D6F47
                                                                        Malicious:false
                                                                        Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">...<assemblyIdentity version="1.0.0.0".processorArchitecture="X86".name="ExeName".type="win32"/>...<description>elevate execution level</description>...<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">....<security>.....<requestedPrivileges>......<requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>.....</requestedPrivileges>....</security>...</trustInfo>..</assembly>

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Campaign Finance Remote.chm

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:MS Windows HtmlHelp Data
                                                                        Category:dropped
                                                                        Size (bytes):302779
                                                                        Entropy (8bit):7.927639628283951
                                                                        Encrypted:false
                                                                        SSDEEP:6144:SVRZVBdxgL1ART/Q+4Ghr6qUeaLAOw6cxf8JYxjv029IDuuj7Y79d/wq5fgSk:SVXVBzWAtQDGtnUxAfx0JEtGDR/Yj/dU
                                                                        MD5:286D69BB312003FA01ECBCAF6587C7D5
                                                                        SHA1:C611D2D743FC45A5BC419D0A255DB4A174100F77
                                                                        SHA-256:F7EDE38A17EC24C0AFA54815DBEA222E17452C4A9A872B7FE462741B70199B6A
                                                                        SHA-512:07A9D2C6F327873C4B2836FD6F434B1012C13CEE3816594C43430B0CA356814AAF0CAE4B490FEF8D89ED51112C3BF2FC240A2AA03B7183D135903B7E9B03F384
                                                                        Malicious:false
                                                                        Preview:ITSF....`..................|.{.......".....|.{......."..`...............x.......T@.......@..............................ITSP....T...........................................j..].!......."..T...............PMGLV................/..../#BSSC...7../#IDXHDR....../#ITBITS..../#STRINGS..B..q./#SYSTEM..n.+./#TOPICS.....P./#URLSTR.....*./#URLTBL..P.H./#WINDOWS....L./$FIftiMain.....g./$OBJINST......./$WWAssociativeLinks/..../$WWAssociativeLinks/Property....../$WWKeywordLinks/..../$WWKeywordLinks/BTree..[..L./$WWKeywordLinks/Data...'.(./$WWKeywordLinks/Map...O.../$WWKeywordLinks/Property...i ./AccountTransferAdd.htm...B.~./AccountTransferDelete.htm...@.7./AccountTransferEdit.htm...m.+./AddingACandidateCommittee.htm..._.C,/AddingAElectioneeringCommunicationFiler.htm......'/AddingAIndependentExpenditureFiler.htm...".0%/AddingAIndependentExpenditurePAC.htm...7..#/AddingAJointCandidateCommittee.htm.....`&/AddingAJudicialCandidateCommittee.htm...".w./AddingALegalExpenseFund.htm...U.D./AddingAPAC

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\1998_NC_Disclosure.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: 1998 Discloure Report, Subject: 1998 Discloure Report, Author: James Lell, Last Saved By: James Lell, Revision Number: 101, Total Editing Time: 08:02:50, Last Printed: Sun Jun 27 21:04:02 1999, Last Saved Time/Date: Tue Feb 22 13:39:32 2005, Create Time/Date: Tue Jun 15 22:03:11 1999, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):442368
                                                                        Entropy (8bit):5.764291489711934
                                                                        Encrypted:false
                                                                        SSDEEP:1536:gqriKCi4JCS0DlTzwKg3Vj/I+HJL9uEXueM5g2ggLR4BZG3OF6OIIKE85+DN:gq0I5cJXXuQ4
                                                                        MD5:4623BE2BABA8AF4A48897E14029EE29F
                                                                        SHA1:12F217A06B3ADD4A579D6E6F4BFF0D60D44F256D
                                                                        SHA-256:24A472D4FD42007DE58116171D84B77906C90D6781C835CCFFF1F3DD704A074B
                                                                        SHA-512:423FD6ECC7F377CAC0EECB7F5B173171E6545FFBAE2964CC33A85114D9D62F783D0ABB6B83C3E00C127A58E74ABDD3CD28B420E503EDAA78B0BF485C22CF7235
                                                                        Malicious:false
                                                                        Preview:......................>...................................................~...............0...................................................................................................................................................................................................................................................................................................................................................................................................................................S.u.b.d.o.c.u.m.e.n.t. .8.9.....................................................................................................C.o.n.t.e.n.t.s..........................................................................................................L......D.a.t.a.b.a.s.e. .(.T.L.V.).............................................................................................t.......S.u.b.d.o.c.u.m.e.n.t. .1.0.1................................... ...................................0...

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\Accounts.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Account List, Subject: Account List, Author: James Lell, Last Saved By: James Lell, Revision Number: 47, Total Editing Time: 07:03:51, Last Printed: Sun Jun 27 21:04:02 1999, Last Saved Time/Date: Tue Feb 22 13:38:30 2005, Create Time/Date: Tue Jun 15 22:03:11 1999, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):17408
                                                                        Entropy (8bit):5.353280867175744
                                                                        Encrypted:false
                                                                        SSDEEP:192:en+EcA/aGyp318p8x3Wb5vNxjOJMHCdrYvQqFvAi1mnYuA8Z7Bu7P7Z7b7gUSA7Q:BjASGyp3uNhJ73O
                                                                        MD5:1A6030B5072235B0965869D19E08A9BB
                                                                        SHA1:BB3A30F534C655B1E2726219CA5BF49B817A2C58
                                                                        SHA-256:17098538A0A0EB865ECBAA17D00CFD09AB83400DA70BC9AE467C506E0F05CBA7
                                                                        SHA-512:2313A99DA787F451009A3BEC94BD4BFECA8A9FCBCAED3954F2923918B0DC1BBEE9E69E82AC978E864E1291692020F246D22F30D5FEF1EB8BBE78901B516EB3F9
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...........................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\Contributions.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Contributions List, Subject: Contributions List, Author: James Lell, Last Saved By: James Lell, Revision Number: 113, Total Editing Time: 12:36:42, Last Printed: Tue Aug 18 20:22:57 1998, Last Saved Time/Date: Tue Feb 22 13:33:52 2005, Create Time/Date: Sun Feb 9 18:04:38 1997, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional
                                                                        Category:dropped
                                                                        Size (bytes):47104
                                                                        Entropy (8bit):5.729017991338511
                                                                        Encrypted:false
                                                                        SSDEEP:384:gYbjI9PoSInCZuHqSTMRHXu+I3PWoCYnp:gYXGoB
                                                                        MD5:A02E3ED15993B8B8CF631068941EFDFA
                                                                        SHA1:68609F9F0CCBF698D602F15DF2783ED919B48DE3
                                                                        SHA-256:19EEE76FD82EC48C325BC696D85989C20BA39DC4D9903C440ECC8A3A91A9E2CC
                                                                        SHA-512:997B08C754A5D0625F39311971BB6113C44EE69F9DB7C3B6D1EC676C9591FCFFD40E428A042A677CB2237DCBE1AD7CDCB463BF721365C9541BD2CEFEB27EDC29
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\Cover.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Disclosure Report Cover, Subject: Disclosure Report Cover, Author: James Lell, Last Saved By: James Lell, Revision Number: 71, Total Editing Time: 09:09:36, Last Printed: Sun Jun 27 21:04:02 1999, Last Saved Time/Date: Mon Feb 21 14:12:42 2005, Create Time/Date: Tue Jun 15 22:03:11 1999, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):102993
                                                                        Entropy (8bit):5.775513240751137
                                                                        Encrypted:false
                                                                        SSDEEP:384:8iPllYflrU4GTGvsz057kQz5xACSYwp3m6MgqGFSIU5DmQ6rfmsduaaahWpQCcxI:ZllI+DQzXAgg3cDtjpM3a
                                                                        MD5:D6C23BB2D2B74DE1C9C452C58ECB7477
                                                                        SHA1:63409B79C746B01C0F12A76BB511849D77B709A2
                                                                        SHA-256:956C888758279B814FEDD7F48D76DFD49F5DF7C75A3FD23FDE0F97BAF0D710AE
                                                                        SHA-512:A43BEACAD2716DF068C68F5FEEB529BBBB2D89706ECC9604BF86F422F26558C98C304387CE134408E329D550E0978F385E0825ED15F4ACD88B94095EB0473A96
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\Debts.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Debts and Obligations List, Subject: Debts and Obligations List, Author: James Lell, Last Saved By: James Lell, Revision Number: 74, Total Editing Time: 05:41:49, Last Printed: Wed Dec 18 13:51:44 1996, Last Saved Time/Date: Tue Feb 22 13:38:41 2005, Create Time/Date: Sun Feb 9 19:12:49 1997, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional
                                                                        Category:dropped
                                                                        Size (bytes):52224
                                                                        Entropy (8bit):5.638520545168639
                                                                        Encrypted:false
                                                                        SSDEEP:384:VA3VCHSQW4z84Bd9CGLVJkhzWRajCIFaydsm4GM:VA3VCyVR4BRyK
                                                                        MD5:C5B71EFA6AFA72802DFD0D8055D128D8
                                                                        SHA1:77DA5148A255488EB4BD30493D2D3BD6DF11735C
                                                                        SHA-256:8F16CC0CB03D6406F4C6A7612F4C9D94D43DA774FC1C6662D76329B177B91F19
                                                                        SHA-512:5C8F634210E3E75F0EFF3975112E7C30AD166B1F8067AFBA65155F6339D198F10E5B5CC2D89CBD2422C32E0AA44EE75F4B00E5F3D936C03C360A3DBA1F0F45EE
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...........................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\Expenditures.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Expenditures List, Subject: Expenditures List, Author: James Lell, Last Saved By: James Lell, Revision Number: 74, Total Editing Time: 09:02:18, Last Printed: Wed Dec 18 13:51:44 1996, Last Saved Time/Date: Tue Feb 22 13:38:47 2005, Create Time/Date: Sun Feb 9 19:12:49 1997, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional
                                                                        Category:dropped
                                                                        Size (bytes):45056
                                                                        Entropy (8bit):5.681619568331793
                                                                        Encrypted:false
                                                                        SSDEEP:192:DNBaBX0B2BUz5jTRE8gxgdPk4tHze8yYWU8M1lt/EsrAmbaplydwDyTgzIF8WPka:ohmNx/zLbkuMC9OqjHWN/VYQBSSu/p
                                                                        MD5:761DBD0A2426A34D51F3362C051B37F9
                                                                        SHA1:5CC1CC3206398C6D7C121EBD2F676C36E9833A94
                                                                        SHA-256:1C0FC5BD6548947A189BED1A0EC51661528A725202E35792D9699C73C095B796
                                                                        SHA-512:D437D6041EC1A412415AE1F99EFB040D8E137378A53CCD9B03F26B1CE38C32ED1294C23D7264C6D8FF59CF39D26B9FF86747AFE7AC99EC7CB50DAB89F5F13C70
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\LoanEndorsers.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Endorsers List, Subject: Endorsers List, Author: James Lell, Last Saved By: James Lell, Revision Number: 45, Total Editing Time: 03:21:14, Last Saved Time/Date: Tue Feb 22 13:38:54 2005, Create Time/Date: Thu Dec 19 13:29:16 1996, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):17920
                                                                        Entropy (8bit):5.421908987486584
                                                                        Encrypted:false
                                                                        SSDEEP:192:2LAHPNxk0i2OLPU8GV8BErS8x3Wb5vNxjOJMHCdr5w7lqm9AmAYm9quAm97ZyPbF:W47k33/MrM4A
                                                                        MD5:BFCC78606337F1ADD7B87FC8E1C8C734
                                                                        SHA1:99B2673556D8A8730DDF60BA15A58BDAAFC9FC4A
                                                                        SHA-256:85CE8C392A2E7FEEE7FABE7A1F3E0F70C7F61F0EF20203EA343F025017803EEA
                                                                        SHA-512:7CC684AE706896B4D4C624941C7D71E6CF8D4C388FC02ABA50DAA23FDE8F9A145C0E998788FF01A9902AF469103281FC8B378F902BCD5E9DBB21DF2C6FADA27A
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!.......................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\LoanProceeds.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Loan Proceeds List, Subject: Loan Proceeds List, Author: James Lell, Last Saved By: James Lell, Revision Number: 71, Total Editing Time: 05:07:43, Last Saved Time/Date: Tue Feb 22 13:39:05 2005, Create Time/Date: Thu Dec 19 13:29:16 1996, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):59904
                                                                        Entropy (8bit):5.764839915499194
                                                                        Encrypted:false
                                                                        SSDEEP:384:2VsucDl8+hn7iszAu1YYDJP99qdKjHFCvCiZ/sHxz/JJ2afOj:isu+uu1YY1Pb
                                                                        MD5:DEF0B47C2A857A3380C7DD9FC55BD7AA
                                                                        SHA1:A42C01237FCEB20AF3C679ACAE403EE64FF0A080
                                                                        SHA-256:AC75DAC13D2DA4BB0AA279C8FB4C45EB2235111F30C76602861768147D61ED98
                                                                        SHA-512:CBA2B92BEA3EEA5E8ACC866AEE856BEEEC8DFCFF7470E5CDB22C7DA5E0AB48682EBD9966D00B11EAF750533FDFB0409145671FAABA93FEDC1EFAFA6386B7234D
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...............................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\LoanRepayments.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Loan Repayments List, Subject: Loan Repayments List, Author: James Lell, Last Saved By: James Lell, Revision Number: 33, Total Editing Time: 02:32:42, Last Saved Time/Date: Tue Feb 22 13:39:11 2005, Create Time/Date: Fri Dec 20 15:00:22 1996, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):41472
                                                                        Entropy (8bit):5.6245741985399995
                                                                        Encrypted:false
                                                                        SSDEEP:192:22EQNdickudiauN8dEZEQcAmbUipjatZkLWkC6lnU/c5HhW8x3b5vNxjOJMHCdru:0QN3ub55LOnz1BNdZSkw4fjjfnWX2R
                                                                        MD5:D96F0BFA34C620CB0904A5C7CD652D76
                                                                        SHA1:8848F994A2873BFA2BC73DFF35A8D1C617575DFF
                                                                        SHA-256:367CC798B9F28285A257274083D43D9CA34822AFBD0026BD7A6B407651AF5F38
                                                                        SHA-512:5207ACF7F10F23DB57FAB85126A7BE970C104088562128B2D982F9CF23C5177558DAAD6063E3A1897C0A1AE65A46D313FE9C32F4B394434455F00BB0E650D97E
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...............................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\Summary.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Summary, Subject: Summary, Author: James Lell, Last Saved By: James Lell, Revision Number: 50, Total Editing Time: 06:54:28, Last Printed: Sun Jun 27 21:04:02 1999, Last Saved Time/Date: Fri Jul 9 19:49:26 2004, Create Time/Date: Tue Jun 15 22:03:11 1999, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):93814
                                                                        Entropy (8bit):5.439847807690734
                                                                        Encrypted:false
                                                                        SSDEEP:384:SGmlkmzysH867TSqxdEjuPCPN2ScQ12ScrOgVzRDoYsg7VSclhhy6gGhJA1zfcOy:gtc67TSqtPCV2S0/
                                                                        MD5:AE82C60145B9DB14E62CFFEDCFDA30E6
                                                                        SHA1:8853BB15A95A0C0BAA23AFC99EC7CDB9303D4974
                                                                        SHA-256:164E5BD41A118A0075260EF11CC157C3AE23D6EC287E1C0F6C56AC0D97CBB627
                                                                        SHA-512:9189A0A9FD15A60BB293F3DDC9D9DBA1AA4EFBF23C70DB81E6A0CA12528F541ED09CB8B9359CEF9F7367BA05D22FF1C46DE8504154F41147CA00F9B462E74EAB
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\2003_Disclosure.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 62, Total Editing Time: 02:41:01, Last Saved Time/Date: Thu Jul 29 14:33:26 2004, Create Time/Date: Mon Mar 22 15:03:08 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):2074624
                                                                        Entropy (8bit):5.277108105692261
                                                                        Encrypted:false
                                                                        SSDEEP:3072:tAcGm88F/D6zksqVGpStaTbIfkI15eJWFNHXaPEOrZGERaot3n5fGeZlVE/hP5Zj:t5YksqVyStMwkTsFda/geZ3E/hP5Z
                                                                        MD5:3BF8C3B91E578461B194D6620D227F23
                                                                        SHA1:254D4D58E68F01DE591E9207898B0774499E98DC
                                                                        SHA-256:D38D74FBB7818D5E01251D91E290BDF2B8C0F2835F45E18039A4426FB536F20B
                                                                        SHA-512:8FF5177AC387B55FBD39712C3578FEA41F8447479B49C56FE6F66FDB31E12385D328867C3441C9A7DA2D100E38D14EB615D70D439F7DF3E38D5233381E8737C3
                                                                        Malicious:false
                                                                        Preview:......................>................... ...3.......................................{...L...4...N.......................(...........~...r...t...........Z...............}.......c...b.........../...y.........................................................................................................................................................................................................................................................................................................................O.l.e.............................................................................................................0.............O.l.e.P.r.e.s.0.0.0...................................................................................................d.......S.u.b.d.o.c.u.m.e.n.t. .5.5............................................."........................... ...pu.. ...pu..............C.o.n.t.e.n.t.s.........................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\2003_Electioneering_Report.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Thu Sep 2 16:11:52 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Wed Sep 29 20:57:07 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):435712
                                                                        Entropy (8bit):5.210313030830372
                                                                        Encrypted:false
                                                                        SSDEEP:1536:DhRq0fBeerIhQVQ+3I+9gc9R6P7KUJSXCMxqAG1V4vS+Zq8veRNXncMEUR21HF:7ser/9WTPTJSXCMxqjevS+ZTveB21
                                                                        MD5:9953C4F01E97E2EAF6D408A9637954AA
                                                                        SHA1:C0CA83C8458AA1A569586CF343E7AC6ABDA51F32
                                                                        SHA-256:D64D4097CC36841AE5E105119E7BD9AF6E099E203C2B6625B5170CCB3AA9EE10
                                                                        SHA-512:43A445C46110992A37B40A9B3D73C89443024FEE6374C7B0AB8B3D047CF5888F0DC25C6FC6A11E8139AA5838907D7005BD11D2A58405679F3D14AF8022BFBA1D
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................\CFRS Common\CF_Common\cf_reports\2003 Forms\cro-2320.ttx..........cro-2320.ttx.......................SQL.....Pdsmon.dll....%Active Data (Field Definitions Only)....HC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\2003 Forms\cro-2340.ttx..........cro-2340.ttx.......................SQL.....Pdsmon.dll....%Active Data (Field Definitions Only)....HC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\2003 Forms\cro-2330.ttx..........cro-2330.ttx.......................SQL.....Pdsmon.dll....%Act

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\2003_FED_Disclosure.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 16 15:54:41 2003, Create Time/Date: Tue Mar 18 18:48:47 2003, Last Saved Time/Date: Wed Sep 29 17:56:45 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):474624
                                                                        Entropy (8bit):5.097844904674963
                                                                        Encrypted:false
                                                                        SSDEEP:3072:mWnYtI5uI5ZzxgLD9yQl2FzHc6AsnkrRcycDCTCQd4iNbN:mG5uaml28/
                                                                        MD5:B27917F1EDBCF0193DD90615BEC558A9
                                                                        SHA1:6FD7536E2D2EDBA9F19AF0C38CEEEE77FA5FD524
                                                                        SHA-256:37162A3D98BBB39027C9E77394BE2928E22E50967213B9FCAA1B371E60B1B298
                                                                        SHA-512:293BB3097A5BEC7C6A757811C1B4F76247C93E39E3BEA5285F80EA31EC8267725B1BC811F2DCC5386B6A191D8C32B8303F18D3165418D740D17414272539ED04
                                                                        Malicious:false
                                                                        Preview:......................>...........................................................<...6.......}.......~......................................................................................................................................................................................................................................................................................................................................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................:...`.......S.u.b.d.o.c.u.m.e.n.t. .4.6.............................................g...0.......................p..,.1.....,.1..............C.o.n.t.e.n.t.s.....................................................................................................?...........D.a.t.a.b.a.s.e. .(.T.L.V.).............................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\2003_FED_Org_Statement.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 53, Total Editing Time: 02:01:06, Last Saved Time/Date: Wed Apr 14 12:43:38 2004, Create Time/Date: Mon Mar 22 15:03:08 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):200192
                                                                        Entropy (8bit):5.169152554231805
                                                                        Encrypted:false
                                                                        SSDEEP:768:gY1gd28LOecPd/HWE03kAoEl1FVledXN/bYNsnDnNH33wvuatdTuBaBn3Dn5E0fp:n1gd28LOecPVSkAPNyTx3wvuRBaNDVV
                                                                        MD5:A64029646B20A91508A70A4BD30D777A
                                                                        SHA1:53C5AAE52951DD3E493EF04295B345CD0A4A3828
                                                                        SHA-256:39BC863CDECC987002C7BDDBEE15FB0226C4640B795E11B6FDC12EF90F3AB48A
                                                                        SHA-512:A5F3EA125987F11157CFC76DA99A5D816C665CCDFE6D9FA141D5AF5D926F85504B8EECCE417570D413DEDDE8EA4CF2C3E4F2FDCC585A0F04FF343E83C1FB4347
                                                                        Malicious:false
                                                                        Preview:......................>.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...........................................................................................................S.u.b.d.o.c.u.m.e.n.t. .3.0..........................................................................?O.."...?O.."..............C.o.n.t.e.n.t.s.........................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\2003_Judicial_Qualify_Report.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:51:41 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Wed Apr 29 22:15:36 2009, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):160256
                                                                        Entropy (8bit):5.0388804598932895
                                                                        Encrypted:false
                                                                        SSDEEP:1536:P1eto9rC6gvneLbeMXHwKY0/Fb57GgYINSfUSfBg:Y6mMXHwKY0/KgSH
                                                                        MD5:4695DF6904EADF85F3BB5A039159BB20
                                                                        SHA1:BDB639C12D0ED8A8C0393169D51859282D5FA7EC
                                                                        SHA-256:0688E65C8A9DAFC70CBACEB99A5B9C97C15E8545149BD907D48F6CB4472EF896
                                                                        SHA-512:02C191C002D5D212ED30893EA8E561A1C07FE1E86B49D6A1F40E7960B95B28EA241EB7F953D00681B76AC5798532CDCFD1FAFDC3B46DF416C8D118C5A4D4C6A2
                                                                        Malicious:false
                                                                        Preview:......................>...................................z.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.............................................................................................................:.............O.l.e.P.r.e.s.0.0.0...............................................................................................A...Fe......S.u.b.d.o.c.u.m.e.n.t. .3.8......................................................................... .F......IH.................C.o.n.t.e.n.t.s.........................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\2003_NC_Disclosure.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Mar 5 20:19:07 2004, Create Time/Date: Tue Mar 18 18:33:40 2003, Last Saved Time/Date: Mon Nov 19 15:30:01 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):2127872
                                                                        Entropy (8bit):5.298889348940432
                                                                        Encrypted:false
                                                                        SSDEEP:6144:nEd7toe+rgeeNPGd7crgEpc8mwE/hP5r8:nEdHiA9c2E/hP5
                                                                        MD5:74FDFC53C374A476FFDFABA9958F8D42
                                                                        SHA1:BFE8448D89E848DD7A14EEB8CC10DB0082B04198
                                                                        SHA-256:71D0000B9B8E8DF9F9E34B81F7BBDD0529C0B8D99BAB2DC83170628C34C33DF3
                                                                        SHA-512:1DE68F6ED46CF91F47110697F97058B7793794455EFCB73F57501FA683EBD004AA2285326E43D5264E12594973BDC49E8CBEE6A580B170D7E0F34EE312054412
                                                                        Malicious:false
                                                                        Preview:......................>...................!...................................d...m...o...........%...............L...............s.......D.......C...................W...............z...m...J.......t...u.....................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.1...........................................................................................................S.u.b.d.o.c.u.m.e.n.t. .2.7.6................................... ....................................>........................C.o.n.t.e.n.t.s.........................................................................................................x.......D.a.t.a.b.a.s.e. .(.T.L.V.).............................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\2003_NC_Informational.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: State, Name of Creating Application: Microsoft Excel, Last Printed: Thu Jun 15 19:07:57 2006, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Mon Jun 19 13:10:06 2006, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):2065408
                                                                        Entropy (8bit):5.312823323440365
                                                                        Encrypted:false
                                                                        SSDEEP:6144:8Ed1Xb0+PgeDeGGHERLAEgipEXZacZzl9zjBABgppv/5/vR6WOyx:8EdFEwMi9cZzl9z
                                                                        MD5:756B7BA54EC030397464A91A2CA8A8F0
                                                                        SHA1:46DBA88F3E7B08D7CC26F2A771E4C0D233140153
                                                                        SHA-256:6D27506B998E52767972E9BE275509AE1287640C3CABA0D850E21BE9D4E62844
                                                                        SHA-512:F35B723ED73D6BE222F402C6839E4E042949AAC33ED959CD82782672FF9AAE4695DC45F7D63317184267A07D085B2FE5001D528B70ADE57DAB68BFDA96BBCD1E
                                                                        Malicious:false
                                                                        Preview:......................>................... ...f...............................d...m...o...........%...............L...............s.......D.......C...................W...............m...J...h.......~.........................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.1...........................................................................................................S.u.b.d.o.c.u.m.e.n.t. .2.7.6................................... ...................................0".......................C.o.n.t.e.n.t.s.........................................................................................................x.......D.a.t.a.b.a.s.e. .(.T.L.V.).............................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\2003_NC_Org_Statement.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 52, Total Editing Time: 02:10:55, Last Saved Time/Date: Thu Apr 15 16:01:09 2004, Create Time/Date: Mon Mar 22 15:03:08 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):901120
                                                                        Entropy (8bit):5.196993760121088
                                                                        Encrypted:false
                                                                        SSDEEP:3072:C8q9+TeL0hZGnIillNma52eiBisyZm9aahAN:r6Jc
                                                                        MD5:B64E6E0CF32FC4A7CCB5C8D3BB92381D
                                                                        SHA1:427DBECB4E18B11CDC6EE54B4FCEA1231535DFDA
                                                                        SHA-256:5019F534DC87B51EDFB8DFF231118328587CCD3572C595E452E57AA7B84E74F3
                                                                        SHA-512:B87857D15D620FE3AE41B0B8761B67FD85ED48D65EB4D081FBC12A94C6ED2303972341B2B4C076C898FBB4063342E8A49DEA5357F0DE559FA6E59423B83B40A0
                                                                        Malicious:false
                                                                        Preview:......................>.......................*...............................................................3...........$...,.................................................................................................................................................................................................................................................................................................................................................................................................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...................................................................................................2.......S.u.b.d.o.c.u.m.e.n.t. .4.2............................................................................|.".....|."..............C.o.n.t.e.n.t.s.........................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1000.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 76, Total Editing Time: 06:03:59, Last Saved Time/Date: Mon Jul 28 15:25:51 2008, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):187399
                                                                        Entropy (8bit):4.9388946711249355
                                                                        Encrypted:false
                                                                        SSDEEP:768:hP25wAQghxgQwBRaKgQwAQBRhxBRRAgwAQCF1lS8Fgwfv/mTnFGZE/hP5Si6N+2/:huOjFuE/hP5Si6x62
                                                                        MD5:D09CD0BF633CD0605976F14AE87B35B9
                                                                        SHA1:6FDE766F4DB41383C067AB5179CE47D83413F5B2
                                                                        SHA-256:D63BEBE3FC83950403F69AFCEFAB59612F44B3D5817C419F3383D95A079BC025
                                                                        SHA-512:297F15C9315AB2159C8630C14DA3E9C25B1A0B200B51A64EF3EB2A82FEA4619D61A7024A07C166C17B6DE8440247193247F436CD1C8383C95B8F3C4D4E46583F
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m.......................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1010.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 53, Total Editing Time: 04:08:04, Last Saved Time/Date: Fri Dec 17 19:08:06 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):61440
                                                                        Entropy (8bit):4.833909151781048
                                                                        Encrypted:false
                                                                        SSDEEP:384:G9NvsBioHfL2O1hhCncEnYeKnDslIADOrlBHYH3sVIc:JL2+hwnDnYeKn
                                                                        MD5:010437FD9249DE33A524028CB861559E
                                                                        SHA1:343EEE5E9C4F8CCDD3BA0962BE55238D58F3F448
                                                                        SHA-256:07E783E5242BFED746924B7678AADABC12C52E463EC0161778BDA98882073612
                                                                        SHA-512:DFD2E2E68ED5C8624EAC69EB559F45FE5F08A902745E400CF7AB1ACF3B8800B919CA74851783DD94CCE313027D5F9BFA69CFD9B88F4773151C24F5F0BB2C40DB
                                                                        Malicious:false
                                                                        Preview:......................>.......................E...........A...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .9..........................................................................F....`!F.k.....I.k.................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................*......E.m.b.e.d.d.i.n.g. .1.1........................................................................F......M.

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1100.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Mar 5 20:19:07 2004, Create Time/Date: Tue Mar 18 18:33:40 2003, Last Saved Time/Date: Mon Nov 19 15:30:01 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):161356
                                                                        Entropy (8bit):5.177382724517874
                                                                        Encrypted:false
                                                                        SSDEEP:768:ep2c9joPH0MdlojY7vmW1EtujSD9DvcRwS+Ln9:9c9amGmWAujI9DvceS49
                                                                        MD5:38AE604FEB6ECCB8EF90ED989E95B55C
                                                                        SHA1:1B48DFDB4F3572758EF88460B29D03879620AC5D
                                                                        SHA-256:61E0E173791B801B023AF5987484487A59CF5FE19C0642BEC8BFBE49677451F9
                                                                        SHA-512:3C41155FDF0A2963C87F1272899C6E3A8C525E2C6982BB080624C8374970B02AD4BD36BFBC570975147BD3E73C3304D71960D48767C7172F45847B9011F28D40
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................]........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1205.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 65, Total Editing Time: 14:30:00, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Wed Dec 22 20:39:36 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):65024
                                                                        Entropy (8bit):5.10343096382262
                                                                        Encrypted:false
                                                                        SSDEEP:384:wIyubiGxnps2q3/FanLN4oCYoBUXmfZn11DP5MN5GY3WqN1xYNifO8fda9C44CVD:wunpTq3/FaZFXmfZnj
                                                                        MD5:097E6B26FE7DD4437D8A343EF52EC517
                                                                        SHA1:BF9B400E4D56BD9D4D6E58CF07F5647428BDB03D
                                                                        SHA-256:79ACD4650E807D66454E0B6B935D3A7E7EFCB728C1DDF33DBA6F65CFA074BA58
                                                                        SHA-512:E6D13C7D55F6C803E530F6BC358ECC4282F32C06F5F75F45FFEE7E05CD1A29CA24E4E1799CBEF86A8325DD46FA6FB88451A4C487B6B642DCD80D710C695B4E8A
                                                                        Malicious:false
                                                                        Preview:......................>.......................;...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .2.0........................................................................F....@..Yf...@..Yf.................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...............................................................................................p...p.......E.m.b.e.d.d.i.n.g. .2.3........................................................................F.......Y

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1210.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 125, Total Editing Time: 1d+06:37:40, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Apr 2 15:23:54 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):108725
                                                                        Entropy (8bit):5.347342388943793
                                                                        Encrypted:false
                                                                        SSDEEP:768:Etuya2n71onFjEkEOnUD8hS2ktBmm8F/pm+g:Et5oLC8F/p1g
                                                                        MD5:24625381A4A79D98BB9D42D6B7F9A5FE
                                                                        SHA1:5D71A3C809D7DBE54A1D7D124C56471B419F1A7F
                                                                        SHA-256:391152A4E0F66892A48EF07066A845E346C749ED479501402C907BA3E4639677
                                                                        SHA-512:9263939EAB0EBD221D17F45A76AA0CF00F4A38E6204E25990B4C1226D06035D7856F3F6239BBCC86F81B9C4DDA1A46BD741FE9976AE50780B69BF078B38075BF
                                                                        Malicious:false
                                                                        Preview:......................>.......................E...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.8........................................................................F.....7..2u.. ...2u................O.l.e.............................................................................................................C.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .2.0........................................................................F......!.

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1220.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 60, Total Editing Time: 1d+02:34:48, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Apr 2 15:44:49 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):89600
                                                                        Entropy (8bit):5.324389651089383
                                                                        Encrypted:false
                                                                        SSDEEP:384:AUfKDNLa1NuYqe26TngjniVd9znZUAQ1FYRzJ8+m63q6dUyAyxjR4avUuVxV79eV:pR2OngjniVd9znfTRDU
                                                                        MD5:D4AF83ED906C7B634BB7988F5FC77D9E
                                                                        SHA1:2C473D306D0071F75D891A2F108677E4563D8609
                                                                        SHA-256:96D3F4B240FCAEEB80222FB2107C4D1274FA3E87E46CBE11F5465657B143C28A
                                                                        SHA-512:FA3B57EC70D34C33BAA41891FC2C8B4A34113027C9B1BE743F14E3EA823E6AAA9E296CEE1A3B1FE8E210DFB2A3A02BF2AAA777EE79642729D7E0813268F05074
                                                                        Malicious:false
                                                                        Preview:......................>.......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.9........................................................................F......)w5u...-.w5u................O.l.e.............................................................................................................=.............O.l.e.P.r.e.s.0.0.0...................................................................................................8.......E.m.b.e.d.d.i.n.g. .2.1........................................................................F......:w

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1230.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 56, Total Editing Time: 11:09:29, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Apr 2 15:46:24 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):112773
                                                                        Entropy (8bit):5.250973108086118
                                                                        Encrypted:false
                                                                        SSDEEP:768:EX82dynZ8nzdp1UQhrV6x0KvnPC5F3RnO:T4LLOPQF3RnO
                                                                        MD5:C776CCEA447F74098919D2CD84E21F27
                                                                        SHA1:39A2C1D292006A4EFF7572393DBF5534D835C95A
                                                                        SHA-256:EA699B7EA87FC4A1F48ABEDA29707D3991950ADD632B54E5CD82D6ED6E19E5A4
                                                                        SHA-512:E7A0001ABDABD65F597C77688A14291AC67FB993BFFEFAB98B35548832DA0823435D4C694CE26E2DDF8D91AA2A39EAE8A52A938463F70BA7074C6F879A7AD982
                                                                        Malicious:false
                                                                        Preview:......................>.......................O...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .2.2........................................................................F.... v}.5u..`...5u................O.l.e.............................................................................................................@.............O.l.e.P.r.e.s.0.0.0...................................................................................................8.......E.m.b.e.d.d.i.n.g. .2.4........................................................................F.....K..

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1240.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 65, Total Editing Time: 1d+15:03:26, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:13:15 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):108914
                                                                        Entropy (8bit):5.248018963968515
                                                                        Encrypted:false
                                                                        SSDEEP:768:U48gnilnzJ1HdBEXHHXiQtsCnm5KYiuqqmrRQ:UekzJb4sEEziuqVVQ
                                                                        MD5:12CB40DE811F5393136639186EFD472E
                                                                        SHA1:22AA2F1FFAEEA90D910E93EDA4DC1B042769DFD5
                                                                        SHA-256:EBD8E59E2EBBC54B139F101EDFDD4972A7466AE8836D956F78BE53258F960A93
                                                                        SHA-512:3DB9E9380DEAECE075B4F82D81E881B385191BC48517600AAB48428669CDF9F13E6D108EC26FF0B1B914E368E0A6B4E8F9D967132556C9A2A781D73844D711F3
                                                                        Malicious:false
                                                                        Preview:......................>.......................Q...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .2.5........................................................................F......r..u...<~..u................O.l.e.............................................................................................................:.............O.l.e.P.r.e.s.0.0.0...................................................................................................&.......E.m.b.e.d.d.i.n.g. .2.7........................................................................F........

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1250.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 69, Total Editing Time: 1d+06:12:29, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:18:06 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):98304
                                                                        Entropy (8bit):5.336808297146148
                                                                        Encrypted:false
                                                                        SSDEEP:384:nZ3AqRFh9vx5LsU1WtnPMn3kB/lH8gUPVncL3heqR3TzGaQnQ1nXLuM3X3s3tkRh:5vx5LsUEtnPMnUB/lRUPVn7MHcM
                                                                        MD5:A38D6C5A69B882D02ECF73C0E5AFAAE1
                                                                        SHA1:0B8C51858A55123050184ACAA72D031C82B34968
                                                                        SHA-256:84EB99CD7F7F121443C559759B9E79DB0095F6001B304E343BEFB14876BE21E2
                                                                        SHA-512:2DFF4584EED803BDCF89F8B4764180B354E6A0A56A016303678643D1BBD6FD797006CD05044C03E880FC7B7489029ED3AD7EFF7179B0ED3AF2C07F078F9AE94B
                                                                        Malicious:false
                                                                        Preview:......................>.......................G...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .2.9........................................................................F........u..p....u................O.l.e.............................................................................................................:.............O.l.e.P.r.e.s.0.0.0...................................................................................................b'......E.m.b.e.d.d.i.n.g. .3.1........................................................................F........

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1260.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 77, Total Editing Time: 13:19:08, Last Printed: Fri Nov 19 19:45:23 2004, Last Saved Time/Date: Fri Jan 21 14:19:25 2005, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):87552
                                                                        Entropy (8bit):5.292860622249849
                                                                        Encrypted:false
                                                                        SSDEEP:384:0IVAgpIDVV3pdY7J84+ZEHnUzmLmCnFJBPncQ5olvPmKgTQVbDpdTC0xIBpIlxyi:UBHpS64+ZEHn0CnVPncxcA
                                                                        MD5:D57ABF650F3A7C4ABAFE3A95464A576E
                                                                        SHA1:888CC2AB4F445D3C25F5030ABC91839D7A75F015
                                                                        SHA-256:4F11CC3F6D5DBA4EC2B1A05ABF3819BA081F21131B80F092F0E8A4EC0E8109A4
                                                                        SHA-512:C46831025A5856D9559A9EE045105931441F2EF813202FCA6DFD7E33D71CF63175103BAB94E4F0F07E98E66E21746B182C9F550942E3CECBCB655437FC48509C
                                                                        Malicious:false
                                                                        Preview:......................>.......................@...........0...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .3.2........................................................................F......5....`|.5..................O.l.e.............................................................................................................8.............O.l.e.P.r.e.s.0.0.0....................................................................................................:......E.m.b.e.d.d.i.n.g. .3.4........................................................................F.... ..5

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1310.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 81, Total Editing Time: 1d+08:19:54, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:20:08 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):107061
                                                                        Entropy (8bit):5.2458729633908385
                                                                        Encrypted:false
                                                                        SSDEEP:384:pGEVny+Or43UTn0jgysu+snyMQnf07AGfiEgwmrqnqMYF18r6q0fcdcClUvKPLjU:tZW10jgysu+snyMQnCAGfiEgwm+nqqDw
                                                                        MD5:0E08FBEEF0207A68F62D4B1D7DEF1C7A
                                                                        SHA1:D27D5D35A399A73F82025A1EDCABE1E2071681B8
                                                                        SHA-256:40E0F4AC3C8E326230535E4553AEC1B51F941A863417538E5EDF35A86F2B7F6F
                                                                        SHA-512:51B6660B2667AB4E6312BBD54765B15150D24C8E93A07F0755DF4733936323A8614F2F15EA6016D1CD1E69D2DDB398A6442B94F4F82C74E7154A86AFCF29E500
                                                                        Malicious:false
                                                                        Preview:......................>.......................P...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .3.5........................................................................F........u..@...u................O.l.e.............................................................................................................:.............O.l.e.P.r.e.s.0.0.0...................................................................................................,'......E.m.b.e.d.d.i.n.g. .3.7........................................................................F....Pr..

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1320.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 84, Total Editing Time: 1d+08:03:53, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:21:39 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):106941
                                                                        Entropy (8bit):5.190240409169272
                                                                        Encrypted:false
                                                                        SSDEEP:384:1/3D+TQ+w2k8nbrnHvqKbV9QhrVRxhBRUQ7ItnF+PQXj01JoRTqQVeOBGws9t8O7:Dh2k8nbrn5QhrVRxhBRUQ7ItnApbRz
                                                                        MD5:D5250C1D0DC2D60F86C6F3709FFD814D
                                                                        SHA1:2043CE28896350EE6382B3172C5766332B09D890
                                                                        SHA-256:36C9C8DDB2D33CABDE074D4D11E53CF22E41C822B0CB6C48FC64CE6036B9494B
                                                                        SHA-512:3C6B69E7FA422A1597F3C75F24163F7D75FD0E357F6060C610CB71AE1CE7777E01BFE58B0B4268AA1316F653BBE1DE34A001270C43322D1D4D577D899FC3F6F7
                                                                        Malicious:false
                                                                        Preview:......................>.......................Q...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .3.9........................................................................F....p.?.u..P..?.u................O.l.e.............................................................................................................9.............O.l.e.P.r.e.s.0.0.0...................................................................................................$.......E.m.b.e.d.d.i.n.g. .4.1........................................................................F....p#.?

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1330.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 96, Total Editing Time: 07:53:47, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:22:29 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):100864
                                                                        Entropy (8bit):5.165912085213481
                                                                        Encrypted:false
                                                                        SSDEEP:384:xMLqp7YPTQPy7qUDcNinkW1dlE31rlsI2nG9XdjnHjjIH2An0zuuNz8wcNAMULKM:q3BDwinkoCD6nG9XdjnHjjIH2AnsBPY
                                                                        MD5:41E08E237789E1CD4CA9D79EA0104A51
                                                                        SHA1:35822182ADD8504CBAD4F16E2A2709F1B79BB859
                                                                        SHA-256:4E5371E38A984141C2F9922C1A1FFAE659F0E33D86ECC0381F2F24595187634B
                                                                        SHA-512:EC7386B8FF167AC216B796B7FD684560B2D51E0C9452F94AA01BD6BC4EE9471ED019035744B464973E1E8C3B9B5D3741C15758678DE1D6D1A1E4AEBA79801E0C
                                                                        Malicious:false
                                                                        Preview:......................>.......................P...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .4.2........................................................................F......c.p.....f.p.................O.l.e.............................................................................................................3.............O.l.e.P.r.e.s.0.0.0...................................................................................................4.......E.m.b.e.d.d.i.n.g. .4.4........................................................................F.....Fr.

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1410.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 100, Total Editing Time: 10:28:55, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:23:03 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):93184
                                                                        Entropy (8bit):5.351003521831334
                                                                        Encrypted:false
                                                                        SSDEEP:384:46cHcDWNkq1ED1vvdmnYGngnmJn6RsLDE/TIYDrUIMNevHA5/AXTeANq+cpAJx2h:cmD1vvdmn7gnmJn645t0
                                                                        MD5:820B972D957DB3C16FBDB57EFCBD5FED
                                                                        SHA1:7406A6C07D42F7F5B3FD1B6D566A7D301A25E99E
                                                                        SHA-256:49DBD73C4739A9BCF13D6D41850413DD22A60E0DF1AF880BAF2598DFEC818A54
                                                                        SHA-512:532EDECFDDA49275BAA849A3802B2A49156D4C0AD7E2423D1CADC81CAD132C0661F1FCBFA6173F5CE60D84D59C84C2B4159A525BE0374FBA236371D1A71DCD8F
                                                                        Malicious:false
                                                                        Preview:......................>.......................D...........2...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .4.6........................................................................F........p...p~..p.................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................;......E.m.b.e.d.d.i.n.g. .4.8........................................................................F....@...

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1420.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 95, Total Editing Time: 08:04:47, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:23:32 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):81920
                                                                        Entropy (8bit):5.321035397652944
                                                                        Encrypted:false
                                                                        SSDEEP:384:u/qIV+qqnAtr6napq/7cen2cvUV9XjQscvbWFlgMFWpoNi7abqN3NE50o8KwBv2a:fqqnAtr6nJcen2cv8
                                                                        MD5:BE5B1FB3E899FABC3EB7401E12F6DAE5
                                                                        SHA1:F1A260B5E17D3FDAF84544CDE55F76F117C0B34A
                                                                        SHA-256:19BDDCBD575C3F844BF482ECF3ADA47DA84DFC0CB8F795E56E8657D16546078F
                                                                        SHA-512:9F8E821FFD7E88450CC8C0C0B9407B763A0EFD536B6DFABA80E6053E82492E83F2836D360D918427FD0A4716CC395462F5BEB6954A15C2C660A0EE8D3A617962
                                                                        Malicious:false
                                                                        Preview:......................>.......................<...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .4.6........................................................................F.......q.......q.................O.l.e.............................................................................................................7.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .4.8........................................................................F....P...

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1430.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 98, Total Editing Time: 08:25:46, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:23:51 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):79872
                                                                        Entropy (8bit):5.287604768176084
                                                                        Encrypted:false
                                                                        SSDEEP:384:UULRea+qwnUfPLUnihpE/Hdi17bNnnJGcI7G9R+ysRUlFtBCyAyx1dmLdJ1/UWmJ:OqwnU7UnrVS71nu8RtOO5
                                                                        MD5:27085F01DE4D3142E9E4B9BB211557EF
                                                                        SHA1:B2B45E3ADCB2E595633992C976C9A261AA6C6D8D
                                                                        SHA-256:CA9A355143C4A90E927BEFB8BBB313DACF45E6ABC5FD8C9395AAF2A1518F1254
                                                                        SHA-512:399AAB73C33F278E058B0506F9D056E99E2F39D62E73F611AF0C3E2A512647567A238F5B1DC1E2B4F0A7EDFCCE79688B130D1ACFCA154EC0E658E50ABA073AAC
                                                                        Malicious:false
                                                                        Preview:......................>.......................=...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .5.0........................................................................F....P.|.q.......q.................O.l.e.............................................................................................................4.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .5.2........................................................................F.....w..

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1440.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 108, Total Editing Time: 1d+11:09:54, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:26:09 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):111586
                                                                        Entropy (8bit):5.367325742316195
                                                                        Encrypted:false
                                                                        SSDEEP:384:jzJFVv9kfjZNPWGeQY99TnjOaLhnniomsnnnzJX556HPipVqxzeixiIAkzk2tMfH:FvmfL+jQY99Tn/hnnLnzJaN9MT
                                                                        MD5:607F6373C804F27F8FDF44A67900FB2F
                                                                        SHA1:3B40ECB8AB64990E950052E75D7A1839F7157705
                                                                        SHA-256:7839AB6F8668346B93AD1A5FB2F6010E768F746C22746A3698A9F8CEFB2240FA
                                                                        SHA-512:B70530BBD70B79E3C2A4DA844CCA9666F79F2A2CE3E07578788A0B8CED4DC65829FF1090B98739E31DA96BAE32B7F94FC982E84C266293046D0F5094ACDF6C34
                                                                        Malicious:false
                                                                        Preview:......................>.......................W...........S...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .5.3........................................................................F.........u.......u................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...................................................................................................XO......E.m.b.e.d.d.i.n.g. .5.5........................................................................F....p...

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1510.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 100, Total Editing Time: 1d+10:02:03, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:23:06 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):96768
                                                                        Entropy (8bit):5.253739160278084
                                                                        Encrypted:false
                                                                        SSDEEP:384:vKm+fLcKtI4w9+IZnT3vWAlrNcEBa75JL7s8+GtGP37Wufq63f4ZlUWDgnfO9U7E:Iw9+IZniArqka75JL7s8+Yi37
                                                                        MD5:DCAB179D3AD3ACFD7A7233C780C4535A
                                                                        SHA1:CAE2FA8660F933F310E00CE62EF0BE2EA3870873
                                                                        SHA-256:3C96A70007A1F72F740E2145478000E1B5AF48EC302B90B44362316C7F6483FF
                                                                        SHA-512:C3848B1E96E8C7AF5F163E0F0D182DCD86259A3DC66E90C872D82603687ED3D8C4904BE4B83D7A75242273629DDD91C7A4C6E9483291D27D7FC7A26ED8EC4D67
                                                                        Malicious:false
                                                                        Preview:......................>.......................H...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .5.2........................................................................F.......s.u..P..s.u................O.l.e.............................................................................................................6.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .5.4........................................................................F.......s

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1610.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 102, Total Editing Time: 12:46:54, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:25:56 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):97280
                                                                        Entropy (8bit):5.433407303868964
                                                                        Encrypted:false
                                                                        SSDEEP:768:Xv8TdJn1L9e/XR1njdFKaVgSoLUW2nE0QNjNH9//SxR2OfRuBtxVet0eYxeggQYv:Xv+kRRpAooLUWoE0F9
                                                                        MD5:172733484051DE3076D0A569F645045D
                                                                        SHA1:8BE5BB91E53AAD1EFBACC2C54AEE07FE1C1F164A
                                                                        SHA-256:E9BB1BA3289F596D025A5231320B03235BE5B816DC0F488EA01C515E4901E54E
                                                                        SHA-512:1252FA1225208BFAAFF9DC65A6825B795EF0909A9998978734615FE782595B3A8A816D08393D36694D02EAA7B292A8328274681CBC4005881F0D071FA08186B8
                                                                        Malicious:false
                                                                        Preview:......................>.......................I...........E...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .5.5........................................................................F.....}.]q...@..]q.................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...................................................................................................2.......E.m.b.e.d.d.i.n.g. .5.7........................................................................F....`..]

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1620.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 101, Total Editing Time: 10:20:22, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:26:15 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):94720
                                                                        Entropy (8bit):5.272781101700666
                                                                        Encrypted:false
                                                                        SSDEEP:768:gNuIJnEBd9cuF8Un89429gapL8LbniyRbV:g5ETv8aNApL8LrzRbV
                                                                        MD5:1B37C2A8DEC9E777B46E116BA50A3563
                                                                        SHA1:A8898F875CBC592BC5E20CE53B6EF9F0BB78D7DF
                                                                        SHA-256:DF084AB74DF1D8A747C1249B49E6D8D59FBF0502605F32E441B197E8E2A93242
                                                                        SHA-512:189D4B233FC19C87796B2CBAA963C482E91DF34BBAB9A07EDAD432383C672FD283CB9A7E4D5A65330767F229357A460E77443E5A05DDD56209B72AD9CB444C0C
                                                                        Malicious:false
                                                                        Preview:......................>.......................E...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .5.9........................................................................F....P..iq...@A.iq.................O.l.e.............................................................................................................?.............O.l.e.P.r.e.s.0.0.0...................................................................................................T.......E.m.b.e.d.d.i.n.g. .6.1........................................................................F.....N.i

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1710.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 102, Total Editing Time: 13:13:55, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Fri Dec 17 19:22:29 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):61952
                                                                        Entropy (8bit):5.197538641051164
                                                                        Encrypted:false
                                                                        SSDEEP:384:Hed98gAdS0dfq8n4hwlnTntEU/19uS6cEa7NyxPRkgmKAKc4IEztItr7XLXjfM:C8gAddRq8n4unTntEU/oV
                                                                        MD5:36859ACF22527BC88FBFB9E37440A55F
                                                                        SHA1:18AF08920D3346871C714D7BD6FA9CE15EB1ACC5
                                                                        SHA-256:75FC4385FB8AD4B3D51363C5698ACB8282103660B6976247C2C2BF503D375A2E
                                                                        SHA-512:29FDB57A280EAE39C3F358601885953CB80361AD30390877DD4A1CAACFE1B3921D021FEA3FF9411642FB32BDBCAC486BCA413F834046E793BD304A51449C0F5B
                                                                        Malicious:false
                                                                        Preview:......................>.......................5...........$...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .6.2........................................................................F....p..m....q.m.................O.l.e.............................................................................................................$.............O.l.e.P.r.e.s.0.0.0....................................................................................................*......E.m.b.e.d.d.i.n.g. .6.4........................................................................F.....,.

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1720.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 101, Total Editing Time: 10:00:19, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Fri Dec 17 19:22:46 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):59392
                                                                        Entropy (8bit):5.168408859847519
                                                                        Encrypted:false
                                                                        SSDEEP:384:+wfUNpSgv0nWjVnVdffnhzK8h4pJQK68JqYVyVSheqCizxT:OpSg8nWjVnVdffnhe
                                                                        MD5:97E1308BA3ADF310E6A2DB558CA9D4EE
                                                                        SHA1:3FEE31C76C8A7648B9019C07D20A20352906D10E
                                                                        SHA-256:4AA41550EC612F8F97BBB2FC015E81FD493DA6C463C4B6A2FE8BA1430BEB5AE9
                                                                        SHA-512:2DE6880192BFE2D4B79F6FCCF0E976B573FF3E0E4468BDBDA75C73E07541ECEA6CAA1D5A2345E103DFD40E68D5C1E5F8B91BE40513879AE87AA1384B4E7F2C2C
                                                                        Malicious:false
                                                                        Preview:......................>.......................1...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .6.5........................................................................F....P...m....,..m.................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .6.7........................................................................F.....9..

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2100A.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 37, Total Editing Time: 03:53:01, Last Saved Time/Date: Tue Apr 13 14:20:34 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):114962
                                                                        Entropy (8bit):5.261604527673691
                                                                        Encrypted:false
                                                                        SSDEEP:768:I2e2hGE0kS1gDYq3nly76JfvRtncMZC03Eew:IjqDJ/cMZC03Eew
                                                                        MD5:1FB07367EEE8E3F2FFA696DA778F9018
                                                                        SHA1:170EF1512BB373E4EC8FBCA5263B5A08F36B9512
                                                                        SHA-256:1D33DC7FF4AD1B4893E9DB4C72C5F6D8D0D86075D397B9186B2854854AB81939
                                                                        SHA-512:178EC58D64CD56BC646D86F86E1ACE92425133C10B7761F5049BD2C091464EC32A570B1E2473B5D0FC011119C74266AEF41B48A12E159F2A262A2F0FD9A2ABA3
                                                                        Malicious:false
                                                                        Preview:......................>.......................X...........T...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2100B.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 48, Total Editing Time: 05:04:50, Last Saved Time/Date: Tue Apr 13 14:21:45 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):146388
                                                                        Entropy (8bit):5.235020092891038
                                                                        Encrypted:false
                                                                        SSDEEP:768:lHhUlBYVEpjE0l/8ygiedZ/ZXA2GGWOnxviPNisAtk71j3/NhaWVh:cisyzxviJhaWVh
                                                                        MD5:47FE2ABB3C4266AA429CAAF719CF71BC
                                                                        SHA1:E4C54798A9BCCF3C701159269C45D7E100260917
                                                                        SHA-256:18FF6C961A1882DBD1F73D84F8FD8EC5B8C15D93216D070AB4B700D56F7D4DE7
                                                                        SHA-512:2C298236AC196DFE6D63D4C39E4E61E33657B6EB532E6C8997238555B8E9D4D0114AA0765B1CD1ED8335595A41BEED6021F80A25ACA9F1CA1F5B830352468DBC
                                                                        Malicious:false
                                                                        Preview:......................>.......................p...........l...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2100C.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 43, Total Editing Time: 04:21:42, Last Saved Time/Date: Thu Apr 8 20:48:13 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):107008
                                                                        Entropy (8bit):5.203668389142667
                                                                        Encrypted:false
                                                                        SSDEEP:768:z/e2h2SnE0VWT+1+CiQCQGWPn32nhLn9ltYpM:XlWTQGnhL9ltYpM
                                                                        MD5:EC5ED3BE771AF6005AFCAC6A4C51F499
                                                                        SHA1:CA5DB43D68B152900E6F53E8E612EC8797F2A3D9
                                                                        SHA-256:DF063F6FB7499AD1ED1A1119619EB53522AAE076943B44014F88D29C546256F8
                                                                        SHA-512:55AE15036ADE8A92BD83E18F5BC56164E2C591E28C8F27F2DD50EBF0510B2A9F5B593FE58967EBEF7BBD2A49B515E13D66435624A8ACCCB6D4C2ADF924F8B266
                                                                        Malicious:false
                                                                        Preview:......................>.......................T...........P...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2100D.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 51, Total Editing Time: 05:01:15, Last Saved Time/Date: Tue Apr 13 14:23:15 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):166675
                                                                        Entropy (8bit):5.129449327763986
                                                                        Encrypted:false
                                                                        SSDEEP:768:GM4hVe2h2WE0VSAcZ7qW5xp7XnWGHP/3HcMJMkcp8sbHVrtHXGnPr9swMnvUgFKG:GjqZGW52uPr9sxDNe6pwO
                                                                        MD5:304833086B629BFAF6693DA65E39EE77
                                                                        SHA1:F76E35DE8ECC14B02F43CA081BCA9564401A98ED
                                                                        SHA-256:7798FE0E09498A983A14564088513DCFF524A92B029E696FA7666E7D2F21CD52
                                                                        SHA-512:3B7BC1572975669F1F0C6C47A4DF4F1D790010432CB1B192A878E765135383937188B7A303804C0650AB95BBF3D49CDC86F1926098830880CF1CCBA01244385F
                                                                        Malicious:false
                                                                        Preview:......................>...................................~....................................................................................................................................................................................................................................................................................................................................................................................................................................................................d.....gdldd.dddddedd........ddddddde.dcddddtdA..dd.gddd.dddddddddddddddddddddddddddddddddddddddddd$dddddddddle.f.....cfkfffffffffffd.ffd.fffgfgfgfffffffffgfffffefffffffffgfffff.fffffgfgffff.7affffl7776777777_4afffffgf..........8....o..... ..hoooo}...;..............oooooo.s.....F..tssssS.p......ppp|9.1........pxprpppqpc{si...^ABCC7,...]:.2........s.s.....@..tssssn.p......pppy94>.....p{pepppqpc{sd...^ABCC7,...]:7=.....s.s.....J..tssssQ.p......ppp~3........>...p{qppppqpc{so...^ABCC7,..

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2100E.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 50, Total Editing Time: 04:33:45, Last Saved Time/Date: Tue Apr 13 14:24:17 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):107008
                                                                        Entropy (8bit):5.212905544497119
                                                                        Encrypted:false
                                                                        SSDEEP:768:Ve2hrxPE0TNYWedi46AMWnX9KtpskNNf:lx7NmX9KtpskNNf
                                                                        MD5:0EDE1C44051050AC187DA8AE1A31C2F8
                                                                        SHA1:6727E18195931D9FFED15210436147C34CF1CC87
                                                                        SHA-256:8D79794DCE8E8102C720728292C6F6EBFA0001110DB7AFB4E02F82F3DC59CAC5
                                                                        SHA-512:AD0387D629DD90745A5566F5DBEFD2EC2F7EBAE6428AB89F0169F11D412B917359CE61DFCB47365CD0D0BFEF58DD57CB7991534B97CAED8778321480062F4842
                                                                        Malicious:false
                                                                        Preview:......................>.......................T...........P...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2110.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 49, Total Editing Time: 03:46:39, Last Saved Time/Date: Thu Apr 15 15:57:48 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):76800
                                                                        Entropy (8bit):5.009447532664834
                                                                        Encrypted:false
                                                                        SSDEEP:384:TPJJ7E0hxrneCraahyLQnKwtdKqDnfpACZZkqelRmEChcbSfjSwHbSwT+4suZMs:VZE0hxrneCraah1nKwtdKqDnf6/uaT
                                                                        MD5:DFF552E4E496944479F953253BBD7351
                                                                        SHA1:C1B05DD86E65721096C510D61D58BD98ED6DF24A
                                                                        SHA-256:F694DB14FCF41F4AB49B0E78A5BB6013F5DBB3C98FE2419A8B4F31E9EC6C01E7
                                                                        SHA-512:C5C7C86701687A794F69CE62BA2283866641C2BC4DF06E81D2B82B13AFE19EE1F3DB98374CACB0BD10ECCAC55BECA350C074B53132878FF7F167B26104D8ED63
                                                                        Malicious:false
                                                                        Preview:......................>.......................I...........F...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.2........................................................................F....P(_.."..P(_.."................O.l.e.............................................................................................................(.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .1.4........................................................................F....@M|.

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2120.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 51, Total Editing Time: 04:10:11, Last Saved Time/Date: Tue Apr 13 14:26:03 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):93184
                                                                        Entropy (8bit):4.932281798856309
                                                                        Encrypted:false
                                                                        SSDEEP:384:my8vFCp9Baa2ei+8dnKS+Mn8ApHNbjjVkyCSiyCizjyfanlIz1c5Ok28Zfcu3HUJ:AFei+8dnXDnjN5ayCSiyCizjyfan
                                                                        MD5:CA9D0B00E917E157CC2408DD4DC2EA90
                                                                        SHA1:DC8EAF0340917B476C13C22392A923FC9FF2A544
                                                                        SHA-256:C08686BA7C85FE2046B9CDDC4A1DD01D46D46C2380097622D01BA26C7FEE2DA0
                                                                        SHA-512:17E3A6CD88BA189CB3661E5A297F208B1460B22920B3C49E2388C521694D6A9857AB388530E606F4672671934F7BF29DACD4526881A46427550EE2BCCCD59779
                                                                        Malicious:false
                                                                        Preview:......................>.......................X...........T...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.7........................................................................F....pn8.Z!..pn8.Z!................O.l.e.............................................................................................................".............O.l.e.P.r.e.s.0.0.0...................................................................................................H.......E.m.b.e.d.d.i.n.g. .1.9........................................................................F....0.U.

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2130.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 53, Total Editing Time: 04:44:01, Last Saved Time/Date: Thu Apr 15 16:32:30 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):91648
                                                                        Entropy (8bit):5.076995311538233
                                                                        Encrypted:false
                                                                        SSDEEP:384:IjZfGSJA38On49XQTyknFq8OgwWu1w8va5Eqbe8E7wtzwaxJbhA4zCeh5oORTJJA:IsaA38On4UnWgwWu17qbe8E7wtzLxJ
                                                                        MD5:5F1D64DB7229FEF2119003A2215D06C4
                                                                        SHA1:42A8A4F7B01CC3363741734F4B3191E835B745ED
                                                                        SHA-256:6DC59A6992E5543D655C584C7E969C76BE1B5E56A7472A89879FD5D78F94CFD7
                                                                        SHA-512:03DEBC9A70F6C3BE45DE952D959B8CD26C30DC1F08C8D1E9383C380592A2158A2209CBB9DB75275838BAB40CA6374609FA472E78EE67216168F322BA357EDBAC
                                                                        Malicious:false
                                                                        Preview:......................>.......................U...........Q...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.9........................................................................F....P...."..@...."................O.l.e.............................................................................................................4.............O.l.e.P.r.e.s.0.0.0...................................................................................................."......E.m.b.e.d.d.i.n.g. .2.1........................................................................F........

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2210.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 68, Total Editing Time: 06:54:28, Last Saved Time/Date: Wed Nov 3 19:31:39 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):175839
                                                                        Entropy (8bit):5.344109633971589
                                                                        Encrypted:false
                                                                        SSDEEP:768:rrFkQq5mlq6EppSEijiV6SArIbn+6UhUHMO5us0LNH:VAvUhUsLxH
                                                                        MD5:AA067548970C7B00CBD1AB3D163064DE
                                                                        SHA1:E72267289B4399F1F51979382060F3A4015D95EE
                                                                        SHA-256:7E38CC0B0BE481B16A64708EAB29064AAA1E7FC9603B479F3A1027C89599C443
                                                                        SHA-512:F9FD3F88F52846DD922F17555AF1E390EE1FEBEF38FE4A8633AC34E1E7B60BFBCD14240FBB1A9A006C6F937453961AB5846ACB6169678DE041EEDB811A450615
                                                                        Malicious:false
                                                                        Preview:......................>...................................~....................................................................................................................................................................................................................................................................................................................................................................................................................................................................d.....gdldd.dddddedd........ddddddde.dcddddtdA.$dd..ddd.dddddddddddddddddddddddddddddddddddddddddd$dddddddddle.f.....cfkfffffffffffd.ffd.fffgfgfgfffffffffgfffffbfffffffffgfffff.fffffgfgffff.7affffl7776777777_4afffffgf..........8....o..... ..hoooo}...\.)............oooooo.s.....?..tssssn.p......pppy3...4...p.pxpppqpc{se...^AABC,...]0...7...s.s.....E..tssssS.p......ppp|9.1........pxprpppqpc{sj...^AABC,...]:.2........s.s.....=..tsssso.p......pppx=.. ...pvpxpppqpc{sf...^AABC,...]>..#...

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2220.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 64, Total Editing Time: 07:36:52, Last Saved Time/Date: Wed Nov 3 19:32:42 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):183665
                                                                        Entropy (8bit):5.227388050044036
                                                                        Encrypted:false
                                                                        SSDEEP:768:MVSBlBnqKOBlueO+O+u7yuLZJ5p5pZQgBx4Un5pFmWfN1pmSoNZl50Qa+OOKF/RI:M0BISTEWfQSoNZl50Qa+ONdu
                                                                        MD5:FBC80A0187F08266BE1BF548458C222B
                                                                        SHA1:407678E96CB6077C13DD905E4773B2EF1EC765BF
                                                                        SHA-256:5A5FC33AFE7368245E28A7713662C9BDA876F5AC927394A5A8A30836FE725DE5
                                                                        SHA-512:11F5E8D401D6FB0172B501776B6DEF21BD11B1081B602F1AC98E8F42D114CDE9EF8EE0728E1F0D509506FCEF5D7D27296290227AF513F4950C40E4F32FCDC8E3
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e.......................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2310.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Thu Sep 2 16:11:52 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Wed Sep 29 20:57:07 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):97792
                                                                        Entropy (8bit):5.235321248671491
                                                                        Encrypted:false
                                                                        SSDEEP:384:h3FE+JrT1W4O7jhcWvL4LRNXncMEUYAkEUANCfn/+ckPJa0ihYpkeQd9H1tiADS5:ijh7vLqRNXncMEUYAs/fn7fOpiq
                                                                        MD5:343EF05BA42CEA68AF2C93D6A13D1DDA
                                                                        SHA1:48696E1A874EC0D9359750ED88AB9DD120556EE6
                                                                        SHA-256:1E7B03D67BDBDA7E22A68F91690B917B454A35B7797A67782DAA970E035E32BC
                                                                        SHA-512:7B2135F9A204F2D06C1AF46AA7E0822ADBDD3FA7D7642B759AA46C56966E864DA2D713C36193DE51F5C7148DF0D1961ED98A14D07A798165065F60CF0478B6F0
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f_reports\2003 Forms\cro-2310.ttx..........cro-2310.ttx.............................................................0...................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2320.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Wed Sep 1 18:17:24 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Thu Sep 30 13:20:19 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):76800
                                                                        Entropy (8bit):4.878667838414998
                                                                        Encrypted:false
                                                                        SSDEEP:384:jaLie5bHqeAsUpQZE0CoYnSmrWJKQa0CoY2SirQ8Oa0CoPp7ft7wMvWwdmhWwSY/:gx6hQA1vWg1SQ8bepLtH8h
                                                                        MD5:5708195C58E3C42049C1B39A69A778CB
                                                                        SHA1:A7B8E652A3719B0495FF8BD553E01518F3D3E6C5
                                                                        SHA-256:7192672E01BE235F4AEE589F8C89AB98CA3937B0E578E707D2C80104EA658F3D
                                                                        SHA-512:9BE7F2BEDB67C1BCB57C713FBE99483F2F59576458FFF2979BD09BB56669AC19A42A5A32B03398163BE93D7011C39C807831901CF90BEEE3A97EF754B32C0F17
                                                                        Malicious:false
                                                                        Preview:......................>.......................J...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.4...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................[...........E.m.b.e.d.d.i.n.g. .2.3............................................."........... ..............F....p...

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2330.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Wed Sep 1 18:30:22 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Thu Sep 30 14:12:24 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):87040
                                                                        Entropy (8bit):5.016829721181625
                                                                        Encrypted:false
                                                                        SSDEEP:384:Sf1lCrJRyG5G0aAYCMKiOqvsgyLfH0aAYxB3UoggtX20aAYpo0/6wMvWwdmhWwS6:1yGy9ygA9XEogIQ9pxM8hqO
                                                                        MD5:F5CDAB6A4DF5F715194C5DB56D5BC3D7
                                                                        SHA1:6C4A37A491B552AA28294D9B739CACD9738B0C0F
                                                                        SHA-256:702F5AB1C9D04BE301A38CAA092D2D77E3A572DF40D08FFC11F4CF875D2E0C9B
                                                                        SHA-512:E35E47012B974896F0904C276EB9BDB9587ABDD8A6891B06BDE60CC14E6D73448FBA3C6E3B536B30BDBE279D6729B2C227D626D7F058BD38C16342405B52E8E0
                                                                        Malicious:false
                                                                        Preview:......................>.......................V...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.4...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................t...........E.m.b.e.d.d.i.n.g. .2.3............................................."........... ..............F........

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2340.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Thu Sep 2 15:18:00 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Tue Nov 2 15:55:18 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):172330
                                                                        Entropy (8bit):5.203209297538331
                                                                        Encrypted:false
                                                                        SSDEEP:768:ZMvUSXCbLRXY+OXLTgcbRRdUKuPkBLpYf78hhxhDhmVhShQhdh5vOG+6z:3SXCbg/gc9R6Pot9hQVQ+3h+G
                                                                        MD5:63F5FF7C2D7205CB2E4D97A709C8BC33
                                                                        SHA1:4E24825E5143987872329001C92F111290F14E84
                                                                        SHA-256:BCD7C0FCE94BA92252B53248F5A7720E9D05EDC5B509B6F5D05640F27C07513B
                                                                        SHA-512:C501643907DE3CB3F96C0B9EA6F8871DAA01DF15D6BE2951DD16E97CB346E19A55E12D58D9D2F71F703D42FEE5C8EA830D1657DFD77AF1C00907F73621ADBD84
                                                                        Malicious:false
                                                                        Preview:......................>.......................m...............................p...............................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.4...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................z...........E.m.b.e.d.d.i.n.g. .2.6............................................."........... ..............F....@o..

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2500.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 43, Total Editing Time: 05:27:46, Last Saved Time/Date: Wed Nov 3 19:33:51 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):57856
                                                                        Entropy (8bit):4.912226439854232
                                                                        Encrypted:false
                                                                        SSDEEP:384:PWFml8E2XE848Qu9rC6gpbtne38GvfPVmPZn8IYpT0QCp3MaQRbx3eCWQ:1l8E2XEwQu9rC6gvnezvfPVmPZn43
                                                                        MD5:3CA49EB0F57DA94C615276F113798BBC
                                                                        SHA1:BF7BC7157F202F78272F8E523A3A79064BE0F9AF
                                                                        SHA-256:8D5E5F0BDA98BDD948625BD559E1E75E8D6409809A0527678156F602D7CCF44D
                                                                        SHA-512:E59A06824B6B995BE87054A7A43A09CDFE033177EEB2E1C2C21465F97C2C2D96CD919202836D23FBC21AF3DCFCCD22507E725E8BD8B9843B4FE08F6B0ADBDEC3
                                                                        Malicious:false
                                                                        Preview:......................>.......................B...........?...................................................................................................................................................................................................................................................................................................................................................................................................................................................................eld Definitions Only)....HC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\2003 Forms\cro-2500.ttx..........cro-2500.ttx.............................................................0...................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2510.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:51:41 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Mon Oct 22 19:25:35 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):97280
                                                                        Entropy (8bit):4.976430970520775
                                                                        Encrypted:false
                                                                        SSDEEP:768:B0jbfG0HYJffpgAnVY7PfsUMXHwKY0/Oxlu7cimw:0btHofHVCf/MXHwKY0/AuIi7
                                                                        MD5:8EAC4565C5C68E1989A9FF7987815CB2
                                                                        SHA1:0EB3FB50AEF02C35F85F65F5857A716C8AEFA682
                                                                        SHA-256:9EC7029D0766167D10E4D46F032B5B108B3B31B3A3237DE100D87E77D2B51386
                                                                        SHA-512:C70D33774D966A4E48970C1C3CECDF47F688603A7D50B707A61C4D8EF045C40997ED14CCE9784C08D05A2503BAAC36394E8E2BF1F137BB9CA21D646C73A27874
                                                                        Malicious:false
                                                                        Preview:......................>.......................b...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.3.............................................................!.......................................................T.h.i.s.W.o.r.k.b.o.o.k................................................."......................................................._.V.B.A._.P.R.O.J.E.C.T.................................................................................................).......E.m.b.e.d.d.i.n.g. .2.2.....................................................%... ..............F.......w

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2520.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Thu Sep 2 15:25:10 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Thu Sep 30 16:30:55 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):135680
                                                                        Entropy (8bit):5.128156286632356
                                                                        Encrypted:false
                                                                        SSDEEP:1536:mV49P3yLKq8o4zLcb2UlUc4K+xTPNRPzUsdiallTonTIn2:1PQyN
                                                                        MD5:DA29DAC0A434ABC27100A3A4A367E110
                                                                        SHA1:C221D94A7BE299E5E14EBEC92A6DE9BF94480A15
                                                                        SHA-256:20D3D0DD26709E180F54668AB6C3699C1868925626FC6B1423D497605E7AD68E
                                                                        SHA-512:1472086D61EB119431EEFA82F285077CADAE6E242F704EE586A792E1D47FC241DDA2EE294FAF059CB172093929EBCAB6FFDFF067D1565F99DEF8C99FCB3E6C6D
                                                                        Malicious:false
                                                                        Preview:......................>...........................................................N...........................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.4...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................V...........E.m.b.e.d.d.i.n.g. .2.8............................................."........... ..............F.......

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2530.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: State, Name of Creating Application: Microsoft Excel, Last Printed: Thu Jun 15 19:07:57 2006, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Mon Jun 19 13:10:06 2006, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):163871
                                                                        Entropy (8bit):5.0807907373790036
                                                                        Encrypted:false
                                                                        SSDEEP:3072:BaoO2BABgppv/5/vR6WOyALYaHueLJJz9nZMEaGzI096cZzl9Q:BaqBABgppv/5/vR6WOyxcZzl9Q
                                                                        MD5:1305898D36FFA9B7F2588B4A1500E83A
                                                                        SHA1:401DFD86A8927D1CB5E22A6AC704398721C28943
                                                                        SHA-256:B1A4B2167F40F9CB5FF128CD49F194334D730ADC6C0B5C71DA91F0AEC41FB573
                                                                        SHA-512:E27CE2D9EB5A541E24F690D6951AB133DB81D9BEE17AEAD2A9FE0A562007F24D522FC9A920F0687BE12BCC3CA357760319D70C077992B2885FD8DED3FE36F5A4
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................z........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...>.......?...............................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2540.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: State, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 16 19:02:54 2006, Create Time/Date: Tue Mar 18 18:33:40 2003, Last Saved Time/Date: Fri Jun 16 19:04:24 2006, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):122880
                                                                        Entropy (8bit):5.031239289107367
                                                                        Encrypted:false
                                                                        SSDEEP:768:FB9CHpBpB5GOLJTJBEb/1EMAsxv5JQUM0FKmoDd:ZApt1LdEb/nAEv5JQX0Fw5
                                                                        MD5:47FFCCC46A2FC77F5FE6538F2BBDAA65
                                                                        SHA1:B99466E07ACEBAECC9444EDE30769BE9DF08F5B9
                                                                        SHA-256:967BEAFE2035D7AD942A8DEF6BA82D5BD8ABE196A2DF615C7C39F9E6CC27B796
                                                                        SHA-512:3829104E23319091FF92652912E9AC6F7AD2812EDDC625599A8B41D4D855F619A46F61FFE797D0243FB3774F49B34C47E42D79B55AB9A53A0D650E4858766D75
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................~...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-3100.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 11, Total Editing Time: 01:13:31, Last Saved Time/Date: Thu Apr 15 16:10:09 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):59392
                                                                        Entropy (8bit):5.20548689364493
                                                                        Encrypted:false
                                                                        SSDEEP:768:Xu/JhxbQkQmhQ5NM9maf1iZxIHbWCAnBHszjGBAX1mrx7SympaenjKC:eR0kQmsMRTu9sPCQ1
                                                                        MD5:F06A082EE26DC7A9FC9AF75EA78CF04B
                                                                        SHA1:6FA744D6397EE27FAD957FD2E835003CE0928D2A
                                                                        SHA-256:E0B846D5CA7F4D42E7801DA32552585399C441E3D3E3B7C209A1EE94603CBF2A
                                                                        SHA-512:0FB7785CE7713382D67CC5FA8E41D0C7371DF9536A0E23A2FCE3A1E9DEDD6A0AEE155B2A0ED95366966CF7A71545B4476A323DCC438615C51A7E70E75DDF4AA9
                                                                        Malicious:false
                                                                        Preview:......................>.......................O...........L...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .4..........................................................................F....0.H.."..0.H.."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .6..........................................................................F.....Mj.

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-3200.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 11, Total Editing Time: 59:12, Last Saved Time/Date: Thu Apr 15 16:10:40 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):58880
                                                                        Entropy (8bit):5.202598797564419
                                                                        Encrypted:false
                                                                        SSDEEP:768:9x/p8JhxbQkQmhQ5NM9maf1iZxIHbWC8nJfBna/KEn2:9Jpe0kQmsMRTabu
                                                                        MD5:F0C67D5BE0C6C23069A98FC9C42B21F0
                                                                        SHA1:3664DAC584F65485BDFDD03FC215D817B9DFC30B
                                                                        SHA-256:EF0E4EA896076843CCAAD02933AEDBE79482D8AA94CC7E42102E4138D665F274
                                                                        SHA-512:3EE740535B59E33A29D9B8B323DEC0B96E6C8552BC38D9C9FD344D91B85AB7284052F6D5968FB2094FC262EFB2F5D80842D9C42392FF1D51BD7169A8F441F0BD
                                                                        Malicious:false
                                                                        Preview:......................>.......................N...........K...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .6..........................................................................F....pP..."..pP..."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .7..........................................................................F....@..

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-3300.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 11, Total Editing Time: 53:27, Last Saved Time/Date: Thu Apr 15 16:11:02 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):59904
                                                                        Entropy (8bit):5.210459280768143
                                                                        Encrypted:false
                                                                        SSDEEP:768:LCRojJhxbQkQmhQ5NM9maf1iZxIHbWCnnkrnCIHWnJE:LEoF0kQmsMRTP62
                                                                        MD5:B511926EF1002CB1F4AAA6E2071672E3
                                                                        SHA1:3C1D20F9223C2CE424D6B906D9789C493576EC55
                                                                        SHA-256:4F495EC0387E14EE0F211F0A53C133D0362A75DFAD14315A9DAB42A7E6D7F6A0
                                                                        SHA-512:1958C9CFE296090A6407AB032CC2E160982942AAB6A5B1CDB466547E6503A612632764471AB7EC80546F960C7CB2E69C115CD7B82FEA90ED0D58BEB818BBD8E3
                                                                        Malicious:false
                                                                        Preview:......................>.......................P...........M...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .8..........................................................................F....pO..."..pO..."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.0........................................................................F.... ...

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-3400.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 14, Total Editing Time: 47:00, Last Saved Time/Date: Thu Apr 15 16:11:40 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):60928
                                                                        Entropy (8bit):5.198727350702287
                                                                        Encrypted:false
                                                                        SSDEEP:768:DQ+bXJhxbQkQmhQ5NM9maf1iZxIHbWCsnThHnRKqn8:DZb50kQmsMRTa9P
                                                                        MD5:F3E96121EF1FE4575C5112E52619A9DA
                                                                        SHA1:A308DD12F2DB9F5863631ABFBE97554C76E32C9C
                                                                        SHA-256:742D520C233C61433A794AB11DB5FBCD236565CFC63A82D2715241BABDEF4041
                                                                        SHA-512:94935A8F87744BBA7FEBCC8A5FEA0F3273CB558D7A385ABBB9CEA94DECD2BC247BB934D472D4136FB431C58956355D7DF9252A849D9731F0C546345C056EB6B2
                                                                        Malicious:false
                                                                        Preview:......................>.......................R...........O...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .9..........................................................................F......+.."....+.."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.1........................................................................F....@tO.

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-3500-add.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 15, Total Editing Time: 01:14:19, Last Saved Time/Date: Thu Apr 15 16:46:43 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):64512
                                                                        Entropy (8bit):5.0872204368180025
                                                                        Encrypted:false
                                                                        SSDEEP:1536:KCrycGESg0kQmsMRTiGlrfSBaEEP4VpAH9fxFS:d0kQm9RT
                                                                        MD5:E6DBE6558E05030B529A9F71B1944DE0
                                                                        SHA1:EBB835D973C152D757845AD9E4EDE7A2DE5D4CB1
                                                                        SHA-256:C52F450DFAD410C2C177A91DB8C070BF63D3068A52C81092AE60D66AFE88F0A3
                                                                        SHA-512:49D6612314178EE866503856AE3E3079C858CA4375F827505BD40423429C120AA388C0CAFA63C4FFE7B36A81BF804AFEB87CDD8739E8F3BAF1E5FDDB533D29D2
                                                                        Malicious:false
                                                                        Preview:......................>.......................]...........;...............:...................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.2........................................................................F....._#..#..._#..#................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.4........................................................................F....@gN.

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-3500-main.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 17, Total Editing Time: 01:43:07, Last Saved Time/Date: Thu Apr 15 16:13:09 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):88064
                                                                        Entropy (8bit):5.388710930708643
                                                                        Encrypted:false
                                                                        SSDEEP:768:+nVHYhxbQkQmhQ5NM9maf1iZxIHbWCFnjDnaUoqrnc94RHexedO:+i0kQmsMRTJPjpHA
                                                                        MD5:5A6E41E293A03AEBC93266499DA11B7C
                                                                        SHA1:6400957B493FED5E571912DB972EBABA94636FF5
                                                                        SHA-256:646174976696BE16DE2AE3D451EF356F83D4DE085329301AC5295F7C61342A4F
                                                                        SHA-512:1E0159E6EBAAFA8AD8BFC8FA7F000B813DC836A344B6112BCA751D0246196F5D9A0FC094842BFB53FD836CC9B7543FFC23656585E1F00BD09A79CAF4B0A6B84B
                                                                        Malicious:false
                                                                        Preview:......................>.......................c...........=...................]...............................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.3........................................................................F.....S>)."...S>)."................O.l.e.............................................................................................................7.............O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.4........................................................................F....P.b)

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-3500.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 55, Total Editing Time: 02:10:00, Last Saved Time/Date: Thu Apr 15 16:46:51 2004, Create Time/Date: Mon Mar 22 15:03:08 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):158208
                                                                        Entropy (8bit):5.340858554251574
                                                                        Encrypted:false
                                                                        SSDEEP:1536:oNe2HASmU0kQmsMRTXTcDCrycGES5orfSBaEE2pAH9fxWK0mU0kQmsMRTg:F+0kQm9RTY0kQm9RT
                                                                        MD5:0393A9F38F3AD7C4A34189358C9754F8
                                                                        SHA1:8622DE3DB6B32284333F4A63BD90B3F8F962CD31
                                                                        SHA-256:93B0F789471FEF00B74DD158933D1E8F9C5AE045183F89910C9472E91E66DA50
                                                                        SHA-512:9322F7A00928E023CE9C9EEC6CD94F338F7661AC2AB2A59BC71DC5B329A873817ABE91CA5788C2B1A6D2966B75DE76588FD57B3EFFC1C5378377DCDE6CD92C56
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................eld Definitions Only)....MC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\crystal version\cro-3500.ttx..........cro-3500.ttx.......................SQL.....Pdsmon.dll....%Active Data (Field Definitions Only)....RC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\crystal version\cro-3500-main.ttx..........cro-3500-main.ttx.......................SQL.....Pdsmon.dll....%Active Data (Field Definitions Only)....QC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\crystal version\cro-3500-add.ttx..

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-3600.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 13, Total Editing Time: 41:36, Last Saved Time/Date: Thu Apr 15 16:13:59 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):60416
                                                                        Entropy (8bit):5.20599462556192
                                                                        Encrypted:false
                                                                        SSDEEP:768:wTlmibYhxbQkQmhQ5NM9maf1iZxIHbWCjnH1I6nd6NbqnQF:glmiU0kQmsMRTLVSM
                                                                        MD5:9E7D6F992148FC5550D5DEA0932E7F24
                                                                        SHA1:EBA62B123B5CA75C49DC41FE142BF5589E88C2A8
                                                                        SHA-256:C09556C17C14E2286977FFB12BE987425EEE0803D607D7446057B55620A2F9D3
                                                                        SHA-512:F8B0EA0B0AFE0125E3662C5FF2145F0A25348FD0F8051E010ED7527AB3BA6AC47FF3207281340E73B47644DE3725C040BF2DADCC506C61DBD32AB1FF31F0E66D
                                                                        Malicious:false
                                                                        Preview:......................>.......................Q...........N...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .8..........................................................................F.......G.".....G."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.0........................................................................F.......G

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-3700.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 16, Total Editing Time: 01:16:19, Last Saved Time/Date: Thu Apr 15 16:14:26 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):59904
                                                                        Entropy (8bit):5.201214682908714
                                                                        Encrypted:false
                                                                        SSDEEP:768:Mm80tYhxbQkQmhQ5NM9maf1iZxIHbWCInu+lnxhvnK:M5020kQmsMRT2hj
                                                                        MD5:AA8902D4CD33C667E28AE4BB9A6CADE1
                                                                        SHA1:334D99391F65F36D54A444DAFC31572766E66039
                                                                        SHA-256:ED8FDE84B287084F0C961C7198ADAEEA4024DDB69A6613B893E0A3AF160A10EA
                                                                        SHA-512:1503E493ED48ED1132A7B3001CC7CB15AEB1F553C14163355A7529285393495C464325EC0EB9EE0D1E313C1B8B7573D7022838B301BD3865B443764EC6C241BB
                                                                        Malicious:false
                                                                        Preview:......................>.......................P...........M...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.0........................................................................F......\W."....\W."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.2........................................................................F......W

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-3800.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 16, Total Editing Time: 55:25, Last Saved Time/Date: Thu Apr 15 16:08:54 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):64512
                                                                        Entropy (8bit):5.222279462324983
                                                                        Encrypted:false
                                                                        SSDEEP:768:3QvYhxbQkQmhQ5NM9maf1iZxIHbWCLnWnJ8nOvuquin:3r0kQmsMRTDWn8sak
                                                                        MD5:881CE3142335B809B9C88D3BAF0F1AC5
                                                                        SHA1:54316525510D401A686BA152A69E658C74F73481
                                                                        SHA-256:373BA0BB70D83F47E9F15967318379C42FC4FCDA8C1FF8CD3F7EE4AF47DBF6B7
                                                                        SHA-512:6F3C6088109D4FE2331A0DDC5A23B4894D0A9709209B042934794CAF72C05FC79187407D199476D7DD5BBABC2D95834097F194BAD3FCC8A211EF9F1B76C8AB14
                                                                        Malicious:false
                                                                        Preview:......................>.......................Y...........V...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.1........................................................................F........."......."................O.l.e............................................................................................................. .............O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.3........................................................................F........

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-4000.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Wed Jul 23 21:08:46 2003, Create Time/Date: Tue Mar 18 18:48:23 2003, Last Saved Time/Date: Wed Sep 29 16:09:05 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):160055
                                                                        Entropy (8bit):5.274194490059007
                                                                        Encrypted:false
                                                                        SSDEEP:1536:LXM5UzLaFCbFD8UlI7wLS4s63a2EPo5FGyy:LXMiLaEbFD8UlI7wLS4s62
                                                                        MD5:37EB610A634C1DDFC81FFB4990591935
                                                                        SHA1:84E81DAED249A25AA2AEB41F15B57DE8867CC93C
                                                                        SHA-256:5D15551981C1099F202823541E981A577372E458BA345752B9B3B0E0E0E2D059
                                                                        SHA-512:72DCAA38E5BA795C56F2E5076064BCD683570FBC8ED4DBA83E88CFEC04AD7B30DBA6A78D7D92F8B8AC16BC5671E0D4359D1AEC1500CEC29D99EF68EAD158C17D
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................g........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...............................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-4010.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: programmer, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Mon Mar 8 13:36:18 2004, Create Time/Date: Tue Mar 25 14:52:47 2003, Last Saved Time/Date: Wed Sep 29 17:55:29 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):143872
                                                                        Entropy (8bit):4.929485413721053
                                                                        Encrypted:false
                                                                        SSDEEP:3072:/im9jlbEsrtvnwTDCI/dIj8yI5Fik6ulE69OsccKy5:
                                                                        MD5:4B55DAB27519155A12B873F1D7D44498
                                                                        SHA1:8B9BE194A8DAAECAD472660DB008326326A1C63B
                                                                        SHA-256:87BC25D6D57B23CE6CA2E6DB3E7FAB777FA5DE415B7347723EDBA7BF7FA43ED6
                                                                        SHA-512:F66495BD44022833DE875DC3788E45CED74D595A8099EB2938B6D2BD2B15DE156FD20557991E946D0CC17D14050A583E7AA3AEF823469C4BAFB805386069431B
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................Q.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-4100.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 16 15:54:41 2003, Create Time/Date: Tue Mar 18 18:48:47 2003, Last Saved Time/Date: Wed Sep 29 17:56:45 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):145920
                                                                        Entropy (8bit):4.9925301432159035
                                                                        Encrypted:false
                                                                        SSDEEP:1536:wHgr56AinkrRcycDCTCQd4iNbBm5+q+zG2F:wHc6AinkrRcycDCTCQd4iNbEN2F
                                                                        MD5:FC038A5D0FD1B115F67ABE16A2B997EE
                                                                        SHA1:F385AC3E5FBD3C5C7E463EA55714797FBA3D3FC1
                                                                        SHA-256:B4E8D00C75260301D54369D88E0EEEEF0D83FD4FB7D8D845D927738453497CD6
                                                                        SHA-512:85F600ABC3EFB7D782396F347F3CB8F723FCE58671002D75E769714387C7D0E35F456DE32FE5F1DCBA271F4E6780A6E8C64F922EAA884D0D5DE77965FA638DE4
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................m...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-4110.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: programmer, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 3 14:49:58 2003, Create Time/Date: Tue Mar 25 14:35:37 2003, Last Saved Time/Date: Wed Sep 29 18:00:44 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):109056
                                                                        Entropy (8bit):4.763335759409982
                                                                        Encrypted:false
                                                                        SSDEEP:768:xnbQqAqLbqr/Su9ySWOQLISXQv+ZN5Zxftt/LIEKjGn:txgLD9yNqSf5ZxV6EKj4
                                                                        MD5:65F9BEB9749339F9E44355A5C809AD4B
                                                                        SHA1:C9F242F2C6E3361F1ECB802984059CD7C911992C
                                                                        SHA-256:B4D9FCAE9C80A489BB0070B090F924B7B21DFAB7ECF45D06C8998287CB1082E3
                                                                        SHA-512:9CF7CEB35B63CBA41C3F3EB0C9104D82729531D9426BB8A27536F594CD96A690D4B05C3029A1A7021D417591475E7A8DA5BFA713E53438122A3738D0858CF39D
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................eld Definitions Only)....RD:\DEV\CR Code\Remote Filing App\Version 2004\CF_Remote\reports\2002\cro-4110.ttx..........cro-4110.ttx.............................................................0.........................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-4200.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Mon Mar 8 13:38:49 2004, Create Time/Date: Tue Mar 18 18:49:06 2003, Last Saved Time/Date: Wed Sep 29 18:02:28 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):156017
                                                                        Entropy (8bit):5.153834479799729
                                                                        Encrypted:false
                                                                        SSDEEP:768:R997ilTTQnZqWBCtvOL1HuQL3psNw8I7e+8xiZJSSZJTLenAjM:1fnUd8H0wt7pvLQqM
                                                                        MD5:85D19DDF6412ADC30E4582B09B12C81D
                                                                        SHA1:2A9E3E70365EDD7E63AF98CC928B1861AF149334
                                                                        SHA-256:0D4EA12E2607E86CC5C7F1052832331678005D9E8A64C818BF4D9BF2E131A71B
                                                                        SHA-512:2A8A070AD593871890BCF825836AF861F5CD6371C832B406E456F5B35D524E85D27DF5E7B4DA90998BFC890068D79252A353CE98AA3660E8E35FA405227250AA
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................A...............................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.........................................................#...%...........................................B...........T.h.i.s.W.o.r.k.b.o.o.k.................................................&...........................................2..........._.V.B.A._.P.R.O.J.E.C.T.................................................................................................`.......E.m.b.e.d.d.i.n.g. .2.1.....................................................(..................F.....(

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-5200.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 4.10, Code page: 1252, Title: Media Complaint, Author: CRO, Template: Normal.dot, Last Saved By: programmer, Revision Number: 4, Name of Creating Application: Microsoft Word 9.0, Total Editing Time: 39:00, Last Printed: Mon Feb 11 16:23:00 2002, Create Time/Date: Mon Feb 11 14:32:00 2002, Last Saved Time/Date: Mon Feb 11 16:23:00 2002, Number of Pages: 1, Number of Words: 121, Number of Characters: 694, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):77312
                                                                        Entropy (8bit):5.1864279109289395
                                                                        Encrypted:false
                                                                        SSDEEP:768:WvRwuJIBchkLEFbzOew7A6irPH9Y2ZVwCFgDv6FoYsHSb:W4BA2SLpzj
                                                                        MD5:46278C5B8F40632A170C005DA9D59E16
                                                                        SHA1:3FF09C3EA468C6DDEAA8B70E780C1C23987A4B9C
                                                                        SHA-256:50D66013ADAEEC5730A46ADB656C69CE53CBA22AC905D6939198ABCD56E6190D
                                                                        SHA-512:12E5C6A70A0001AF370D1A82F8931E9F4F1CCD8728C3A7BB67F6D80E8247BCB5272D2C2C2A316D9C7A2C11125A3D747C2B2C0BC2B9895E58B772820A1C0D8B7B
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................c...............................................................................................................................................................................................................................................................................................................................................................................................................................................S.a.v.e.d.R.e.c.o.r.d.s.S.t.r.e.a.m. .3.4.l.........................................................................>...........R.e.p.o.r.t.P.a.r.a.m.e.t.e.r.s.S.t.r.e.a.m. .0.l...............4...................................................l...H.......A.n.a.l.y.s.i.s.G.r.i.d.s.S.t.r.e.a.m. .3.5.l...................0...................................................n...........V.i.e.w.I.n.f.o.r.m.a.t.i.o.n.S.t.r.e.a.m. .0.l.................2.......................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-6000.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 16, Total Editing Time: 01:19:16, Last Saved Time/Date: Thu Apr 15 16:15:03 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):90112
                                                                        Entropy (8bit):5.462546839098408
                                                                        Encrypted:false
                                                                        SSDEEP:768:+nYhxbQkQmhQ5NM9maf1iZxIHbWCc+nBn3IP3r8anGFfti:J0kQmsMRTNNMek
                                                                        MD5:3250FC4FD11C15C54822054C28780B01
                                                                        SHA1:215184E6327FE1AC1D273BADCCED85E782923AD9
                                                                        SHA-256:1E7672885014E6B7C146889E2220D70D08901E7C49208B651DD234936AB2A544
                                                                        SHA-512:4F73F3CF649EFCA18472C01B431646327F69DE1F5048427471344041BE5A721AE505A9B544BCA1DD1D9616EB098FA0DC1299C1652691AE217F5FFE9FA6CE69A7
                                                                        Malicious:false
                                                                        Preview:......................>.......................R...........N...................Z...............................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.2........................................................................F.....>lm."...>lm."................O.l.e.............................................................................................................2.............O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.4........................................................................F....`=.m

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-6100.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 19, Total Editing Time: 01:29:13, Last Saved Time/Date: Thu Apr 15 16:35:31 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):46080
                                                                        Entropy (8bit):5.043756431144704
                                                                        Encrypted:false
                                                                        SSDEEP:384:7VOicAD99Eq1HqIbOqWLgBe5lnq+jJqa+k9OdV9d:B9hD99CISbgBon
                                                                        MD5:26D7904E98C4826EC8C737C66BDCBC12
                                                                        SHA1:7CA4829A3E5F1BBFEDA5E3AEFBC156C39874DA4E
                                                                        SHA-256:8C347894CA7949613D31E39D033063A1AF4CF3FE757333C4F1BE2579CF920473
                                                                        SHA-512:F1B514950453EA4F92BC5103E0138A23ED6354780A4D29DE127A0E6056C888C320E248B1E2126013271BBC844D0DA8A20E84AD8E9BF757F5B36F75743C552E8B
                                                                        Malicious:false
                                                                        Preview:......................>.......................4...........1...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.3........................................................................F......I."....I."................O.l.e.............................................................................................................&.............O.l.e.P.r.e.s.0.0.0...................................................................................................l.......E.m.b.e.d.d.i.n.g. .1.2........................................................................F.....8.I

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-6200.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 21, Total Editing Time: 01:30:00, Last Saved Time/Date: Thu Apr 15 16:16:31 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):30720
                                                                        Entropy (8bit):5.045260314109269
                                                                        Encrypted:false
                                                                        SSDEEP:192:tL7OOnPkQ0hIdHb5xjvNOJMHCdrx38bW/9sn0A/qmDSAmeCDtF2MjTDIRzDwOaUe:tfOEB7n0tPRjTDJxUe8U5Ba2EBnUU
                                                                        MD5:452A7EB0E5D50CCA95CD8005C00F58B6
                                                                        SHA1:D28E656B06ED04270698665896266CED2D8864B2
                                                                        SHA-256:E9B38C68D490F2CDA0F40BBD13DCEFDB49E20954704AEBE1111068C97ECFBBB3
                                                                        SHA-512:3078578BC5CBA6866B27E0D8B4B63818D5A776867BD36859AE50B1D78EAED6EE45D68BC1D8FE2B7A12304E04977E53B30A5425409144293DA1FFF93969C2DF27
                                                                        Malicious:false
                                                                        Preview:......................>......................."...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.4........................................................................F.....*.."...*.."................O.l.e.............................................................................................................".............O.l.e.P.r.e.s.0.0.0...................................................................................................n.......E.m.b.e.d.d.i.n.g. .1.3........................................................................F........

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-6300.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 22, Total Editing Time: 01:42:27, Last Saved Time/Date: Thu Apr 15 16:17:09 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):261632
                                                                        Entropy (8bit):1.9491111808148631
                                                                        Encrypted:false
                                                                        SSDEEP:384:/meSOY8bNrkn5G4LLHPI7AroarCIC7eVl5nnm3PVbWkPTf:umkn5vnHoADnncPZ
                                                                        MD5:2BDAB01E7B8095BB8FDEBE7AF3926965
                                                                        SHA1:BA9DEB25822C3E374CC2B2E07FE661F4E9502282
                                                                        SHA-256:34B8F59F480FCAF32C09E1B8427FAF5E0CF80DC39918B8E1BBF0DAE220B9B386
                                                                        SHA-512:7D00C4F622E969B22416AD3C2C5C7A768CD3D95E61109DA061FACD98F7BBD43AA5EE0CA7C600F2FF7B26201ED341187F2DE4C7E2A587ACE2AE1458978F89022C
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.5........................................................................F......r.."....r.."................O.l.e.............................................................................................................#.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .1.6........................................................................F........

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\2007_Electioneering_Report.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Oct 15 14:21:07 2010, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Mon Feb 14 13:42:12 2011, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):607232
                                                                        Entropy (8bit):5.407342130384767
                                                                        Encrypted:false
                                                                        SSDEEP:6144:DPJo8DExbYmh3gZ+RwPONXoRjDhIcp0fDlavx+W/WEjGSZ+RwPONXoRjDhIcp0fe:DPJo8DExbuG6GA0
                                                                        MD5:B54AEDB3AEEA8EDEF964AB865229C237
                                                                        SHA1:D4037247E61D6ECE36F3534F38427E3F59B8B9B2
                                                                        SHA-256:9E3BC47402EFBF6F9E1217D2353B4ED2D633E4E0B889A8A14C4D1A2A5F48A67E
                                                                        SHA-512:99842D7DAFEB366E76004A6B5306ECCF6EC9AC92E76782F12B94DA6C37EE3552522DA3CE7B1381686B44BA210785959949AB0B2D363D2282F27E2906821C2B2D
                                                                        Malicious:false
                                                                        Preview:......................>.......................d.......................................}...\...[...Z...f.......o.................................................................................................................................................................................................................................................................................................................................................................................................................C.o.m.p.O.b.j.....................................................................................................~...r.........O.l.e.P.r.e.s.0.0.0...................................................................................................l ......S.u.b.d.o.c.u.m.e.n.t. .5.5.............................................@..............................:......:...............C.o.n.t.e.n.t.s.........................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\2007_FED_Disclosure.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Oct 16 21:17:12 2007, Create Time/Date: Tue Mar 18 18:48:47 2003, Last Saved Time/Date: Mon Oct 22 19:28:02 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):625664
                                                                        Entropy (8bit):4.950657383336972
                                                                        Encrypted:false
                                                                        SSDEEP:3072:TQrFH2RZraHzLWTkjqEMONv9tKAd0oNhzwcAS66emLo4cOfpkcUd3MDwC6SaHfs5:TmqHeuZgz+OSXG/inxkDo
                                                                        MD5:740F31D396DCEF3D05BDED7BD483AFB1
                                                                        SHA1:F8F66D67B56C7033DEB75E51521F5A447AD34996
                                                                        SHA-256:FBED39F9C33EB26E82A9C20B6F90DE125D74D8168E596CD3D40D00ED7998CAB8
                                                                        SHA-512:7F4E86B98968760E6E7DF03FF65E4BDF99B961FB3768C7DB49DA5796302D6F711C3CAB22733FB2B20F84F9222F33E6B849BD6AABE51AB574954A34DC50E9C57A
                                                                        Malicious:false
                                                                        Preview:......................>...............................................................c.......~...............h...............................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.3.5.......................................................3...5...........................................|...:.......T.h.i.s.W.o.r.k.b.o.o.k.................................................6...........................................l..........._.V.B.A._.P.R.O.J.E.C.T.............................................................................................>...O.......S.u.b.d.o.c.u.m.e.n.t. .6.8.................................................:...........................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\2007_Independent_Expenditure_Report.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 77, Total Editing Time: 03:30:42, Last Saved Time/Date: Tue Feb 15 18:26:50 2011, Create Time/Date: Mon Mar 22 15:03:08 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):488448
                                                                        Entropy (8bit):5.4462079439186635
                                                                        Encrypted:false
                                                                        SSDEEP:3072:dH3+Wiq7/cnF9G6Hlx/6uGUZdle9R/R1f4qzta896JboUEednkO8X7W:0rG6nSaZHQ4qJa896GsnkZ
                                                                        MD5:7AC4C6D7C7069B28B2EB439657BA0494
                                                                        SHA1:992D6D9DB36178139DBA882992E2D7ED9C175592
                                                                        SHA-256:87046ECB5B9DE39287DFDA261139352FAF81E8CF6A37FDF964A20BD9616FE732
                                                                        SHA-512:9716FC62672228B374FB537C8B02621DFAB592A2E8D757A474E001AF154214D1424A5AD9D1BFF70D77862F1F3BC4F681CF4B56DCA388E30B71809915BE0AD2BE
                                                                        Malicious:false
                                                                        Preview:......................>...............................................................................q.........................................................................................................................................................................................................................................................................................................................................................................................................................C.o.m.p.O.b.j.....................................................................................................D...r.........O.l.e.P.r.e.s.0.0.0...................................................................................................dB......S.u.b.d.o.c.u.m.e.n.t. .5............................................................................`..=....`..=...............C.o.n.t.e.n.t.s.........................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\2007_Muni_Voter-Owned_Election_Qualify_Report.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:51:41 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Wed Apr 29 22:15:36 2009, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):192512
                                                                        Entropy (8bit):5.007944223673486
                                                                        Encrypted:false
                                                                        SSDEEP:1536:RktWZ7Ut5HHsDYP8my+MXHwKY0/abtfiYIiVSfaSfV:r45HHsDSMXHwKY0/JtF
                                                                        MD5:A7F2BE0A9C76BEC9C49EB1373D5090D4
                                                                        SHA1:7369379F50FC341D466CC8A2B28EEDB854AB8C64
                                                                        SHA-256:FAA0526CA53536BEB1316741D680356DC81479982B2250C8798D0E6F91FD896E
                                                                        SHA-512:05AD1783BD4A2EE920C335CF2AB392C9DB856F15DA13EE7C509F59DB44900B17E93C901A862C540D6267CC75E322989D1C852F661D4E7BE2135D350DBC935EAE
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................V...........S.u.b.d.o.c.u.m.e.n.t. .6.2.................................................!...................................................C.o.n.t.e.n.t.s.........................................................#...............................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\2007_NC_Disclosure.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 12 20:34:40 2007, Create Time/Date: Tue Mar 18 18:36:59 2003, Last Saved Time/Date: Wed Dec 19 20:19:48 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):4794368
                                                                        Entropy (8bit):5.157456740228194
                                                                        Encrypted:false
                                                                        SSDEEP:12288:m9v/Mkrk2keuK63GyEhFKT8Y6IOm8XqQEJj+8fZvR7S/z0Ie2tXK:m98GyR6NKSLt6
                                                                        MD5:544DA1BE09475C44146130A8FCB9B3BE
                                                                        SHA1:4513DFA718004166D674C9E6573FBBAF9C186B70
                                                                        SHA-256:09A127F8DD521F7E1D029B922EA63CB1BD6C75BFF74025C78758500DB481320D
                                                                        SHA-512:3DCC434E59EEFA896DBC4BDC97E13D06A4757804BB8EA04F17F7EEA86DB6B5F6C31E1C94867C177A4E84B4756A66678D93F54D4AC2126AFF42B24ED49504D95E
                                                                        Malicious:false
                                                                        Preview:......................>...................J...[#..............f...............Y...........2...........................).......v...........t.......................!.......S...........................P...|...~...1...2...............M ..O ..............w..."...{...........v.......x.......z...y...............{.../.......}.......: ..K.......F...4....!...!..."..]#...#..U...............................................................................................................................................S.h.e.e.t.3.5.......................................................3...5...............................................A.......T.h.i.s.W.o.r.k.b.o.o.k.................................................6......................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................X...O.......S.u.b.d.o.c.u.m.e.n.t. .3.7.7................................... ...........:.......................P<d.

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\2007_Voter-Owned_Election_Qualify_Report.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:51:41 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Wed Apr 29 22:15:36 2009, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):188416
                                                                        Entropy (8bit):5.010132586463127
                                                                        Encrypted:false
                                                                        SSDEEP:1536:OO5mMgUei51+DbPc4MIwMXHwKY0/mbtPVYI9cSfaSfJ:ATi51+DanMXHwKY0/C3F
                                                                        MD5:A4F078FF359ADA243E48087C2CF00052
                                                                        SHA1:5E12458C8146DD365637A89B5B21930E48C108B2
                                                                        SHA-256:861FE0412A7C7BDBC203F4C8E70959F03DF97949DAD70E725CCD6B193E972A48
                                                                        SHA-512:250DF78987D7DCC9CD13B17EC00CA67AE5AE23FF0356F7D9096C9F948CEDB1EB334E818BEC3B3E945A5A6F575EDAF7EB42CD3FC2072F043B0797C6B0EAED6499
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.3.5...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................V..._.......S.u.b.d.o.c.u.m.e.n.t. .5.5.............................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1000.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Sep 29 22:25:01 2008, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Tue Sep 30 17:11:16 2008, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):277199
                                                                        Entropy (8bit):4.955204919765509
                                                                        Encrypted:false
                                                                        SSDEEP:3072:A83b1ABghpv/5/vR6xyPk3kHgC6tgd9bA3wOsWU7YoWIGLtXqSEB6Wrp9RdrW+Z+:AQABghpv/5/vR6xyPk3kj8fZvRwY
                                                                        MD5:C1C49AEF91B5BD6B09A0D16DE5B5A1A8
                                                                        SHA1:3BCEAFC0D57E4806D853E5CAFBDF83C58D9AD543
                                                                        SHA-256:68F186EB404BB675258B7A37F436EF8CAE0CE0C99CE99A3E7405AD73014FC213
                                                                        SHA-512:1DAD02580762635B05900A44F272F64AC084EEB913B904B9BA69A44E56A116D92B6E73EF4E1A2495441D1D1F6E6678DAA584B1D07116F2BAE0F04A7C3A83AD1A
                                                                        Malicious:false
                                                                        Preview:......................>....................................................... .......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1010.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Dec 10 15:09:59 2007, Create Time/Date: Tue Mar 18 18:32:55 2003, Last Saved Time/Date: Wed Dec 19 19:22:20 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):115712
                                                                        Entropy (8bit):4.729959959151051
                                                                        Encrypted:false
                                                                        SSDEEP:1536:yYQlKGozYa7z986/yv/C/vABgvp5RhnJvq:yYQlKGozYa7z9byv/C/vABgvp5RhnJv
                                                                        MD5:6106AD996499E23B00951728597CCFA9
                                                                        SHA1:2A0925E3FA17D899BEACA18C7FDA025CFC23594E
                                                                        SHA-256:39165D6F20199D558C3DD18966B64523636C0C9ADA65C4A1BA3A4E8DB9999B61
                                                                        SHA-512:6AC84F98E24B1BAF384BDAA7B7DB12BA7B427E895FD1B81EB2B8902820E606227FEC837BB0C2C3519E94F12B16D6E5601FD1EC89235C28CE024CE3C6EE6D361D
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1100.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Wed Sep 24 18:58:40 2008, Create Time/Date: Tue Mar 18 18:33:40 2003, Last Saved Time/Date: Wed Oct 8 17:43:19 2008, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):179642
                                                                        Entropy (8bit):5.166216624571424
                                                                        Encrypted:false
                                                                        SSDEEP:768:/pwcx63BOdZ8FNq+cqbVozkajO32K9E9vjwWR9OqQHuqXhoOunwXyRZL7W:6cx/dqFNEqhoA3XwvAF6xnwiRxW
                                                                        MD5:62F7E5138E3377191BA9809FD25E3052
                                                                        SHA1:AA896EECBB096365E52FC60D1D971EDCE8C45D73
                                                                        SHA-256:27BE3E35FBDED425853F321AA82115B85D4E9D03BDA9986F58ED78D174AE3259
                                                                        SHA-512:D015AE587566DDB0520C47021684C3F1B373B3A9647445F937B60A6BF1175A22DF4BF41E35CB140999BB58BEAF33D627589F3755AFB84FD04408407EEDE251BE
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................k........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...%.......&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...].......................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1205.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 12 20:37:09 2007, Create Time/Date: Wed Mar 19 14:57:07 2003, Last Saved Time/Date: Mon Oct 22 14:25:42 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):182784
                                                                        Entropy (8bit):4.952399645110275
                                                                        Encrypted:false
                                                                        SSDEEP:3072:TXrzxidmGZKpR/V1Z2gnM815Usm8oPKcz4JyKYFf4XgQLtIyumEk/np0aVfUOBGW:5SkIDk6Fk
                                                                        MD5:D4132237EB41C001172379B0CFBD2716
                                                                        SHA1:F650B72162CFE3C41FBC3BB060A1F7A61025E922
                                                                        SHA-256:B639182A4F1DD0297405DB3123413041F130C8358545AEBB8346132FEC5FBE1C
                                                                        SHA-512:4027D8DD1303EB2A2BF0274F4D62AA38553B2C2520F448BDCA49B0B84DB5E4CD80A5BC172E2FB77EEC0F6B47BFC3E24BD056EDA5154B5D6FCFC04030F40CB26D
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................n...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1210.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 12 20:08:58 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Mon Oct 22 14:29:10 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):185201
                                                                        Entropy (8bit):5.240949811968868
                                                                        Encrypted:false
                                                                        SSDEEP:3072:lZ4aXxE0IeiZAqCfBFANfkF/CamYMfXFpAaZ5mSAAmTvC8s7GopsOG+8F/I:a
                                                                        MD5:CDDFB8A098D01B326568A8934542E6FD
                                                                        SHA1:810056460BCD69778469E80499B1B8A5ABF10689
                                                                        SHA-256:23EFA47355AC238926FDD2F156959CB828F3B56F233B32B6191E590620D845DF
                                                                        SHA-512:17F5AAAB78AD19DA3B44260E3142E928558C1C28BD30DC0357D2E841072BC88AE9ADC08C0479F7D14C79190A4EDA814FE81D8DDD4AA802B1A77BCEAFD60675DE
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...[.......\...]...^..._...`...a...b...c...d...e...f...g...h...........................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1215.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Jan 3 14:48:09 2008, Create Time/Date: Tue Mar 18 18:37:23 2003, Last Saved Time/Date: Thu Jan 3 14:48:33 2008, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):168448
                                                                        Entropy (8bit):5.202527529762482
                                                                        Encrypted:false
                                                                        SSDEEP:3072:6urIsxEywEw+001sKJY0yNnQiawtVanTTWukckYPSKjggF0M61LIiOIE1zeG9GXn:+yp3
                                                                        MD5:921173462DF6CC5BE5AA6E7F1C9F19D0
                                                                        SHA1:64A7090A11E0DED04E3F13AA70C0AED377DB0EDF
                                                                        SHA-256:CCF9CC5D1E823E08443BE7ADCD00B20B2975B694226DE83CE4D66F8A2E7F985B
                                                                        SHA-512:BBF4A1E7380D727BA46223032CBBB8FEAB208C08291DCF5C588F205628FEC74672EFA2A61A03B9EE302E02811245C1A335D2D3E2D5A29E47EA6D2270AB519BC3
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................H...[...........................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1220.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Apr 13 20:48:40 2007, Create Time/Date: Tue Mar 18 18:36:01 2003, Last Saved Time/Date: Mon Oct 22 14:45:49 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):150016
                                                                        Entropy (8bit):5.205596829097363
                                                                        Encrypted:false
                                                                        SSDEEP:1536:2W6NZmGBWou83Gngj6uPMzsWT3fki8oaKo/M4iTuRR:2W6NZmGBWoBGngj6uPMzxB8oaKo/M
                                                                        MD5:A088F0800E0E423C554231B891E59390
                                                                        SHA1:C345820606D84BB6529876F4F02D82C25DE22707
                                                                        SHA-256:C7AB5E1C7436A1A4C405A77975716247FB177B19AF52DD58E8275B68A524E3B9
                                                                        SHA-512:CE0D4E040DC1426274E2BC96CC3F997866EEE53E8A6CF8E77246E38E9C2D537A32FBC2190657667E047994DA39A0033F75D2ADFE9BA1A29881B40D1DDDF98882
                                                                        Malicious:false
                                                                        Preview:......................>.......................w...............................y...H...........................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1230.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 12 20:12:11 2007, Create Time/Date: Tue Mar 18 18:36:29 2003, Last Saved Time/Date: Mon Oct 22 14:51:19 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):206658
                                                                        Entropy (8bit):5.156970374644571
                                                                        Encrypted:false
                                                                        SSDEEP:3072:gMPxdYIMwBzRn3Y5LoGMicjtGTD8x/0LUdheW/zXni8yV5Gr920W8y8a50032gSs:EKhK
                                                                        MD5:B6C3CE1000718B8957385CAE877FAEE5
                                                                        SHA1:0725EA60150FBA6EC4D98719193AF6A7212B609C
                                                                        SHA-256:5D45D44FFDBEE1BDEAFD1082651EF382164B646F75C53720D0D37E1FEB9C1BEA
                                                                        SHA-512:0D29BBCF4DBBD8E1DB670D662BB3471E315DFA90DBF23D36E921B39F7A98E8A5DED836CD2E4AB643FEF9039D8F68A2D0C2EDF440967D494EFDF30E59EA29C0EB
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................S.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1240.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 12 20:34:40 2007, Create Time/Date: Tue Mar 18 18:36:59 2003, Last Saved Time/Date: Wed Dec 19 20:19:59 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):207407
                                                                        Entropy (8bit):5.130835054236678
                                                                        Encrypted:false
                                                                        SSDEEP:3072:6mmZR4NTY+fBFvgipoLoJtpu6ndNVE6JsjNNKuX4Nrr9fO0Ehz0tmlgkArzOQAI5:6b8tx
                                                                        MD5:83E657E047E43622F4BBCEAE2E3ED26C
                                                                        SHA1:6B57E3230F7EB72E477AEDB6E48414E756108C2B
                                                                        SHA-256:CBF8CC5001E9509BB035677C6106EF50B74AF9146FDBBD6CB1A2D273A59C7C93
                                                                        SHA-512:D6514F1D0BF39089B7DE336BFA0BAC1983E006373CFAC35BC8F03D6A656F8CE1A40499558F8289A1D0D1727C3D3662E9AA169ABE35E033C4DE814CAC37F8FD69
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................H.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1250.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Wed Dec 12 20:36:55 2007, Create Time/Date: Tue Mar 18 18:37:23 2003, Last Saved Time/Date: Wed Dec 19 20:23:26 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):165376
                                                                        Entropy (8bit):5.204630458042751
                                                                        Encrypted:false
                                                                        SSDEEP:3072:JQZ7yok/viUkLZqhZnQeGfJDLsPO46kG/B+:Ig
                                                                        MD5:6742E11F8276F6F9B4310F9A505922C6
                                                                        SHA1:B63BD30E24C7310953E5C93E24FD41E32E742902
                                                                        SHA-256:DF570C2774335D78B52FE6F814C2CC28EC7A550D779E1FBAC909BE924F319977
                                                                        SHA-512:76E07A69587EF15CF26071D0CE3FD7438182F779AEB85EDEEB8512EA81DFF949FBF6D49B1D83F5A7BD2F11C29C2686D5B01F75C7563E86D1971762CEACB5F75B
                                                                        Malicious:false
                                                                        Preview:......................>...........................................................U...........................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.................................................................................................7...................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1260.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 77, Total Editing Time: 13:19:08, Last Printed: Fri Nov 19 19:45:23 2004, Last Saved Time/Date: Fri Jan 21 14:19:25 2005, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):87552
                                                                        Entropy (8bit):5.292860622249849
                                                                        Encrypted:false
                                                                        SSDEEP:384:0IVAgpIDVV3pdY7J84+ZEHnUzmLmCnFJBPncQ5olvPmKgTQVbDpdTC0xIBpIlxyi:UBHpS64+ZEHn0CnVPncxcA
                                                                        MD5:D57ABF650F3A7C4ABAFE3A95464A576E
                                                                        SHA1:888CC2AB4F445D3C25F5030ABC91839D7A75F015
                                                                        SHA-256:4F11CC3F6D5DBA4EC2B1A05ABF3819BA081F21131B80F092F0E8A4EC0E8109A4
                                                                        SHA-512:C46831025A5856D9559A9EE045105931441F2EF813202FCA6DFD7E33D71CF63175103BAB94E4F0F07E98E66E21746B182C9F550942E3CECBCB655437FC48509C
                                                                        Malicious:false
                                                                        Preview:......................>.......................@...........0...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .3.2........................................................................F......5....`|.5..................O.l.e.............................................................................................................8.............O.l.e.P.r.e.s.0.0.0....................................................................................................:......E.m.b.e.d.d.i.n.g. .3.4........................................................................F.... ..5

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1265.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Oct 2 21:58:32 2008, Create Time/Date: Tue Mar 18 18:38:43 2003, Last Saved Time/Date: Tue Oct 7 22:00:07 2008, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):179200
                                                                        Entropy (8bit):4.971791860235385
                                                                        Encrypted:false
                                                                        SSDEEP:3072:8gDFkCHwgaAaIpyGreKLZOpjlbu9yz1LCAcZ/8z5tSZOcOtuA8YLahxbRvaZJSCf:8Qcjwf
                                                                        MD5:C39EC68DC1C973913E5680996790FE4D
                                                                        SHA1:D9EB6D942E3F5F7901D9242F8C63A0982090544F
                                                                        SHA-256:2F1987D27D8BF22DAAC561C2C7A078BCC9EAFA35414ED36C624A6E72A1FED69B
                                                                        SHA-512:B97B290FF58EF29C3A29282FFAE0E878A3232BA2F6EAF7368BB5A75643E32BB7BA6F3BD2F756AFF772CDAAB0434211F61C1E1AC8C92098A8810034CA872C5264
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................G...............................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.3.2.......................................................#...%...............................................Y.......T.h.i.s.W.o.r.k.b.o.o.k.................................................&......................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................U...y.......E.m.b.e.d.d.i.n.g. .3.4.............................................O......./... ..............F....`..y

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1270.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Nov 16 20:33:18 2009, Create Time/Date: Tue Mar 18 18:37:23 2003, Last Saved Time/Date: Mon Dec 21 15:58:40 2009, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):258048
                                                                        Entropy (8bit):4.950934717075591
                                                                        Encrypted:false
                                                                        SSDEEP:3072:1P1JR2biO95hFqzw8mFJjefgL/ezzrUt6rDTUVykn3T+sNdhKnJgHxXbyjQYmxFQ:Xu
                                                                        MD5:D46A8E06CF758CE784DAB6A346C18CC2
                                                                        SHA1:5FC8A9A21870F50138241F374A9EC4F81C308827
                                                                        SHA-256:EFB54DCAA6451E8820004655327485E7A9C76E57766819A3285B29536F0AD5B2
                                                                        SHA-512:1E2AC43866C5C3AB826955DAF76FEDD6C1DEACC48D208F28DF68E7DF46C7AF4D48A10F5298732B5AB8485F065F40542329C4CF93A77756E30E2325FFF01B49CE
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................r...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................l...............................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1305.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue May 8 15:48:55 2007, Create Time/Date: Wed Mar 19 14:57:07 2003, Last Saved Time/Date: Mon Oct 22 15:14:45 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):186880
                                                                        Entropy (8bit):4.934801965469349
                                                                        Encrypted:false
                                                                        SSDEEP:3072:o87jT9+1SaVWBR7VFlScnEQVJIwqccjmUr0tGCMhH0bgkbVci2REk7EXX6lHMqVX:oMjkDkPHk
                                                                        MD5:3C139956F2E1AAAC4FBA589907644095
                                                                        SHA1:E1E86F73DAEA1EDD3B5C1361DCEC1DD2A7B42697
                                                                        SHA-256:F1638B572DF258D7BB77E2F4DA6CF00B30DCCB40A5B43DBB82B251673DB41559
                                                                        SHA-512:139BEB1D1FAEFBDE2EBB39909102444BF87A5A64E8AAF1269C3B7AF930FF5413FC5ED33AFE346ED40C26C955BA98C7AE9862F8A121E7476983835BE2D994CB9B
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................n...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.................................................................................................\...................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1310.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Nov 17 16:11:09 2009, Create Time/Date: Tue Mar 18 18:39:02 2003, Last Saved Time/Date: Mon Dec 21 16:03:24 2009, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):253952
                                                                        Entropy (8bit):4.88787880649354
                                                                        Encrypted:false
                                                                        SSDEEP:3072:4OpY1fX4D+QYNyPyELBJ6s0HBp08DS/X/UMmoDX48jp+oUP1jRnx+Us/56AxRqm4:y02Zz
                                                                        MD5:BB8CEB43E879AFFC33789AB3A02C78FA
                                                                        SHA1:0C75F019D84546AF18C10B0CB4DA2F4F41D43DAA
                                                                        SHA-256:1A9EA3240F75F09A639DA23CADCB1523E6EA5C9D3E37DC3D1AEC8D309D29CE1C
                                                                        SHA-512:E64DA3919089C1F32CB9F53C7A1A0647D477D84AFE48621FE0318770DB17E324E6A782D50E85556F139D509D45A2EE1A7A7334C9E3E07A189A15B8FC9BCC9F1F
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................]..............................................................................................................................................................................................................................................................................................................................................................................................................................................._._.S.R.P._.3.......................................................+...-.......................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................u...........E.m.b.e.d.d.i.n.g. .5.1.............................................[.......7... ..............F.....T0.

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1315.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: Template, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Wed Dec 23 13:23:38 2009, Create Time/Date: Fri Sep 18 14:41:55 2009, Last Saved Time/Date: Wed Dec 23 13:29:52 2009, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):221696
                                                                        Entropy (8bit):4.852220976251422
                                                                        Encrypted:false
                                                                        SSDEEP:3072:lyx6XPLzL0eeyD3xPNkzv5OLJYFRydDaQTD6lo5wUixc2CwfVzkFt4htDDXPUK+8:cxPk0v
                                                                        MD5:F75B99D5796990BA2E531D625E00FB2E
                                                                        SHA1:4CC6F255FB99858909B7CF37476F3822678C0F6D
                                                                        SHA-256:DE6274B458ABB143F4832E93E7BE4D8C13044204ADB442A235D8DCA18A06C860
                                                                        SHA-512:EB71CE8F3641C01551EB9AD28D6B746028D8A5786F3C055C9C7F6106318E0A10572C8A902AB080AE39EA8E33DAFA03AC55383039E05179B66271172D0AF8EA10
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................r...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1320.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jul 6 16:30:49 2007, Create Time/Date: Tue Mar 18 18:39:25 2003, Last Saved Time/Date: Mon Oct 22 15:23:52 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):209920
                                                                        Entropy (8bit):5.072464260495382
                                                                        Encrypted:false
                                                                        SSDEEP:3072:HLIBwkq9NAIoSzQ0S7SIZGBRA4R7BnRMbp9Rt7rG6+sdoaSYt9awFUYBaNERBAQU:r8t
                                                                        MD5:2FBD7AAF164C869883BEC2BCA05010A7
                                                                        SHA1:FE725E820949A2C5D065ECFE0DFA0E8AE7A69F5B
                                                                        SHA-256:3DDEDB67316FE565FFAD865ED2D6DD574C3D6AA230A35E20C7E1C01344C8E0F1
                                                                        SHA-512:7AB12BBC73486ABFB52D94C147B70981B90271609AAFE45BD25535F28B2A53179A389670758640D839A3A8EC67E6A615599008251887E3C9BFEF71AC13E421C9
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................I.......l.......................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1330.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Dec 10 15:31:24 2007, Create Time/Date: Tue Mar 18 18:39:46 2003, Last Saved Time/Date: Thu Dec 20 12:45:54 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):225792
                                                                        Entropy (8bit):4.958937507406109
                                                                        Encrypted:false
                                                                        SSDEEP:3072:HlrC1rCMbggED9nSChJ5BGPIrjTG2ldhg4Z0TlLFhd7pq753VLW3wLEdZGGS+F0y:UxV
                                                                        MD5:CD5E5B4E39ECA860862276250E7F25D2
                                                                        SHA1:531B5ABB29CEA928C9CCD01B0C721AA0188F342E
                                                                        SHA-256:908A0E47CF765F28A66ED79EC769792FA715CBBD3861EBAD833CFCE93375FCA6
                                                                        SHA-512:E9A2AFFB0DC8ACD871E13E777CD09A5C9E4BB912252AFC4AB4EF40E088536E5DFE54CE4DEDDF5BEB8B1ABC64CDB221BDF3F96DED417B191038EAA22184848B7E
                                                                        Malicious:false
                                                                        Preview:......................>...................................................W...Y...............................................................................................................................................................................................................................................................................................................................................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k.................................................9......................................................._.V.B.A._.P.R.O.J.E.C.T.................................................................................................q.......E.m.b.e.d.d.i.n.g. .5.0.............................................p.......J... ..............F....P.D..C...E..C................O.l.e.................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1410.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Apr 13 21:15:00 2007, Create Time/Date: Tue Mar 18 18:40:06 2003, Last Saved Time/Date: Mon Oct 22 15:34:20 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):149504
                                                                        Entropy (8bit):5.15953513117498
                                                                        Encrypted:false
                                                                        SSDEEP:768:Ycv3JYOB0T8OEpgwJmvmEGcDKCwaEzJGmG1OnS6fJwaEPz54:YiO8OEp30vOcDKtPVGmGInS6fWPPC
                                                                        MD5:4C745F24AB6AD29C007BBCC4ACBD0192
                                                                        SHA1:5A40DFC1CE95AAFD3869E55A91250239A35A2944
                                                                        SHA-256:DBB69B1CCE9B73FAD9CE55FF4E340131AA3DFCCA7C641551E5CF6FCD586CD4EF
                                                                        SHA-512:9001287CF61BFDFF81B20F6864FAAA3A2EC7DA7D278D411130CE1C89086E38DE643FB9D402C09D3B203009E181B57013D6A9A3FC13C213DFE19DB0D653C09B4B
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1420.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Dec 10 15:45:28 2007, Create Time/Date: Tue Mar 18 18:40:26 2003, Last Saved Time/Date: Thu Dec 20 12:49:10 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):146432
                                                                        Entropy (8bit):5.063673625152432
                                                                        Encrypted:false
                                                                        SSDEEP:1536:BGf37BCzwSJ43KyN3DEXrz4wn7KKgKLli1+49:Af37BCzwSWKyN3DEXfn7KKgKLli4
                                                                        MD5:16E2E8C47A83FA4CBA0EF9969DD3EAEA
                                                                        SHA1:7B9CF6EB74205A42A27166F24347F17433AAE122
                                                                        SHA-256:30D816129634F858170327E77DDD28C02F631FE76EAC00D28434CA167E635C57
                                                                        SHA-512:046C63E6135EC52EEEDA975A69BC159E004A5EF58D6729C6766E28AD56B5599AA5F3495F8AA0B9ACBC13D523B1F71B9DC0CD7F5A828DE1069879206A4287DE33
                                                                        Malicious:false
                                                                        Preview:......................>.......................{...............................}...J...........................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1430.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 11 21:22:12 2007, Create Time/Date: Tue Mar 18 18:40:48 2003, Last Saved Time/Date: Thu Dec 20 12:51:53 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):143872
                                                                        Entropy (8bit):5.048937898720221
                                                                        Encrypted:false
                                                                        SSDEEP:3072:SEgHKAt1aapBgC9y3Nu/2eX76vUbBKYe/CTLlm1:SEgHKAt1aa1/HKF
                                                                        MD5:37BF265114AC548A613E0F811A4E14AA
                                                                        SHA1:7EEBD6C38835BC0E2561D3CCBFD0682E5C125889
                                                                        SHA-256:27ED2A6B9FE0961396D609EC771E13FB96AE8771BDD125AB45B0849224CA9A91
                                                                        SHA-512:D9C9F8EE1C66C2255C9A03057FA29563791A4309E6B299D91B83190EC06F173247DC2B6883C4C403AEA20C75774D567F7D1D07D09A4398FBDD2069CC6CD744BC
                                                                        Malicious:false
                                                                        Preview:......................>.......................x...............................}..............................................................................................................................................................................................................................................................................................................................................................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................U...........E.m.b.e.d.d.i.n.g. .5.8.............................................5.......!... ..............F.....hO.C...hO.C................O.l.e.........................................................................................................................C.t.l.s................................................................. ...............................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1440.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: sboetest, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 11 20:56:44 2007, Create Time/Date: Fri Apr 4 21:28:15 2003, Last Saved Time/Date: Thu Dec 20 12:55:10 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):131072
                                                                        Entropy (8bit):5.157600548856342
                                                                        Encrypted:false
                                                                        SSDEEP:768:2AuLeepR5sEeSGQk9dq7WEbZFFeQkhwX06timb2/WxDjVaj6gKQk2nuKQ:2AqbsEeEPbZFdYS0K2/Wx/Vaj6m7a
                                                                        MD5:1AB6467BB94BFA8E94830B2C7857ECEE
                                                                        SHA1:D0571B1EEEA6411F837FBF725F2365A8C52F022F
                                                                        SHA-256:14F8DEB2F3CA26B3B5890CA042D3BAE02080A105789EB05504DFE0B956285ABF
                                                                        SHA-512:FEDC72819025644B7CEBC93C1AF7008E2F4E05C5ECFDF2E62947705CD0B7F8CBF13C33CD27BBC68A50DFDE27AE08514D0E62125EBFD02BB9ED1A22C8FF76326D
                                                                        Malicious:false
                                                                        Preview:......................>.......................o...............................r...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1510.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Dec 10 15:57:10 2007, Create Time/Date: Tue Mar 18 18:41:35 2003, Last Saved Time/Date: Thu Dec 20 13:08:22 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):196608
                                                                        Entropy (8bit):5.043187868752451
                                                                        Encrypted:false
                                                                        SSDEEP:3072:OFoAmv0dDkBDZ5DolqUzTHvUmq7qAap18NCXxrJftxOqfUCfOWenNZwUq73aRYdH:0x7wkZ
                                                                        MD5:B3A51CE1A4426170A893BD555B37F02E
                                                                        SHA1:863DF9EB5D3CEBE077CBF887656E86B7E4D73397
                                                                        SHA-256:0924764EAABC8A2D479EB9DA07A9B03780F3382C8DE6B72BE6DFFFF346607A34
                                                                        SHA-512:D9A1FB8C6362B17494574D9C718C931FE7DEA85CD0420180B0A48196AF1568E6CCD9013D1E03339AA0E2D903EC57555314105B1EEAE5F4447707D6CB9EEE94D0
                                                                        Malicious:false
                                                                        Preview:......................>...................................................M...N...............................................................................................................................................................................................................................................................................................................................................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k.................................................-......................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................s...........E.m.b.e.d.d.i.n.g. .6.0.............................................X.......>... ..............F.... ..D.d.....D.d................O.l.e.................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1610.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 116, Total Editing Time: 1d+04:18:33, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 5 12:05:46 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):334424
                                                                        Entropy (8bit):5.342674465414266
                                                                        Encrypted:false
                                                                        SSDEEP:1536:7jO3+tEK0cDamfB2LkNBn0FVs3J0E43q0cmfB2LkNBn0ICGcLI4DMHdjuTEzrIIw:G32EKF6VEJ0EtKCGH9jGEz0IeSdq
                                                                        MD5:F17BF9315C6397B804496247421E8E24
                                                                        SHA1:3DF470B8684DAC414FF7D6AF3175AA35A14B84DC
                                                                        SHA-256:98605AEE454F9557B227622FB414270301E4F63B79947D766129DCE16CD17E66
                                                                        SHA-512:B45CACD79F16664A2923635F70083130AA9C6637B6A1AAACE52670DCE21D28064C682CDC751BBE188CBB0544AB6861587836435DABB6188DA865AB795AE2777D
                                                                        Malicious:false
                                                                        Preview:......................>...........................................................r...s.......M.................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .6.6.........................................................0..............F.....}.j.....}.j..................O.l.e.........................................................................................................................P.a.c.k.a.g.e...........................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1620.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 11 21:26:45 2007, Create Time/Date: Tue Mar 18 18:43:28 2003, Last Saved Time/Date: Thu Dec 20 13:16:27 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):170496
                                                                        Entropy (8bit):5.077195832841005
                                                                        Encrypted:false
                                                                        SSDEEP:3072:lg6OZuzT6RBP01esKcdOPfsL2FVrm57oQ+a:7/k
                                                                        MD5:403056F1D56084DC1034682F28C069B2
                                                                        SHA1:552AED44B6D7CD1D691B4E519C89DFA37764FB5C
                                                                        SHA-256:EC17AC16E8F9F10D26357F53A3ECA16C2E3692B07D0A0B49F8618BC3C7F5595A
                                                                        SHA-512:30F5900C8777AED243911549BF7113F10722B74A303AA8D79B83BE9D59221E907307587CD4E2A0186BE3EE756F8259D786C58D6C2D95E80244C2E220E907FA0E
                                                                        Malicious:false
                                                                        Preview:......................>...........................................................P..........................................................................................................................................................................................................................................................................................................................................................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................(...........E.m.b.e.d.d.i.n.g. .6.6.....................................................1... ..............F.........C.......C................O.l.e.........................................................................................................................C.t.l.s.................................................................0...............................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1710.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 11 21:08:44 2007, Create Time/Date: Tue Mar 18 18:43:53 2003, Last Saved Time/Date: Thu Dec 20 13:19:54 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):122880
                                                                        Entropy (8bit):4.960800429743342
                                                                        Encrypted:false
                                                                        SSDEEP:768:54C7x0agTFz+OSXG/inAMXOFwPSZcP74zvD8QrqFrQDYB:5LEz+OSXG/inzXOFCSuD4zb8Q8r6YB
                                                                        MD5:909287CDC971C0D4B31C5D32B688A6BC
                                                                        SHA1:EFF5CE5BAC01F247903A402BBDBF409EFF9B725C
                                                                        SHA-256:31BD8F97745B70084DC405A219C9ACC90E0C22580CEAB06486EF13B3789EC639
                                                                        SHA-512:6D7D694DF5904D20C44195DCD9905A239BB1B8632EC03D7D90787F7D351A82EC56429DA6E22E8A2F9BBA74A2C2ACDA8A70D99F76C8E6BF01FD4604F159F07490
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.0.......................................................................................................|...........T.h.i.s.W.o.r.k.b.o.o.k.............................................................................................l..........._.V.B.A._.P.R.O.J.E.C.T.............................................................................................?...=.......E.m.b.e.d.d.i.n.g. .7.4.............................................)........... ..............F.......6

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1720.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Dec 10 15:38:38 2007, Create Time/Date: Tue Mar 18 18:44:11 2003, Last Saved Time/Date: Thu Dec 20 13:21:49 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):181248
                                                                        Entropy (8bit):4.919450248953279
                                                                        Encrypted:false
                                                                        SSDEEP:3072:utTgm+uUSbiaPH82Yy1uK8PJRG33hD2Hutv+Ud1mXtNB61s+X2Kp5AKSFGAtjm3R:5Ha8Dm1
                                                                        MD5:1A1174381B327B0BE6AEA5AFD221DB4D
                                                                        SHA1:5E005EED30F08BCFDC2DC666DC2E54D4AE9E2BE7
                                                                        SHA-256:5EA0AC5B9592134749833BB0803ABC6BE782C7FD57CFD0971A7E2E9B80CFE20C
                                                                        SHA-512:AE7EEA2A39429B0EB694039026329F252B3ADEBC0DBB6E444E9319DEEAE0F6582D45F6F181DA25CE82634505AC075C49F2168EFF0B9BD46A57662AF042CD7FD5
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................p...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2210A.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 55, Total Editing Time: 14:49:41, Last Saved Time/Date: Tue Feb 15 18:01:58 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):158720
                                                                        Entropy (8bit):5.268140724248468
                                                                        Encrypted:false
                                                                        SSDEEP:1536:HZLzpe9R/R1gGWx2oLnq0qwA1s3A85Yh:5Lle9R/R1fEqzt8
                                                                        MD5:4882CF47C2091D38AF98D8287394A284
                                                                        SHA1:0B4F8D02922F66C946ACBE312382E06245C8C040
                                                                        SHA-256:03C156AF47054845AB03DAC77350A3C34D013E332EDC8E6596978B46FEB05244
                                                                        SHA-512:9554817DB5026E3F4CC350FAFF41BC2C7DB39A452B1549B6E4184F1FD6FAE828C200FF684D2532BCFCDF5CB6D242E6577CAFA4006347140BE790E10885CD93B3
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................eld Definitions Only).....D:\VersionControl\SEIMS1.0\Development\2010 YearEnd\Applications\CR Code\CFRS Common\CF_Common\CF_Reports\2007 Forms\cro-2210A.ttx..........cro-2210A.ttx.............................................................0.......................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2210B.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 135, Total Editing Time: 1d+04:13:02, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Jan 3 19:00:05 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):103936
                                                                        Entropy (8bit):5.592327674224524
                                                                        Encrypted:false
                                                                        SSDEEP:768:zeHskQ4XJukQLWS6lZaqkbDdHkdxkBNox3XRXhTBPSWlPGRCAIIrZTretmXV8hBv:zuhX/6uGRCOX6HHFxGXF6DwNS
                                                                        MD5:2AB980981BB08FC87E4B8E885C775867
                                                                        SHA1:F72DF109611C6E5A83BA7282C9E8E9ED4E4D9B1E
                                                                        SHA-256:3A11440931E4AF31F03346CAF6DEB28AA9592A50B12126DD434D708D4EDB1C39
                                                                        SHA-512:B6FEC7CCFFE987A8C4A16A15714014565B6CB19F55ACEBA887336DF297706FE23AC0BA3148BCC7821CB4664187B614FCFB66E0A601BA08F1C049F4A4E0320A13
                                                                        Malicious:false
                                                                        Preview:......................>.......................}...........|.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0...................................................................................................dB......E.m.b.e.d.d.i.n.g. .3.1.........................................................0..............F.....>.nx....>.nx.................O.l.e.............................................................................................................1...........P.a.c.k.a.g.e...........................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2210C.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 174, Total Editing Time: 1d+13:39:25, Last Printed: Tue Nov 2 15:30:29 2004, Last Saved Time/Date: Tue Feb 15 18:24:24 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):222452
                                                                        Entropy (8bit):5.4064762014400065
                                                                        Encrypted:false
                                                                        SSDEEP:1536:kp1HN2XddW26XOTh3B0Zld7gpi1ELoAdMLg6:kp1H87WtOL0j6pOmFWM6
                                                                        MD5:FADE02A6571C1E7B61F7D2912843299B
                                                                        SHA1:5B02062FD22BE8F768CE81B7F6500D0658DD6447
                                                                        SHA-256:CAECEBCE8CF9785948FC753AAD941939A8644C61DEEBC32DB66BD020FD60B219
                                                                        SHA-512:013E9CC58F5F0EC7C379777CFFA5D25A27EC1673F861A4A52F746E6AC63C8231B8969F7D03E3E63BCA6E531FA2B7657BF0E38B05429BEEF5BFF4D1F59E5BCE2F
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................'.......v.........................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................+......E.m.b.e.d.d.i.n.g. .4.1.........................................................0..............F.......=......=.................O.l.e.............................................................................................................H...........P.a.c.k.a.g.e...........................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2310.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 56, Total Editing Time: 14:47:29, Last Saved Time/Date: Tue Feb 15 18:02:08 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):163840
                                                                        Entropy (8bit):5.228829883731787
                                                                        Encrypted:false
                                                                        SSDEEP:768:dg+RR+r9hPq0TcyUwDFOkZ8E7VFFyhufjMVok2HKrs0yhjtLvjMVokT6X4GyBBC5:dg+R+y6s6oagYnysA0VWeDm6iE43qf
                                                                        MD5:F51BEAB10802D8F46CD91524C29A78A9
                                                                        SHA1:825EC58150D825C5245F1FFA0AAE8A8E39EACD4B
                                                                        SHA-256:2D4E4ED8AC8175EAE07D880B467815C561E31410E75F33CABA41CD16534E71AE
                                                                        SHA-512:60B5ED2AA7DBEFEE444B6B12110A80104B5C6EBAD2F82B9CF73939857AD255F4EFC419766BFAF63B8AB8D1EC48C14996082C7E3F4309CFE151A82FC2B4C15D23
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................eld Definitions Only).....D:\VersionControl\SEIMS1.0\Development\2010 YearEnd\Applications\CR Code\CFRS Common\CF_Common\CF_Reports\2007 Forms\cro-2310.ttx..........cro-2310.ttx.............................................................0.........................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2320.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 122, Total Editing Time: 1d+03:59:21, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Jan 3 12:16:34 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):83456
                                                                        Entropy (8bit):5.617886733447368
                                                                        Encrypted:false
                                                                        SSDEEP:768:kLjO/+KGidgXJBPjjZTX4BPBPn5925VhljMVokLqhdXpBPNZXP8h:kHX/ZX85/5scqhdXfr
                                                                        MD5:E708CF7FC5A36DCFB21C4C71D3D3830E
                                                                        SHA1:524E043B77C72E1AF8DFE79029FF4843EC93693C
                                                                        SHA-256:E1D8DA0491FFE506F325D2FE0A0292A3FE1A3700CA1D8A2E780876E8E4964D7C
                                                                        SHA-512:C5A59C922BDE6E6BF36AEA1A6655E4A6743DE391721B233FA1BB54F8A82BA9066551F8815507CC01E25DE00D6800D4421071CEE65591D042FA9476ED04847BBE
                                                                        Malicious:false
                                                                        Preview:......................>.......................d...........c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0...................................................................................................l ......E.m.b.e.d.d.i.n.g. .2.8.........................................................0..............F........@.......@.................O.l.e.............................................................................................................j...........P.a.c.k.a.g.e...........................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2330.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 133, Total Editing Time: 1d+04:11:03, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Jan 3 13:05:25 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):104448
                                                                        Entropy (8bit):5.571042801433939
                                                                        Encrypted:false
                                                                        SSDEEP:768:hkvnrY8fsuk9LCS87Q4kh6+ubXbFiNExN2HXbdBP+VtzY1g5pL8lQM1KXVTBP657:XNyNOXbrctpUKXbuT4WhZXF6Bqn
                                                                        MD5:A0C044D33CB4F0DB844EC13C156BDF6F
                                                                        SHA1:9FC9F3526F3E9785B898BBC239590DED15AF9AE0
                                                                        SHA-256:82EDAF0D98E22A5BF59CB851687DDC0DE7B974DA2BC10AA528BEBA1BEB0F5064
                                                                        SHA-512:832F30833ABA02BEF0172AAC47175D9B9A16C3B50AEAC12DD8FF01F13D215DC18BB39A1113EE785C4C3A310B07886FCFD361F76A2A2447A1D77507B17471D34C
                                                                        Malicious:false
                                                                        Preview:......................>.......................~...........}.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................B......E.m.b.e.d.d.i.n.g. .2.9.........................................................0..............F.....$..F....$..F.................O.l.e.............................................................................................................1...........P.a.c.k.a.g.e...........................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2340.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Oct 15 14:21:07 2010, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Mon Feb 14 13:42:24 2011, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):252750
                                                                        Entropy (8bit):5.25060703850526
                                                                        Encrypted:false
                                                                        SSDEEP:6144:YZ+RwPONXoRjDhIcp0fDlavx+W/WEtZ+RwPONXoRjDhIcp0fDlavx+W/WEp3FZ+m:kGo
                                                                        MD5:D386DF49CA08E8BC94B632AE6BEF1DB1
                                                                        SHA1:4D236FB675BD56A0CCB979BB26809A6278B45C58
                                                                        SHA-256:6C7F2A579D4218ABF8375315255417A740D4964E9DE361B6B00E9F6BF1E4AB92
                                                                        SHA-512:44BEC47D9E91DED6E741D82FE4C0D98E73A109CD5A9E9543FE47DC1A28D0619E9CB20F607C30BD620918EEE34AA813253DE302A339435EC7835E7BD3081EAC92
                                                                        Malicious:false
                                                                        Preview:......................>...................................E.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................+........S.u.m.m.a.r.y.I.n.f.o.r.m.a.t.i.o.n...........................(...................................................D.............D.o.c.u.m.e.n.t.S.u.m.m.a.r.y.I.n.f.o.r.m.a.t.i.o.n...........8...................................................@...........E.m.b.e.d.d.i.n.g. .3.5......................................................... ..............F.....)

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2500.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:40:21 2007, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Mon Oct 22 19:22:13 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):86528
                                                                        Entropy (8bit):4.881958494433561
                                                                        Encrypted:false
                                                                        SSDEEP:768:Fl8E2XX+tjZyfSiy947UelYPLVEr+HClN61P:OyjZyWEUelyEr+MN6
                                                                        MD5:E34AF91588EF52750B571461438523FC
                                                                        SHA1:060DAAD994AD9CA194CF2745B197524AF01E4981
                                                                        SHA-256:F05461F9C2DE1E0B19F4F2C4C44BCB9BFEF39586B18EB9D403497586DA5FE981
                                                                        SHA-512:0971601CC34A99B221F284D5865323FD060E5F3DAF95EECCB2C0F434A6AC6FB12E77C5E4544BEE59BEFAEA704814979A94C0DC9BA5AEBF510A8F9E177CE44E54
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2501.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:40:21 2007, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Tue Oct 23 14:18:36 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):86528
                                                                        Entropy (8bit):4.88633501894969
                                                                        Encrypted:false
                                                                        SSDEEP:768:al8E2XBaqD5vSiyV7UeikdtZ81+D9FCl9w:V5OUei51+D969
                                                                        MD5:4C8430FEB6682068847DE23E43B28916
                                                                        SHA1:BBC51A81B9A85354CD567DC39EF69579D4320DA7
                                                                        SHA-256:C8BE4F958AA658009028FAAD99474AEE6E1834558AFC655BEE3F086E24EC394E
                                                                        SHA-512:4547A4CD0869296621E0684AAF030133250DB8E4335BCDBFAB924CE389AAA826C477486176199688719CE7FBB00D628E079BD89033D7D1B32F0B94144ED03155
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2502.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Apr 28 17:00:15 2009, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Wed Apr 29 22:24:07 2009, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):90112
                                                                        Entropy (8bit):4.881150690200426
                                                                        Encrypted:false
                                                                        SSDEEP:768:O4l8E2XlCGZJgtiSCg5Ut5Zl8MlHsDllxW:O5ZMUt5HHsD1
                                                                        MD5:1A8B9BAB9A26DE6C4D078DE140FAEFAA
                                                                        SHA1:108F6E387FFA826F7E52BCD4CC9A01B7428FB809
                                                                        SHA-256:2FDEB8A9E37FB4B225AB55F317F06D00F280890466F03C0309EF76D577C29DE1
                                                                        SHA-512:95A587D23889964C05FD9AB1C90F189947526697C0060386EE8CDDB26152E758E3F1C3167341CBE13815B5907017820AC20A1B97C799C162EA99BA3CEEBD7CEF
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................~................................................................................................................................................................................................................................................................................................................................................................................................................................................d.....gdldd.dddddedd........ddddddde.dcddddtdA..dd..ddd.dddddddddddddddddddddddddddddddddddddddddd$dddddddddle.f.....cfkfffffffffffd.fffffffgfgfgfffffffffgfffffefffffffffgfffff.fffffgfgffff.7affffl7776777777_4afffffgf...........................c....._..._....8....o..... ..hoooo}..................oooooo.s.....I..tssssQ.p......ppp~3........>...p{qppppqpc{sh...^AFCA,...]0........=...s.s.....K..tssssP.p......ppp.3........94>..p{pepppqpc{so...^AFCA,...]0........:7=..s.s.....A..tssssm.p..

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2510.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:51:41 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Mon Oct 22 19:25:35 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):97280
                                                                        Entropy (8bit):4.977162636578716
                                                                        Encrypted:false
                                                                        SSDEEP:768:iR0jbfG0fYJfrpgAnVY7IfsUMXHwKY0/Oxlu7cimw:HbtfofTVxf/MXHwKY0/AuIi7
                                                                        MD5:896F8A0D7E194A0685F0955C6FCD724D
                                                                        SHA1:32AFD8CA6ADBFE20CB4D818F3C90FB4FD81BA04E
                                                                        SHA-256:9AA224A1B697BCC8292EA5FFDC9BAF52F81287B157EA48A230F60024631A4614
                                                                        SHA-512:BEC97B6CFF0656AC4F2AC8ABD20A4139C1B0E501AE69EF02840BD6DC9C0129D13BBBB19D2DCC19E41A342C18CC8726BE6BEB20A7BAB6391C95DA4310A0174026
                                                                        Malicious:false
                                                                        Preview:......................>.......................b...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.3.............................................................!.......................................................T.h.i.s.W.o.r.k.b.o.o.k................................................."......................................................._.V.B.A._.P.R.O.J.E.C.T.................................................................................................).......E.m.b.e.d.d.i.n.g. .2.2.....................................................%... ..............F.....P..

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2520.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 19:02:52 2007, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Fri May 16 18:49:41 2008, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):136704
                                                                        Entropy (8bit):5.122314043578528
                                                                        Encrypted:false
                                                                        SSDEEP:1536:xv1oKLyI9q8o4zTcb2UlgcWK+xTrz7axPzUsdiallTonTIn2:xv1oY3z7
                                                                        MD5:CEB12F669CCD7F4EECDA6E6526546E0F
                                                                        SHA1:0DD99622131222D076229E0F8C407F74625E1CAE
                                                                        SHA-256:9046CA568975FAD9DF681D3330D74EB9D0DA3649DD2D047E18578B91073B6F8A
                                                                        SHA-512:DCB2B77ABE0973ABC483B9248754E57CBBDBF9BA989B62CA4C200851B26C09B6C894C593FC14375E6FFEF93FE5A77B822FBC57A89E054A0866B4BB52508A9217
                                                                        Malicious:false
                                                                        Preview:......................>...........................................................P...........................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.4...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................U...........E.m.b.e.d.d.i.n.g. .3.1............................................."........... ..............F.......

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2600-1.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Certification of Inactive Status, Author: James Lell, Template: Normal.dot, Last Saved By: msteffens, Revision Number: 3, Name of Creating Application: Microsoft Word 10.0, Total Editing Time: 01:00, Last Printed: Wed Oct 15 21:58:00 2008, Create Time/Date: Thu Oct 16 12:01:00 2008, Last Saved Time/Date: Thu Oct 16 12:02:00 2008, Number of Pages: 1, Number of Words: 178, Number of Characters: 1019, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):180224
                                                                        Entropy (8bit):5.3712177177850355
                                                                        Encrypted:false
                                                                        SSDEEP:1536:+fpOF0kQmsMRT9CrDc0QrilK3dQKDj2MQCFju:8py0kQm9RT9CrFQXDj2gA
                                                                        MD5:AA19D7736F3EF3BC68B25908B726999A
                                                                        SHA1:3E2A28FA79CD93F0D47CD8E6FA9F09E8A2F12ED9
                                                                        SHA-256:FB22AB8A19306CF0CBC659A6353A22880960907DD5182A83A713C94DA95DBFC9
                                                                        SHA-512:D4510269FC2294B89C4AC530F2684F596953BDE1F5585576D2659ABE657BE436D08C2965343FB0A0713FEB09BF941FA203536E26E2805200124A835FC30C5242
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................:................................................................................................................................................................................................................................................................................................................................................................................................................................................d.....gdldd.dddddedddA..dd.fddddddde.dcddddtdA..dd.fddd<dddddddddddddddddddddddddddddddddddddddddd$dddddddddle.f.....cfkfffffffffffg.ffg.fffgfgfgfffffffffgfffffefffffffffgfffff.fffffgfgffff.7affffl7776777777_4afffffgf..........8....o..... ..hoooo}..."..............oooooo.s.....K..tssssQ.p......ppp~3........>...p{p.pppqpc{sn...^AECC^B,...]0........=...s.s.....O..tssssW.p......ppp` ...4..........p{p.pppqpc{sl...^AECC^B,...]#...7..........s.s.....K..tssssQ.p......ppp~$........>...p{p.p

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2600-2.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Certification of Inactive Status, Author: James Lell, Template: Normal.dot, Last Saved By: msteffens, Revision Number: 3, Name of Creating Application: Microsoft Word 10.0, Total Editing Time: 01:00, Last Printed: Wed Oct 15 21:58:00 2008, Create Time/Date: Thu Oct 16 12:02:00 2008, Last Saved Time/Date: Thu Oct 16 12:03:00 2008, Number of Pages: 1, Number of Words: 42, Number of Characters: 241, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):463360
                                                                        Entropy (8bit):4.580779504933828
                                                                        Encrypted:false
                                                                        SSDEEP:3072:Xx0kQm9RT0PhzfHiQ+z0kQm9RT0PhzfH7QKR50kQm9RT0PhzfHBQ:h4yRTAM4yRTAPr4yRTA
                                                                        MD5:3E283F1FD6FE821EF531355E09CD8FAC
                                                                        SHA1:DE14DF4F69EB7123F4CD2AFF72F093C6BBF7BDF5
                                                                        SHA-256:77EA4BF10E6EB2AB9F8C4A752D67A65F268C6D9F4501DABCEABD1B0E8236A714
                                                                        SHA-512:B256F3E0AC5282F399C7DDEC15E896FDEF25E73559A0630CC036EB3A849F9AEC22267776DA851E77B34950D0B6BAA0B273B72B63682D7D59EC24F88C853F2E1B
                                                                        Malicious:false
                                                                        Preview:......................>.......................7...........6...........................f...T...c.................................................................................................................................................................................................................................................................................................................................................................................................................................D.o.c.u.m.e.n.t.S.u.m.m.a.r.y.I.n.f.o.r.m.a.t.i.o.n...........8...............................................................E.m.b.e.d.d.i.n.g. .1.7........................................................................F......Nx./....Nx./................O.l.e.........................................................................................................................D.a.t.a.................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2600.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Certification of Inactive Status, Author: James Lell, Template: Normal.dot, Last Saved By: msteffens, Revision Number: 3, Name of Creating Application: Microsoft Word 10.0, Total Editing Time: 01:00, Last Printed: Wed Oct 15 21:58:00 2008, Create Time/Date: Thu Oct 16 12:01:00 2008, Last Saved Time/Date: Thu Oct 16 12:02:00 2008, Number of Pages: 1, Number of Words: 178, Number of Characters: 1019, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):646656
                                                                        Entropy (8bit):4.870802515688482
                                                                        Encrypted:false
                                                                        SSDEEP:3072:9n0kQm9RT0PhzfHtQfl0kQm9RT0PhzfHFQ+l0kQm9RT0PhzfHyQuU5pD0kQm9RTC:J4yRTAc4yRTAD4yRTAyU5h4yRTwrdOi
                                                                        MD5:0AF05A4650FDF343A9C13262E16F986E
                                                                        SHA1:9D7EDAFFC85356249BCABCC8A25B556E8615B36E
                                                                        SHA-256:C87F73A359565D04941EB305AF7C9FE5B4818F577CA1319F8B578B69F2E4A947
                                                                        SHA-512:C8FC8A1C1E3EBEA9927D0ACCD8A0C27D6F60F4A13E642DF894CE7387097D76B1F557B184A18DB80EDC7D7E50EF47BBAC65D8B35ACC349F415B9707698ACA69D2
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................a...............................%.................................................................................................................................................................................................................................................................................................................................................................................................................S.u.m.m.a.r.y.I.n.f.o.r.m.a.t.i.o.n...........................(.......!...........................................t.............D.o.c.u.m.e.n.t.S.u.m.m.a.r.y.I.n.f.o.r.m.a.t.i.o.n...........8...................................................l...........S.u.b.d.o.c.u.m.e.n.t. .7...................................................%..........................t./..@..t./..............C.o.n.t.e.n.t.s.........................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-4100.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Oct 16 21:17:12 2007, Create Time/Date: Tue Mar 18 18:48:47 2003, Last Saved Time/Date: Mon Oct 22 19:28:02 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):162304
                                                                        Entropy (8bit):4.830184722169816
                                                                        Encrypted:false
                                                                        SSDEEP:768:HIVX+tXppv5JZp8scM0UET/5r9//PSfdNI46B4yGUbV2fiWwhgVQwq+1o:HIVX+IJafdNH6B4yZbV2fiWwIq+1o
                                                                        MD5:B1056B83A838C1A1050782D8DE2B86FA
                                                                        SHA1:A813E6A224949231A9B9AB4E7B7F675125D25D47
                                                                        SHA-256:19F4FDA329AF5201897E76EB13A18FF469BB6C1C90D63679182A0E631C943026
                                                                        SHA-512:DD3A5E08193527DF583206CBAA51B2AE0BE6A428A5FF37FA6BC37BD08601BDB24238D5C615FAE54B47136D154E49B503D9A100034BAEE40125F43B2BDE68DAB9
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................0.........................SQL.....PdSMON.DLL....%Active Data (Field Definitions Only)....RD:\DEV\CR Code\Remote Filing App\Version 2004\CF_Remote\reports\2002\cro-4100.ttx..........cro-4100.ttx.............................................................0.........................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-4110.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: programmer, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue May 29 15:40:58 2007, Create Time/Date: Tue Mar 25 14:35:37 2003, Last Saved Time/Date: Mon Oct 22 20:27:11 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):116224
                                                                        Entropy (8bit):4.831635357966716
                                                                        Encrypted:false
                                                                        SSDEEP:768:FZMVR2jqTkOCsKswrOnHz9rm32Q3cpFHfuis3+nc:FVWTkOLKZraHzZmT3cpFHfur3+nc
                                                                        MD5:5379BC15FFA3C25789C420B782932967
                                                                        SHA1:E9C3245791ED044E567EA105AEBE066A3DD2DC66
                                                                        SHA-256:01B3854F730104522577E3BF28277EA5808DAE318690B7DF3F2934C382C957DC
                                                                        SHA-512:1E65192F90136EA88EFE3DD2F335FA5568538EA390DA7B1EAE50ACBCD4946590BD608AB4FF0D4A65BCBD2803AB6F3697CB966B09DA09433EF15E39017785696E
                                                                        Malicious:false
                                                                        Preview:......................>.......................v...............................y...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-4200.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Oct 16 21:22:03 2007, Create Time/Date: Tue Mar 18 18:49:06 2003, Last Saved Time/Date: Mon Oct 22 20:31:02 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):222577
                                                                        Entropy (8bit):4.92535757129126
                                                                        Encrypted:false
                                                                        SSDEEP:3072:IfsIsefpkcEtHsDwC6Sag1Lo4cOfpkcUd3MDwC6SaXaoONv9tKAd0oNhzwcAS66p:kn
                                                                        MD5:7770B0334CFBBE2CAF0B823D0D73024E
                                                                        SHA1:38152A320F374F5115C0E4C4A249C4484D194CAB
                                                                        SHA-256:F3CB0021FC58775DF1965E1AA682EDD8B228991ACBE3C7ECBBB50872CDAC5032
                                                                        SHA-512:AF64DBBEE6A881D6C024CDC63B5C63A9DC7FC378B95D1FC3ECC61B421F9B3EDCE2715D5EA2F8C8290D96AACE5910561A12E7B6E8E2A6DE759989D3B97A999705
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................T.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\misc\contlist.rpt

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Revision Number: 19, Total Editing Time: 04:03:46, Last Saved Time/Date: Wed Mar 18 14:37:02 2009, Create Time/Date: Wed Jan 4 17:35:48 2006, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):45568
                                                                        Entropy (8bit):5.362863051604835
                                                                        Encrypted:false
                                                                        SSDEEP:384:dOOtOnXLo80Y31Q7yrelcg6BfJnuewBc18:dftOilH
                                                                        MD5:F333AB5364641E71074B186AAB1753BD
                                                                        SHA1:BD37BB9C3814C0B6CAFD478DD317C19FB35BB81F
                                                                        SHA-256:ECEB4597F02DBAC4C570E53EEFAA40D45862058609DCFF34B4E612CB5CA8E165
                                                                        SHA-512:8E0BF47C1FC1A55D0EC0D9BD435235EA3D8F66235DC075F5C32EDD46D9D03088A4743607C96F12D5C3E298F384CC14BB8D8094B912AC0B69F24A4A8872698C5A
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...............................................................................................................................................

                                                                        C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\dbs\cf_data_empty.mdb

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Microsoft Access Database
                                                                        Category:dropped
                                                                        Size (bytes):4894720
                                                                        Entropy (8bit):2.4562849415129704
                                                                        Encrypted:false
                                                                        SSDEEP:6144:aduPCcaI/tlAIZ8Jo3Vw3QWjz3dwDQW8SypfZ3L1vLMqeFjFJJomc5S:xCF4tlAIK7IEEhOmcY
                                                                        MD5:FED4926EDE0F27BB72EFFFAC8FC55876
                                                                        SHA1:1136FC24FD788D3912F01B415A7A9CFD1A1C2E61
                                                                        SHA-256:EA2D8537CF76616D0EDA204F64E617A4989CC1AAF1C31B5F297400EFFADAB8E5
                                                                        SHA-512:162FB0823FC97AF70CDCB6CC0E617C2906D3EEF52440C5A76E577745407C0628D444FF7570ED9107DB1D632B356DAF7C3CE1BC9D86DD884D493BED311193684E
                                                                        Malicious:false
                                                                        Preview:....Standard Jet DB......n.b`..U.gr@?..~.....1.y..0...c...F...N.U.7g....(.)..`n:{6...MZ.C...3..y[..|*..|.........8..f_...$.g..'D...e....F.x....-b.T...4.0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Campaign Finance\CF Remote.lnk

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Dec 1 14:44:33 2023, mtime=Tue Jan 23 14:43:32 2024, atime=Fri Dec 1 14:44:33 2023, length=4243456, window=hide
                                                                        Category:dropped
                                                                        Size (bytes):1218
                                                                        Entropy (8bit):4.657571391506197
                                                                        Encrypted:false
                                                                        SSDEEP:24:8AmESbdOEcKy+KXUM97DAGsLy4A+WdIzoUUkWyfm:8AZ2dOX+kUMeGz4TWdK97
                                                                        MD5:5A29A31C19FB1712984E3385E3DD17A8
                                                                        SHA1:1C7D097A5F836B41E82BFB52E926CFB164DCC78B
                                                                        SHA-256:F67913A86B59E62F3BB8FC551841A40FF7B6BC4DB86397C73D3A38047D83FD86
                                                                        SHA-512:C0B4AC12A8D6D6FA71778D615C45A190984CAB45D145B1E8A48D38B24DB585EA22630C384031759F304D783FF97E6B41D174C614887105019D077C01D76357A2
                                                                        Malicious:false
                                                                        Preview:L..................F.... ......Gm$...r...N.....Gm$....@.....................C....P.O. .:i.....+00.../C:\.....................1.....7Xn}..PROGRA~2.........O.I7Xn}....................V.....<...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....N.1.....7Xn}..SBoE..:......7Xn}7Xn}..........................<...S.B.o.E.....j.1.....7Xn}..CAMPAI~1..R......7Xn}7Xn}.... .....................<...C.a.m.p.a.i.g.n. .F.i.n.a.n.c.e.....\.1.....7Xq}..CFREMO~1..D......7Xn}7Xq}....!.......................'.C.F. .R.e.m.o.t.e.....h.2...@..W.} .CF_REM~1.EXE..L......W.}7Xq}.....I......................P.C.F._.R.e.m.o.t.e...e.x.e.......s...............-.......r....................C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\CF_Remote.exe..S.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.S.B.o.E.\.C.a.m.p.a.i.g.n. .F.i.n.a.n.c.e.\.C.F. .R.e.m.o.t.e.\.C.F._.R.e.m.o.t.e...e.x.e.........*................@Z|...K.J.........`.......X.......

                                                                        C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5675007
                                                                        Entropy (8bit):6.48705961905541
                                                                        Encrypted:false
                                                                        SSDEEP:98304:2hG63qsl7dEhYCHnWzXzLbVI9AB5dECNhc6ZzH2oYK13icjqsNTUjJG:2Jah2zXzL5IWB5JhnHfFIG
                                                                        MD5:3B2D532673D1567116105D04C621CDBA
                                                                        SHA1:F0892A2DCF772529C115C15E6B1A510B4DC214E1
                                                                        SHA-256:FD6D2298B1B5DD14A9F02207FAA4D7D7DC5F5B399E71F2F4EC3680C2DBC6DF0E
                                                                        SHA-512:15ABF21DCF9ABF346DDFB6B35F75C607B4E6CF4518B629C39ADCA5E4690955D70C46C5A842F73FE7373FA6A7F7860DB514D3815DD04D1280DAD7A7D1A315B672
                                                                        Malicious:true
                                                                        Yara Hits:
                                                                        • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe, Author: Joe Security
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?..`.................z;..........e;.......;...@.......................... Y..................@............................?..Y... D.......................................................?.......................?......`?......................text.....:.......:................. ..`.itext.......;.......:............. ..`.data...(.....;......~;.............@....bss.....}....=......Z=..................idata...Y....?..Z...Z=.............@....didata......`?.......=.............@....tls.....A...p?.......=..................rdata........?.......=.............@..@.reloc...I....?.......=.............@..B.rsrc........ D.......=.............@..@.............pY......\W.............@..@........................................................

                                                                        C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.msi

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Template: Intel;1033, Revision Number: {D529246B-78E5-4E65-A3A2-8E1040E91E59}, Number of Words: 0, Number of Pages: 200, Title: CF Remote, Subject: CF Remote, Keywords: Installer, MSI, Database, Author: NC SBoE, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):868352
                                                                        Entropy (8bit):6.2772030756930395
                                                                        Encrypted:false
                                                                        SSDEEP:12288:gmLYSxeFmPBKXsbzlDSJjQ8guBoN2KA2wKc7wMz7:XLYSxHW5BqPA2fc7wMz7
                                                                        MD5:C42393B9643339D7F19EC2C717562646
                                                                        SHA1:2D6F6B8CE8DE076516095B9E35157055F530EF41
                                                                        SHA-256:2C3F9688DD4A7D3AFB3A28DDFA9A3A584C94E9029887DE5B3EF50F1DBB3D334E
                                                                        SHA-512:72BCBA2C66EBD01BDDF1490A65BB7E640D967B86AABE22C93E15C1EDF560C6C3E4A22D7601D2C085466E8E05F2129417DA2BBE21B4F342641741667BEF6E80E8
                                                                        Malicious:false
                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.res

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:7-zip archive data, version 0.3
                                                                        Category:dropped
                                                                        Size (bytes):8694055
                                                                        Entropy (8bit):6.569101251424524
                                                                        Encrypted:false
                                                                        SSDEEP:98304:6bCyTWyZzxtJNL05f9tAYnA3U9XHsHcCXq8vXKEUo/wRZlV:Ia8KEUo/wdV
                                                                        MD5:FDC346FFDFDD1F15F1DBA95695960160
                                                                        SHA1:4983376DAB7201E8AF1728D2F6FD9AEE0CCAD376
                                                                        SHA-256:74924F08BD5817B532B441E57C5D9C7CB55AD001C410C038DE1F54427D1160E9
                                                                        SHA-512:AE7F0A4EC374A78816B7DDF3B90BD358729BC6E0C153C08CA4AC17741F6E72C0A3E43B822DD3A55FA15C603314B78B4D7E43D8F131ED60143CFB9B7C65E0B66E
                                                                        Malicious:false
                                                                        Preview:7z..'.....%........{........fX....TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.|\9..P...W...^..._...e...c...i...l...s...{...y...z...|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(..*..-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\ADVPACK.DLL

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):74960
                                                                        Entropy (8bit):6.080943948881524
                                                                        Encrypted:false
                                                                        SSDEEP:1536:3TlRSuxQYyqUB9XzWqxGHVcIIX5ZDBZGscEvWlExtJl966CX6q0uE:FfUB9XamGHpw5ZDXXPOixtJz3CX6qQ
                                                                        MD5:81E5C8596A7E4E98117F5C5143293020
                                                                        SHA1:45B7FE0989E2DF1B4DFD227F8F3B73B6B7DF9081
                                                                        SHA-256:7D126ED85DF9705EC4F38BD52A73B621CF64DD87A3E8F9429A569F3F82F74004
                                                                        SHA-512:05B1E9EEF13F7C140EB21F6DCB705EE3AAAFABE94857AA86252AFA4844DE231815078A72E63D43725F6074AA5FEFE765FEB93A6B9CD510EE067291526BB95EC6
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Joe Sandbox View:
                                                                        • Filename: TextSpeaker.exe, Detection: malicious, Browse
                                                                        • Filename: TextSpeaker.exe, Detection: malicious, Browse
                                                                        • Filename: TextSpeaker.exe, Detection: malicious, Browse
                                                                        • Filename: MXrpqIRV2z.exe, Detection: malicious, Browse
                                                                        • Filename: MXrpqIRV2z.exe, Detection: malicious, Browse
                                                                        • Filename: Bonzify.exe, Detection: malicious, Browse
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~c.3...."......#.................3.............p................................g....................................................%.......................... ...8............................................................................text....................... ....... ..`.data...............................@....rsrc....%.......&..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\W95INF16.DLL

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:MS-DOS executable, NE for MS Windows 3.x (DLL or font)
                                                                        Category:dropped
                                                                        Size (bytes):2272
                                                                        Entropy (8bit):5.626412274243338
                                                                        Encrypted:false
                                                                        SSDEEP:48:iuB0q8Z8LCQZ5U45owLkq10Ju1pwZbQP+DWmnDypKGDsQVG:NB0q7L35S22u1pwZC+ymnDmKGDsv
                                                                        MD5:7210D5407A2D2F52E851604666403024
                                                                        SHA1:242FDE2A7C6A3EFF245F06813A2E1BDCAA9F16D9
                                                                        SHA-256:337D2FB5252FC532B7BF67476B5979D158CA2AC589E49C6810E2E1AFEBE296AF
                                                                        SHA-512:1755A26FA018429AEA00EBCC786BB41B0D6C4D26D56CD3B88D886B0C0773D863094797334E72D770635ED29B98D4C8C7F0EC717A23A22ADEF705A1CCF46B3F68
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Joe Sandbox View:
                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                        • Filename: 1diWXDlHzi.exe, Detection: malicious, Browse
                                                                        • Filename: TextSpeaker.exe, Detection: malicious, Browse
                                                                        • Filename: TextSpeaker.exe, Detection: malicious, Browse
                                                                        • Filename: TextSpeaker.exe, Detection: malicious, Browse
                                                                        • Filename: MXrpqIRV2z.exe, Detection: malicious, Browse
                                                                        • Filename: MXrpqIRV2z.exe, Detection: malicious, Browse
                                                                        • Filename: Bonzify.exe, Detection: malicious, Browse
                                                                        • Filename: nusb320-Eng-98FE.exe, Detection: malicious, Browse
                                                                        Preview:MZR.....................@...............................................!..L.!This program requires Microsoft Windows...$.......NE.<............................1.@.P.|.....M.............R.......r.P.r.`.r.q.r...........l...0...............p...0..........W95INF16...WEP...DLLENTRYPOINT...........KERNEL.USER.SETUPX....?.z...?.....?.!...INF Installation Library...W95THK_THUNKDATA16.....................................................................EU...WQ.V..j.j.Q......j....f..]M.EU....f..]M....2...v.2...6...:.XZh..h..h>.hV..RP.....w95thk_ThunkData32..U..F..p........U...h ..h...v.f.v..@.I.=....@.........V.^.&....f.v..F..P.........t....M.v...6L...6X......Ph...........u.....P..6d........t..v.......j....F..^.&..3.^.........WV.v..v.V......N.....N.;.v.QVQP........&.?\t..F.&..\G.^.&.? t.......F&.< t..v.W.V.....^_........WV..C.......f....3.........F..F.f.v..F..P............j......P.......u......P.......t..F...j.f.v......3.....~....f.~..u..F......F...3..F.F.F.f+.f.N.f.N.h..h...N..Q......

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\W95INF32.DLL

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4608
                                                                        Entropy (8bit):2.9774207313950316
                                                                        Encrypted:false
                                                                        SSDEEP:48:6Z3Mi+h0U47yaE6akf1WbvgFfSBZW3IezfXNFk5WgF:VEyaVaVv+aPWJXNyWg
                                                                        MD5:4BE7661C89897EAA9B28DAE290C3922F
                                                                        SHA1:4C9D25195093FEA7C139167F0C5A40E13F3000F2
                                                                        SHA-256:E5E9F7C8DBD47134815E155ED1C7B261805EDA6FDDEA6FA4EA78E0E4FB4F7FB5
                                                                        SHA-512:2035B0D35A5B72F5EA5D5D0D959E8C36FC7AC37DEF40FA8653C45A49434CBE5E1C73AAF144CBFBEFC5F832E362B63D00FC3157CA8A1627C3C1494C13A308FC7F
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....=2...........!......................... .....p.........................p...................................... .......@..<....P.......................`..0...................................................d@..(............................text............................... ..`.rdata....... ......................@..@.data........0......................@....idata..@....@......................@....rsrc........P......................@....reloc..\....`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\asycfilt.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):147728
                                                                        Entropy (8bit):5.909287934496192
                                                                        Encrypted:false
                                                                        SSDEEP:3072:h+qD1Cd/Oa5kXFlqkFGr3CAP7LCyInPEggen5Ez:hlCd/OaaFEjCAPKyOE6na
                                                                        MD5:C89E401800DE62E5702E085D898EED20
                                                                        SHA1:72FB4F088C6AC02097B55FB267C76FBF5E0FA1F7
                                                                        SHA-256:DE83C9D9203050B40C098E4143EF8F577AA90016C7A64D4F2931B57A4C43E566
                                                                        SHA-512:70006D70DCB47361FF43E4F7C458655AD2474B70CB917873AA77D2CC06465A68D375D36C494D154A03DBBFF891DF7DD6CAB3D2C7B08E8650B9FF170E30838070
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ru..ru..ru..mf..ru..ru..su.Rich.ru.........................PE..L....!.6...........#..................... ........<e.........................`... ..^q..................................n.......d....0.......................@..0...P!............................................... ..L............................text...n.... ....... .............. ..`.data....d.......P..................@....rsrc........0......................@..@.reloc..v....@... ... ..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\comcat.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):22288
                                                                        Entropy (8bit):4.814478820147639
                                                                        Encrypted:false
                                                                        SSDEEP:384:23Fob3slaN3oF1fHICOoMzMv/QTIBjDVquODJXsUW7ftWs6:Yo7s28JnOxzMv/QsBjRqugXspd
                                                                        MD5:3B180DA2B50B954A55FE37AFBA58D428
                                                                        SHA1:C2A409311853AD4608418E790621F04155E55000
                                                                        SHA-256:96D04CDFAF4F4D7B8722B139A15074975D4C244302F78034B7BE65DF1A92FD03
                                                                        SHA-512:CF94AD749D91169078B8829288A2FC8DE86EC2FE83D89DC27D54D03C73C0DECA66B5D83ABBEAA1FF09D0ACAC4C4352BE6502945B5187ECDE952CBB08037D07E8
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...rD.2....i......#.....2...................P.....w.................................................................?......*<..d....`.......................p..4...............................................X....................................text...#0.......2.......... V...... ..`.data........P.......B..............@....rsrc........`.......N..............@..@.reloc.......p.......R..............@..BkD.2(.....22...jD.2?....%.2J...........ole32.dll.KERNEL32.dll.USER32.dll.ADVAPI32.dll..........................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\mVBExec.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1357600
                                                                        Entropy (8bit):6.676037472083791
                                                                        Encrypted:false
                                                                        SSDEEP:24576:BbQr0YK8Usasyc0ZP0rqqTKOdB4Ssab0IOb/Ng/r0GEj:13CaZzqrdSSfW/WTjEj
                                                                        MD5:7084D611F4646FD3652B1ED603A1F4CD
                                                                        SHA1:9CA06B546644D37A62F11F79B1463FEBD974EC74
                                                                        SHA-256:DEA658AA6156AD4C54BDD4BDE1883CA088D38CDD0E220946F3CE44767FF42BAE
                                                                        SHA-512:9D00AC1C77EFEABA6AD59E461C2E396B716D4B888DF8D0FC2CBB7D9D1572C3AF12B7DF4822E19CD73DDDCC346AC6C481B9D725A1E1B5994BCDF74EEC93E41981
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....;.b.....................x.....................Q................................[~..................................N.......\7.......Z...........`.. W... ......................................................,................................text............................... ..`.itext.............................. ..`.data....O.......P..................@....bss.....S...P.......8...................idata..\7.......8...8..............@....didata..............p..............@....edata..N............z..............@..@.rdata...............|..............@..@.reloc....... .......~..............@..B.rsrc....Z.......Z..................@..@.....................`..............@..@........................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\msvbvm60.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1386496
                                                                        Entropy (8bit):6.507253562372704
                                                                        Encrypted:false
                                                                        SSDEEP:24576:jrWIEO0eDfcPOvCOpMEPJonhql5oHS+zh3JajtObuF+T+NUFRjUgIeX40sgdp:jrOuCQhJohq3oHrh3JajtObu2+NUF5Vd
                                                                        MD5:F28EB5CBC3CA6D8C787F09F047D1F9C8
                                                                        SHA1:70DB1FAC822974BC9B636A984BCC1DA2E67F8DE5
                                                                        SHA-256:3EF32E0152CC3FA07C417E6AADF9EAD83A17B5FDEE73799044E1BD7564725D6E
                                                                        SHA-512:84F811F75E9D5143898728D2109B349802A292D4EF2CCAE4B4421D20268A33C6DDEE9C70E8BDEB474A3AC70307B2554C00CE786CA1F446807610FA2717F3745F
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....:@...........#.........v.....................f......................... .......N...............................0...Q..............L.................... .......................................................................................text.............................. ..`ENGINE.............................. ..`.data....n.......p..................@....rsrc...l...........................@..@.reloc....... ....... ..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\oleaut32.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):598288
                                                                        Entropy (8bit):6.644743270512807
                                                                        Encrypted:false
                                                                        SSDEEP:12288:HCKynQWKglDhrUtrvT/NInIk4NDXsR6lMlpGz:HGXqB8V6lMlMz
                                                                        MD5:7B156D230278B8C914EF3F4169FEC1CC
                                                                        SHA1:6B58E20B2538CB308091DA838710F6AAD933A301
                                                                        SHA-256:BAEB2F7C1B8BE56738D34E1D1DDF8E0EEBD3A633215DC1575E14656BE38B939D
                                                                        SHA-512:E4EC2BC714069E0A6B56D89B52AABAD92E5BA741DC6F26D2FC2D72AA9AD2EC465DEA523CCCD810331AB78B5FB8A1244B2B521303418EAD5BD6BE5A58B43794C5
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ibW.-.9.-.9.-.9...7.(.9.{.*.,.9.-.9...9.Rich-.9.................PE..L....#.6...........#..... ...................p....4e......................... ......+................................6..%$.......................................g...................................................................................text............ ... .............. ..`.data....a...0...`...@..............@....rsrc...............................@..@.reloc...g.......p..................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\olepro32.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):164112
                                                                        Entropy (8bit):5.8462943829831575
                                                                        Encrypted:false
                                                                        SSDEEP:3072:+VrhrwLXcA2Ha/joWklbo/Acjwm4AaW7zozn/zgOh0Z76:fklbsqmyWnoz/P
                                                                        MD5:CE0155405EA902797E88B92A78443AEB
                                                                        SHA1:8ADFF69050D14A57D7F553CA8978439AF188C192
                                                                        SHA-256:789C3C45EDA1749BD939F4A96616E1E9EF1B7DCC62A2889F65088954C64D0938
                                                                        SHA-512:3FDE09067F9CA8D315DE07C8DB972F99723EA4C3F997DC58210F9D6565CAA9935C79F13E8B2D20ADC5609919A381E4C2A90A0B3123A35947997229D7C615E162
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.'r!.I!!.I!!.I!w.Z!*.I!!.I!\.I!Rich!.I!........PE..L....!.6...........#.................)... ........0_............................. ..>................................................0...3...................p...... #............................................... ...............................text...q.... ....... .............. ..`.data....X.......P..................@....rsrc....3...0...@... ..............@..@.reloc.......p... ...`..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\stdole2.tlb

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):17920
                                                                        Entropy (8bit):4.083884450202126
                                                                        Encrypted:false
                                                                        SSDEEP:384:cogoEvM/uFrR+X6QNn1pcJIrWocDGWct:cogoEvM0rgqQNn3
                                                                        MD5:1B02577F0ADDEA32EB02A50D4A4CDD1E
                                                                        SHA1:36F701CCEC78A5D218FEA23FD05351890F14CF7D
                                                                        SHA-256:6EA525BFACE5467C1045C3708F339A4B92A3A273F70656E061C7F7322C56D667
                                                                        SHA-512:87FD4AA5158D09EB97B6131E651DB2A4761546907A960AF7792F8E95947C0A825E84F88ECCF42EC896FF5BB2BBC461488B898D5F1BD853847317493C44B330C9
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......eU!.!4O.!4O.!4O.!4O. 4O.Rich!4O.................PE..L....!.6...........!.........D...............................................p...........................................................@...................`.......................................................................................rsrc....@.......B..................@..@.reloc.......`.......D..............@..B.............!.6............ .......8........!.6............P........!.6............h........!.6.....................!.6....................@:...........J................T.Y.P.E.L.I.B.MSFT................A...........*................................... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...............h...........................................L...P.......

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\vbrun60.inf

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Generic INItialization configuration [DestinationDirs]
                                                                        Category:dropped
                                                                        Size (bytes):1069
                                                                        Entropy (8bit):5.4959184158351215
                                                                        Encrypted:false
                                                                        SSDEEP:24:yuZq732XeLfX8IUy3k8exg5S3X8n2uNXVANXVMbNX9NXR/NXVuZZNXV0pT7:BJeL/8IhvFSn82CVoVMB/DViDV057
                                                                        MD5:F8854BDCD55ECCF24F077981ADFE6B9A
                                                                        SHA1:377FC226B1C10B244F1E32F6EA3A20B5D47D4777
                                                                        SHA-256:E5A9050E93487A1D296CEEC10B95BE9F92EB877AA2913296B5C31B9F74F7C788
                                                                        SHA-512:6331F337A1595D6F83281614E6A92AABA9D8B27FDA3B5CF4E85F1B49AC335E10F0F62CD147131D53C473B3ACC42BC27F2D02073F0CC60755CA10871EF2E7AC8E
                                                                        Malicious:false
                                                                        Preview:; INF file for Visual Basic 6.0 Run-time Redist Pack....[DefaultInstall]..CopyFiles=install.files..RegisterOCXs=RegisterFiles....[DestinationDirs]..install.files=11....[install.files]..OLEAUT32.DLL,,OLEAUT32.DLL,32;..OLEPRO32.DLL,,OLEPRO32.DLL,32;..ASYCFILT.DLL,,ASYCFILT.DLL,32;..STDOLE2.TLB,,STDOLE2.TLB,32;..MSVBVM60.DLL,,MSVBVM60.DLL,32;..COMCAT.DLL,,COMCAT.DLL,32;....[RegisterFiles]..%11%\OLEAUT32.DLL..%11%\OLEPRO32.DLL..%11%\MSVBVM60.DLL..%11%\COMCAT.DLL....[OLEAUT32.DLL]..file-win32-x86=thiscab..RegisterServer=Yes..FileVersion=2,40,4275,1....[OLEPRO32.DLL]..file-win32-x86=thiscab..RegisterServer=Yes..FileVersion=5,0,4275,1....[ASYCFILT.DLL]..file-win32-x86=thiscab..RegisterServer=No..FileVersion=2,40,4275,1....[STDOLE2.TLB]..file-win32-x86=thiscab..RegisterServer=No..FileVersion=2,40,4275,1....[MSVBVM60.DLL]..file-win32-x86=thiscab..RegisterServer=Yes..FileVersion=6,0,97,82....[COMCAT.DLL]..file-win32-x86=thiscab..RegisterServer=Yes..FileVersion=4,71,1460,1....[version]..signature

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\cabinet.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):56080
                                                                        Entropy (8bit):6.471892347922079
                                                                        Encrypted:false
                                                                        SSDEEP:1536:Je/7+7mzLZ9Q6uooPz0OQJ6hbaenpmju6xv50VK/kroRj:JeC7mzl9Q6w09J6hbaop0OK/kroRj
                                                                        MD5:267AB17A3526C6C46B2A1CF9A0A51280
                                                                        SHA1:A18DDA64D88228D0783D5FF24769FF0375DB1349
                                                                        SHA-256:CB535E27870708F94F46ECB75BF6A5DFF17422C28B9F21C2C80AB7B1FCF1F715
                                                                        SHA-512:DD462E0DD24940C39EBF843D21DECEDC2CA96FEC3848CDE25218EC9EA45B19A8D559251309240688E981C6915BEC664B6969280E157B00115F13003E60BE430A
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{J...$...$...$...%...$..97...$..."...$...$...$.Rich..$.................PE..L...R.C8...........#.........2.....................u.........................0......N...........................................<............................ ......`.......................................`...D.......\............................text...M........................... ..`.data....(..........................@....rsrc...............................@..@.reloc....... ......................@..B4.D8 ...0[.8-...5.D87...........KERNEL32.dll.NTDLL.DLL.ole32.dll........................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\imagehlp.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):106013
                                                                        Entropy (8bit):6.212455176025638
                                                                        Encrypted:false
                                                                        SSDEEP:1536:M82ThwpbJDIQp4J0O0oRPcHPsw7e2EoFtV6tF3x6WyglF3CT:yTh0bJDIQp4J0O08cHp75kH6pgX3CT
                                                                        MD5:0B783914A5BF8CE566C6F7BE36E50759
                                                                        SHA1:B72151196A33D73606D20B0265B2D039EF9D1CF2
                                                                        SHA-256:A01EA2839B8B9676631CC7D5A9E8D6D64C2CAE5CFBA8D7E74D6E9F4B0E122331
                                                                        SHA-512:E863B49D8B1681279D4083EC6AAFC8EE3BB91F81DF4428089219BE616FD66560CC8F97B674B208ABD0566763E27ED5546F9DF9EC7B85B82E17F0376D6B6A07ED
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....B/3...........!.....P...P.......S.......`.....v................................................................p.......k..(....................................`...............................................`...............................text....N.......P.......... ....... ..`.rdata.......`.......`..............@..@.data...4............x..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\instmsi.msi

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Windows Installer database, Author: Microsoft Corporation, Keywords: Installer,MSI,Database, Comments: Instala Windows Installer, Create Time/Date: Wed Apr 14 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 2, Template: Alpha,Intel;1033, Last Saved By: Alpha,Intel;3082, Revision Number: {CA04376B-A6BA-F246-20B1-EBD703D8F0D2}1.0.00.000;{CA04376B-A6BA-F246-20B1-EBD703D8F0D2}1.0.00.000, Number of Pages: 30, Number of Characters: 8
                                                                        Category:dropped
                                                                        Size (bytes):951808
                                                                        Entropy (8bit):6.02604379952541
                                                                        Encrypted:false
                                                                        SSDEEP:24576:T8aSNCmuikMvQVcboqTR/oNsBOozxEAnxEq6UEWtoDbC0snsTSOfWLkLIHt2xNq0:T8aSNCmuiXQVcV/oNsBOozxEAnQWto/l
                                                                        MD5:DACAD73CE0EF57276296E89A4F28710E
                                                                        SHA1:5E99C052B9D24C8C245632D0691B949F59E19D95
                                                                        SHA-256:61AD5E27FC7D0D39E7CBA51C3792F18E6FDC744921E6C416798D8179AACFC32A
                                                                        SHA-512:1268D7A180F95847DD0725633E87884D478EBACBF93D11CB7557BF58CDABCF487D8E2D4E36717335983AB81816CB713F04E91E722A4D74CDA7EE34554E4DFED9
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................p.......j.......n.......v.......t.......k.......g.......................................................................................................................................................................................................................................................................................................................................................................................................................C.......................................................A.......D................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...i.......E...f...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e.......g...h...l...j...k.......m...n...o...........r...s...t...u...v...w...x...y...z...

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msi.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1927680
                                                                        Entropy (8bit):6.128521877107153
                                                                        Encrypted:false
                                                                        SSDEEP:49152:XCRTdYNHpRTrNHpRTfNHpRTRZzg5UYvn81oq24TVvnN6MatzkEs+qa3URcNoX:Tg5UYvaoq24TVv4MatzkEs+3xo
                                                                        MD5:1F4327678ED079D6FE37CBB2679F9B7E
                                                                        SHA1:1F5ECF24191E7E40C54354EFEFAC95A21AE91EA4
                                                                        SHA-256:56B289A74A0420E0D8BEFF631F1FC34C9F650E1876C2FE2BD7CC715CBAD04C49
                                                                        SHA-512:628359DD72B3684C08751E5890A79D11DBF9820A2F9DA706D92DEFDCE7942A09FDD7FC1634F85D99D312A068E05B3C166DD8D4A5F99A7DA6039A94B4A9653C7A
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y...8..8..8....c.8..I.U.8..z.f.8..8~..9..z.?.8..z.@.8..Z.b.8..Z.c..8....:.8..z.B.8..Rich.8..........PE..L......;...........!.........z.......i.......0....@.............................................................................x.......0)...........................................................................................................text............................... ..`.orpc........ ...................... ..`.data....|...0...d..................@....rsrc...0).......*...n..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiexec.exe

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):83456
                                                                        Entropy (8bit):6.31626628635355
                                                                        Encrypted:false
                                                                        SSDEEP:1536:2eIGSoxLTd4LcE3AeweFR/L0thKAMkIOyMYozY0Cri+tg43wKcQvL6:jIGSoxLTd4LxAen0/Kbk5YozIeOwKcQu
                                                                        MD5:E6B975475B001A15B14AE6BDCDE58E45
                                                                        SHA1:78E98C30801D2E9FF3005F829B0574CD2B3C2F48
                                                                        SHA-256:175435FD486045310E8C393B9B151638756AD14C7C93232BBD9D6920F1268E46
                                                                        SHA-512:67957EB32D414E883EDF9D957D9A8783FFD5305E968A046245B79FB7677D5ABEB2651280C9D2117C097BBF53B2A4A10A6B40D5522C4A04F9A0F37D94548C620A
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P2...S...S...S...p...S...S...S...p..S...p..XS...p..S...p...S...p...S..Rich.S..........................PE..L......;.....................P............... ..................................................................................x....`..X...............................................................................|............................text............................... ..`.data...T3... ... ..................@....rsrc...X....`.......*..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msihnd.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):297472
                                                                        Entropy (8bit):6.293291033170778
                                                                        Encrypted:false
                                                                        SSDEEP:3072:QA/lZmzljpUKaEU6q+R91vlI2+a1Lnby+0K9RrqfXPQUwyf8gSXlTHM9u3cQKtTP:QA/XIUzEUonvlIrGT0MWfYdbzlbMIkz
                                                                        MD5:AB3A6F9B84D4B74F7811A99FB0314A9B
                                                                        SHA1:C26185396B46ED706C401A8605CE1BF946AE5CF1
                                                                        SHA-256:F7382C1B01B52ABFEF7BD5E7921C2D05E114584255FB1BC17119DBC035C8A008
                                                                        SHA-512:1C08854A4240C84913FD925968D838BE25978A58A2D0C59EF46636ED90105FF60CEE047CC58B5B7F555744461095A4CD854F4EB4670BE7870778D743E1D4281E
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E-.Q$C,Q$C,Q$C,..Z,^$C,Q$B,.$C,...,G$C,..|,P$C,...,P$C,..^,^$C,.._,/$C,..~,P$C,RichQ$C,........................PE..L.....;...........!..............................@..............................................................................................................+......................................................\............................text...c........................... ..`.data....4..........................@....rsrc...............................@..@.reloc...5.......6...T..............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiinst.exe

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):36864
                                                                        Entropy (8bit):6.126214350182879
                                                                        Encrypted:false
                                                                        SSDEEP:768:SSjhX67ianPrIQBpZE/vwsRcL1S2cETJXUl:SS1X67RnUQBXYIsOZS2c4JE
                                                                        MD5:47EB6C6EAAAE1544A50339A51A8AE481
                                                                        SHA1:7DF0BEB8F719174419D9421497F203D63290F8D6
                                                                        SHA-256:3C97927B8BF0BB1A54271D6F117E0E12B673122284B2E382D55237A3487960B2
                                                                        SHA-512:A675F471A8404830B114CEC2F0605EF18DCA203B74E2D5A26F3F3A9B0055FF3DAAD45E04AC11FC794E6DF90B9CE700CF39F85E2F2193AF1D13BDE776D3157FCC
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.jir..:r..:r..:...:y..:r..:...:..D:|..:...:I..:..A:s..:...:u..:..9:s..:Richr..:................PE..L.....;.................|...........I......................................................................................$...x....................................................................................................................text...$z.......|.................. ..`.data...x...........................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msimain.sdb

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Windows application compatibility Shim DataBase
                                                                        Category:dropped
                                                                        Size (bytes):134164
                                                                        Entropy (8bit):5.119567377291569
                                                                        Encrypted:false
                                                                        SSDEEP:3072:2vbOQXQtrj+jcAxeL9+9sw4vQoZv++lbuSOS+J:2vbOQmOgL9+YOj
                                                                        MD5:9A7CA59803DD20AC5C6B900E8665169B
                                                                        SHA1:247C0DC1C82F70E6E7F9CAFA9F7C8C69EC4C2648
                                                                        SHA-256:AEEC814144D4253D3167360EC6399F542D9123E4D5878808BAC279D6436B3C8D
                                                                        SHA-512:DADD8F6023F063F59C0F7703D706218F59F8D54EDFF3CB2CF8C71C67DF22CF6EE32C379DD65C2C69D3FFCF0D84C500737EA294C9CB1126656FB1D6E629F3058C
                                                                        Malicious:false
                                                                        Preview:....A*..sdbf.xh....x.....8.p.8.`.@......x...VILEBODAf...02MOCUED~...OCHCNERF....OCOTOHPI....RT1002IP....IERUTCIP....VEZILAER....DACOBRUT......YAWNIW&...IUSSKROW>....x.....8.p.8.........F1R..'.r....*c..........n...@............N...p{...4!....k.\o8a.&.........>.+......)...w/........=@i?........=@i?.........ED....q-...I.....qM...I.....q]...I:....q}...I.....g.tWc.L.......s3.`O4......~.'.Xl...Y0.50..YV.......3.i\.....7..AZd.f...K@}...F.....0i........?.3i....2...,.3.....j.....*...........\...6.l.....\...6.......Q. .d......8 ?..H...,....@N.........i*%.B...P...>.......X6...........^^..^!......^^..^!.T....^^..^!.D....^^..^!.6.......L........x.....8.p.8...@...........p..-1..V...U.h.........u.......D.....8.........."a..N..D....H.`T.z........../'2...t=.'.o.+........M..0........9.W1j.......|.GE....qO.2-:.H:...,....I.R....T.kI..SYF...;.Ek..Y......;..nw[d....8..O.f......'.fK.h4...c...I..q....J....z.y....n..g...|......!Y|p.......&Eo....r.......L........eS.....B...&.w........vI!$!E-.H.

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msimsg.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):847872
                                                                        Entropy (8bit):5.7770113379561385
                                                                        Encrypted:false
                                                                        SSDEEP:24576:7FrZsyKWdbhmUXE9KIrufRO4t1YF6OWez17:VVhmUXE34t1YFp7
                                                                        MD5:1528B3892C7D02CD5BC58DB0736C069D
                                                                        SHA1:7B25B7DEC2448CD31D2D029FBB9177D68B0FA107
                                                                        SHA-256:AA5A8E2DFA32FD93E56B93F4EE57131EFCAB0C66E822D59DB187410D923EDB6B
                                                                        SHA-512:FF9CF44CEE136B5D9854C67F0F05740BBA915B58240F0A9A816DED4EEAE151B4A6C60D0BE650B9E28276DA582FBE1AC22149621CC2599270790E419609EE5CF5
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........=.C.S.C.S.C.S.....B.S...n.B.S.RichC.S.................PE..L...U..;...........!....................................................................................................................x............................................................................................................rsrc...x...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msisip.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):40448
                                                                        Entropy (8bit):6.0759855839723365
                                                                        Encrypted:false
                                                                        SSDEEP:768:DvNOtQ6P36XywYpWMbhK5CuInamzP0gEWm4C0HO:rNOK6/6zYpWM0C7namzPFEd0H
                                                                        MD5:B5BECF4BDAF9D68ABFFEA2E7F4747265
                                                                        SHA1:CCA2DF95690835604BC00E46F39DEA08810DF8EF
                                                                        SHA-256:325D9AEECB2E2607ECC43BFCE7E49C2561195158E8A38F366A33CCA5300876C4
                                                                        SHA-512:B0828B92849BB6A8E7CF5966C2930502F733C5F6D42787F8873FC1ADB1048A922DE786395BAEABBFE90E30365F29E1698ABEB156B34C3544B692921821DBECF3
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k.c.8.c.8.c.88@.8.c.8.@.8.c.88@.8.c.8.c.8.c.88@.8.c.8U@.8.c.8.@.8.c.88@.8.c.8Rich.c.8........................PE..L......;...........!.....|...&......Y<............@..................................=.............................. ...8......(...................................0................................................................................text...X{.......|.................. ..`.data...|...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msls31.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):167936
                                                                        Entropy (8bit):5.9814955021734715
                                                                        Encrypted:false
                                                                        SSDEEP:3072:sIvjlvPmGwB5RezjIN+vqjo/pFNrk3br+uubhokMD81s2pAFfqCF1hW4HgB/i:sSjpjwOjIN+v30vsVW2pK7F1hW4Hg
                                                                        MD5:2CAB9989FB957EFD98DBBBCB9B1946AB
                                                                        SHA1:0D01E4AC66D852730D8031A2BCAE215210EA7385
                                                                        SHA-256:841FDE9B24476A7ED364A3E4A1470AC9B7358BC92F29FCA4A06AAB557D140850
                                                                        SHA-512:92FA2DACE9589789FE2A84E4F561D1DDA32858AEEB4CD13EF73D94D6619A27F68988D653367D0CEB91FBFF8C427D6FF28E8ED0FE00FBA91B006F9FA13F3F9943
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........#..cp..cp..cph.ip..cp8.ep..cph.gp..cpRich..cp........................PE..L......6...........#.....0...@............... .....H.................................=...............................A..Y............`.......................p.......J...............................................................................text....#.......0... .............. ..`.rdata.......@.......P..............@..@.data...@....P.......`..............@....rsrc........`.......p..............@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\mspatcha.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):28746
                                                                        Entropy (8bit):6.545540060601869
                                                                        Encrypted:false
                                                                        SSDEEP:768:hLCnlsA4wVor2lcvDd2nafVz7aGXdP6YMKdI6C6udCv:h2voo2p2naf9aediYMftdw
                                                                        MD5:60D88C0829FE1E16C32F76D71724807B
                                                                        SHA1:40FB4D13A643B6F8A7A7CABC2A3F9E48B9E0CC50
                                                                        SHA-256:6007DA6BB72FE138DD4AE622C78C5337E3EAF9E8020B748B4A6918563EC988F6
                                                                        SHA-512:A8D35023AA60C601B581847E8FA3A1B5E52D5A6515DE6C6EAF7AAFA64CDD6A3BFE6E17281C6870F39343D8D45E2460A8730E8BAA26C24296087BF37ACF55E414
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................................Rich...........................PE..L....aJ9...........!.....d.........................X..............a..................`...............................p.......n..(...............................X...`...................................................T............................text....b.......d.................. ..`.rsrc................j..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\riched20.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):431133
                                                                        Entropy (8bit):6.6536949023972145
                                                                        Encrypted:false
                                                                        SSDEEP:12288:xWNTGm1c2qUkM9nv2VOXRc5uynesaycwrt/cIC:xW8m3qUv9EeROxXcoJC
                                                                        MD5:AE5ABEC31518E015A9FB4EB196854291
                                                                        SHA1:DEB63ECB2CBC60A688797478A204A2A57F49D1E6
                                                                        SHA-256:1C2508FB55DDC459D0327F2017471545C87420443391567094E768FB34032DA1
                                                                        SHA-512:DFE3E803AB7940FE4811627832CD048ED872111C3AE6B4DFE3493CB14E7932AFF9B5ACA7E5F387F5B38A44CAFBB350540A4B41955A3D28F36953B01FABCAA2F9
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.Gu...u...u...u...{...,......._...t...u...$...Richu...........PE..L...0.V8...........!...............................H................................................................`...=................w.......................(..<.......................................X...l...............`....................text............................... ..`.data...............................@....rsrc....w.......x..................@..@.reloc...(.......*...j..............@..B4.D80...0[.8=...4.D8G...4.D8T.....+8_...........KERNEL32.DLL.NTDLL.DLL.ADVAPI32.DLL.USER32.DLL.GDI32.DLL........................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\sdbapi.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):63488
                                                                        Entropy (8bit):6.659673413793373
                                                                        Encrypted:false
                                                                        SSDEEP:1536:PETcumoD4VtSnCl2nMdzMdcITmPKhi1fKIaj1/VYcR83:PETcRVtSnUdzMZiFA/VYcR83
                                                                        MD5:F8FD9158C6C71F3494A1D469EF78EEA3
                                                                        SHA1:747C7D9AA94317B894A77EA903DF959F60282EC4
                                                                        SHA-256:68AEFE972833C881857B27BC28D3191234B3C0D73B0F538032DCB82BE3DC4A0E
                                                                        SHA-512:D0940A38711DEB93139469863A5B507BE246AFDEDE6195FDD0264490FA4A00A06BB223347316E877B38557FAD5275FFA4384FF58836F54394819800FB140B843
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N..O.h...h...h...K...h...h..Nh...K...h...K...h...K...h...K...h...K...h..Rich.h..........PE..L....};...........!...............................G......................... ......................................P...c.......P...........................................................................p...X....................................text............................... ..`.data...............................@....rsrc...............................@..@.reloc..............................@..B..};(.....};3.....};@.....};M...........msvcrt.dll.ADVAPI32.dll.KERNEL32.dll.NTDLL.DLL..................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\shfolder.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):21021
                                                                        Entropy (8bit):4.8801661651868615
                                                                        Encrypted:false
                                                                        SSDEEP:384:L5yAJ3gXLVMYNcJhGCMcrXWpiWwH/sHHgH2nKwsHTWHi5AGsHW0HcHpLHP0oqQGI:0AJ3IMYNcJXMcyu/z
                                                                        MD5:B7993C10B9A8C3B9735D7696C7B9E8B6
                                                                        SHA1:AC2E765311380BFA502B3B7AED2E8D80C351E08B
                                                                        SHA-256:6F0443A62FD444C4254F902F668543B867A0577504915D22CD75328F73CD4472
                                                                        SHA-512:D17AE76467F5FAC056494A0FDEF445A5BBB1F633507DDEF9B2AFC12DD47EAA68096784D47E968383B207382850100EF1915378E74564E29CBE1C8E0D422DD679
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q{J...$...$...$...%.'.$.L97...$..."...$...$...$.Rich..$.................PE..L...q.^7...........!.........0...............0.....u.................................................................'..k....(..X....@...+...................p..P....,......................................`...4....................................text............................... ..`.data........0......."..............@....rsrc....+...@...,...$..............@..@.reloc..P....p.......P..............@..BM.^7....N.^7%...........KERNEL32.DLL.ADVAPI32.DLL.......................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\usp10.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):314906
                                                                        Entropy (8bit):6.170788306003831
                                                                        Encrypted:false
                                                                        SSDEEP:3072:10EvBHYN6cpZbdPYxDhjnYnMq182s8Vvh0VCPL2zHoytG5dHJZE5d8wfI:1LHYwcLdy9Ir6v8tS8ytG5dHL+pI
                                                                        MD5:4437B4E1EFC79C331070B9F481E3E97A
                                                                        SHA1:793B1D0839912679CB43E50B63C186205B8B7D44
                                                                        SHA-256:4D8FF1F53C3BABF9BFD11B2EBCD44E2698CFE3BC80C6F0CBC64C0D191EA1FC1B
                                                                        SHA-512:C82CEA06778426943958E47A8A3372731A3834C412F919E1E6C35B7FE41DD55E3E6D881CD489464A69FD65180A4B1632527C0B06E62700F5C66BF4867089A7CD
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............................................Rich....................PE..L...0.C8...........!.........................@....ef.........................@....../^..............................@9.......1..d............................ ..p...`...........................................l.......`............................text...]-.......................... ..`.data........@...>...4..............@...Shared..P........0...r..............@..P.rsrc...............................@..P.reloc....... ......................@..B4.D80...0[.8=...4.D8G.....+8R...4.D8\...........KERNEL32.dll.NTDLL.DLL.USER32.dll.GDI32.dll.ADVAPI32.dll........................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\mWinRunExec.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1353504
                                                                        Entropy (8bit):6.674591083664776
                                                                        Encrypted:false
                                                                        SSDEEP:24576:sff3GymQgwTKYZe9YNTUPTBAS5m0WrSu/CScsOE:EmjtTT6S5ro/CzsOE
                                                                        MD5:F7FF3D6E5359DA5243D7889D3200E32B
                                                                        SHA1:6B4B02BBE68B09DF0D0CD680ECB56DF6C7F4463C
                                                                        SHA-256:69DD649F0D3A05149E048EE216F8F68D8B81AE32473EF511A144C99352FCA960
                                                                        SHA-512:9B11E90E0C50826EE571C3B6AA7D039AAD4B18481619404D3E578A41585214943FFC8C2A551E2B883C7C4F3544635A1BF5DF178F94B654C63F11E7ABF494B69E
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....;.b.....................v.....................Q....................................................................R......."6.......Z...........P.. W... .........................................................\.......^....................text...H........................... ..`.itext.............................. ..`.data....O.......P..................@....bss....|S...P.......*...................idata.."6.......8...*..............@....didata.^............b..............@....edata..R............l..............@..@.rdata...............n..............@..@.reloc...... .......p..............@..B.rsrc....Z.......Z..................@..@.....................P..............@..@........................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\cabinet.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):56080
                                                                        Entropy (8bit):6.471892347922079
                                                                        Encrypted:false
                                                                        SSDEEP:1536:Je/7+7mzLZ9Q6uooPz0OQJ6hbaenpmju6xv50VK/kroRj:JeC7mzl9Q6w09J6hbaop0OK/kroRj
                                                                        MD5:267AB17A3526C6C46B2A1CF9A0A51280
                                                                        SHA1:A18DDA64D88228D0783D5FF24769FF0375DB1349
                                                                        SHA-256:CB535E27870708F94F46ECB75BF6A5DFF17422C28B9F21C2C80AB7B1FCF1F715
                                                                        SHA-512:DD462E0DD24940C39EBF843D21DECEDC2CA96FEC3848CDE25218EC9EA45B19A8D559251309240688E981C6915BEC664B6969280E157B00115F13003E60BE430A
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{J...$...$...$...%...$..97...$..."...$...$...$.Rich..$.................PE..L...R.C8...........#.........2.....................u.........................0......N...........................................<............................ ......`.......................................`...D.......\............................text...M........................... ..`.data....(..........................@....rsrc...............................@..@.reloc....... ......................@..B4.D8 ...0[.8-...5.D87...........KERNEL32.dll.NTDLL.DLL.ole32.dll........................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\imagehlp.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):106013
                                                                        Entropy (8bit):6.212455176025638
                                                                        Encrypted:false
                                                                        SSDEEP:1536:M82ThwpbJDIQp4J0O0oRPcHPsw7e2EoFtV6tF3x6WyglF3CT:yTh0bJDIQp4J0O08cHp75kH6pgX3CT
                                                                        MD5:0B783914A5BF8CE566C6F7BE36E50759
                                                                        SHA1:B72151196A33D73606D20B0265B2D039EF9D1CF2
                                                                        SHA-256:A01EA2839B8B9676631CC7D5A9E8D6D64C2CAE5CFBA8D7E74D6E9F4B0E122331
                                                                        SHA-512:E863B49D8B1681279D4083EC6AAFC8EE3BB91F81DF4428089219BE616FD66560CC8F97B674B208ABD0566763E27ED5546F9DF9EC7B85B82E17F0376D6B6A07ED
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....B/3...........!.....P...P.......S.......`.....v................................................................p.......k..(....................................`...............................................`...............................text....N.......P.......... ....... ..`.rdata.......`.......`..............@..@.data...4............x..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\instmsi.msi

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Windows Installer database, Author: Microsoft Corporation, Keywords: Installer,MSI,Database, Comments: Instala Windows Installer, Create Time/Date: Wed Apr 14 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 2, Template: Alpha,Intel;1033, Last Saved By: Alpha,Intel;3082, Revision Number: {CA04376B-A6BA-F246-20B1-EBD703D8F0D2}1.0.00.000;{CA04376B-A6BA-F246-20B1-EBD703D8F0D2}1.0.00.000, Number of Pages: 30, Number of Characters: 8
                                                                        Category:dropped
                                                                        Size (bytes):951808
                                                                        Entropy (8bit):6.029627921240929
                                                                        Encrypted:false
                                                                        SSDEEP:24576:A8OSNZmfikMhQccboqT+/+NsBGozxEEnjEq6UEWtoDbC4snsTMOf2LkLIHtuxPqC:A8OSNZmfiZQcc6/+NsBGozxEEn+Wto/X
                                                                        MD5:2B4B94ABE5C6B89A47F212C2D696D618
                                                                        SHA1:15DF612410AC2D576D069DF94B306066D15D60F3
                                                                        SHA-256:3900B678DE6D24DB7ED9D7190517C60793B9B435EC58BBE46AAD044A49CAF636
                                                                        SHA-512:0311EAC11B1FE3A3AE6420F46534A420E70C3C8D2BF05D5E754DFDB480722D28E97732AF0E25890AF22C3FAC1CE01ED008886E22445C37E9894ED76FEA76850A
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................p.......j.......n.......v.......t.......k.......g.......................................................................................................................................................................................................................................................................................................................................................................................................................C.......................................................A.......D................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@.......B...i.......E...f...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e.......g...h...l...j...k.......m...n...o...........r...s...t...u...v...w...x...y...z...

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.cat

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):9178
                                                                        Entropy (8bit):6.934013526787076
                                                                        Encrypted:false
                                                                        SSDEEP:192:nC1zR7DDb5qikTvpTKaErlnkTN2+goPKJ54Kn4dFR+4Db:ArAChe1nDj+Yb
                                                                        MD5:C74C5092222CA8B7C32B3423B22DE3A0
                                                                        SHA1:3EF6BE0BBF482EB3D026247B31B1A0DADBC1C71F
                                                                        SHA-256:4B3A1258638737EE338885DFF62256AA747A08BFC738C4A9850477B4AC7462EB
                                                                        SHA-512:3059D6BE46BFCBBAC148C5A6E20D9EF5512F2F5B5EC0BE5970C1E34FE73EC81D01D5D54F9CB6DBAECBD0ECC8F7A89D031E9D173D5A6925EC0FF89FFA1601B0AD
                                                                        Malicious:false
                                                                        Preview:0.#...*.H........#.0.#....1.0...*.H.......0.....+.....7......0...0...+.....7.....(..GN..F..*....W..010818054031Z0...+.....7.....0..j0..&.R0.2.4.8.2.9.8.3.6.D.D.0.C.B.1.0.9.8.0.F.E.E.E.C.1.E.1.D.C.1.A.C.6.3.A.0.B.0.8.4...1..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........H).m...........c...0....R2.4.7.C.0.D.C.1.C.8.2.F.7.0.E.6.E.7.F.9.C.A.F.A.9.F.7.C.8.C.6.9.E.C.4.C.2.6.4.8...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........$|.../p......|.i.L&H0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0..&.R3.7.0.F.D.A.0.E.C.9.4.3.3.B.2.6.E.4.A.B.3.C.8.5.C.0.4.3.0.4.0.7.A.5.3.4.A.2.E.8...1..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........7.

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1991168
                                                                        Entropy (8bit):5.8958492897713075
                                                                        Encrypted:false
                                                                        SSDEEP:24576:GB7Nqm40TSJvanFIrEegExvhiwtqeBf4QASo0u7kHRwuVkdLURWs:GB7dSJvanedlxEwtq+sr7KVyLURF
                                                                        MD5:5A6627C42F40199CABBF11391E141928
                                                                        SHA1:43D97D4DA87D15C7FD96D95F9BFC90C3CEBF8A91
                                                                        SHA-256:860E1B58DE5FCB3DBC7DCD9A16C5FAA56C748DA24C69A05417C75CD40E4432D3
                                                                        SHA-512:F63401AB3650EF3CB5DE8F419807E3C3825F3CF68DA39A13C084A3DFA562BA77E7993F99B2E83AE2CED4D95D763AA49BB3D3228C07048BDB2654CD3767A6EE8D
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I....................................%.......%......%.......................H......%.......Rich............PE..L.....};...........!................\~.......0.....w........................................................................$...........H)..........................p*............................................... ...............................orpc............................... ..`.text........ ...................... ..`.data........0...l..................@....rsrc...H).......*...v..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.inf

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Windows setup INFormation
                                                                        Category:dropped
                                                                        Size (bytes):1116
                                                                        Entropy (8bit):5.322486389930819
                                                                        Encrypted:false
                                                                        SSDEEP:24:podajIZRTvvD6SxJre7OI+g/5xCYUf4QOSNWU4KugU5IvDGfjbIDSFSxJSbcexJJ:4aUTzSR5WvWNJgwIKbIDSY2bce2S
                                                                        MD5:FB6D53A80B79EEF39A6EE32DC35EF9EA
                                                                        SHA1:59A11A3EF985F9F776D5908F0A11910BB749CD5D
                                                                        SHA-256:95CC7C6E3797E544516B952442888D6A000FEF7B339997EC8ADDB7F180DF6D7E
                                                                        SHA-512:E29268033177E88693385847EEA2A2118943B3848A552E3A9B2629106F41644F82C78AE6CAD2CFEBE34D70D7F7212E3411687E32094E9D469EA74409C32346E1
                                                                        Malicious:false
                                                                        Preview:[Version]..signature = "$Windows NT$"..Class = %ExceptionClassDesc%..ClassGUID = {F5776D81-AE53-4935-8E84-B0B283D8BCEF}..Provider = %Microsoft%..CatalogFile = msi.cat..ComponentId = {2E742517-5D48-4DBD-BF93-48FDCF36E634} ; GUID assigned to the Windows Installer..DriverVer=03-13-2001, 2.0.2460.1....[SourceDisksNames]..1 = %msi_media%....[SourceDisksFiles]..msi.dll = 1..msihnd.dll = 1..msimsg.dll = 1..msiexec.exe = 1..msisip.dll = 1....[DestinationDirs]..Msi.SystemFiles = 11 ; %windir%\system32..Msi.DllCacheFiles = 11,dllcache ; %windir%\system32\dllcache....[DefaultInstall]..CopyFiles = Msi.SystemFiles,Msi.DllCacheFiles....;..; COPYFLG_REPLACE_BOOT_FILE flag (0x1000) not necessary for..; files in the dllcache..;....[Msi.DllCacheFiles]..msi.dll..msihnd.dll..msimsg.dll..msiexec.exe..msisip.dll....[Msi.SystemFiles]..msi.dll,,,0x1000..msihnd.dll,,,0x1000..msimsg.dll,,,0x1000..msiexec.exe,,,0x1000..msisip.dll,,,0x1000....[Strings]..Microsoft = "Microsoft Corporation"..msi_media

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiexec.exe

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):63488
                                                                        Entropy (8bit):5.818017231218899
                                                                        Encrypted:false
                                                                        SSDEEP:768:rI4YSbqG4TY4LkR2Jcwuoc7NokgteLVyNlKludccVor3whUOyZWCTRpmaBVVG:x4TY4LCj+c7NIGVybKluS3YnyQCyaB+
                                                                        MD5:E7A49533944654EDD82D26338DF0FD05
                                                                        SHA1:573E88D79B4359D4314A3DB71928730BD018FDB5
                                                                        SHA-256:9E251671385941E2ADA9AA40811F1BA1E876E40A70C81AFAE1F88D18D80D0FEB
                                                                        SHA-512:5C7933E4F1D4329380F22C9FED907041295DBD9D91CDDAC20961924614AA944ED6641915D0777DB0BB0C55B6C097EC51C10A21096C6C098E2EFE6B84219A5BD9
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........S[b..[b..[b...A.._b...A..Pb..[b...b...A..Tb...A..Zb...A..Yb...A..Zb..Rich[b..................PE..L.....};.....................H............................................... ......y9......................................<...........h...........................p.......................................P...........T............................text...^........................... ..`.data....*..........................@....rsrc...h...........................@..@..};H.....};S.....};`.....};m.....};w.....};m.....};......};............msvcrt.dll.ADVAPI32.dll.KERNEL32.dll.NTDLL.DLL.USER32.dll.ole32.dll.msi.dll.....................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msihnd.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):304640
                                                                        Entropy (8bit):6.29099735641058
                                                                        Encrypted:false
                                                                        SSDEEP:6144:NT/c7YrGE4VUDbJIFo4791yrsd4DtTnnhV7d:q7YrGEJqLzotTnh5
                                                                        MD5:E7F00952494BA4D9545242514614844A
                                                                        SHA1:8AC8A0228698E562C1B1592177662611ABEF144C
                                                                        SHA-256:DA4192B9B0A0C3A1BE1F1E52E2A4CC4BCF11B8436B04D0AE8118EF84FC4F6D34
                                                                        SHA-512:5FAA7518B5A4C33797C0D43D7C884D408351507B7223698DEF313AE23DAABE8B9B10DB58F86939D054CB5DADE6FCA525EBDC84E26D97FCFD42866D9EF9B179E2
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6..W...W...W...W..ZW..Wt...W..Wt..W..Wt...W..:t..W..wt...W..wt..,W..Wt...W..Rich.W..........PE..L.....};...........!................]..............`........................................................................(....................................+..........................................x...........t............................text...c........................... ..`.data....8..........................@....rsrc...............................@..@.reloc...5.......6...p..............@..B..};P.....};Z.....};P.....};g.....};t.....};....2.};......};......};............ntdll.dll.KERNEL32.dll.ADVAPI32.dll.USER32.dll.GDI32.dll.COMCTL32.dll.IMM32.dll.SHELL32.dll.....................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiinst.exe

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):50688
                                                                        Entropy (8bit):5.935720802852158
                                                                        Encrypted:false
                                                                        SSDEEP:1536:NB9UO9nZK+ISiSoPSLljX1FEiZ3ZmcmIHv:NB9U0nZKQlNR7Z3gcmIHv
                                                                        MD5:41C714021C92086E80B0B57DD1E634FB
                                                                        SHA1:60F86C8CE8FA4BEA23D7CA4C4F01E33D63B5990C
                                                                        SHA-256:A6F1B26EEB1DE06F319BBE0F5E4BED4AF9C708A9D4F3E574EEA924B29EBD5001
                                                                        SHA-512:81C4D3B826F2F715E03EDF2C65DBB9F00990B5A8FA40EEF5531FE1B656CF5DBCF5A45A86E8A903980C07624B84841F34597C716067FE5CC662AD69ED5CBD09A7
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................l.............l.....L.............L......l......Rich............PE..L...m.};....................."......Cj..............................................j:..............................................................................0................................................................................text...h........................... ..`.data...8...........................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msimain.sdb

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Windows application compatibility Shim DataBase
                                                                        Category:dropped
                                                                        Size (bytes):134164
                                                                        Entropy (8bit):5.119567377291569
                                                                        Encrypted:false
                                                                        SSDEEP:3072:2vbOQXQtrj+jcAxeL9+9sw4vQoZv++lbuSOS+J:2vbOQmOgL9+YOj
                                                                        MD5:9A7CA59803DD20AC5C6B900E8665169B
                                                                        SHA1:247C0DC1C82F70E6E7F9CAFA9F7C8C69EC4C2648
                                                                        SHA-256:AEEC814144D4253D3167360EC6399F542D9123E4D5878808BAC279D6436B3C8D
                                                                        SHA-512:DADD8F6023F063F59C0F7703D706218F59F8D54EDFF3CB2CF8C71C67DF22CF6EE32C379DD65C2C69D3FFCF0D84C500737EA294C9CB1126656FB1D6E629F3058C
                                                                        Malicious:false
                                                                        Preview:....A*..sdbf.xh....x.....8.p.8.`.@......x...VILEBODAf...02MOCUED~...OCHCNERF....OCOTOHPI....RT1002IP....IERUTCIP....VEZILAER....DACOBRUT......YAWNIW&...IUSSKROW>....x.....8.p.8.........F1R..'.r....*c..........n...@............N...p{...4!....k.\o8a.&.........>.+......)...w/........=@i?........=@i?.........ED....q-...I.....qM...I.....q]...I:....q}...I.....g.tWc.L.......s3.`O4......~.'.Xl...Y0.50..YV.......3.i\.....7..AZd.f...K@}...F.....0i........?.3i....2...,.3.....j.....*...........\...6.l.....\...6.......Q. .d......8 ?..H...,....@N.........i*%.B...P...>.......X6...........^^..^!......^^..^!.T....^^..^!.D....^^..^!.6.......L........x.....8.p.8...@...........p..-1..V...U.h.........u.......D.....8.........."a..N..D....H.`T.z........../'2...t=.'.o.+........M..0........9.W1j.......|.GE....qO.2-:.H:...,....I.R....T.kI..SYF...;.Ek..Y......;..nw[d....8..O.f......'.fK.h4...c...I..q....J....z.y....n..g...|......!Y|p.......&Eo....r.......L........eS.....B...&.w........vI!$!E-.H.

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msimsg.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):847872
                                                                        Entropy (8bit):5.777004388495094
                                                                        Encrypted:false
                                                                        SSDEEP:24576:yFrNsyKWdbhmUXE9KIrufRO4t1YF6OWez17:KZhmUXE34t1YFp7
                                                                        MD5:0695F0F7008EB5F5B389ED0E57089BDF
                                                                        SHA1:16C1EFC321761DA9A082DA756ED9D1AADF9CA246
                                                                        SHA-256:FA4106578D9B3C425AB992B0877CBE1D60A05493CBF46FB21ECA89E5D468A0A8
                                                                        SHA-512:2F2AB3A4498ADED3E76A9DF0765E8390A9BB9F9D3E1500D1B8DD3679CA22E882C323492AC576DC185B9B6581FCBFFB1233A6E97CBB2BC33501A6C0C0E80725DE
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........=.C.S.C.S.C.S.....B.S...n.B.S.RichC.S.................PE..L.....};...........!..............................q`...................................................................................x............................................................................................................rsrc...x...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msisip.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):39936
                                                                        Entropy (8bit):6.201920535107619
                                                                        Encrypted:false
                                                                        SSDEEP:768:6Gxnz2TWfL8g3/2RVjoOPeHd4xKQ7m4d05hgl36:nxzdfLn3ug8eHd4R0fgl3
                                                                        MD5:91E27CBCEB6ADDCFDF0D1E7D1A3AD339
                                                                        SHA1:17D489C003355A34197C84BE37ED393BB9BFF2D3
                                                                        SHA-256:DEC5542F2A19FF58AF26B1E30A80D2628AC8FBA9D8569A867F1C8529EB209F8E
                                                                        SHA-512:58FC549A3953456F4149582288B35F98D72231FF06E34E633A3DFD77FCBBC5F9C2C8B864F02E32259B0D6AAEAE72F860CD3CD6739134424FB3447044F62E83F0
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............c.,.c.,.c.,8@.,.c.,.@.,.c.,8@.,.c.,.c.,.c.,8@.,.c.,U@.,.c.,.@.,.c.,8@.,.c.,Rich.c.,........................PE..L.....};...........!.....z...&......(;............_`.................................c..................................8.......(................................... ...........................................0....................................text....y.......z.................. ..`.data................~..............@....rsrc...............................@..@.reloc..d...........................@..B..};......};%...........KERNEL32.dll.NTDLL.DLL..................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msls31.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):167936
                                                                        Entropy (8bit):5.9814955021734715
                                                                        Encrypted:false
                                                                        SSDEEP:3072:sIvjlvPmGwB5RezjIN+vqjo/pFNrk3br+uubhokMD81s2pAFfqCF1hW4HgB/i:sSjpjwOjIN+v30vsVW2pK7F1hW4Hg
                                                                        MD5:2CAB9989FB957EFD98DBBBCB9B1946AB
                                                                        SHA1:0D01E4AC66D852730D8031A2BCAE215210EA7385
                                                                        SHA-256:841FDE9B24476A7ED364A3E4A1470AC9B7358BC92F29FCA4A06AAB557D140850
                                                                        SHA-512:92FA2DACE9589789FE2A84E4F561D1DDA32858AEEB4CD13EF73D94D6619A27F68988D653367D0CEB91FBFF8C427D6FF28E8ED0FE00FBA91B006F9FA13F3F9943
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........#..cp..cp..cph.ip..cp8.ep..cph.gp..cpRich..cp........................PE..L......6...........#.....0...@............... .....H.................................=...............................A..Y............`.......................p.......J...............................................................................text....#.......0... .............. ..`.rdata.......@.......P..............@..@.data...@....P.......`..............@....rsrc........`.......p..............@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\mspatcha.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):28746
                                                                        Entropy (8bit):6.545540060601869
                                                                        Encrypted:false
                                                                        SSDEEP:768:hLCnlsA4wVor2lcvDd2nafVz7aGXdP6YMKdI6C6udCv:h2voo2p2naf9aediYMftdw
                                                                        MD5:60D88C0829FE1E16C32F76D71724807B
                                                                        SHA1:40FB4D13A643B6F8A7A7CABC2A3F9E48B9E0CC50
                                                                        SHA-256:6007DA6BB72FE138DD4AE622C78C5337E3EAF9E8020B748B4A6918563EC988F6
                                                                        SHA-512:A8D35023AA60C601B581847E8FA3A1B5E52D5A6515DE6C6EAF7AAFA64CDD6A3BFE6E17281C6870F39343D8D45E2460A8730E8BAA26C24296087BF37ACF55E414
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................................Rich...........................PE..L....aJ9...........!.....d.........................X..............a..................`...............................p.......n..(...............................X...`...................................................T............................text....b.......d.................. ..`.rsrc................j..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\riched20.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):431133
                                                                        Entropy (8bit):6.6536949023972145
                                                                        Encrypted:false
                                                                        SSDEEP:12288:xWNTGm1c2qUkM9nv2VOXRc5uynesaycwrt/cIC:xW8m3qUv9EeROxXcoJC
                                                                        MD5:AE5ABEC31518E015A9FB4EB196854291
                                                                        SHA1:DEB63ECB2CBC60A688797478A204A2A57F49D1E6
                                                                        SHA-256:1C2508FB55DDC459D0327F2017471545C87420443391567094E768FB34032DA1
                                                                        SHA-512:DFE3E803AB7940FE4811627832CD048ED872111C3AE6B4DFE3493CB14E7932AFF9B5ACA7E5F387F5B38A44CAFBB350540A4B41955A3D28F36953B01FABCAA2F9
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.Gu...u...u...u...{...,......._...t...u...$...Richu...........PE..L...0.V8...........!...............................H................................................................`...=................w.......................(..<.......................................X...l...............`....................text............................... ..`.data...............................@....rsrc....w.......x..................@..@.reloc...(.......*...j..............@..B4.D80...0[.8=...4.D8G...4.D8T.....+8_...........KERNEL32.DLL.NTDLL.DLL.ADVAPI32.DLL.USER32.DLL.GDI32.DLL........................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\sdbapiU.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):72192
                                                                        Entropy (8bit):6.449616021144991
                                                                        Encrypted:false
                                                                        SSDEEP:1536:R+XuzhVtdQKdeHAonHjKN7TtKIn+UT+eSIdzw2ah6lLd0O:R+XuzhVtdQKd9GOd/+eSm6h67F
                                                                        MD5:552F387180800CDEA023DC65E2F62416
                                                                        SHA1:E0E76E9D224157FA9D1B83A1533B049103EEEBBE
                                                                        SHA-256:55AA0917FD64607FEDC6AD71DEE75E333C23DC283342205880F8F66DEDA269E6
                                                                        SHA-512:144E4EB61E932BC33EBBA9DCCB5D3A450EA7E1B63C54B459F47CD1CC0A5178C545DE16FD5D3E3F1A3861BCE56C9FD7D4DB457DD4A1A744A06FD255C3E0DEA1F9
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.5...[...[...[......[...Z.T.[..B...[..d...[.......[..G...[..f...[.Rich..[.........................PE..L....};...........!........."......^..............G.........................P......7...............................0...c.......P.... .......................0......P...........................................L.......P............................text............................... ..`.data...............................@....rsrc........ ......................@..@.reloc.......0......................@..B..};(.....};3.....};=.....};3...........msvcrt.dll.ntdll.dll.KERNEL32.dll...............................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\shfolder.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):21021
                                                                        Entropy (8bit):4.8801661651868615
                                                                        Encrypted:false
                                                                        SSDEEP:384:L5yAJ3gXLVMYNcJhGCMcrXWpiWwH/sHHgH2nKwsHTWHi5AGsHW0HcHpLHP0oqQGI:0AJ3IMYNcJXMcyu/z
                                                                        MD5:B7993C10B9A8C3B9735D7696C7B9E8B6
                                                                        SHA1:AC2E765311380BFA502B3B7AED2E8D80C351E08B
                                                                        SHA-256:6F0443A62FD444C4254F902F668543B867A0577504915D22CD75328F73CD4472
                                                                        SHA-512:D17AE76467F5FAC056494A0FDEF445A5BBB1F633507DDEF9B2AFC12DD47EAA68096784D47E968383B207382850100EF1915378E74564E29CBE1C8E0D422DD679
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q{J...$...$...$...%.'.$.L97...$..."...$...$...$.Rich..$.................PE..L...q.^7...........!.........0...............0.....u.................................................................'..k....(..X....@...+...................p..P....,......................................`...4....................................text............................... ..`.data........0......."..............@....rsrc....+...@...,...$..............@..@.reloc..P....p.......P..............@..BM.^7....N.^7%...........KERNEL32.DLL.ADVAPI32.DLL.......................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\usp10.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):314906
                                                                        Entropy (8bit):6.170788306003831
                                                                        Encrypted:false
                                                                        SSDEEP:3072:10EvBHYN6cpZbdPYxDhjnYnMq182s8Vvh0VCPL2zHoytG5dHJZE5d8wfI:1LHYwcLdy9Ir6v8tS8ytG5dHL+pI
                                                                        MD5:4437B4E1EFC79C331070B9F481E3E97A
                                                                        SHA1:793B1D0839912679CB43E50B63C186205B8B7D44
                                                                        SHA-256:4D8FF1F53C3BABF9BFD11B2EBCD44E2698CFE3BC80C6F0CBC64C0D191EA1FC1B
                                                                        SHA-512:C82CEA06778426943958E47A8A3372731A3834C412F919E1E6C35B7FE41DD55E3E6D881CD489464A69FD65180A4B1632527C0B06E62700F5C66BF4867089A7CD
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............................................Rich....................PE..L...0.C8...........!.........................@....ef.........................@....../^..............................@9.......1..d............................ ..p...`...........................................l.......`............................text...]-.......................... ..`.data........@...>...4..............@...Shared..P........0...r..............@..P.rsrc...............................@..P.reloc....... ......................@..B4.D80...0[.8=...4.D8G.....+8R...4.D8\...........KERNEL32.dll.NTDLL.DLL.USER32.dll.GDI32.dll.ADVAPI32.dll........................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\161F85F0\7204BF44\CRUTL15.DLL

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):290816
                                                                        Entropy (8bit):6.551645416298201
                                                                        Encrypted:false
                                                                        SSDEEP:6144:sP1hcYD9DDW+j8PPk/axspmqPugvLRyoVLNMIrZO:sPPZ9Dq+oPkwspm2+uO
                                                                        MD5:DFCEEBC9D6DBB3DB56B735C7020A35D1
                                                                        SHA1:189F681C860D15E997F3ED4502D747F25656BAC1
                                                                        SHA-256:09687C007B9D0C4047BC42C58C54E6DB62B9614306AC6DCBCD1B7532CF5ACF17
                                                                        SHA-512:15E73EFE925572ED9FDD11C316255880F7F131BEE084121B28B8507AB88E95FC22CDB9D606481CA499BD2BFDB61E871A2F026CEC56F5B747388237E3FB752351
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'"..cC.OcC.OcC.OcC.O.C.O.\.OkC.O.\.OeC.O.\.O.C.O._.OvC.OcC.OfC.O.c.O.C.O.E.ObC.O.c.ObC.O.c.ObC.ORichcC.O........PE..L...K.j9...........!................G0.....................................................................................`...x....@.......................P...8...................................................................................text...R........................... ..`.rdata..............................@..@.data...............................@....rsrc........@....... ..............@..@.reloc...?...P...@...0..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\184596D6\1517B7F7\CF_login_bus.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):49152
                                                                        Entropy (8bit):4.387373720474639
                                                                        Encrypted:false
                                                                        SSDEEP:768:hMVuR2oP0u6XsofBidHI/X/K3amL0N8YEeRFJRLtt+5l+s:hM4vM9XSryD33t+is
                                                                        MD5:FA2FA874B44742422A3FF24C0B0FD197
                                                                        SHA1:7B6788715EC613A3C6BDE749FAB28CAB22C615A4
                                                                        SHA-256:269957304D54C9EAED58FC26DEEC3F0A3AB44A17D2291C1B3B252436A3A10080
                                                                        SHA-512:E3E29467903C41891023673FA7193F2ADCE59A79AB8A1C0819DEC7E71B8F4C3CC1357299B3762E376B76DAA6B53A5F34DFED69B7ADBEB37F10969BAF1EF123FE
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 2%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................N....................2......Rich...................PE..L.....)X...........!.....p...@......T................................................................................o.......j..(...........................................................................`... .......0............................text...Y`.......p.................. ..`.data...............................@....rsrc............ ..................@..@.reloc..6...........................@..Bl.[J............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1A28DE63\34510A4\dao360.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):610304
                                                                        Entropy (8bit):6.2640254765203
                                                                        Encrypted:false
                                                                        SSDEEP:6144:WuvRsZJVIlB7FXdo6h4JOyXztOLVbC3ZtEVQ71L9UvsY42L/ZEmq79Hozkf:Wu5jn26hLLNCptjpS6ya
                                                                        MD5:FC877611E178FA17E23F99D9694590A0
                                                                        SHA1:5B9E15F716F4D32CA249E5A81D4739F20BBC276C
                                                                        SHA-256:A09132479BF9D6EC78448688986984C66973434FA0C92DC7406C0FBCBF522F33
                                                                        SHA-512:3D83907D60ACB074FA2DA454F4FA598E190F354804C4C7C8E2D5E54D03493BEFFCC31D8BBD8C2112B05A776D30B8DD7F92F0585704C3078040CA71EE0CE3968F
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........%Ga.vGa.vGa.vGa.v5a.v`..vJa.v`..vBa.v`..vXa.v`..vha.v`..vFa.v`..vFa.v`..vFa.vRichGa.v................PE..L...In$I...........!................@.............{..........................`............@.....................................................................Tc..................................h...@............................................text............................... ..`.rdata..............................@..@.data....%....... ..................@....CRT................................@..@.rsrc...............................@..@.reloc..nd.......p..................@..Bo.[J@.....[JK.....[JX.../.[Jb...~.[Jm.....[Jz.....[J............msvcrt.dll.KERNEL32.dll.NTDLL.DLL.USER32.dll.ADVAPI32.dll.ole32.dll.OLEAUT32.dll........................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1BF788A5\1517B7F7\CF_Name_bus.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):217088
                                                                        Entropy (8bit):5.770430998285837
                                                                        Encrypted:false
                                                                        SSDEEP:1536:1nV7hrLWSPhPXkkMuvcxIxqW6utdvM6M:DhXjJ0kpEysuz
                                                                        MD5:30BF99F06F5611B31C507271F9FF864D
                                                                        SHA1:1B3A0E066AA172E56C0D027152AF3030AB6F7F82
                                                                        SHA-256:AE7AD9EF03FC7BF37DAAFB0E36959C587533DF07808B7CC2B7970651F6B34394
                                                                        SHA-512:C2A0880802DF23B694D6A6219E5C0646C10339555930CF2A60E2B52E8DFA0AA2B7B835C2761B43D8D40256E44DBAA8DC53BA062229AC7E9D64B7C1E317E4BB9A
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f..........&......%.....$....Z'....Rich...................PE..L....B.C...........!................t".......................................P.......n......................................d{..(........S......................`9..........................................`... .......\............................text...8r.......................... ..`.data...............................@....rsrc....S.......`..................@..@.reloc..N@.......P..................@..B.$.>............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1D5631E8\1517B7F7\CF_Login.ocx

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):53248
                                                                        Entropy (8bit):4.8812124598826285
                                                                        Encrypted:false
                                                                        SSDEEP:768:lU0gWrY5CAKGMsEcfUy5Nv0SNOHWRV0KqNukmdM2yxZyIJ56ZZnl:vMs8O2RV0i45m
                                                                        MD5:6A961C35752F5917B10E5A4390838F89
                                                                        SHA1:01F79863059372E76467100FFFDDB73A1E33C087
                                                                        SHA-256:A9D7EE5FBAD27EAAD0878F2C29A47EBE3D25E246E1758895E12179963146CF19
                                                                        SHA-512:FB6AB0EC85D0FD2DE6159F6CA1FE49B3B759D3142BFBCC78D236AD386307F6914D043825CDAD4E8E52EEBF0D578F5E8259F0EDCB90C50D4F1DFF2F3B9EDF8A1C
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f..........&......%.....$....Z'....Rich...................PE..L....M.@...........!.........@......4...............................................#Z..........................................(...........................................................................`... .......p............................text....~.......................... ..`.data...H...........................@....rsrc............ ..................@..@.reloc..............................@..B'.};............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1DF81C7A\34510A4\ImgXPrint61.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):132600
                                                                        Entropy (8bit):5.764106197379897
                                                                        Encrypted:false
                                                                        SSDEEP:1536:Vf/gAB2/w4M8BYaAVPwOC/1pT8D8gQ3hjjpCp788CuS2y29i8p5pX6SmFXn44:9o9//VBfOCtLfpCl2uLg8zpXp2nJ
                                                                        MD5:3484FD2B93B9720DE9E09E04630F6786
                                                                        SHA1:A538294DDA5314407434F421ED8DD9E22C4F052B
                                                                        SHA-256:C5491E88680F291F8BCE5F6CF3D0AAF05348AD6B041C1AEE390FA69C42071CE8
                                                                        SHA-512:8E98169B6C68ED0CECD094404D0D5909DC4AB2EA5F31C6A023048A2F29F28819BA32ABCE75C1DFE43E752E6C7979EB967DBF66A13CD3BD902159A51DA9222D05
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........AN. .. .. ..<... ...).. ...-.. .~.$.. .Rich. .................PE..L...+.zF...........!.....@..........L........P......................................=...............................@C......t;..(....`...k..........8.......................................................`... ....................................text....3.......@.................. ..`.data...|....P.......P..............@....rsrc....k...`...p...`..............@..@.reloc..6........ ..................@..B..:@............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\1F62DE62\1517B7F7\CF_File_Import_bus.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):49152
                                                                        Entropy (8bit):4.588173828979497
                                                                        Encrypted:false
                                                                        SSDEEP:768:hHmFNJBa5eAimsRsrf+y5cxSK8Vsdc6xUzKi:dmFnBa5sm5cxS3McKUOi
                                                                        MD5:C546CEC8F4C0EDE2F51EEDC7CE5DC564
                                                                        SHA1:A2C0D484E50ADB0B757CFD34CB12B678F4614986
                                                                        SHA-256:1B0B1848DC8EF5F60B812F405D4CDA43F67566155FB8F229A7B3E3EA1ECFBDBA
                                                                        SHA-512:62664E8A3A493A301E5D8DF250542EB8D5F23F8074814135D712AC9D8F7AA0BDE0A09505FD745C2F4EEB81EDB8159E57D15ED21B39A7541AE1F95CCD2A652930
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i~..i~..i~...b..h~..&\..k~..m]..h~...^..h~..Richi~..................PE..L....@.Q...........!.....p...@......(................................................o...............................v.......q..(...........................................................................`... .......(............................text..._g.......p.................. ..`.data...............................@....rsrc............ ..................@..@.reloc..............................@..B...E............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\205EBC50\34510A4\ImgXTwain61.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):144888
                                                                        Entropy (8bit):5.640141676664818
                                                                        Encrypted:false
                                                                        SSDEEP:3072:9JshFryVlQMhtRu/O+NXGF1CRBgQYMWY7WnM:5lQMhPu2+wF1oaQYc
                                                                        MD5:E0458E23FA5B2852F1B88F487B0C916A
                                                                        SHA1:C71B9769E677434A473ADE1126D04E9CEFEBFBD8
                                                                        SHA-256:96D981A8269BFA3A183CD0963FEC841373C08A97C34E35A05123D50547DEB1A6
                                                                        SHA-512:8564BAD65232F7D2524417A5942C099C9A467AD86544EB6006D247B893F7AB9034A65C4059CD99C72466BE6E41AC5EAC0CBE96DCA77EE7919629D66D576BAC7A
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q..Q..Q....P.....W..g..P.....P..RichQ..........................PE..L...+.zF...........!................H.............Bu......................... ......W8......................................$...(.... ..............8 ..............`.......................................h... .......T............................text...(........................... ..`.data...,...........................@....rsrc........ ....... ..............@..@.reloc........... ..................@..B..:@............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2ADC2324\1835CB68\u25dts.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):24576
                                                                        Entropy (8bit):1.5243719406147602
                                                                        Encrypted:false
                                                                        SSDEEP:96:R5XacropfVAbDWmqXUv+lzoY9W2+xiRfhDbRIQYcvEYmotqYC1hoa:NrCmbDBqXw+hbWM1aQDmYC1J
                                                                        MD5:6D669FC0192A4F685147B5C7BCF637CD
                                                                        SHA1:ED0FECDD48D49645C89CF23056F9310EEA0BB23C
                                                                        SHA-256:3F75A0AC5BECFB33C9CC0312B486D45BCD528992FD6EABA7FA7A1539FC7F4F49
                                                                        SHA-512:2E23EA333461FE9110E2FA6F83214BA9C83C002EB3CBFF53CB13A30E44619526D00A8ECD87089DEFCED83947D90726BE5687BC4A9B09C07CCC2333A8299C10DA
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........OD..*...*...*..2$...*...+...*.~. ...*.~.!...*.F(,...*.~.....*.Rich..*.................PE..L....Y.:...........!.........@......!........ .....@.........................`.......................................!......` ..(....@.......................P....................................................... .. ............................text............................... ..`.rdata....... ....... ..............@..@.data........0.......0..............@....rsrc........@.......@..............@..@.reloc.......P.......P..............@..B.$.>............MSVCRT.dll......................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2D3E0D90\7204BF44\Crpe32.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5042233
                                                                        Entropy (8bit):6.348947882126544
                                                                        Encrypted:false
                                                                        SSDEEP:98304:WJdA7Kn4uYmR88wV1s8dxnve1RZ3BUE9nPdf9avG37EuY:WJy7OymLH8dhg3jPdWGLO
                                                                        MD5:2517D67C02B04B3D07FEF74501D6E303
                                                                        SHA1:8FE46EFC7F3810358F31AC45B87BB54F08C4FFFE
                                                                        SHA-256:A1B0116C01EFB841A263DF2A7BA261FB1B131169C0974E90383535F90C704C83
                                                                        SHA-512:3032B05A178BA384693A02AC221B394CA3FDA60D7A0EB2D4039A31C527721FF458A1E486CC0C32834E35A3A2D3F4EF0237368D7E5F084267327EB650239CD3E1
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.........."..q..q..q..q..q...q..q..q..q..q..q..q..q..q..qn..q..q..q..q..q..q...q..q...q..q..q..q...q..q...q..q...q..q...qb.q*.q..q...q..qRich..q........................PE..L....t.?...........!......4.........#.2.......5...............................M......................................J<..j..l.<.......?......................I..^..`.5...............................................5.T.....<.@....................text...>.4.......4................. ..`.rdata..E.....5.......5.............@..@.data.........<.......<.............@..._CODE....*....>..0...@>.............@....rsrc........?......p>.............@..@.reloc..".....I...... I.............@..B................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2E5B6414\1835CB68\u2fcr.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):28672
                                                                        Entropy (8bit):2.6466214442096905
                                                                        Encrypted:false
                                                                        SSDEEP:192:soGk2GtWbZ97gEjWzhQEjIhNFeI59g2jQ66FupdS:soGk2LZ97qljIhNFeW9g2jQ66s
                                                                        MD5:B86749B441E49EBD58141871DA7F8DD7
                                                                        SHA1:83C1D25B2D2803CAB684ECB6F36F2FEAEB79EB4A
                                                                        SHA-256:492C644DBEBB7999EA02E2F2CB562C41D1BB10296BCC72900A59F2CA4D5090B4
                                                                        SHA-512:84DFF0CEA5E6239090AD3797F5062A1F54DA16FF2387998C415A01C175266F9127CC4A123ECBE98DADD4940E125DCD7A08FF9993DC4B671FF058BC251C6DA5FE
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.a./k../k../k...w...k..rI..+k..rI..-k../k...k..Mt..*k..pI..,k...m...k...K...k..Rich/k..........PE..L...B.|:...........!..... ...@.......$.......0.....@.........................p.......)...............................3.......0..P....P.......................`..................................................D....0...............................text............ .................. ..`.rdata.......0.......0..............@..@.data........@.......@..............@....rsrc........P.......P..............@..@.reloc.......`.......`..............@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll......................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2E81A74\34510A4\vbalColumnTreeView6.oca

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):54784
                                                                        Entropy (8bit):4.791159064203773
                                                                        Encrypted:false
                                                                        SSDEEP:768:7ZulXt12qM+Tgi3Y9iRJfeYIegQQmF6if4oQ:7ZulZTgio9e5eYIegQ1m
                                                                        MD5:C703D97D68033A2DD0B6EBE3CCD3C196
                                                                        SHA1:69E86AA066A0CA260D28149B151ACC4C318DF9B5
                                                                        SHA-256:8E61E4714BEEC40A5062023038B86B1258129EDDA39B73CDCA71916E0941CF56
                                                                        SHA-512:882B67E0B8F7A9F276D2430DE92E3C2811BC3D557FC07085F48D513B73B032EED02F0319B15A86BD8E83B3A99A70D24287860EF9CE848CC92F44684CBCA8948E
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....B..................................... ....@..................................................................................0...............................................................................................................text............................... ..`.bss......... ...........................rsrc........0......................@..@.idata..............................@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\2EC6F5ED\34510A4\vbalColumnTreeView6.ocx

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):245760
                                                                        Entropy (8bit):5.1770781573052425
                                                                        Encrypted:false
                                                                        SSDEEP:3072:hzjb+IRc8dAzofC+Tuna7ac2SGumAN4nphB:hzjb+T5+B2Sqxh
                                                                        MD5:010CA532E3A09F1755500ACCCA93D966
                                                                        SHA1:641B201FE8871A5256607E2EFA4505FE3C43C468
                                                                        SHA-256:72FA78FC7B8E99726FF1B6B77E30A290750324FC50758A42DC50F48D8CB0CAE8
                                                                        SHA-512:5631B7DCEC43E32FF31F843B14B12A7F29E6530BD80240B87E5AB49180150B95CE57420028BC32BC3640A656AEA149846E41B7598AEF84889609CE4531B1606A
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=...y.q.y.q.y.q..|.x.q...u.x.q.Richy.q.........................PE..L...p.T@...........!................x.............GD................................................................p...........(....... .......................D2..........................................X... ....................................text... ........................... ..`.data...<...........................@....rsrc... ...........................@..@.reloc...2.......@..................@..B'.};............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\33BB160B\1835CB68\u2dapp.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):28672
                                                                        Entropy (8bit):3.124598839033411
                                                                        Encrypted:false
                                                                        SSDEEP:192:LJ2lGLpG+9B8Rzg1auG+i3OeJrcTtWrgwx9r+jCNFeOp5m:LJ2l69Y4a6eJrUtWrgS9r+jCN3Y
                                                                        MD5:347E011F0164DB9CFAC6BB066BAADEC0
                                                                        SHA1:116E90AD2358FC31F0C9F86035895BFE9A55A8AE
                                                                        SHA-256:67263AF5AD1B9E0CD7A9088B8BA0CA2D05995E73F6E2ADBDDABD53E075BA9533
                                                                        SHA-512:707FA48E83BF497540A8D688975D8A885E005ABA321C179BDD95B123573786BBB29E4CB176D46291E945068D8EFE6047C393E6303F925ADC2F64F9CF551912B9
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1=..u\x.u\x.u\x..@t.w\x..@v.t\x.u\y.[\x..Ck.|\x..|s.w\x..|r.p\x.Z~.t\x..||.v\x.Richu\x.................PE..L....Y.:...........!..... ...@.......*.......0.....@.........................p.......<...............................4.......0..x....P.......................`..................................................l....0...............................text...0........ .................. ..`.rdata.......0.......0..............@..@.data...d....@.......@..............@....rsrc........P.......P..............@..@.reloc..,....`.......`..............@..B.$.>0....v1?=....$.>H....$.>U....$.>a...........KERNEL32.dll.USER32.dll.comdlg32.dll.SHELL32.dll.MSVCRT.dll.....................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\3B44007A\1835CB68\u252000.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):24576
                                                                        Entropy (8bit):1.8691527276214883
                                                                        Encrypted:false
                                                                        SSDEEP:96:2IIUH5yvzjhJe5klNxxL3bU1ogumEoQTbbQBCxYmotqDNhoUN:2Ih5yc5klNxxL3boRumErQcDN
                                                                        MD5:9CECBCFF995CF75B752130D3137D39F1
                                                                        SHA1:6893B2B9F32E12E16F2F5C5D9CBEC3E603B4EEED
                                                                        SHA-256:3CCC9887261965B99EC0F2751D3D3096F2E31CBF281E7EA1A9902C814985DB9B
                                                                        SHA-512:DB464E70B3141248B3E63449F15D3CD9937F81207B6E32878AAF570FE7B027E1651061F808AA9670017A00B3694824061F06F03E3F446423A633C892AB08C638
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?...Q...Q...Q.j._...Q...P...Q...B...Q...Z...Q...[...Q...W...Q...U...Q.Rich..Q.................PE..L....Y.:...........!.........@............... .....@.........................`......................................."..6.... ..P....@.......................P..................................................D.... ..T............................text............................... ..`.rdata....... ....... ..............@..@.data...L....0.......0..............@....rsrc........@.......@..............@..@.reloc..b....P.......P..............@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll......................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\3D003E72\1835CB68\u2fxml.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):225280
                                                                        Entropy (8bit):5.724903191036286
                                                                        Encrypted:false
                                                                        SSDEEP:3072:q54c1n/ypBau8j3dzRTGT2Idm2tbBu5Y6obbliT/mV:q54vaBtzRTf2Bgmb4TmV
                                                                        MD5:F122F3946E0C78A8782BA78153E0A4DB
                                                                        SHA1:2932A0217CF396C3EA1D0014E09D24BA7FD6DFD7
                                                                        SHA-256:33F3970E1C14EDC4962F8394CA7A30F619516EE6A89535DDDF31017EB084DB69
                                                                        SHA-512:15EC323EAA5B1D2863B4AC50A21BCB4647B08A776F7A3C981CCEFB4F0CB6E628A305C060721D0C5494BFDF557706D7415ADD88E5FF6C87B4F0E1F2C83F42B3F4
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@ .w.A.$.A.$.A.$.^.$.A.$Yc.$.A.$.].$.A.$Yc.$xA.$f^.$.A.$.A.$wA.$[c.$.A.$[c.$.A.$.G.$.A.$.a.$.A.$Rich.A.$........................PE..L.....{:...........!..... ...`.......{.......0.......................................a...............................O......xF..d....@.......................`..................................................l....0...............................text............ .................. ..`.rdata..:$...0...0...0..............@..@.data...Q....`.......`..............@....rsrc........@... ... ..............@..@.reloc... ...`...0...@..............@..B.$.>0....$.>=....v1?G....$.>R....$.>\...........KERNEL32.dll.NTDLL.DLL.USER32.dll.GDI32.dll.comdlg32.dll................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\3E323407\1835CB68\u2fxls.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):221184
                                                                        Entropy (8bit):6.073107874518051
                                                                        Encrypted:false
                                                                        SSDEEP:3072:KegzPMHKTjDd/fW+uTASAnjAmqvgvks5eXIm2099RX9O+84IEo5lDNy:hAP0KbdXUAFgZsqImx9OGfo59
                                                                        MD5:E1DCB4C37FCCD79578F1B8E376D1B3F6
                                                                        SHA1:9351C62C6302F62049485E4C15BA909B8E902C08
                                                                        SHA-256:A3186DDE55B8F897C5D953F986B4F0A77797E9617609909C49DA6F3E285AE4B5
                                                                        SHA-512:F5D34E397B5075603384DA42A8617A46834C696720B8B71D3E1384EF6B368422E785127165F34F71A92413980DB510BDD72F24D89E7FAC7C65ED3CE251C36A7B
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P...1.R.1.R.1.R.-.R.1.R...R.1.RI-.R.1.R...R.1.R...R.1.R.1.R.1.R...R.1.R...R.1.R.7.R.1.R5..R.1.RRich.1.R........PE..L.....=...........!.........................................................`......................................`.......p........ .......................@.......................................................................................text...5........................... ..`.rdata..o........0..................@..@.data...............................@....rsrc........ ... ... ..............@..@.reloc.......@... ...@..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\416B4F42\1517B7F7\CF_org_history_bus.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):69632
                                                                        Entropy (8bit):5.117727805431737
                                                                        Encrypted:false
                                                                        SSDEEP:768:ozUIYk6zTsTKPGfysb5s6fNFJRX6Esq10h:ozUft+asb+6flJA
                                                                        MD5:6357561041ACA8C2DDB47819F864D583
                                                                        SHA1:C487E183366C43C98623ED9BD6197C400CA6A231
                                                                        SHA-256:5882978A3CF04C47E7C1B81A55FDE27DEB45D6009F85BF318A97AA9D95D8686B
                                                                        SHA-512:DEDFB7C921473E3644D29F65BF1A7CE6EA9F2A6EE9B8C272645536278C24C79976EA8876FE3F1817C90DE18ED27BCF1999EA15E37507D11A41D7208C4425723F
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i~..i~..i~...b..h~..&\..k~..m]..h~...^..h~..Richi~..................PE..L....flD...........!.........P......@................................................;.........................................(...........................................................................`... .......X............................text............................... ..`.data...P...........................@....rsrc............ ..................@..@.reloc........... ..................@..B.$.>............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\43981525\7204BF44\pg32conv.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):100352
                                                                        Entropy (8bit):6.01574608255945
                                                                        Encrypted:false
                                                                        SSDEEP:1536:W0/GIQTIfT9Q2qEB+Jk3gC7UfPnJQBJHl8UPif4xStOgkM:NGg98fC43nuBBGU+4
                                                                        MD5:59B610DF85409A13832B9B5B807DA4FE
                                                                        SHA1:FADFCE97D3D9F6935D5F6A4ACA53232D733AB4C6
                                                                        SHA-256:369C08452CE18AA2894442F63C524C4F8DB416F12D86E624099BE61DAD9F2F98
                                                                        SHA-512:117D144807C1BC38858859F8417CE69597FDF3B3FAF28D5567ECA58A84CBAC292C87EB54840E8DAC9A0F3CD66F755CE8CB31BC30D78B01A47B09FAA1C2C8B73C
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Nb#P/.pP/.pP/.pP/.p./.p.).pQ/.p.3.pL/.pRichP/.p........................PE..L....V.7...........!.................$.......0.......................................[..............................p5..f....1..d...............................................................................X....0...............................text...P........................... ..`.rdata.......0......................@..@.data...xt...@...D...*..............@....rsrc................n..............@..@.reloc...............p..............@..BN_.P(.../.[J5.....[J@...4..NJ...........KERNEL32.dll.USER32.dll.GDI32.dll.MSVCRT.dll............................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\474E307D\1835CB68\u2lsamp1.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):24576
                                                                        Entropy (8bit):1.965175828785223
                                                                        Encrypted:false
                                                                        SSDEEP:192:xGqtPxX4u8XuBxGkkUiRh8jJmmj2sucQgeh:xGqdSP4xPibOMm/Qgeh
                                                                        MD5:7BBBE3749D17CD539623C60F5E023992
                                                                        SHA1:E0769AEA1E7EC30DD33AC022E8C1D0F79983BE36
                                                                        SHA-256:D8F7E302FD89ACD8EE36FAA07214ED3B6039F91EC45F72FC954967C04FE906FF
                                                                        SHA-512:86AEC1D8FC59DD7B8F86815928196798FD6C0288B331B552298CDD157025B7BD3CD9ED84C0A07D4B3D5ED347AC0B2944931AEC9FA15D9ABA1DDFC8796619AE40
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...ir..ir..ir...n..hr..ir..Nr...m..lr...R..kr...R..nr...t..hr...R..jr..Richir..................PE..L....Y.:...........!.........@............... .....@.........................`.......!..............................."......h ..P....@..(....................P..................................................D.... ..h............................text...~........................... ..`.rdata....... ....... ..............@..@.data........0.......0..............@....rsrc...(....@.......@..............@..@.reloc.......P.......P..............@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll......................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\47C10F79\7204BF44\CRxmlx07r.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):69632
                                                                        Entropy (8bit):3.5687827741608045
                                                                        Encrypted:false
                                                                        SSDEEP:1536:ZWJaaymHs15LBdFElh9aaaD+FdhaG9AFqg24CHgSz+Qar:ZWJaaymHs15LBdFElh9aaaD+PUG9AFqQ
                                                                        MD5:E8C7545574E4D9E9992CB5B9331271CC
                                                                        SHA1:CF271D3B4A88DA069E61D1269DC8EE412695C69D
                                                                        SHA-256:14A788E493779B3FD96C1F94D7154642E79F34594B978A6A7E39C97BEC5F7E5B
                                                                        SHA-512:F4A5E5D7F2D162260F150E4F3069F707E0D3C291E0766720E813F5A40D410A67AC18DC03ED5DC7B5DF579A8A3BFCA4F5EF667D16733B853D11104F0C7F165E90
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.hG]..A[.Rich.A[.................PE..L......:...........!.................................................................................................................................................................................................................................rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\487DDF\1835CB68\u2ddisk.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):28672
                                                                        Entropy (8bit):2.744540447798788
                                                                        Encrypted:false
                                                                        SSDEEP:192:X/62KJlTcY9alIW9avJMdVxWH/Y9VP0QCKFYOpf:X/62EcY9JEavOdVxWHQ9VcQCOT
                                                                        MD5:7C94ECB0391127848A8F20AFA8FD63F6
                                                                        SHA1:53B7FC88913CAB7E4E030504E58DFDA87E395ED1
                                                                        SHA-256:BE4C2FE0AF5612C91EAE9AB4D67F5276C46963FACE2D5B734BE7E40B382B7332
                                                                        SHA-512:1AF94DE58B00BE9F49046A0EC5A326957B00550DF5E9F7359CF97FFAF219540C98EBEEA10EEF8CEE7388D4690C9B322624D48962F4628D4D65852D07AE9C1BDF
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................@......<......................................<.......Rich...........PE..L...D.5<...........!..... ...@.......'.......0...............................p.......................................4.......0..x....P.......................`.......................................................0...............................text...`........ .................. ..`.rdata..X....0.......0..............@..@.data...T....@.......@..............@....rsrc........P.......P..............@..@.reloc.......`.......`..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\496179\1517B7F7\CF_rs_browse_bus.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):28672
                                                                        Entropy (8bit):3.769486670952223
                                                                        Encrypted:false
                                                                        SSDEEP:384:6P8c5PrzxQK07hKTQhbXETATDluQXE8m:6Pz5PrzxQKYkUhb2AnluaE8
                                                                        MD5:6BA1EF4DB1C4430CEE386B60D38B7935
                                                                        SHA1:DF42C4E61714457EEDFEE488769B0983D3CD0865
                                                                        SHA-256:7E6234E69BF794F27A67B936911F4540A994673F5CB746F767F4CE0E4DB55A09
                                                                        SHA-512:A9AB00275E19299F3B44F1000F0AF3ACA009CD9D043D0236D3B05E15F66177DC56EBCABA45151D980D5B5A99F1A3542781A8BF809E90EB1399373315649CB7BB
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k!../@../@../@...\...@..`b...@...f...@...`...@..Rich/@..................PE..L......B...........!.....0...0...............@...............................p.......................................;.......8..(....P.......................`..............................................`... ....................................text...],.......0.................. ..`.data...\....@.......@..............@....rsrc........P.......P..............@..@.reloc.......`.......`..............@..B..:@............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\496C80D6\34510A4\MSCHRT20.OCX

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1009336
                                                                        Entropy (8bit):6.46634380726448
                                                                        Encrypted:false
                                                                        SSDEEP:24576:hlXNkkmkDgQPnYVGEDc9u3WiZZRUKTX44gDk:LXNBmkDgmnYVBDcoZ4a
                                                                        MD5:C80389E4872A0885CBB14FD3641166AB
                                                                        SHA1:B0B125C77E62FF50EE34896D4F11B3EB6E798D84
                                                                        SHA-256:A281C15CBDE263D4D0DA4A78FD29F861473B68464051E591E57DD693E2E68DD4
                                                                        SHA-512:9C4AF367AD39ED7D9E630367C0BDC163C61F0E1410645E0EF63198CE4AC5357EA28399C05B8489FD2E852AADA414BD883AFB2ABF859B79F2E6A802CE183E5A6A
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...qy.8.....|.....#.....B................... ....I(........................................................................@........ ..............Q..........X...@1...............................................................................text...p@.......B.................. ..`.rdata.. ....`.......H..............@..@.data...l....@......................@....idata..............................@....rsrc....... ......................@....reloc..X...........................@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\4B371E22\34510A4\vbalFlBr6.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):40960
                                                                        Entropy (8bit):4.057730216921513
                                                                        Encrypted:false
                                                                        SSDEEP:384:+Q80x006bw+FkZQ47Jx4j6uX6yzd54gEvtyFvb01ij2ZJQiz/AoN9s0KJb8:+QP6bw+GyOij6850Abj6/Qiz40KJ
                                                                        MD5:9FDB8A72D927888796A4E6A14560CC5F
                                                                        SHA1:ED49DCFE5FD16C658033373D816E61D8173368A3
                                                                        SHA-256:E692AB331FA5753D619B5FBE68BD5AC44C57AD13D046048414F75CFDE4065A19
                                                                        SHA-512:040358819A95AC368E1A67523B409E7E18C1D37444B03A14BF346F5C9183B8743D4F97011C0C5AE177B2BEC8AAACC687416B9A6ABBC2D692CC2307DD0B56C1C2
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=...y.q.y.q.y.q..|.x.q...u.x.q.Richy.q.........................PE..L......=...........!.....P...P...............`.....4.................................................................U......tS..(....p...)..................................................................X... .......h............................text....E.......P.................. ..`.data........`......................@....rsrc....)...p...0...`..............@..@.reloc..............................@..B'.};............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\4D29780E\1835CB68\u2fsepv.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):40960
                                                                        Entropy (8bit):4.1158608664095375
                                                                        Encrypted:false
                                                                        SSDEEP:384:o0a2aB9b6YzTIy2EdQicNtkjmxHSxb/SI9mviJ4zZ95ewFkK492/T:o0aBBMGMy2EdQicNpR2SiqzWQ/T
                                                                        MD5:1AF1B68553F1D5D59158727F6EB49DBB
                                                                        SHA1:7386BEAE5AC29E8240F7C1D651F1B0D09B535957
                                                                        SHA-256:006D43D8400DD964907D0797A9B9E29A8A8964C11BAD3E7A0E35DBE0DB0506D8
                                                                        SHA-512:336C996DDC17F8A7AB39486C6980C88F113B96A672D7243B2971850D3055DC767ED285457374D9B5CEBDAD3BFAA56F7D4774222C7B0CA5D2D63B079B9D354D80
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........cu......................................................!......H.......p"......Rich............................PE..L.....c>...........!.....P...@.......O.......`.......................................................................g.......b..d...............................d....................................................`...............................text....@.......P.................. ..`.rdata.......`.......`..............@..@.data........p.......p..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\4DD6AFDD\34510A4\ISHF_Ex.tlb

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):18728
                                                                        Entropy (8bit):4.5595763568254295
                                                                        Encrypted:false
                                                                        SSDEEP:384:lilrpyGufzrUBnv45HxA0wid3qiMmQ28C2:lilFylzrUBnA5Hw
                                                                        MD5:07934C956B971F10B7F73D55239AB976
                                                                        SHA1:50C8C3E4C01546B5A51D27BF780E1B3219C802CD
                                                                        SHA-256:4C63DD877BF263ED2AD5C2EFCF92FEECFAB1C7037583D3DD70C91A04BD30E506
                                                                        SHA-512:D439BE4AEBF674937B5512381D0BBBF1127D785B290DB4CD50DB3D667E9CEA6A1E4741610E3F7AA67C1927ED1F1B0CDC309602480461210B91B645D37F80E961
                                                                        Malicious:false
                                                                        Preview:MSFT................A........... ...................Q............... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...........................................................................D................... ...............................t...........X)..P............,..............h-..0............-..0...........................................................!!...-.............................................. ...............................................!...L...h...X.......................................0...............................................!.......4...,.......................................D............................................... !..................................................\...............................................!!.../..h...X.......................................p...............................................#!..\/..........................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\51868479\1517B7F7\CF_report_main_bus.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):409600
                                                                        Entropy (8bit):5.896273828906067
                                                                        Encrypted:false
                                                                        SSDEEP:6144:zUv6aVWzjnY5Cpbe1i3irndYi1PN2Ba1NQoy4ky:UVWzjnY5CpoprDsBa1Ntky
                                                                        MD5:E9214CA4A0BBDFC7CAAA8DF4E21DCA65
                                                                        SHA1:00CA85B3130278B4E9140DEF8E3F67BE445D8542
                                                                        SHA-256:264A1CC8D3C4852C9D2F09E22EAE30BF81C1D388F7CC7EF1CD46DA425BD642B1
                                                                        SHA-512:85EE59B8E54D8E1D884EE05F0ED77C4ABBA9AC476D5615FCD4E75AFDF0C93BA8F1C21FD1D0B68D075FE32B04A28283839078AABB0189921F9B7EEB6B76CFD41C
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+..J...J...J...V...J...h...J...l...J..nj...J..Rich.J..........................PE..L...q..\...........!..... ...................0...............................@......?...............................@,.......$..(....@..8........................b..........................................h... ....................................text............ .................. ..`.data........0.......0..............@....rsrc...8....@.......@..............@..@.reloc...m.......p..................@..Bl.[J............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\526A560A\1835CB68\u2lcom.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):106496
                                                                        Entropy (8bit):5.19516961379927
                                                                        Encrypted:false
                                                                        SSDEEP:1536:gw/iTp1rZP6UpbRfOdkWY+o9uLtOpaYlga+gi4+m6bnStQgc:A1lSUTf2YhatKJogi44nStU
                                                                        MD5:1EDC1124D987025B4539C6CCD86FE52C
                                                                        SHA1:76C6558A038714C0671BE517DC3FAA47A9804BCA
                                                                        SHA-256:54EC7365B4C8AF951C0447493D6D0A32CCBE9C1139CAE4D2252D44DC7B1B8E6F
                                                                        SHA-512:18EE07CBAA4A443AD8B61E89BA0E466C065B7BFBE5E14258F280E2C3DD266B0D9F78C0C5580C0F2E3EC3A502D9F7A4AE3A38543F0C8B8178E85EA3C9290CCA72
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............H...H...H`..H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H(..H...H...H$..H...H...H...HRich...H........PE..L...4.v=...........!................;................................................................................:..e....2.......P..@....................`.......................................................................................text............................... ..`.rdata.............................@..@.data...T....@.......@..............@....rsrc...@....P.......P..............@..@.reloc..x:...`...@...`..............@..B........................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\5A4D542C\7204BF44\CRUTL15R.DLL

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):20480
                                                                        Entropy (8bit):1.807152052248964
                                                                        Encrypted:false
                                                                        SSDEEP:96:5qsN56E9EADBVzBDaZBcG6fyXmuY+eQ5TMbKGbMH7x6sTFw+YprWUUsmn+sWiNBg:5qP1ADhAZXmuY+LubKRc6smh7
                                                                        MD5:859751A660914A75FB9062E47B7111B5
                                                                        SHA1:741752CECE787A377987A3C329238E87B1AEBBAE
                                                                        SHA-256:7DDDB9C0D38C2BC47EA44B0B5F73A1A6411BC0069AFD4B42AECD79C92D1666FE
                                                                        SHA-512:8D8D3278111BCEA19781A3523F863B378BDA40D8AB580775CE6664F080777E5F83C4F0EAA42A98363A0842F6DE9FD47CEDB1AE5DD42AC5D04BB046A6213A4F94
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.hG]..A[.Rich.A[.................PE..L...E.j9...........!.........@...............................................P..........................................................X!...................@.......................................................................................rsrc...X!.......0..................@..@.reloc.......@.......@..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\600299E5\34510A4\OLEGUIDS.TLB

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):8096
                                                                        Entropy (8bit):4.112479782177178
                                                                        Encrypted:false
                                                                        SSDEEP:96:xZg7aPZBVJYko6ayMa4iBJAaiuPh+tefhFyr9YkheQWg8YilYb97PTwU26QLll2:xJGb6rx3JAAjZFyYIIg8tmR7r06QLll2
                                                                        MD5:21699843C3F8594D68263645ECE51DD3
                                                                        SHA1:5F6A4AE01CBC09A70C5A47F003E39A3B3C23544D
                                                                        SHA-256:4CAB84B86D92EA0807F436459E6F6B8F8834AC1013EB1004C3C88A5F57BF8B96
                                                                        SHA-512:72DF305F6D1D8D0FFBA24244485F2EA39EC76D3DEE7AA812A4FFB0DC0F2FE55E17E04D01A14270182B7F107524863D38342E68CAC1518ECCC1DE8861326DA0F2
                                                                        Malicious:false
                                                                        Preview:MSFT................A...........................c................... ...................d.......,...........X....... ...........L...........x.......@.......................<...........................................,................... ...........$...............$...`...............$...........................................................................................................!!..0...............................................................................................!!......h...X.......................................(...............................................!!......h...X.......................................<...............................................!!..<...............................................P...............................................&!..................................................`...............................................&!..................................................x...............................................!!......

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\63200452\1835CB68\u2dpost.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):102400
                                                                        Entropy (8bit):5.440036346891534
                                                                        Encrypted:false
                                                                        SSDEEP:1536:1rKnUevheUuLzGUT842VxV40Zi8ooiWC:QtZ6LzLgxhooiW
                                                                        MD5:D6AC6D930525ED743418E29802510BBB
                                                                        SHA1:F4AD2AE3E144F6BD1E103DF5E40654EEAC29A728
                                                                        SHA-256:06228AC38A5052A9430195B1D00546B05E23D0EBE4E93F6E0364D14282369DC4
                                                                        SHA-512:DE41F832F2EB4BDA0C158FEFAD0C0DB9170736A0DF916773286564FADC7E32F1713024CCD4EE8DEF3658F4612AF933DF1A8B6FA312B4B92B5F79E9670C864B05
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Xz.z...)...)...)...)...)...)...)A9.)u..)A9.)...)...)...)~..)...)...)...)...)...)C9.)...)...)...).;.)...)Rich...)........................PE..L...B.|:...........!.................~.............@...............................................................`.......x...d....`..........................................................................l....................................text...z........................... ..`.rdata..8........ ..................@..@.data....N.......@..................@....rsrc........`... ...P..............@..@.reloc........... ...p..............@..B.$.>0....$.>=....$.>J....v1?T....$.>_...........COMCTL32.dll.KERNEL32.dll.NTDLL.DLL.USER32.dll.GDI32.dll........................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\679B857\34510A4\COMDLG32.OCX

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):152848
                                                                        Entropy (8bit):5.88912905338292
                                                                        Encrypted:false
                                                                        SSDEEP:3072:VCslb9HnH/GrQ/qCFyn7dWXSQeRDBIY/OR5JrNo2CocrJbNN6N2TRqEydc:VCsB9Hu9nweRD4JZoDxtRHj
                                                                        MD5:AB412429F1E5FB9708A8CDEA07479099
                                                                        SHA1:EB49323BE4384A0E7E36053F186B305636E82887
                                                                        SHA-256:E32D8BBE8E6985726742B496520FA47827F3B428648FA1BC34ECFFDD9BDAC240
                                                                        SHA-512:F3348DBC3B05D14482250D7C399C00533598973F8E9168B4082EE5CBB81089DFAEFCFDA5A6A3C9F05B4445D655051B7A5170C57EE32D7A783DC35A75FEE41AA9
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....:@...........#......................... ....z!.........................0......(I...............................q...............@...............:...............................................................................................text...L........ .................. ..`.data........0.......0..............@....rsrc........@.......@..............@....reloc........... ..................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\68965F3A\1835CB68\u2fhtml.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):45056
                                                                        Entropy (8bit):3.954164176068831
                                                                        Encrypted:false
                                                                        SSDEEP:384:qi9tF0bg81ZrH7b34Fu2NFuYNFD5Gl8m369SLQJ9yuFpzDt:qiXKbgWrHH3KuIuYzol8m34yuTzD
                                                                        MD5:F61DC6C03816ED80201D25FBBB30FED1
                                                                        SHA1:3AA785941B1FF7A880228248F94148718FC47146
                                                                        SHA-256:5CDC8ADB1C10223A4C3AF25BB192E2FD47F8E83539714661AD4A6FCABB47F163
                                                                        SHA-512:E802DD73A1CA937004B3A47E00FF75B744BB2B00A962559684FA01AFBDFC40C3ED4755BC8B5ACA1C57B9A5075B0FB39B1FBB3DD875D5A4F2CB6A88B4CB4BFDEB
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y........................W.....B.............Rich..................PE..L..../;...........!.....P...P.......O.......`......................................................................ph.......a.......................................................................................`..8............................text....@.......P.................. ..`.rdata..-....`.......`..............@..@.data........p.......p..............@....rsrc............ ..................@..@.reloc..<...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\6C6652B9\1517B7F7\CF_report_bus.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1032192
                                                                        Entropy (8bit):6.101428802921911
                                                                        Encrypted:false
                                                                        SSDEEP:6144:CtAHN82uQEooHGt5iJATXUyMTlyfkFvV7MRIdKfjidfGdpb4W:ssuQtHt8JAiFvV4RO9G7
                                                                        MD5:958010BB6090C998DBD84279C5A115EE
                                                                        SHA1:53295D5498C7BB60B285F86D327264E526CB8034
                                                                        SHA-256:D1936FB2D6D9F13DE68A423870931D1467BD6DC6115D55579DF84E6F9CC90FB8
                                                                        SHA-512:42A44A32F60A58CB45B8B05299A9EB2C0C945A248B59641ADA7396BB4C8C64D2D04130066CECEB51A23E2AD2A55971FC07766EAF9D281F5F87E438BE2E5E54B0
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B............6.......................J.......Rich....................PE..L......\...........!.................Y..........................................................................................(.... ..`Z.......................#..........................................`... ....................................text............................... ..`.data...............................@....rsrc...`Z... ...`..................@..@.reloc..~@.......P...p..............@..Bl.[J............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\6D4D0E7\34510A4\ImgX61.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1213936
                                                                        Entropy (8bit):6.347694185622386
                                                                        Encrypted:false
                                                                        SSDEEP:24576:CjKrC6GOC5tmhsG3Ikjhd+guqUvM+EoOoSSWKWm3ld0Wd8P/b+M7nchgQNpo/4oe:y6GOC5tmhsG3Ikjhd+gu9EoOpm3kWdII
                                                                        MD5:ADCF2B08D824BFEE8E022403DA1B6351
                                                                        SHA1:7E675B66DAC9DE781AABFD7A5F24FF00832363B3
                                                                        SHA-256:89D6303A7725CE4A39417ECA498EEEAEDC286747004002853C6D49D4589B506F
                                                                        SHA-512:DE3E0A28D920FB5206DD86AFE0ABD02F835F04F73828CBE73B6D1B613B5ED565FE479CE3898CF56612E8457AE1F4ECC651B028000E0FE4F239C4BFFB0A15F430
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~.;...h...h...hY..h...h.=.h...h.9.h...h%?.h...hRich...h................PE..L...&.zF...........!.................\............R................................................................. .......t...(.... ..............0p......................................................`... ....................................text............................... ..`.data... 1..........................@....rsrc........ ......................@..@.reloc..............................@..B..:@............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\6DEA5FF3\7204BF44\CRXML15.DLL

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):167936
                                                                        Entropy (8bit):6.187995719559416
                                                                        Encrypted:false
                                                                        SSDEEP:3072:RiT9Mjz9fxT8ms8xHZaKV6AORqrkcNnVn6u7OtP:RvfxFHZdYOk4nVnf
                                                                        MD5:56A8FDC2477954D863C92D08675FFE57
                                                                        SHA1:00E91FC7856C20F05E7203CE3BA72F2F0F78BEB2
                                                                        SHA-256:B39FE18BFA62BA1A2F1D680B3505100448F3CB3ABE49B6D55B3DFFDF430E25BE
                                                                        SHA-512:233379A84A523A890E593C7550344CCA982E18A5F5A91B42209304279CD0F0798AEC67D9BC897769A537C2DB617E9A2210EB5A5E1A0E6C388AC0A70CE8A40FD6
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................%....Y..........Y.....a....Y.....Rich...........................PE..L...E.=9...........!.............................n(.................................................................................`.......................p..X....................................................................................text...r........................... ..`.rdata..sf.......p..................@..@.data....+...0...0...0..............@....rsrc........`.......`..............@..@.reloc.......p... ...p..............@..B................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\701CB7F7\34510A4\mscomctl.ocx

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1077344
                                                                        Entropy (8bit):6.342928728513251
                                                                        Encrypted:false
                                                                        SSDEEP:24576:dnt4M/pL1wAEIqSBanK6CC33VTj+1R8xRFLqqmbD1kWIAqKU:dPL15EIqS1e6q3FmKbtL
                                                                        MD5:774A15583DB1AD44C5EE32309C840C96
                                                                        SHA1:B3F80B06AD6283FC021DE1682772C22DD6F2436B
                                                                        SHA-256:E1058530566AAEDF7D529A394F18E8540D8F6106F57381D2DD431AFF99951F8C
                                                                        SHA-512:01070B6DCB28E4AC8E1D2C3B44F882E85249D6F00DF58229ED938592CB7355613BD88F649664AC9E5EE2F8328F578BCA0C4A14B1F1904D372AAFD1F7464CBA86
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r..<.....@.....#.........j.......9.......p....X'.........................P....... ...............................E...............P...Z...........V..`............................................................................................text...H........................... ..`.data....s..........................@....rsrc....\...P...`...P..............@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\7A300D31\1835CB68\crxf_pdf.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):270336
                                                                        Entropy (8bit):6.270731532321854
                                                                        Encrypted:false
                                                                        SSDEEP:6144:shwrCzCaYgTe2I3J1un3m6fdjR4vAkGh+:shwmPrI3u3pd9kAM
                                                                        MD5:A14947F6BA9E75C5E5C2263157E886CE
                                                                        SHA1:0E39F13BEC51D6CB2F1CFF3F35660B0A2E3C4F40
                                                                        SHA-256:E43F008E7E57BACDD29E02570C4728B720BA2D11D9D269FCFCA54C875715ABF8
                                                                        SHA-512:B7CA2D08D9D5C9D1374CF541BFFF5AC87C2D5C82857AEF1B84BA6307A5157B192AABA62BE399B2B25AAE5176D39E198625A1CBB109B494AEDDC33B4783C73401
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:Km.[%>.[%>.[%>yD/>.[%>yD.>.[%>.G)>.[%>.y.>.[%>.G+>.[%>.y/>.[%>.y/>.[%>.D6>.[%>.D6>.[%>.[$>![%>.y.>.[%>V]#>.[%>n{!>.[%>Rich.[%>........PE..L.....{:...........!......... .......=.......................................0.......................................x.......m..x.......x........................,..............................................|....................................text...b........................... ..`.rdata...j.......p..................@..@.data....[.......P..................@....rsrc...x...........................@..@.reloc...=.......@..................@..B(.m=8......>E......=O....#.?Z...".m=d...'.m=q...........KERNEL32.dll.NTDLL.DLL.USER32.dll.ole32.dll.OLEAUT32.dll.GDI32.dll......................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\7CC1D691\34510A4\TABCTL32.OCX

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):209608
                                                                        Entropy (8bit):6.343103011256511
                                                                        Encrypted:false
                                                                        SSDEEP:3072:kBOrV7gwFcKneF9s2x+eDYIRXDc6VNeFjzBB9g3A/Vt8DbtUfREm/UmL/8zc8N9R:k0rVdCVrsEncIRXDdVNeFBIk2DgR4d
                                                                        MD5:908938D3BA2D870EE9FC6238A4C6AF95
                                                                        SHA1:E8648D6D69FD5CF900C4BF98B210F6921BED3EF5
                                                                        SHA-256:40CADBFB2EB5732F025D687664F34239DB7153A192BCA0287F9208852B201FB6
                                                                        SHA-512:F9433F48330F7DDC64EDB8A64229C1490FA31978E9F4FFDC5FA5FF8B18430317A39A07A559D560051BA195B730429ACFB18EDB38BF712507B00AC788FFCA0B74
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......:....f......#..... ..........X........0..../!.........................0.......i...............................................p...............................................................................................................text...f........ .................. ..`.data....7...0...8...&..............@....rsrc.......p.......^..............@....reloc........... ..................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\7CC4B206\7204BF44\QECR.LIC

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):796
                                                                        Entropy (8bit):2.1709395683364
                                                                        Encrypted:false
                                                                        SSDEEP:3:2Ao1ihaQDeFS4qs//l8AqjXF1WX0jpuqje2up1Y1p7vuV//14En:251peeFuE8Aqju0jFjenw7WVX1j
                                                                        MD5:892C3A800773081A9110542550B11EA4
                                                                        SHA1:A9D593E2FA8A59D4F4425DD7679B3D600B47D3F9
                                                                        SHA-256:03EEA05D4F15377229E49E38887D2B2BE57E80988FF9741F15F4A6C1EF377562
                                                                        SHA-512:68C3021FC86328473A45A56AAE1FF0207956C72392036DB6B4CD67803C701C61B686F925C527DFDAE1A1F98806C10C4A107949113E0306720B699844C97D6999
                                                                        Malicious:false
                                                                        Preview:........(.....Z`.O.K.$...?..-.{P./.;.T.x............`...................................DataDirect ODBC Driver Pack.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\7DB1D6B0\7204BF44\CRBAS15R.DLL

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):32768
                                                                        Entropy (8bit):2.8457754129966433
                                                                        Encrypted:false
                                                                        SSDEEP:384:7GiZrKbKxGbk5MOqerr5iKVHHgEKZ2ajjH:tWbKxGbk5MOqirbngbj7
                                                                        MD5:2D9A1115B872258CFCD657E32A2955B8
                                                                        SHA1:23021F48D1F741BF04F79DB49202A0A3243F3D05
                                                                        SHA-256:5D137E1FE18A51D7A7AA6B5F67BA55E00ADB44155F771F81F56A22418FA8EB6F
                                                                        SHA-512:F08CEFE2F8D208CBD554B673300536C69C0F08B016B236293CAED0E62C7393CBABC4F8D377EC5BB05D902DAA96B3370648CF188C0B5A0989AFBEFCDFE0B3F205
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.hG]..A[.Rich.A[.................PE..L...M.t9...........!.........p...........................................................................................................]...................p.......................................................................................rsrc....].......`..................@..@.reloc.......p.......p..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\80B1517D\1835CB68\u2dvim.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):57344
                                                                        Entropy (8bit):4.985155994169938
                                                                        Encrypted:false
                                                                        SSDEEP:768:r/LUjp/k9cBvKyKjvyalzmxzaoxz8VeqiX9WHFN1T8Oqm/TKFIJsa:8jp/kWBC0aR8nmLKFIf
                                                                        MD5:C57A3BFF1408C33DE5DA5BB1C62ECC5B
                                                                        SHA1:1A4DE7F1677689E71C2AC78080AE62687808FAB5
                                                                        SHA-256:83EFCAC4F78331E6F8F25ABBEBBC11667E11F46627AB188EC7E00BEB51B9DAC9
                                                                        SHA-512:D2E7B4FDF32E45B032823B7A515BB348DB63A1CD63A3EC7D286521FCCDD39870BABD4E82038FE8937CBC8C30F2FF6D2BFBD05F9CE34CFF2A153654B77AFED08E
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^~..?...?...?...#...?..H#...?..4....?...?...?... ...?..4....?...9...?..4....?..Rich.?..........PE..L....Y.:...........!.........P.....................@.................................5..............................p...........P...............................................................................D....................................text...3........................... ..`.rdata..............................@..@.data...............................@....rsrc............ ..................@..@.reloc..............................@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll......................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\832FC268\1517B7F7\LogFile.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):28672
                                                                        Entropy (8bit):3.485382050322971
                                                                        Encrypted:false
                                                                        SSDEEP:192:i9NOy89Skl9gzr3HUZTNzEOsrt/V8Rhfv67fSryIAuAhqLaPXGOS:i9NOGFH3HYTNzjsrt/V8vOSryShLaP/
                                                                        MD5:BB46C0B126E28AED97D3DDFC96BE0902
                                                                        SHA1:BAAA2A2CE2BA8563E4F6298A9EE2BF5D38D1AB2F
                                                                        SHA-256:BB2469FC8087D0CF223E2344525A8FC536CF2CCEBC213F43F765FFAFEE44729E
                                                                        SHA-512:747C578E3D44ACDF079693A8887EB898A6A213DD190AE98FECC348EAA371772F4BC98BE4C195F0C5A68BDB38EEB3D9F57B81189E46E284551B10F7F7664EA643
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k!../@../@../@...\...@..`b...@...f...@...`...@..Rich/@..................PE..L......B...........!.....0...0......l........@...............................p......&h..............................P8.......3..(....P..4....................`..............................................`... ....................................text....(.......0.................. ..`.data...H....@.......@..............@....rsrc...4....P.......P..............@..@.reloc.......`.......`..............@..B..:@............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\83C5D67\7204BF44\crtslv.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):49223
                                                                        Entropy (8bit):4.109718425650408
                                                                        Encrypted:false
                                                                        SSDEEP:768:+ccYopyfE7saYHK54TbAG9sAiw6SlglrtA:ZcYop1gaYO4oG9sAu/rA
                                                                        MD5:9B7EB9FB8DF4F52965CBC4808EA5062D
                                                                        SHA1:5D516D6F766A1911C7F1AFCC9B71A2A90F426B02
                                                                        SHA-256:30BA60E53FACB1F6AB703108688CE281DFEBEAE01A203DE0D800EC6DE5089538
                                                                        SHA-512:C69D998736D2F6CCF515D35436EE0CCC32403F0A6A0E22F28CCCBAF837D65D027E5470DC5805A02ED599DFDC32B113CB394EACBBDBD4B5879EC2C30805D55304
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......uFq.1'..1'..1'...;..4'..0...3'..g8..9'..1'..)'..S8..4'..n...4'...!..0'......0'..Rich1'..................PE..L..._.{:...........!.....@...p.......1.......P......................................"...............................PV.......S..d....p...3......................0....P..........................................h....P...............................text...E1.......@.................. ..`.rdata.......P.......P..............@..@.data...l....`.......`..............@....rsrc....3...p...@...p..............@..@.reloc..............................@..BN_.P0......N=...V|)LG....sXNQ...z.[J^...........KERNEL32.dll.NTDLL.DLL.ole32.dll.OLEAUT32.dll.ATL.DLL...........................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\83ED17B7\1517B7F7\CF_report_history_bus.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):53248
                                                                        Entropy (8bit):4.898095142151349
                                                                        Encrypted:false
                                                                        SSDEEP:384:J+vR8H66UYH0zwqXI7sf1PipgoMpUIp5DVFnJZJbBi2wq2e/8B5DXbON3WyIaW5i:gCa+UzwqXw9GZ9Bi2ldClmJhWc2tIGS
                                                                        MD5:3160134FFCEE79CA0F64F305858F468B
                                                                        SHA1:ADD3DF032A94EDA0872F06003844480145906B4B
                                                                        SHA-256:F7CE6181546DFC6F72B012EB16ADDBFEEF2E1966455F4165E17287D87BCEB415
                                                                        SHA-512:DAD017DB58DED87008409094655B0B476FF8F3C639EEFA082D3513687FFA36B9214F46B4AB26B0DB9444A6B785A44786CDFEA4C5D09C86C4CB3BCFAF582D5851
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i~..i~..i~...b..h~..&\..k~..m]..h~...^..h~..Richi~..................PE..L.....aC...........!.........@......................................................9Y..............................P...........(...............................<...........................................`... .......X............................text....|.......................... ..`.data...............................@....rsrc............ ..................@..@.reloc.. ...........................@..B.$.>............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\880D11DF\1835CB68\P2smon.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):192512
                                                                        Entropy (8bit):5.9642286021294835
                                                                        Encrypted:false
                                                                        SSDEEP:3072:068MaRFejZOvjqOTN9cWLBuQVNysFsfEz1vUgfK/vsIzx4yEo9:3cpAW9uQVUpMJvKMaxB
                                                                        MD5:D24020E137BD588D955ACEF0A8E389CF
                                                                        SHA1:7836AAA05532145E85C770EFA6B06398E5DDEF7B
                                                                        SHA-256:815F428668D75B9328ACA5199A601F1DADB949D50D29E510E73E260B76323852
                                                                        SHA-512:EC91F81F66B365D7C4C291D066F64D74A964D3535AFBC72A29C0B6F0DB1B7B260565F26A3CFFB5D4E48C63342B637A65B127019F58982C43593DC81FFD569852
                                                                        Malicious:false
                                                                        Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......'$.cE..cE..cE...Y..dE...Y..aE...Z..gE..=g..`E...Z..gE...Z..gE..Z..aE..e..bE..cE..`E..5Z..pE...Z..nE..cE...E..ef..@E..C..bE..e..bE..RichcE..........................PE..L....A>=...........!.................................................................................................@.......,.......p.. C...........................................................................................................text...%........................... ..`.rdata...J.......P..................@..@.data........P... ...P..............@....rsrc... C...p...P...p..............@..@.reloc...$.......0..................@..B................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\8BAE8D59\7204BF44\p2sodbc.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):307200
                                                                        Entropy (8bit):6.022609410600443
                                                                        Encrypted:false
                                                                        SSDEEP:6144:FpQDKIhkfJxWbuqzTZSDS03HSWAuV0W+td9x/LJL:FpQDKIhkfJxWiMTZSDS03yWAuV0BrH/R
                                                                        MD5:8394AF480C146EC7F7A554EA1FB8E9C4
                                                                        SHA1:C44B3BD7D524A0F37D1171F4066C7BD0AA7E3CF9
                                                                        SHA-256:73EE0E2B4822A03136B18AB32C951CFC5E7C68A40B046B82E68B1B156582FC18
                                                                        SHA-512:7E7BB50BFDDF3B69813F4A87DCBFC76A6A3DCCCD6CC9F459DCD56A222EF82C980B5B5A900293CE8A6DBDB1C68483443726D4834886AFB067A1A009B875D03E1C
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........oa8...k...k...k...k...kP..k...k...k...k...k...k...k...k...k...k...k...k...k...k.-.k...k...k...k,..k...kRich...k........................PE..L....Q.>...........!.......................................................................................................p........ ...S......................4....................................................................................text...;........................... ..`.rdata........... ..................@..@.data....+.......0..................@....rsrc....S... ...`... ..............@..@.reloc..X .......0..................@..B................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\90E4D581\1517B7F7\CF_ref_report_bus.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):53248
                                                                        Entropy (8bit):4.713712240941136
                                                                        Encrypted:false
                                                                        SSDEEP:384:4tkKyqTOaORsY855to5sNS0yGm3WyzKIN19xqgefE5sg+OjWgDpu:8kKkWt2sLyDJ+EnWg1
                                                                        MD5:BAF2D0717D304BE1C5A265FC01D92FF6
                                                                        SHA1:E02B63B69C92478B03D7F105F4A494F012E4F66A
                                                                        SHA-256:7E67EC445AA7B8C2915339514DC025C432C6253FDA8FC5463F5F704F5999E846
                                                                        SHA-512:CF51856162C34DCF373FAABDE89168EC63B9DC86F883867EDCDEE8D6BEAB09673BF4995D52E6A6C42EBDA820C6332D962E0ED3540EC747CED7398B2AD2BA3E76
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................N....................2......Rich...................PE..L......C...........!.........@......L.......................................................................................~..(...........................................................................`... ....................................text...Ns.......................... ..`.data...,...........................@....rsrc............ ..................@..@.reloc..............................@..B..:@............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\92CEEA92\34510A4\DAO350.DLL

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):570128
                                                                        Entropy (8bit):6.368068172894281
                                                                        Encrypted:false
                                                                        SSDEEP:6144:lO4zReIcAtVXrPsS3Syvqe4v2QeD8yCaDSCwBwAlvz6Bm2hf9QdHHtMMeOh4J7Wu:lO4zRe7AvBiyvqe4pe7wHlv1tO7VYFk
                                                                        MD5:8888BDBD4E118D915D40A11748282BCA
                                                                        SHA1:4E8822D2242D175CC3D708843E2CD71B7EE7033D
                                                                        SHA-256:A4B20735BE317A924D2E36707BAAF911FBAE890CA53C5044FB506F15D33BCB6D
                                                                        SHA-512:A96F5E72905571DE84F515DD8A19C87D5143EAD532BF01F0132DA8262974BFAF910F24B466D49CD4EE83845FC65F02C273A550786854AEC3E0F4FA713929B562
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....+5...........#.....(..........t.............G.................................Z........}...................... /.......0.......`..T........................P...0...............................................................................text....'.......(.................. ..`.data........@......................@....rsrc...T....`... ...@..............@..@.reloc...P.......R...`..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\9F0CE7B6\7204BF44\CRxmlx07.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):942080
                                                                        Entropy (8bit):6.65646975675861
                                                                        Encrypted:false
                                                                        SSDEEP:12288:c30LOWsXFbwAlSc96WPwYW0WxgERNUzD71h1PTMNy:vLOWsXiAlS86WPhOvNUANy
                                                                        MD5:4FCCBA7B1CDF3BC6EA31F1B0627AE8EC
                                                                        SHA1:770725AF1E58CA070AD3456D8572B3E04A70B7EA
                                                                        SHA-256:D97B3B00646FED52DF6855EFBA4269B63F1263EF32B3E477E1E2236A7F126F4E
                                                                        SHA-512:0786A923077CC4BA30E79C052590D571F54DF3E3B01BC6F9781B7E0ACF0E3F5D2549641C1CA11ABDCA064D88728F33B7E63C07DFE0D09D19AE339ECB6F86F6E3
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^x4...Z...Z...Z.a.V...Z.G;Q...Z..T...Z.G;P..Z.L.I.c.Z.D;Q...Z...[...Z.x.I...Z...Z...Z..9Q..Z.E;Q.0.Z...\...Z..9^...Z.Rich..Z.........PE..L......:...........!................g................................................................(..............p...>........................................v...................................................................................text............................... ..`.rdata..............................@..@.data....>..........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A157FA05\1835CB68\crxf_rtf.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):180275
                                                                        Entropy (8bit):6.1633040175705185
                                                                        Encrypted:false
                                                                        SSDEEP:3072:nl3w8fl441BooG039ZYWI7ge5JC3t11WX3V0v4zSuoMZmbesm:nlrfZfAQ5efC911y3V0qZ2y
                                                                        MD5:A636F5E7FF78759D5F3C677A2875FA2D
                                                                        SHA1:DDCE4DC55DF00A4B6B92FBADDA6CF444B4D82F35
                                                                        SHA-256:7C33447829876F22FA5D5FD5EF2E67AE06B48BB2BA32840CF44F940F2F547DF7
                                                                        SHA-512:8C7A23B9B01075C0355E8889DE007D962E24E84EBA13B896FA8251EF2750D620CDCE74AD423003BFED70C39F7144803089B17C4D949DC9F71714BACC02668E15
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........lx..+..+..+...+...+...+...+p..+..+...+...+...+...+..+...+...+...+4..+..+...+..+Rich..+........................PE..L...M..;...........!.................B....... ...................................................................... ].......Q..x...................................0"............................................... ..0............................text............................... ..`.rdata...?... ...@... ..............@..@.data...08...`...0...`..............@....rsrc...............................@..@.reloc..l........ ..................@..B................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A297C06E\1517B7F7\CF_audit_review_bus.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):90112
                                                                        Entropy (8bit):4.965285395888949
                                                                        Encrypted:false
                                                                        SSDEEP:768:52il+An9+x/+RsLeXyQwyUi+75TQjwwMevLC8jRWExNNHRxb4PzI4aaD:52il+OamB5wPQ8ErpNVfOaa
                                                                        MD5:5E2CF9895D2D94D593139ADB77F68714
                                                                        SHA1:753FCCA7D9E6ABA17DAF198B4F3EFD096509DEA3
                                                                        SHA-256:3D80746EB136679B2139AF22A29C4917FEFFE08B986F55C2F224D61001C1F924
                                                                        SHA-512:AC2959EBDF0881A724912A77FBEB02D3B61888AAD96814B3B9A1FF4595DC081EBEEAC186A119D46B318D0141461B16F2B60D15E21F3181ED1E5ED242CBA06DEA
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........AN. .. .. ..<... ...).. ...-.. .~.$.. .Rich. .................PE..L...S.:^...........!.........p......0........................................`..................................................(.......`0...................@..............................................`... .......D............................text...@........................... ..`.data...............................@....rsrc...`0.......@..................@..@.reloc..\....@... ...@..............@..Bl.[J............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A52CA551\7204BF44\CRXML15S.DLL

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):40960
                                                                        Entropy (8bit):4.673313433135478
                                                                        Encrypted:false
                                                                        SSDEEP:384:xEXQnim4w2xSKOJtcLFZdMQzf3M7TnSYkN9A/hqycPGSpzuE8d+chaz:xEcim4uUFgQzf4nSH9A/hqycesuac4z
                                                                        MD5:1783A2BC9AB938AD923D2040B4ABB243
                                                                        SHA1:CA6EABACF16E56723429F65CC5D592699015783A
                                                                        SHA-256:0D4B4BAE969E25267C54B367AC9760A718869ACB793CC1380D3A37767BC8E63C
                                                                        SHA-512:1A3790C55A7015F4D867C76CB6F4E2D483818A9534E5F4EAD73E44E19B876672EE4A9AEA9A4960E37F729B3C428C40755023FDA7D197064793002B2FFD5AFC20
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*...*...*...*...*...5...*..X6...*..$....*...*...*..$....*...,...*..$....*..Rich.*..........................PE..L...].=9...........!.....0...`......j6.......@.......................................................................N...... C..................................@....................................................@...............................text....,.......0.................. ..`.rdata..d....@... ...@..............@..@.data........`... ...`..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A8299B92\7204BF44\CRXML15R.DLL

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):20480
                                                                        Entropy (8bit):2.452431739694398
                                                                        Encrypted:false
                                                                        SSDEEP:96:50f6X9EKZaMwah+RtQl9X8N5MMJigpFnUqmspl65z+muijdwMDRaaPp/MQaf:50CaKHwah1wF3TWd/Rama
                                                                        MD5:3243A8F5DB572EAE76FE2348B2E106C0
                                                                        SHA1:9DCEE517723C6B2206C83C065B4C0B889B69E0DD
                                                                        SHA-256:B7714239D578D588B1AECC55E89DC6327716F43A4CB68627ABFE30AB344AF460
                                                                        SHA-512:98F5F5BCACB3B86EA05E493883D62744E20351334A71D7E3066D177797BD132A51B647C60A485E05041E3A1F6003E0D093D267AEFD0AA5DD3008C44676426E05
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.hG]..A[.Rich.A[.................PE..L...G.=9...........!.........@...............................................P...........................................................+...................@.......................................................................................rsrc....+.......0..................@..@.reloc.......@.......@..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A95AB0B4\34510A4\ImgX61.ocx

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):431600
                                                                        Entropy (8bit):6.217541423817009
                                                                        Encrypted:false
                                                                        SSDEEP:12288:pCPlz9HRXcktcvyk694AVvc8POXqgaLkS8xitZIM5y4w:pCtzao48c8mXqga4SoMkF
                                                                        MD5:C7082A0F831F2EE00AB907FC7B9EB040
                                                                        SHA1:3A145FDE8D84162E8C86999BCEDA0A2207D80BE4
                                                                        SHA-256:C33468445FD4CB01B701AFBC41ACF3422484B734A4490B8CC21E2ACEDAE35DC0
                                                                        SHA-512:AFEA29D84C9174539D32FE796F24ABAA134174366FFCB859F3B38BBEBF1780AA0BD0F882C97C8C769D11242E00945DDBFC9613FF1FCEA70D0DBA8B51FA61C6F9
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#.}.#.}.#.}...s.".}.l.t.7.}...p.".}...y.".}.Rich#.}.........PE..L...).zF...........!................4............. V................................zR..............................P.......T...(....P..............0........P...F..........................................X... ....................................text............................... ..`.data....5..........................@....rsrc........P....... ..............@..@.reloc...S...P...`... ..............@..B..:@............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\A9695CDF\1517B7F7\CF_Rmt_DB4_Update.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):86016
                                                                        Entropy (8bit):5.059200142599135
                                                                        Encrypted:false
                                                                        SSDEEP:1536:9lU/HEzdtrCTdqWlLZAGFrlDMkPXBiwBMeOYey6yJPkk84I8zEP5sM:vU/Hy25XttJlBXh84bwPiM
                                                                        MD5:FBB1A200C62241DBA86AA9A9EDB448D8
                                                                        SHA1:E6F5B758221D23F608780BF1203D684CB39DB8CA
                                                                        SHA-256:D7670874382FF3D458CC7B766127CE497B87D59C420DB5C4FD65D48693F6BB27
                                                                        SHA-512:6740B3EEB2D0A4903926F0614BD930DE67DBE3DDE757C17F514EA6C7A1337DB82497035B843FA1AF55C13656B4D88A719FE95FF52D709D5EC4C53E811C0C4553
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i~..i~..i~...b..h~..&\..k~..m]..h~...^..h~..Richi~..................PE..L.... .H...........!.........@......\........................................P......o...............................@...........(.... .......................0..............................................`... .......,............................text............................... ..`.data...............................@....rsrc........ ....... ..............@..@.reloc.......0... ...0..............@..B.$.>............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\AB3A15F4\34510A4\TABCTL32.OCX

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):209608
                                                                        Entropy (8bit):6.343103011256511
                                                                        Encrypted:false
                                                                        SSDEEP:3072:kBOrV7gwFcKneF9s2x+eDYIRXDc6VNeFjzBB9g3A/Vt8DbtUfREm/UmL/8zc8N9R:k0rVdCVrsEncIRXDdVNeFBIk2DgR4d
                                                                        MD5:908938D3BA2D870EE9FC6238A4C6AF95
                                                                        SHA1:E8648D6D69FD5CF900C4BF98B210F6921BED3EF5
                                                                        SHA-256:40CADBFB2EB5732F025D687664F34239DB7153A192BCA0287F9208852B201FB6
                                                                        SHA-512:F9433F48330F7DDC64EDB8A64229C1490FA31978E9F4FFDC5FA5FF8B18430317A39A07A559D560051BA195B730429ACFB18EDB38BF712507B00AC788FFCA0B74
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......:....f......#..... ..........X........0..../!.........................0.......i...............................................p...............................................................................................................text...f........ .................. ..`.data....7...0...8...&..............@....rsrc.......p.......^..............@....reloc........... ..................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B2966187\1517B7F7\CF_File_Data.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):368640
                                                                        Entropy (8bit):5.586081247688742
                                                                        Encrypted:false
                                                                        SSDEEP:3072:9NZEJpxaZlLOYMAp03rQycjxgM+FcMei/j:9jeraZlFxuK+FX
                                                                        MD5:3C1A0BD4BE7917D6AF874FEAE055E28D
                                                                        SHA1:EEF06485875C7FE0505FE54EE1346AF610421CF8
                                                                        SHA-256:AACF51731D19CCC4B2A01489C0210E5D9BD6EF8886D802BB83FB49DDA5F2C7F5
                                                                        SHA-512:6B7131F6223E055F2AA9A3618FC4BC2F4893C5E0C9708CBD0C6E5925D490A921FBC8E7BC48D8E6459738D163771CBB4D140385D590E111A6B97BF99B7DC59B31
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......fa`."..."...".......#...m"..5....&..#.... ..#...Rich"...........PE..L...QE._...........!.................B..............................................................................`...........(....0..$....................0..8d..........................................X... .......t............................text............................... ..`.data...............................@....rsrc...$....0....... ..............@..@.reloc...y...0....... ..............@..Bl.[J............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B3FFCC7F\1835CB68\u2dmapi.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):40960
                                                                        Entropy (8bit):4.318216925570331
                                                                        Encrypted:false
                                                                        SSDEEP:384:6W2HDi9HjAqwwbEdrakQnfsm4taun3RICVM6Db9S6echEFROQk9D7:6WIDiJwuEN/3auBIKMcIHRED
                                                                        MD5:E09FEC233CCD2C6E9D390787D2F87DDA
                                                                        SHA1:264F65809115879521DAAD866792C92D9D3C6539
                                                                        SHA-256:709EFD24B655E782C423D2A73A7B6DB687ADA69FEDC8DED6A0C6081A416E8742
                                                                        SHA-512:E9388F6645A586BCCEE14C5DCABEC47F7B64505C6998C9100A19E32B8ED98BD058458859E2CD6D063CD61E90CD4D812FC47F42BEC54502DEAA31ED13F2F6A4B7
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........a.....................h.......................................,...............Rich....................PE..L...7<.<...........!.....P...@......-S.......`......................................................................Pe......Ha..P...............................(....................................................`...............................text....C.......P.................. ..`.rdata.......`.......`..............@..@.data........p.......p..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\2003_Disclosure.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 62, Total Editing Time: 02:41:01, Last Saved Time/Date: Thu Jul 29 14:33:26 2004, Create Time/Date: Mon Mar 22 15:03:08 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):2074624
                                                                        Entropy (8bit):5.277108105692261
                                                                        Encrypted:false
                                                                        SSDEEP:3072:tAcGm88F/D6zksqVGpStaTbIfkI15eJWFNHXaPEOrZGERaot3n5fGeZlVE/hP5Zj:t5YksqVyStMwkTsFda/geZ3E/hP5Z
                                                                        MD5:3BF8C3B91E578461B194D6620D227F23
                                                                        SHA1:254D4D58E68F01DE591E9207898B0774499E98DC
                                                                        SHA-256:D38D74FBB7818D5E01251D91E290BDF2B8C0F2835F45E18039A4426FB536F20B
                                                                        SHA-512:8FF5177AC387B55FBD39712C3578FEA41F8447479B49C56FE6F66FDB31E12385D328867C3441C9A7DA2D100E38D14EB615D70D439F7DF3E38D5233381E8737C3
                                                                        Malicious:false
                                                                        Preview:......................>................... ...3.......................................{...L...4...N.......................(...........~...r...t...........Z...............}.......c...b.........../...y.........................................................................................................................................................................................................................................................................................................................O.l.e.............................................................................................................0.............O.l.e.P.r.e.s.0.0.0...................................................................................................d.......S.u.b.d.o.c.u.m.e.n.t. .5.5............................................."........................... ...pu.. ...pu..............C.o.n.t.e.n.t.s.........................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\2003_Electioneering_Report.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Thu Sep 2 16:11:52 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Wed Sep 29 20:57:07 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):435712
                                                                        Entropy (8bit):5.210313030830372
                                                                        Encrypted:false
                                                                        SSDEEP:1536:DhRq0fBeerIhQVQ+3I+9gc9R6P7KUJSXCMxqAG1V4vS+Zq8veRNXncMEUR21HF:7ser/9WTPTJSXCMxqjevS+ZTveB21
                                                                        MD5:9953C4F01E97E2EAF6D408A9637954AA
                                                                        SHA1:C0CA83C8458AA1A569586CF343E7AC6ABDA51F32
                                                                        SHA-256:D64D4097CC36841AE5E105119E7BD9AF6E099E203C2B6625B5170CCB3AA9EE10
                                                                        SHA-512:43A445C46110992A37B40A9B3D73C89443024FEE6374C7B0AB8B3D047CF5888F0DC25C6FC6A11E8139AA5838907D7005BD11D2A58405679F3D14AF8022BFBA1D
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................\CFRS Common\CF_Common\cf_reports\2003 Forms\cro-2320.ttx..........cro-2320.ttx.......................SQL.....Pdsmon.dll....%Active Data (Field Definitions Only)....HC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\2003 Forms\cro-2340.ttx..........cro-2340.ttx.......................SQL.....Pdsmon.dll....%Active Data (Field Definitions Only)....HC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\2003 Forms\cro-2330.ttx..........cro-2330.ttx.......................SQL.....Pdsmon.dll....%Act

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\2003_FED_Disclosure.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 16 15:54:41 2003, Create Time/Date: Tue Mar 18 18:48:47 2003, Last Saved Time/Date: Wed Sep 29 17:56:45 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):474624
                                                                        Entropy (8bit):5.097844904674963
                                                                        Encrypted:false
                                                                        SSDEEP:3072:mWnYtI5uI5ZzxgLD9yQl2FzHc6AsnkrRcycDCTCQd4iNbN:mG5uaml28/
                                                                        MD5:B27917F1EDBCF0193DD90615BEC558A9
                                                                        SHA1:6FD7536E2D2EDBA9F19AF0C38CEEEE77FA5FD524
                                                                        SHA-256:37162A3D98BBB39027C9E77394BE2928E22E50967213B9FCAA1B371E60B1B298
                                                                        SHA-512:293BB3097A5BEC7C6A757811C1B4F76247C93E39E3BEA5285F80EA31EC8267725B1BC811F2DCC5386B6A191D8C32B8303F18D3165418D740D17414272539ED04
                                                                        Malicious:false
                                                                        Preview:......................>...........................................................<...6.......}.......~......................................................................................................................................................................................................................................................................................................................................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................:...`.......S.u.b.d.o.c.u.m.e.n.t. .4.6.............................................g...0.......................p..,.1.....,.1..............C.o.n.t.e.n.t.s.....................................................................................................?...........D.a.t.a.b.a.s.e. .(.T.L.V.).............................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\2003_FED_Org_Statement.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 53, Total Editing Time: 02:01:06, Last Saved Time/Date: Wed Apr 14 12:43:38 2004, Create Time/Date: Mon Mar 22 15:03:08 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):200192
                                                                        Entropy (8bit):5.169152554231805
                                                                        Encrypted:false
                                                                        SSDEEP:768:gY1gd28LOecPd/HWE03kAoEl1FVledXN/bYNsnDnNH33wvuatdTuBaBn3Dn5E0fp:n1gd28LOecPVSkAPNyTx3wvuRBaNDVV
                                                                        MD5:A64029646B20A91508A70A4BD30D777A
                                                                        SHA1:53C5AAE52951DD3E493EF04295B345CD0A4A3828
                                                                        SHA-256:39BC863CDECC987002C7BDDBEE15FB0226C4640B795E11B6FDC12EF90F3AB48A
                                                                        SHA-512:A5F3EA125987F11157CFC76DA99A5D816C665CCDFE6D9FA141D5AF5D926F85504B8EECCE417570D413DEDDE8EA4CF2C3E4F2FDCC585A0F04FF343E83C1FB4347
                                                                        Malicious:false
                                                                        Preview:......................>.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...........................................................................................................S.u.b.d.o.c.u.m.e.n.t. .3.0..........................................................................?O.."...?O.."..............C.o.n.t.e.n.t.s.........................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\2003_Judicial_Qualify_Report.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:51:41 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Wed Apr 29 22:15:36 2009, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):160256
                                                                        Entropy (8bit):5.0388804598932895
                                                                        Encrypted:false
                                                                        SSDEEP:1536:P1eto9rC6gvneLbeMXHwKY0/Fb57GgYINSfUSfBg:Y6mMXHwKY0/KgSH
                                                                        MD5:4695DF6904EADF85F3BB5A039159BB20
                                                                        SHA1:BDB639C12D0ED8A8C0393169D51859282D5FA7EC
                                                                        SHA-256:0688E65C8A9DAFC70CBACEB99A5B9C97C15E8545149BD907D48F6CB4472EF896
                                                                        SHA-512:02C191C002D5D212ED30893EA8E561A1C07FE1E86B49D6A1F40E7960B95B28EA241EB7F953D00681B76AC5798532CDCFD1FAFDC3B46DF416C8D118C5A4D4C6A2
                                                                        Malicious:false
                                                                        Preview:......................>...................................z.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.............................................................................................................:.............O.l.e.P.r.e.s.0.0.0...............................................................................................A...Fe......S.u.b.d.o.c.u.m.e.n.t. .3.8......................................................................... .F......IH.................C.o.n.t.e.n.t.s.........................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\2003_NC_Disclosure.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Mar 5 20:19:07 2004, Create Time/Date: Tue Mar 18 18:33:40 2003, Last Saved Time/Date: Mon Nov 19 15:30:01 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):2127872
                                                                        Entropy (8bit):5.298889348940432
                                                                        Encrypted:false
                                                                        SSDEEP:6144:nEd7toe+rgeeNPGd7crgEpc8mwE/hP5r8:nEdHiA9c2E/hP5
                                                                        MD5:74FDFC53C374A476FFDFABA9958F8D42
                                                                        SHA1:BFE8448D89E848DD7A14EEB8CC10DB0082B04198
                                                                        SHA-256:71D0000B9B8E8DF9F9E34B81F7BBDD0529C0B8D99BAB2DC83170628C34C33DF3
                                                                        SHA-512:1DE68F6ED46CF91F47110697F97058B7793794455EFCB73F57501FA683EBD004AA2285326E43D5264E12594973BDC49E8CBEE6A580B170D7E0F34EE312054412
                                                                        Malicious:false
                                                                        Preview:......................>...................!...................................d...m...o...........%...............L...............s.......D.......C...................W...............z...m...J.......t...u.....................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.1...........................................................................................................S.u.b.d.o.c.u.m.e.n.t. .2.7.6................................... ....................................>........................C.o.n.t.e.n.t.s.........................................................................................................x.......D.a.t.a.b.a.s.e. .(.T.L.V.).............................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\2003_NC_Informational.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: State, Name of Creating Application: Microsoft Excel, Last Printed: Thu Jun 15 19:07:57 2006, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Mon Jun 19 13:10:06 2006, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):2065408
                                                                        Entropy (8bit):5.312823323440365
                                                                        Encrypted:false
                                                                        SSDEEP:6144:8Ed1Xb0+PgeDeGGHERLAEgipEXZacZzl9zjBABgppv/5/vR6WOyx:8EdFEwMi9cZzl9z
                                                                        MD5:756B7BA54EC030397464A91A2CA8A8F0
                                                                        SHA1:46DBA88F3E7B08D7CC26F2A771E4C0D233140153
                                                                        SHA-256:6D27506B998E52767972E9BE275509AE1287640C3CABA0D850E21BE9D4E62844
                                                                        SHA-512:F35B723ED73D6BE222F402C6839E4E042949AAC33ED959CD82782672FF9AAE4695DC45F7D63317184267A07D085B2FE5001D528B70ADE57DAB68BFDA96BBCD1E
                                                                        Malicious:false
                                                                        Preview:......................>................... ...f...............................d...m...o...........%...............L...............s.......D.......C...................W...............m...J...h.......~.........................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.1...........................................................................................................S.u.b.d.o.c.u.m.e.n.t. .2.7.6................................... ...................................0".......................C.o.n.t.e.n.t.s.........................................................................................................x.......D.a.t.a.b.a.s.e. .(.T.L.V.).............................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\2003_NC_Org_Statement.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 52, Total Editing Time: 02:10:55, Last Saved Time/Date: Thu Apr 15 16:01:09 2004, Create Time/Date: Mon Mar 22 15:03:08 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):901120
                                                                        Entropy (8bit):5.196993760121088
                                                                        Encrypted:false
                                                                        SSDEEP:3072:C8q9+TeL0hZGnIillNma52eiBisyZm9aahAN:r6Jc
                                                                        MD5:B64E6E0CF32FC4A7CCB5C8D3BB92381D
                                                                        SHA1:427DBECB4E18B11CDC6EE54B4FCEA1231535DFDA
                                                                        SHA-256:5019F534DC87B51EDFB8DFF231118328587CCD3572C595E452E57AA7B84E74F3
                                                                        SHA-512:B87857D15D620FE3AE41B0B8761B67FD85ED48D65EB4D081FBC12A94C6ED2303972341B2B4C076C898FBB4063342E8A49DEA5357F0DE559FA6E59423B83B40A0
                                                                        Malicious:false
                                                                        Preview:......................>.......................*...............................................................3...........$...,.................................................................................................................................................................................................................................................................................................................................................................................................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...................................................................................................2.......S.u.b.d.o.c.u.m.e.n.t. .4.2............................................................................|.".....|."..............C.o.n.t.e.n.t.s.........................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1000.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 76, Total Editing Time: 06:03:59, Last Saved Time/Date: Mon Jul 28 15:25:51 2008, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):187399
                                                                        Entropy (8bit):4.9388946711249355
                                                                        Encrypted:false
                                                                        SSDEEP:768:hP25wAQghxgQwBRaKgQwAQBRhxBRRAgwAQCF1lS8Fgwfv/mTnFGZE/hP5Si6N+2/:huOjFuE/hP5Si6x62
                                                                        MD5:D09CD0BF633CD0605976F14AE87B35B9
                                                                        SHA1:6FDE766F4DB41383C067AB5179CE47D83413F5B2
                                                                        SHA-256:D63BEBE3FC83950403F69AFCEFAB59612F44B3D5817C419F3383D95A079BC025
                                                                        SHA-512:297F15C9315AB2159C8630C14DA3E9C25B1A0B200B51A64EF3EB2A82FEA4619D61A7024A07C166C17B6DE8440247193247F436CD1C8383C95B8F3C4D4E46583F
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m.......................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1010.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 53, Total Editing Time: 04:08:04, Last Saved Time/Date: Fri Dec 17 19:08:06 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):61440
                                                                        Entropy (8bit):4.833909151781048
                                                                        Encrypted:false
                                                                        SSDEEP:384:G9NvsBioHfL2O1hhCncEnYeKnDslIADOrlBHYH3sVIc:JL2+hwnDnYeKn
                                                                        MD5:010437FD9249DE33A524028CB861559E
                                                                        SHA1:343EEE5E9C4F8CCDD3BA0962BE55238D58F3F448
                                                                        SHA-256:07E783E5242BFED746924B7678AADABC12C52E463EC0161778BDA98882073612
                                                                        SHA-512:DFD2E2E68ED5C8624EAC69EB559F45FE5F08A902745E400CF7AB1ACF3B8800B919CA74851783DD94CCE313027D5F9BFA69CFD9B88F4773151C24F5F0BB2C40DB
                                                                        Malicious:false
                                                                        Preview:......................>.......................E...........A...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .9..........................................................................F....`!F.k.....I.k.................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................*......E.m.b.e.d.d.i.n.g. .1.1........................................................................F......M.

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1100.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Mar 5 20:19:07 2004, Create Time/Date: Tue Mar 18 18:33:40 2003, Last Saved Time/Date: Mon Nov 19 15:30:01 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):161356
                                                                        Entropy (8bit):5.177382724517874
                                                                        Encrypted:false
                                                                        SSDEEP:768:ep2c9joPH0MdlojY7vmW1EtujSD9DvcRwS+Ln9:9c9amGmWAujI9DvceS49
                                                                        MD5:38AE604FEB6ECCB8EF90ED989E95B55C
                                                                        SHA1:1B48DFDB4F3572758EF88460B29D03879620AC5D
                                                                        SHA-256:61E0E173791B801B023AF5987484487A59CF5FE19C0642BEC8BFBE49677451F9
                                                                        SHA-512:3C41155FDF0A2963C87F1272899C6E3A8C525E2C6982BB080624C8374970B02AD4BD36BFBC570975147BD3E73C3304D71960D48767C7172F45847B9011F28D40
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................]........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1205.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 65, Total Editing Time: 14:30:00, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Wed Dec 22 20:39:36 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):65024
                                                                        Entropy (8bit):5.10343096382262
                                                                        Encrypted:false
                                                                        SSDEEP:384:wIyubiGxnps2q3/FanLN4oCYoBUXmfZn11DP5MN5GY3WqN1xYNifO8fda9C44CVD:wunpTq3/FaZFXmfZnj
                                                                        MD5:097E6B26FE7DD4437D8A343EF52EC517
                                                                        SHA1:BF9B400E4D56BD9D4D6E58CF07F5647428BDB03D
                                                                        SHA-256:79ACD4650E807D66454E0B6B935D3A7E7EFCB728C1DDF33DBA6F65CFA074BA58
                                                                        SHA-512:E6D13C7D55F6C803E530F6BC358ECC4282F32C06F5F75F45FFEE7E05CD1A29CA24E4E1799CBEF86A8325DD46FA6FB88451A4C487B6B642DCD80D710C695B4E8A
                                                                        Malicious:false
                                                                        Preview:......................>.......................;...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .2.0........................................................................F....@..Yf...@..Yf.................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...............................................................................................p...p.......E.m.b.e.d.d.i.n.g. .2.3........................................................................F.......Y

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1210.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 125, Total Editing Time: 1d+06:37:40, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Apr 2 15:23:54 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):108725
                                                                        Entropy (8bit):5.347342388943793
                                                                        Encrypted:false
                                                                        SSDEEP:768:Etuya2n71onFjEkEOnUD8hS2ktBmm8F/pm+g:Et5oLC8F/p1g
                                                                        MD5:24625381A4A79D98BB9D42D6B7F9A5FE
                                                                        SHA1:5D71A3C809D7DBE54A1D7D124C56471B419F1A7F
                                                                        SHA-256:391152A4E0F66892A48EF07066A845E346C749ED479501402C907BA3E4639677
                                                                        SHA-512:9263939EAB0EBD221D17F45A76AA0CF00F4A38E6204E25990B4C1226D06035D7856F3F6239BBCC86F81B9C4DDA1A46BD741FE9976AE50780B69BF078B38075BF
                                                                        Malicious:false
                                                                        Preview:......................>.......................E...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.8........................................................................F.....7..2u.. ...2u................O.l.e.............................................................................................................C.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .2.0........................................................................F......!.

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1220.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 60, Total Editing Time: 1d+02:34:48, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Apr 2 15:44:49 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):89600
                                                                        Entropy (8bit):5.324389651089383
                                                                        Encrypted:false
                                                                        SSDEEP:384:AUfKDNLa1NuYqe26TngjniVd9znZUAQ1FYRzJ8+m63q6dUyAyxjR4avUuVxV79eV:pR2OngjniVd9znfTRDU
                                                                        MD5:D4AF83ED906C7B634BB7988F5FC77D9E
                                                                        SHA1:2C473D306D0071F75D891A2F108677E4563D8609
                                                                        SHA-256:96D3F4B240FCAEEB80222FB2107C4D1274FA3E87E46CBE11F5465657B143C28A
                                                                        SHA-512:FA3B57EC70D34C33BAA41891FC2C8B4A34113027C9B1BE743F14E3EA823E6AAA9E296CEE1A3B1FE8E210DFB2A3A02BF2AAA777EE79642729D7E0813268F05074
                                                                        Malicious:false
                                                                        Preview:......................>.......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.9........................................................................F......)w5u...-.w5u................O.l.e.............................................................................................................=.............O.l.e.P.r.e.s.0.0.0...................................................................................................8.......E.m.b.e.d.d.i.n.g. .2.1........................................................................F......:w

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1230.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 56, Total Editing Time: 11:09:29, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Apr 2 15:46:24 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):112773
                                                                        Entropy (8bit):5.250973108086118
                                                                        Encrypted:false
                                                                        SSDEEP:768:EX82dynZ8nzdp1UQhrV6x0KvnPC5F3RnO:T4LLOPQF3RnO
                                                                        MD5:C776CCEA447F74098919D2CD84E21F27
                                                                        SHA1:39A2C1D292006A4EFF7572393DBF5534D835C95A
                                                                        SHA-256:EA699B7EA87FC4A1F48ABEDA29707D3991950ADD632B54E5CD82D6ED6E19E5A4
                                                                        SHA-512:E7A0001ABDABD65F597C77688A14291AC67FB993BFFEFAB98B35548832DA0823435D4C694CE26E2DDF8D91AA2A39EAE8A52A938463F70BA7074C6F879A7AD982
                                                                        Malicious:false
                                                                        Preview:......................>.......................O...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .2.2........................................................................F.... v}.5u..`...5u................O.l.e.............................................................................................................@.............O.l.e.P.r.e.s.0.0.0...................................................................................................8.......E.m.b.e.d.d.i.n.g. .2.4........................................................................F.....K..

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1240.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 65, Total Editing Time: 1d+15:03:26, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:13:15 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):108914
                                                                        Entropy (8bit):5.248018963968515
                                                                        Encrypted:false
                                                                        SSDEEP:768:U48gnilnzJ1HdBEXHHXiQtsCnm5KYiuqqmrRQ:UekzJb4sEEziuqVVQ
                                                                        MD5:12CB40DE811F5393136639186EFD472E
                                                                        SHA1:22AA2F1FFAEEA90D910E93EDA4DC1B042769DFD5
                                                                        SHA-256:EBD8E59E2EBBC54B139F101EDFDD4972A7466AE8836D956F78BE53258F960A93
                                                                        SHA-512:3DB9E9380DEAECE075B4F82D81E881B385191BC48517600AAB48428669CDF9F13E6D108EC26FF0B1B914E368E0A6B4E8F9D967132556C9A2A781D73844D711F3
                                                                        Malicious:false
                                                                        Preview:......................>.......................Q...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .2.5........................................................................F......r..u...<~..u................O.l.e.............................................................................................................:.............O.l.e.P.r.e.s.0.0.0...................................................................................................&.......E.m.b.e.d.d.i.n.g. .2.7........................................................................F........

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1250.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 69, Total Editing Time: 1d+06:12:29, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:18:06 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):98304
                                                                        Entropy (8bit):5.336808297146148
                                                                        Encrypted:false
                                                                        SSDEEP:384:nZ3AqRFh9vx5LsU1WtnPMn3kB/lH8gUPVncL3heqR3TzGaQnQ1nXLuM3X3s3tkRh:5vx5LsUEtnPMnUB/lRUPVn7MHcM
                                                                        MD5:A38D6C5A69B882D02ECF73C0E5AFAAE1
                                                                        SHA1:0B8C51858A55123050184ACAA72D031C82B34968
                                                                        SHA-256:84EB99CD7F7F121443C559759B9E79DB0095F6001B304E343BEFB14876BE21E2
                                                                        SHA-512:2DFF4584EED803BDCF89F8B4764180B354E6A0A56A016303678643D1BBD6FD797006CD05044C03E880FC7B7489029ED3AD7EFF7179B0ED3AF2C07F078F9AE94B
                                                                        Malicious:false
                                                                        Preview:......................>.......................G...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .2.9........................................................................F........u..p....u................O.l.e.............................................................................................................:.............O.l.e.P.r.e.s.0.0.0...................................................................................................b'......E.m.b.e.d.d.i.n.g. .3.1........................................................................F........

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1260.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 77, Total Editing Time: 13:19:08, Last Printed: Fri Nov 19 19:45:23 2004, Last Saved Time/Date: Fri Jan 21 14:19:25 2005, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):87552
                                                                        Entropy (8bit):5.292860622249849
                                                                        Encrypted:false
                                                                        SSDEEP:384:0IVAgpIDVV3pdY7J84+ZEHnUzmLmCnFJBPncQ5olvPmKgTQVbDpdTC0xIBpIlxyi:UBHpS64+ZEHn0CnVPncxcA
                                                                        MD5:D57ABF650F3A7C4ABAFE3A95464A576E
                                                                        SHA1:888CC2AB4F445D3C25F5030ABC91839D7A75F015
                                                                        SHA-256:4F11CC3F6D5DBA4EC2B1A05ABF3819BA081F21131B80F092F0E8A4EC0E8109A4
                                                                        SHA-512:C46831025A5856D9559A9EE045105931441F2EF813202FCA6DFD7E33D71CF63175103BAB94E4F0F07E98E66E21746B182C9F550942E3CECBCB655437FC48509C
                                                                        Malicious:false
                                                                        Preview:......................>.......................@...........0...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .3.2........................................................................F......5....`|.5..................O.l.e.............................................................................................................8.............O.l.e.P.r.e.s.0.0.0....................................................................................................:......E.m.b.e.d.d.i.n.g. .3.4........................................................................F.... ..5

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1310.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 81, Total Editing Time: 1d+08:19:54, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:20:08 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):107061
                                                                        Entropy (8bit):5.2458729633908385
                                                                        Encrypted:false
                                                                        SSDEEP:384:pGEVny+Or43UTn0jgysu+snyMQnf07AGfiEgwmrqnqMYF18r6q0fcdcClUvKPLjU:tZW10jgysu+snyMQnCAGfiEgwm+nqqDw
                                                                        MD5:0E08FBEEF0207A68F62D4B1D7DEF1C7A
                                                                        SHA1:D27D5D35A399A73F82025A1EDCABE1E2071681B8
                                                                        SHA-256:40E0F4AC3C8E326230535E4553AEC1B51F941A863417538E5EDF35A86F2B7F6F
                                                                        SHA-512:51B6660B2667AB4E6312BBD54765B15150D24C8E93A07F0755DF4733936323A8614F2F15EA6016D1CD1E69D2DDB398A6442B94F4F82C74E7154A86AFCF29E500
                                                                        Malicious:false
                                                                        Preview:......................>.......................P...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .3.5........................................................................F........u..@...u................O.l.e.............................................................................................................:.............O.l.e.P.r.e.s.0.0.0...................................................................................................,'......E.m.b.e.d.d.i.n.g. .3.7........................................................................F....Pr..

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1320.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 84, Total Editing Time: 1d+08:03:53, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:21:39 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):106941
                                                                        Entropy (8bit):5.190240409169272
                                                                        Encrypted:false
                                                                        SSDEEP:384:1/3D+TQ+w2k8nbrnHvqKbV9QhrVRxhBRUQ7ItnF+PQXj01JoRTqQVeOBGws9t8O7:Dh2k8nbrn5QhrVRxhBRUQ7ItnApbRz
                                                                        MD5:D5250C1D0DC2D60F86C6F3709FFD814D
                                                                        SHA1:2043CE28896350EE6382B3172C5766332B09D890
                                                                        SHA-256:36C9C8DDB2D33CABDE074D4D11E53CF22E41C822B0CB6C48FC64CE6036B9494B
                                                                        SHA-512:3C6B69E7FA422A1597F3C75F24163F7D75FD0E357F6060C610CB71AE1CE7777E01BFE58B0B4268AA1316F653BBE1DE34A001270C43322D1D4D577D899FC3F6F7
                                                                        Malicious:false
                                                                        Preview:......................>.......................Q...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .3.9........................................................................F....p.?.u..P..?.u................O.l.e.............................................................................................................9.............O.l.e.P.r.e.s.0.0.0...................................................................................................$.......E.m.b.e.d.d.i.n.g. .4.1........................................................................F....p#.?

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1330.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 96, Total Editing Time: 07:53:47, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:22:29 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):100864
                                                                        Entropy (8bit):5.165912085213481
                                                                        Encrypted:false
                                                                        SSDEEP:384:xMLqp7YPTQPy7qUDcNinkW1dlE31rlsI2nG9XdjnHjjIH2An0zuuNz8wcNAMULKM:q3BDwinkoCD6nG9XdjnHjjIH2AnsBPY
                                                                        MD5:41E08E237789E1CD4CA9D79EA0104A51
                                                                        SHA1:35822182ADD8504CBAD4F16E2A2709F1B79BB859
                                                                        SHA-256:4E5371E38A984141C2F9922C1A1FFAE659F0E33D86ECC0381F2F24595187634B
                                                                        SHA-512:EC7386B8FF167AC216B796B7FD684560B2D51E0C9452F94AA01BD6BC4EE9471ED019035744B464973E1E8C3B9B5D3741C15758678DE1D6D1A1E4AEBA79801E0C
                                                                        Malicious:false
                                                                        Preview:......................>.......................P...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .4.2........................................................................F......c.p.....f.p.................O.l.e.............................................................................................................3.............O.l.e.P.r.e.s.0.0.0...................................................................................................4.......E.m.b.e.d.d.i.n.g. .4.4........................................................................F.....Fr.

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1410.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 100, Total Editing Time: 10:28:55, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:23:03 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):93184
                                                                        Entropy (8bit):5.351003521831334
                                                                        Encrypted:false
                                                                        SSDEEP:384:46cHcDWNkq1ED1vvdmnYGngnmJn6RsLDE/TIYDrUIMNevHA5/AXTeANq+cpAJx2h:cmD1vvdmn7gnmJn645t0
                                                                        MD5:820B972D957DB3C16FBDB57EFCBD5FED
                                                                        SHA1:7406A6C07D42F7F5B3FD1B6D566A7D301A25E99E
                                                                        SHA-256:49DBD73C4739A9BCF13D6D41850413DD22A60E0DF1AF880BAF2598DFEC818A54
                                                                        SHA-512:532EDECFDDA49275BAA849A3802B2A49156D4C0AD7E2423D1CADC81CAD132C0661F1FCBFA6173F5CE60D84D59C84C2B4159A525BE0374FBA236371D1A71DCD8F
                                                                        Malicious:false
                                                                        Preview:......................>.......................D...........2...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .4.6........................................................................F........p...p~..p.................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................;......E.m.b.e.d.d.i.n.g. .4.8........................................................................F....@...

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1420.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 95, Total Editing Time: 08:04:47, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:23:32 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):81920
                                                                        Entropy (8bit):5.321035397652944
                                                                        Encrypted:false
                                                                        SSDEEP:384:u/qIV+qqnAtr6napq/7cen2cvUV9XjQscvbWFlgMFWpoNi7abqN3NE50o8KwBv2a:fqqnAtr6nJcen2cv8
                                                                        MD5:BE5B1FB3E899FABC3EB7401E12F6DAE5
                                                                        SHA1:F1A260B5E17D3FDAF84544CDE55F76F117C0B34A
                                                                        SHA-256:19BDDCBD575C3F844BF482ECF3ADA47DA84DFC0CB8F795E56E8657D16546078F
                                                                        SHA-512:9F8E821FFD7E88450CC8C0C0B9407B763A0EFD536B6DFABA80E6053E82492E83F2836D360D918427FD0A4716CC395462F5BEB6954A15C2C660A0EE8D3A617962
                                                                        Malicious:false
                                                                        Preview:......................>.......................<...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .4.6........................................................................F.......q.......q.................O.l.e.............................................................................................................7.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .4.8........................................................................F....P...

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1430.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 98, Total Editing Time: 08:25:46, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:23:51 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):79872
                                                                        Entropy (8bit):5.287604768176084
                                                                        Encrypted:false
                                                                        SSDEEP:384:UULRea+qwnUfPLUnihpE/Hdi17bNnnJGcI7G9R+ysRUlFtBCyAyx1dmLdJ1/UWmJ:OqwnU7UnrVS71nu8RtOO5
                                                                        MD5:27085F01DE4D3142E9E4B9BB211557EF
                                                                        SHA1:B2B45E3ADCB2E595633992C976C9A261AA6C6D8D
                                                                        SHA-256:CA9A355143C4A90E927BEFB8BBB313DACF45E6ABC5FD8C9395AAF2A1518F1254
                                                                        SHA-512:399AAB73C33F278E058B0506F9D056E99E2F39D62E73F611AF0C3E2A512647567A238F5B1DC1E2B4F0A7EDFCCE79688B130D1ACFCA154EC0E658E50ABA073AAC
                                                                        Malicious:false
                                                                        Preview:......................>.......................=...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .5.0........................................................................F....P.|.q.......q.................O.l.e.............................................................................................................4.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .5.2........................................................................F.....w..

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1440.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 108, Total Editing Time: 1d+11:09:54, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:26:09 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):111586
                                                                        Entropy (8bit):5.367325742316195
                                                                        Encrypted:false
                                                                        SSDEEP:384:jzJFVv9kfjZNPWGeQY99TnjOaLhnniomsnnnzJX556HPipVqxzeixiIAkzk2tMfH:FvmfL+jQY99Tn/hnnLnzJaN9MT
                                                                        MD5:607F6373C804F27F8FDF44A67900FB2F
                                                                        SHA1:3B40ECB8AB64990E950052E75D7A1839F7157705
                                                                        SHA-256:7839AB6F8668346B93AD1A5FB2F6010E768F746C22746A3698A9F8CEFB2240FA
                                                                        SHA-512:B70530BBD70B79E3C2A4DA844CCA9666F79F2A2CE3E07578788A0B8CED4DC65829FF1090B98739E31DA96BAE32B7F94FC982E84C266293046D0F5094ACDF6C34
                                                                        Malicious:false
                                                                        Preview:......................>.......................W...........S...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .5.3........................................................................F.........u.......u................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...................................................................................................XO......E.m.b.e.d.d.i.n.g. .5.5........................................................................F....p...

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1510.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 100, Total Editing Time: 1d+10:02:03, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:23:06 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):96768
                                                                        Entropy (8bit):5.253739160278084
                                                                        Encrypted:false
                                                                        SSDEEP:384:vKm+fLcKtI4w9+IZnT3vWAlrNcEBa75JL7s8+GtGP37Wufq63f4ZlUWDgnfO9U7E:Iw9+IZniArqka75JL7s8+Yi37
                                                                        MD5:DCAB179D3AD3ACFD7A7233C780C4535A
                                                                        SHA1:CAE2FA8660F933F310E00CE62EF0BE2EA3870873
                                                                        SHA-256:3C96A70007A1F72F740E2145478000E1B5AF48EC302B90B44362316C7F6483FF
                                                                        SHA-512:C3848B1E96E8C7AF5F163E0F0D182DCD86259A3DC66E90C872D82603687ED3D8C4904BE4B83D7A75242273629DDD91C7A4C6E9483291D27D7FC7A26ED8EC4D67
                                                                        Malicious:false
                                                                        Preview:......................>.......................H...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .5.2........................................................................F.......s.u..P..s.u................O.l.e.............................................................................................................6.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .5.4........................................................................F.......s

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1610.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 102, Total Editing Time: 12:46:54, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:25:56 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):97280
                                                                        Entropy (8bit):5.433407303868964
                                                                        Encrypted:false
                                                                        SSDEEP:768:Xv8TdJn1L9e/XR1njdFKaVgSoLUW2nE0QNjNH9//SxR2OfRuBtxVet0eYxeggQYv:Xv+kRRpAooLUWoE0F9
                                                                        MD5:172733484051DE3076D0A569F645045D
                                                                        SHA1:8BE5BB91E53AAD1EFBACC2C54AEE07FE1C1F164A
                                                                        SHA-256:E9BB1BA3289F596D025A5231320B03235BE5B816DC0F488EA01C515E4901E54E
                                                                        SHA-512:1252FA1225208BFAAFF9DC65A6825B795EF0909A9998978734615FE782595B3A8A816D08393D36694D02EAA7B292A8328274681CBC4005881F0D071FA08186B8
                                                                        Malicious:false
                                                                        Preview:......................>.......................I...........E...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .5.5........................................................................F.....}.]q...@..]q.................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...................................................................................................2.......E.m.b.e.d.d.i.n.g. .5.7........................................................................F....`..]

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1620.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 101, Total Editing Time: 10:20:22, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:26:15 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):94720
                                                                        Entropy (8bit):5.272781101700666
                                                                        Encrypted:false
                                                                        SSDEEP:768:gNuIJnEBd9cuF8Un89429gapL8LbniyRbV:g5ETv8aNApL8LrzRbV
                                                                        MD5:1B37C2A8DEC9E777B46E116BA50A3563
                                                                        SHA1:A8898F875CBC592BC5E20CE53B6EF9F0BB78D7DF
                                                                        SHA-256:DF084AB74DF1D8A747C1249B49E6D8D59FBF0502605F32E441B197E8E2A93242
                                                                        SHA-512:189D4B233FC19C87796B2CBAA963C482E91DF34BBAB9A07EDAD432383C672FD283CB9A7E4D5A65330767F229357A460E77443E5A05DDD56209B72AD9CB444C0C
                                                                        Malicious:false
                                                                        Preview:......................>.......................E...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .5.9........................................................................F....P..iq...@A.iq.................O.l.e.............................................................................................................?.............O.l.e.P.r.e.s.0.0.0...................................................................................................T.......E.m.b.e.d.d.i.n.g. .6.1........................................................................F.....N.i

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1710.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 102, Total Editing Time: 13:13:55, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Fri Dec 17 19:22:29 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):61952
                                                                        Entropy (8bit):5.197538641051164
                                                                        Encrypted:false
                                                                        SSDEEP:384:Hed98gAdS0dfq8n4hwlnTntEU/19uS6cEa7NyxPRkgmKAKc4IEztItr7XLXjfM:C8gAddRq8n4unTntEU/oV
                                                                        MD5:36859ACF22527BC88FBFB9E37440A55F
                                                                        SHA1:18AF08920D3346871C714D7BD6FA9CE15EB1ACC5
                                                                        SHA-256:75FC4385FB8AD4B3D51363C5698ACB8282103660B6976247C2C2BF503D375A2E
                                                                        SHA-512:29FDB57A280EAE39C3F358601885953CB80361AD30390877DD4A1CAACFE1B3921D021FEA3FF9411642FB32BDBCAC486BCA413F834046E793BD304A51449C0F5B
                                                                        Malicious:false
                                                                        Preview:......................>.......................5...........$...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .6.2........................................................................F....p..m....q.m.................O.l.e.............................................................................................................$.............O.l.e.P.r.e.s.0.0.0....................................................................................................*......E.m.b.e.d.d.i.n.g. .6.4........................................................................F.....,.

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1720.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 101, Total Editing Time: 10:00:19, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Fri Dec 17 19:22:46 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):59392
                                                                        Entropy (8bit):5.168408859847519
                                                                        Encrypted:false
                                                                        SSDEEP:384:+wfUNpSgv0nWjVnVdffnhzK8h4pJQK68JqYVyVSheqCizxT:OpSg8nWjVnVdffnhe
                                                                        MD5:97E1308BA3ADF310E6A2DB558CA9D4EE
                                                                        SHA1:3FEE31C76C8A7648B9019C07D20A20352906D10E
                                                                        SHA-256:4AA41550EC612F8F97BBB2FC015E81FD493DA6C463C4B6A2FE8BA1430BEB5AE9
                                                                        SHA-512:2DE6880192BFE2D4B79F6FCCF0E976B573FF3E0E4468BDBDA75C73E07541ECEA6CAA1D5A2345E103DFD40E68D5C1E5F8B91BE40513879AE87AA1384B4E7F2C2C
                                                                        Malicious:false
                                                                        Preview:......................>.......................1...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .6.5........................................................................F....P...m....,..m.................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .6.7........................................................................F.....9..

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2100A.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 37, Total Editing Time: 03:53:01, Last Saved Time/Date: Tue Apr 13 14:20:34 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):114962
                                                                        Entropy (8bit):5.261604527673691
                                                                        Encrypted:false
                                                                        SSDEEP:768:I2e2hGE0kS1gDYq3nly76JfvRtncMZC03Eew:IjqDJ/cMZC03Eew
                                                                        MD5:1FB07367EEE8E3F2FFA696DA778F9018
                                                                        SHA1:170EF1512BB373E4EC8FBCA5263B5A08F36B9512
                                                                        SHA-256:1D33DC7FF4AD1B4893E9DB4C72C5F6D8D0D86075D397B9186B2854854AB81939
                                                                        SHA-512:178EC58D64CD56BC646D86F86E1ACE92425133C10B7761F5049BD2C091464EC32A570B1E2473B5D0FC011119C74266AEF41B48A12E159F2A262A2F0FD9A2ABA3
                                                                        Malicious:false
                                                                        Preview:......................>.......................X...........T...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2100B.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 48, Total Editing Time: 05:04:50, Last Saved Time/Date: Tue Apr 13 14:21:45 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):146388
                                                                        Entropy (8bit):5.235020092891038
                                                                        Encrypted:false
                                                                        SSDEEP:768:lHhUlBYVEpjE0l/8ygiedZ/ZXA2GGWOnxviPNisAtk71j3/NhaWVh:cisyzxviJhaWVh
                                                                        MD5:47FE2ABB3C4266AA429CAAF719CF71BC
                                                                        SHA1:E4C54798A9BCCF3C701159269C45D7E100260917
                                                                        SHA-256:18FF6C961A1882DBD1F73D84F8FD8EC5B8C15D93216D070AB4B700D56F7D4DE7
                                                                        SHA-512:2C298236AC196DFE6D63D4C39E4E61E33657B6EB532E6C8997238555B8E9D4D0114AA0765B1CD1ED8335595A41BEED6021F80A25ACA9F1CA1F5B830352468DBC
                                                                        Malicious:false
                                                                        Preview:......................>.......................p...........l...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2100C.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 43, Total Editing Time: 04:21:42, Last Saved Time/Date: Thu Apr 8 20:48:13 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):107008
                                                                        Entropy (8bit):5.203668389142667
                                                                        Encrypted:false
                                                                        SSDEEP:768:z/e2h2SnE0VWT+1+CiQCQGWPn32nhLn9ltYpM:XlWTQGnhL9ltYpM
                                                                        MD5:EC5ED3BE771AF6005AFCAC6A4C51F499
                                                                        SHA1:CA5DB43D68B152900E6F53E8E612EC8797F2A3D9
                                                                        SHA-256:DF063F6FB7499AD1ED1A1119619EB53522AAE076943B44014F88D29C546256F8
                                                                        SHA-512:55AE15036ADE8A92BD83E18F5BC56164E2C591E28C8F27F2DD50EBF0510B2A9F5B593FE58967EBEF7BBD2A49B515E13D66435624A8ACCCB6D4C2ADF924F8B266
                                                                        Malicious:false
                                                                        Preview:......................>.......................T...........P...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2100D.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 51, Total Editing Time: 05:01:15, Last Saved Time/Date: Tue Apr 13 14:23:15 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):166675
                                                                        Entropy (8bit):5.129449327763986
                                                                        Encrypted:false
                                                                        SSDEEP:768:GM4hVe2h2WE0VSAcZ7qW5xp7XnWGHP/3HcMJMkcp8sbHVrtHXGnPr9swMnvUgFKG:GjqZGW52uPr9sxDNe6pwO
                                                                        MD5:304833086B629BFAF6693DA65E39EE77
                                                                        SHA1:F76E35DE8ECC14B02F43CA081BCA9564401A98ED
                                                                        SHA-256:7798FE0E09498A983A14564088513DCFF524A92B029E696FA7666E7D2F21CD52
                                                                        SHA-512:3B7BC1572975669F1F0C6C47A4DF4F1D790010432CB1B192A878E765135383937188B7A303804C0650AB95BBF3D49CDC86F1926098830880CF1CCBA01244385F
                                                                        Malicious:false
                                                                        Preview:......................>...................................~....................................................................................................................................................................................................................................................................................................................................................................................................................................................................d.....gdldd.dddddedd........ddddddde.dcddddtdA..dd.gddd.dddddddddddddddddddddddddddddddddddddddddd$dddddddddle.f.....cfkfffffffffffd.ffd.fffgfgfgfffffffffgfffffefffffffffgfffff.fffffgfgffff.7affffl7776777777_4afffffgf..........8....o..... ..hoooo}...;..............oooooo.s.....F..tssssS.p......ppp|9.1........pxprpppqpc{si...^ABCC7,...]:.2........s.s.....@..tssssn.p......pppy94>.....p{pepppqpc{sd...^ABCC7,...]:7=.....s.s.....J..tssssQ.p......ppp~3........>...p{qppppqpc{so...^ABCC7,..

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2100E.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 50, Total Editing Time: 04:33:45, Last Saved Time/Date: Tue Apr 13 14:24:17 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):107008
                                                                        Entropy (8bit):5.212905544497119
                                                                        Encrypted:false
                                                                        SSDEEP:768:Ve2hrxPE0TNYWedi46AMWnX9KtpskNNf:lx7NmX9KtpskNNf
                                                                        MD5:0EDE1C44051050AC187DA8AE1A31C2F8
                                                                        SHA1:6727E18195931D9FFED15210436147C34CF1CC87
                                                                        SHA-256:8D79794DCE8E8102C720728292C6F6EBFA0001110DB7AFB4E02F82F3DC59CAC5
                                                                        SHA-512:AD0387D629DD90745A5566F5DBEFD2EC2F7EBAE6428AB89F0169F11D412B917359CE61DFCB47365CD0D0BFEF58DD57CB7991534B97CAED8778321480062F4842
                                                                        Malicious:false
                                                                        Preview:......................>.......................T...........P...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2110.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 49, Total Editing Time: 03:46:39, Last Saved Time/Date: Thu Apr 15 15:57:48 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):76800
                                                                        Entropy (8bit):5.009447532664834
                                                                        Encrypted:false
                                                                        SSDEEP:384:TPJJ7E0hxrneCraahyLQnKwtdKqDnfpACZZkqelRmEChcbSfjSwHbSwT+4suZMs:VZE0hxrneCraah1nKwtdKqDnf6/uaT
                                                                        MD5:DFF552E4E496944479F953253BBD7351
                                                                        SHA1:C1B05DD86E65721096C510D61D58BD98ED6DF24A
                                                                        SHA-256:F694DB14FCF41F4AB49B0E78A5BB6013F5DBB3C98FE2419A8B4F31E9EC6C01E7
                                                                        SHA-512:C5C7C86701687A794F69CE62BA2283866641C2BC4DF06E81D2B82B13AFE19EE1F3DB98374CACB0BD10ECCAC55BECA350C074B53132878FF7F167B26104D8ED63
                                                                        Malicious:false
                                                                        Preview:......................>.......................I...........F...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.2........................................................................F....P(_.."..P(_.."................O.l.e.............................................................................................................(.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .1.4........................................................................F....@M|.

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2120.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 51, Total Editing Time: 04:10:11, Last Saved Time/Date: Tue Apr 13 14:26:03 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):93184
                                                                        Entropy (8bit):4.932281798856309
                                                                        Encrypted:false
                                                                        SSDEEP:384:my8vFCp9Baa2ei+8dnKS+Mn8ApHNbjjVkyCSiyCizjyfanlIz1c5Ok28Zfcu3HUJ:AFei+8dnXDnjN5ayCSiyCizjyfan
                                                                        MD5:CA9D0B00E917E157CC2408DD4DC2EA90
                                                                        SHA1:DC8EAF0340917B476C13C22392A923FC9FF2A544
                                                                        SHA-256:C08686BA7C85FE2046B9CDDC4A1DD01D46D46C2380097622D01BA26C7FEE2DA0
                                                                        SHA-512:17E3A6CD88BA189CB3661E5A297F208B1460B22920B3C49E2388C521694D6A9857AB388530E606F4672671934F7BF29DACD4526881A46427550EE2BCCCD59779
                                                                        Malicious:false
                                                                        Preview:......................>.......................X...........T...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.7........................................................................F....pn8.Z!..pn8.Z!................O.l.e.............................................................................................................".............O.l.e.P.r.e.s.0.0.0...................................................................................................H.......E.m.b.e.d.d.i.n.g. .1.9........................................................................F....0.U.

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2130.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 53, Total Editing Time: 04:44:01, Last Saved Time/Date: Thu Apr 15 16:32:30 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):91648
                                                                        Entropy (8bit):5.076995311538233
                                                                        Encrypted:false
                                                                        SSDEEP:384:IjZfGSJA38On49XQTyknFq8OgwWu1w8va5Eqbe8E7wtzwaxJbhA4zCeh5oORTJJA:IsaA38On4UnWgwWu17qbe8E7wtzLxJ
                                                                        MD5:5F1D64DB7229FEF2119003A2215D06C4
                                                                        SHA1:42A8A4F7B01CC3363741734F4B3191E835B745ED
                                                                        SHA-256:6DC59A6992E5543D655C584C7E969C76BE1B5E56A7472A89879FD5D78F94CFD7
                                                                        SHA-512:03DEBC9A70F6C3BE45DE952D959B8CD26C30DC1F08C8D1E9383C380592A2158A2209CBB9DB75275838BAB40CA6374609FA472E78EE67216168F322BA357EDBAC
                                                                        Malicious:false
                                                                        Preview:......................>.......................U...........Q...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.9........................................................................F....P...."..@...."................O.l.e.............................................................................................................4.............O.l.e.P.r.e.s.0.0.0...................................................................................................."......E.m.b.e.d.d.i.n.g. .2.1........................................................................F........

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2210.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 68, Total Editing Time: 06:54:28, Last Saved Time/Date: Wed Nov 3 19:31:39 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):175839
                                                                        Entropy (8bit):5.344109633971589
                                                                        Encrypted:false
                                                                        SSDEEP:768:rrFkQq5mlq6EppSEijiV6SArIbn+6UhUHMO5us0LNH:VAvUhUsLxH
                                                                        MD5:AA067548970C7B00CBD1AB3D163064DE
                                                                        SHA1:E72267289B4399F1F51979382060F3A4015D95EE
                                                                        SHA-256:7E38CC0B0BE481B16A64708EAB29064AAA1E7FC9603B479F3A1027C89599C443
                                                                        SHA-512:F9FD3F88F52846DD922F17555AF1E390EE1FEBEF38FE4A8633AC34E1E7B60BFBCD14240FBB1A9A006C6F937453961AB5846ACB6169678DE041EEDB811A450615
                                                                        Malicious:false
                                                                        Preview:......................>...................................~....................................................................................................................................................................................................................................................................................................................................................................................................................................................................d.....gdldd.dddddedd........ddddddde.dcddddtdA.$dd..ddd.dddddddddddddddddddddddddddddddddddddddddd$dddddddddle.f.....cfkfffffffffffd.ffd.fffgfgfgfffffffffgfffffbfffffffffgfffff.fffffgfgffff.7affffl7776777777_4afffffgf..........8....o..... ..hoooo}...\.)............oooooo.s.....?..tssssn.p......pppy3...4...p.pxpppqpc{se...^AABC,...]0...7...s.s.....E..tssssS.p......ppp|9.1........pxprpppqpc{sj...^AABC,...]:.2........s.s.....=..tsssso.p......pppx=.. ...pvpxpppqpc{sf...^AABC,...]>..#...

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2220.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 64, Total Editing Time: 07:36:52, Last Saved Time/Date: Wed Nov 3 19:32:42 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):183665
                                                                        Entropy (8bit):5.227388050044036
                                                                        Encrypted:false
                                                                        SSDEEP:768:MVSBlBnqKOBlueO+O+u7yuLZJ5p5pZQgBx4Un5pFmWfN1pmSoNZl50Qa+OOKF/RI:M0BISTEWfQSoNZl50Qa+ONdu
                                                                        MD5:FBC80A0187F08266BE1BF548458C222B
                                                                        SHA1:407678E96CB6077C13DD905E4773B2EF1EC765BF
                                                                        SHA-256:5A5FC33AFE7368245E28A7713662C9BDA876F5AC927394A5A8A30836FE725DE5
                                                                        SHA-512:11F5E8D401D6FB0172B501776B6DEF21BD11B1081B602F1AC98E8F42D114CDE9EF8EE0728E1F0D509506FCEF5D7D27296290227AF513F4950C40E4F32FCDC8E3
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e.......................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2310.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Thu Sep 2 16:11:52 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Wed Sep 29 20:57:07 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):97792
                                                                        Entropy (8bit):5.235321248671491
                                                                        Encrypted:false
                                                                        SSDEEP:384:h3FE+JrT1W4O7jhcWvL4LRNXncMEUYAkEUANCfn/+ckPJa0ihYpkeQd9H1tiADS5:ijh7vLqRNXncMEUYAs/fn7fOpiq
                                                                        MD5:343EF05BA42CEA68AF2C93D6A13D1DDA
                                                                        SHA1:48696E1A874EC0D9359750ED88AB9DD120556EE6
                                                                        SHA-256:1E7B03D67BDBDA7E22A68F91690B917B454A35B7797A67782DAA970E035E32BC
                                                                        SHA-512:7B2135F9A204F2D06C1AF46AA7E0822ADBDD3FA7D7642B759AA46C56966E864DA2D713C36193DE51F5C7148DF0D1961ED98A14D07A798165065F60CF0478B6F0
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f_reports\2003 Forms\cro-2310.ttx..........cro-2310.ttx.............................................................0...................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2320.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Wed Sep 1 18:17:24 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Thu Sep 30 13:20:19 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):76800
                                                                        Entropy (8bit):4.878667838414998
                                                                        Encrypted:false
                                                                        SSDEEP:384:jaLie5bHqeAsUpQZE0CoYnSmrWJKQa0CoY2SirQ8Oa0CoPp7ft7wMvWwdmhWwSY/:gx6hQA1vWg1SQ8bepLtH8h
                                                                        MD5:5708195C58E3C42049C1B39A69A778CB
                                                                        SHA1:A7B8E652A3719B0495FF8BD553E01518F3D3E6C5
                                                                        SHA-256:7192672E01BE235F4AEE589F8C89AB98CA3937B0E578E707D2C80104EA658F3D
                                                                        SHA-512:9BE7F2BEDB67C1BCB57C713FBE99483F2F59576458FFF2979BD09BB56669AC19A42A5A32B03398163BE93D7011C39C807831901CF90BEEE3A97EF754B32C0F17
                                                                        Malicious:false
                                                                        Preview:......................>.......................J...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.4...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................[...........E.m.b.e.d.d.i.n.g. .2.3............................................."........... ..............F....p...

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2330.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Wed Sep 1 18:30:22 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Thu Sep 30 14:12:24 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):87040
                                                                        Entropy (8bit):5.016829721181625
                                                                        Encrypted:false
                                                                        SSDEEP:384:Sf1lCrJRyG5G0aAYCMKiOqvsgyLfH0aAYxB3UoggtX20aAYpo0/6wMvWwdmhWwS6:1yGy9ygA9XEogIQ9pxM8hqO
                                                                        MD5:F5CDAB6A4DF5F715194C5DB56D5BC3D7
                                                                        SHA1:6C4A37A491B552AA28294D9B739CACD9738B0C0F
                                                                        SHA-256:702F5AB1C9D04BE301A38CAA092D2D77E3A572DF40D08FFC11F4CF875D2E0C9B
                                                                        SHA-512:E35E47012B974896F0904C276EB9BDB9587ABDD8A6891B06BDE60CC14E6D73448FBA3C6E3B536B30BDBE279D6729B2C227D626D7F058BD38C16342405B52E8E0
                                                                        Malicious:false
                                                                        Preview:......................>.......................V...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.4...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................t...........E.m.b.e.d.d.i.n.g. .2.3............................................."........... ..............F........

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2340.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Thu Sep 2 15:18:00 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Tue Nov 2 15:55:18 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):172330
                                                                        Entropy (8bit):5.203209297538331
                                                                        Encrypted:false
                                                                        SSDEEP:768:ZMvUSXCbLRXY+OXLTgcbRRdUKuPkBLpYf78hhxhDhmVhShQhdh5vOG+6z:3SXCbg/gc9R6Pot9hQVQ+3h+G
                                                                        MD5:63F5FF7C2D7205CB2E4D97A709C8BC33
                                                                        SHA1:4E24825E5143987872329001C92F111290F14E84
                                                                        SHA-256:BCD7C0FCE94BA92252B53248F5A7720E9D05EDC5B509B6F5D05640F27C07513B
                                                                        SHA-512:C501643907DE3CB3F96C0B9EA6F8871DAA01DF15D6BE2951DD16E97CB346E19A55E12D58D9D2F71F703D42FEE5C8EA830D1657DFD77AF1C00907F73621ADBD84
                                                                        Malicious:false
                                                                        Preview:......................>.......................m...............................p...............................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.4...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................z...........E.m.b.e.d.d.i.n.g. .2.6............................................."........... ..............F....@o..

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2500.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 43, Total Editing Time: 05:27:46, Last Saved Time/Date: Wed Nov 3 19:33:51 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):57856
                                                                        Entropy (8bit):4.912226439854232
                                                                        Encrypted:false
                                                                        SSDEEP:384:PWFml8E2XE848Qu9rC6gpbtne38GvfPVmPZn8IYpT0QCp3MaQRbx3eCWQ:1l8E2XEwQu9rC6gvnezvfPVmPZn43
                                                                        MD5:3CA49EB0F57DA94C615276F113798BBC
                                                                        SHA1:BF7BC7157F202F78272F8E523A3A79064BE0F9AF
                                                                        SHA-256:8D5E5F0BDA98BDD948625BD559E1E75E8D6409809A0527678156F602D7CCF44D
                                                                        SHA-512:E59A06824B6B995BE87054A7A43A09CDFE033177EEB2E1C2C21465F97C2C2D96CD919202836D23FBC21AF3DCFCCD22507E725E8BD8B9843B4FE08F6B0ADBDEC3
                                                                        Malicious:false
                                                                        Preview:......................>.......................B...........?...................................................................................................................................................................................................................................................................................................................................................................................................................................................................eld Definitions Only)....HC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\2003 Forms\cro-2500.ttx..........cro-2500.ttx.............................................................0...................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2510.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:51:41 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Mon Oct 22 19:25:35 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):97280
                                                                        Entropy (8bit):4.976430970520775
                                                                        Encrypted:false
                                                                        SSDEEP:768:B0jbfG0HYJffpgAnVY7PfsUMXHwKY0/Oxlu7cimw:0btHofHVCf/MXHwKY0/AuIi7
                                                                        MD5:8EAC4565C5C68E1989A9FF7987815CB2
                                                                        SHA1:0EB3FB50AEF02C35F85F65F5857A716C8AEFA682
                                                                        SHA-256:9EC7029D0766167D10E4D46F032B5B108B3B31B3A3237DE100D87E77D2B51386
                                                                        SHA-512:C70D33774D966A4E48970C1C3CECDF47F688603A7D50B707A61C4D8EF045C40997ED14CCE9784C08D05A2503BAAC36394E8E2BF1F137BB9CA21D646C73A27874
                                                                        Malicious:false
                                                                        Preview:......................>.......................b...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.3.............................................................!.......................................................T.h.i.s.W.o.r.k.b.o.o.k................................................."......................................................._.V.B.A._.P.R.O.J.E.C.T.................................................................................................).......E.m.b.e.d.d.i.n.g. .2.2.....................................................%... ..............F.......w

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2520.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Thu Sep 2 15:25:10 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Thu Sep 30 16:30:55 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):135680
                                                                        Entropy (8bit):5.128156286632356
                                                                        Encrypted:false
                                                                        SSDEEP:1536:mV49P3yLKq8o4zLcb2UlUc4K+xTPNRPzUsdiallTonTIn2:1PQyN
                                                                        MD5:DA29DAC0A434ABC27100A3A4A367E110
                                                                        SHA1:C221D94A7BE299E5E14EBEC92A6DE9BF94480A15
                                                                        SHA-256:20D3D0DD26709E180F54668AB6C3699C1868925626FC6B1423D497605E7AD68E
                                                                        SHA-512:1472086D61EB119431EEFA82F285077CADAE6E242F704EE586A792E1D47FC241DDA2EE294FAF059CB172093929EBCAB6FFDFF067D1565F99DEF8C99FCB3E6C6D
                                                                        Malicious:false
                                                                        Preview:......................>...........................................................N...........................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.4...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................V...........E.m.b.e.d.d.i.n.g. .2.8............................................."........... ..............F.......

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2530.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: State, Name of Creating Application: Microsoft Excel, Last Printed: Thu Jun 15 19:07:57 2006, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Mon Jun 19 13:10:06 2006, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):163871
                                                                        Entropy (8bit):5.0807907373790036
                                                                        Encrypted:false
                                                                        SSDEEP:3072:BaoO2BABgppv/5/vR6WOyALYaHueLJJz9nZMEaGzI096cZzl9Q:BaqBABgppv/5/vR6WOyxcZzl9Q
                                                                        MD5:1305898D36FFA9B7F2588B4A1500E83A
                                                                        SHA1:401DFD86A8927D1CB5E22A6AC704398721C28943
                                                                        SHA-256:B1A4B2167F40F9CB5FF128CD49F194334D730ADC6C0B5C71DA91F0AEC41FB573
                                                                        SHA-512:E27CE2D9EB5A541E24F690D6951AB133DB81D9BEE17AEAD2A9FE0A562007F24D522FC9A920F0687BE12BCC3CA357760319D70C077992B2885FD8DED3FE36F5A4
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................z........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...>.......?...............................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2540.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: State, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 16 19:02:54 2006, Create Time/Date: Tue Mar 18 18:33:40 2003, Last Saved Time/Date: Fri Jun 16 19:04:24 2006, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):122880
                                                                        Entropy (8bit):5.031239289107367
                                                                        Encrypted:false
                                                                        SSDEEP:768:FB9CHpBpB5GOLJTJBEb/1EMAsxv5JQUM0FKmoDd:ZApt1LdEb/nAEv5JQX0Fw5
                                                                        MD5:47FFCCC46A2FC77F5FE6538F2BBDAA65
                                                                        SHA1:B99466E07ACEBAECC9444EDE30769BE9DF08F5B9
                                                                        SHA-256:967BEAFE2035D7AD942A8DEF6BA82D5BD8ABE196A2DF615C7C39F9E6CC27B796
                                                                        SHA-512:3829104E23319091FF92652912E9AC6F7AD2812EDDC625599A8B41D4D855F619A46F61FFE797D0243FB3774F49B34C47E42D79B55AB9A53A0D650E4858766D75
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................~...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-3100.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 11, Total Editing Time: 01:13:31, Last Saved Time/Date: Thu Apr 15 16:10:09 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):59392
                                                                        Entropy (8bit):5.20548689364493
                                                                        Encrypted:false
                                                                        SSDEEP:768:Xu/JhxbQkQmhQ5NM9maf1iZxIHbWCAnBHszjGBAX1mrx7SympaenjKC:eR0kQmsMRTu9sPCQ1
                                                                        MD5:F06A082EE26DC7A9FC9AF75EA78CF04B
                                                                        SHA1:6FA744D6397EE27FAD957FD2E835003CE0928D2A
                                                                        SHA-256:E0B846D5CA7F4D42E7801DA32552585399C441E3D3E3B7C209A1EE94603CBF2A
                                                                        SHA-512:0FB7785CE7713382D67CC5FA8E41D0C7371DF9536A0E23A2FCE3A1E9DEDD6A0AEE155B2A0ED95366966CF7A71545B4476A323DCC438615C51A7E70E75DDF4AA9
                                                                        Malicious:false
                                                                        Preview:......................>.......................O...........L...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .4..........................................................................F....0.H.."..0.H.."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .6..........................................................................F.....Mj.

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-3200.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 11, Total Editing Time: 59:12, Last Saved Time/Date: Thu Apr 15 16:10:40 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):58880
                                                                        Entropy (8bit):5.202598797564419
                                                                        Encrypted:false
                                                                        SSDEEP:768:9x/p8JhxbQkQmhQ5NM9maf1iZxIHbWC8nJfBna/KEn2:9Jpe0kQmsMRTabu
                                                                        MD5:F0C67D5BE0C6C23069A98FC9C42B21F0
                                                                        SHA1:3664DAC584F65485BDFDD03FC215D817B9DFC30B
                                                                        SHA-256:EF0E4EA896076843CCAAD02933AEDBE79482D8AA94CC7E42102E4138D665F274
                                                                        SHA-512:3EE740535B59E33A29D9B8B323DEC0B96E6C8552BC38D9C9FD344D91B85AB7284052F6D5968FB2094FC262EFB2F5D80842D9C42392FF1D51BD7169A8F441F0BD
                                                                        Malicious:false
                                                                        Preview:......................>.......................N...........K...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .6..........................................................................F....pP..."..pP..."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .7..........................................................................F....@..

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-3300.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 11, Total Editing Time: 53:27, Last Saved Time/Date: Thu Apr 15 16:11:02 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):59904
                                                                        Entropy (8bit):5.210459280768143
                                                                        Encrypted:false
                                                                        SSDEEP:768:LCRojJhxbQkQmhQ5NM9maf1iZxIHbWCnnkrnCIHWnJE:LEoF0kQmsMRTP62
                                                                        MD5:B511926EF1002CB1F4AAA6E2071672E3
                                                                        SHA1:3C1D20F9223C2CE424D6B906D9789C493576EC55
                                                                        SHA-256:4F495EC0387E14EE0F211F0A53C133D0362A75DFAD14315A9DAB42A7E6D7F6A0
                                                                        SHA-512:1958C9CFE296090A6407AB032CC2E160982942AAB6A5B1CDB466547E6503A612632764471AB7EC80546F960C7CB2E69C115CD7B82FEA90ED0D58BEB818BBD8E3
                                                                        Malicious:false
                                                                        Preview:......................>.......................P...........M...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .8..........................................................................F....pO..."..pO..."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.0........................................................................F.... ...

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-3400.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 14, Total Editing Time: 47:00, Last Saved Time/Date: Thu Apr 15 16:11:40 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):60928
                                                                        Entropy (8bit):5.198727350702287
                                                                        Encrypted:false
                                                                        SSDEEP:768:DQ+bXJhxbQkQmhQ5NM9maf1iZxIHbWCsnThHnRKqn8:DZb50kQmsMRTa9P
                                                                        MD5:F3E96121EF1FE4575C5112E52619A9DA
                                                                        SHA1:A308DD12F2DB9F5863631ABFBE97554C76E32C9C
                                                                        SHA-256:742D520C233C61433A794AB11DB5FBCD236565CFC63A82D2715241BABDEF4041
                                                                        SHA-512:94935A8F87744BBA7FEBCC8A5FEA0F3273CB558D7A385ABBB9CEA94DECD2BC247BB934D472D4136FB431C58956355D7DF9252A849D9731F0C546345C056EB6B2
                                                                        Malicious:false
                                                                        Preview:......................>.......................R...........O...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .9..........................................................................F......+.."....+.."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.1........................................................................F....@tO.

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-3500-add.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 15, Total Editing Time: 01:14:19, Last Saved Time/Date: Thu Apr 15 16:46:43 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):64512
                                                                        Entropy (8bit):5.0872204368180025
                                                                        Encrypted:false
                                                                        SSDEEP:1536:KCrycGESg0kQmsMRTiGlrfSBaEEP4VpAH9fxFS:d0kQm9RT
                                                                        MD5:E6DBE6558E05030B529A9F71B1944DE0
                                                                        SHA1:EBB835D973C152D757845AD9E4EDE7A2DE5D4CB1
                                                                        SHA-256:C52F450DFAD410C2C177A91DB8C070BF63D3068A52C81092AE60D66AFE88F0A3
                                                                        SHA-512:49D6612314178EE866503856AE3E3079C858CA4375F827505BD40423429C120AA388C0CAFA63C4FFE7B36A81BF804AFEB87CDD8739E8F3BAF1E5FDDB533D29D2
                                                                        Malicious:false
                                                                        Preview:......................>.......................]...........;...............:...................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.2........................................................................F....._#..#..._#..#................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.4........................................................................F....@gN.

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-3500-main.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 17, Total Editing Time: 01:43:07, Last Saved Time/Date: Thu Apr 15 16:13:09 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):88064
                                                                        Entropy (8bit):5.388710930708643
                                                                        Encrypted:false
                                                                        SSDEEP:768:+nVHYhxbQkQmhQ5NM9maf1iZxIHbWCFnjDnaUoqrnc94RHexedO:+i0kQmsMRTJPjpHA
                                                                        MD5:5A6E41E293A03AEBC93266499DA11B7C
                                                                        SHA1:6400957B493FED5E571912DB972EBABA94636FF5
                                                                        SHA-256:646174976696BE16DE2AE3D451EF356F83D4DE085329301AC5295F7C61342A4F
                                                                        SHA-512:1E0159E6EBAAFA8AD8BFC8FA7F000B813DC836A344B6112BCA751D0246196F5D9A0FC094842BFB53FD836CC9B7543FFC23656585E1F00BD09A79CAF4B0A6B84B
                                                                        Malicious:false
                                                                        Preview:......................>.......................c...........=...................]...............................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.3........................................................................F.....S>)."...S>)."................O.l.e.............................................................................................................7.............O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.4........................................................................F....P.b)

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-3500.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 55, Total Editing Time: 02:10:00, Last Saved Time/Date: Thu Apr 15 16:46:51 2004, Create Time/Date: Mon Mar 22 15:03:08 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):158208
                                                                        Entropy (8bit):5.340858554251574
                                                                        Encrypted:false
                                                                        SSDEEP:1536:oNe2HASmU0kQmsMRTXTcDCrycGES5orfSBaEE2pAH9fxWK0mU0kQmsMRTg:F+0kQm9RTY0kQm9RT
                                                                        MD5:0393A9F38F3AD7C4A34189358C9754F8
                                                                        SHA1:8622DE3DB6B32284333F4A63BD90B3F8F962CD31
                                                                        SHA-256:93B0F789471FEF00B74DD158933D1E8F9C5AE045183F89910C9472E91E66DA50
                                                                        SHA-512:9322F7A00928E023CE9C9EEC6CD94F338F7661AC2AB2A59BC71DC5B329A873817ABE91CA5788C2B1A6D2966B75DE76588FD57B3EFFC1C5378377DCDE6CD92C56
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................eld Definitions Only)....MC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\crystal version\cro-3500.ttx..........cro-3500.ttx.......................SQL.....Pdsmon.dll....%Active Data (Field Definitions Only)....RC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\crystal version\cro-3500-main.ttx..........cro-3500-main.ttx.......................SQL.....Pdsmon.dll....%Active Data (Field Definitions Only)....QC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\crystal version\cro-3500-add.ttx..

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-3600.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 13, Total Editing Time: 41:36, Last Saved Time/Date: Thu Apr 15 16:13:59 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):60416
                                                                        Entropy (8bit):5.20599462556192
                                                                        Encrypted:false
                                                                        SSDEEP:768:wTlmibYhxbQkQmhQ5NM9maf1iZxIHbWCjnH1I6nd6NbqnQF:glmiU0kQmsMRTLVSM
                                                                        MD5:9E7D6F992148FC5550D5DEA0932E7F24
                                                                        SHA1:EBA62B123B5CA75C49DC41FE142BF5589E88C2A8
                                                                        SHA-256:C09556C17C14E2286977FFB12BE987425EEE0803D607D7446057B55620A2F9D3
                                                                        SHA-512:F8B0EA0B0AFE0125E3662C5FF2145F0A25348FD0F8051E010ED7527AB3BA6AC47FF3207281340E73B47644DE3725C040BF2DADCC506C61DBD32AB1FF31F0E66D
                                                                        Malicious:false
                                                                        Preview:......................>.......................Q...........N...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .8..........................................................................F.......G.".....G."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.0........................................................................F.......G

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-3700.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 16, Total Editing Time: 01:16:19, Last Saved Time/Date: Thu Apr 15 16:14:26 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):59904
                                                                        Entropy (8bit):5.201214682908714
                                                                        Encrypted:false
                                                                        SSDEEP:768:Mm80tYhxbQkQmhQ5NM9maf1iZxIHbWCInu+lnxhvnK:M5020kQmsMRT2hj
                                                                        MD5:AA8902D4CD33C667E28AE4BB9A6CADE1
                                                                        SHA1:334D99391F65F36D54A444DAFC31572766E66039
                                                                        SHA-256:ED8FDE84B287084F0C961C7198ADAEEA4024DDB69A6613B893E0A3AF160A10EA
                                                                        SHA-512:1503E493ED48ED1132A7B3001CC7CB15AEB1F553C14163355A7529285393495C464325EC0EB9EE0D1E313C1B8B7573D7022838B301BD3865B443764EC6C241BB
                                                                        Malicious:false
                                                                        Preview:......................>.......................P...........M...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.0........................................................................F......\W."....\W."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.2........................................................................F......W

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-3800.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 16, Total Editing Time: 55:25, Last Saved Time/Date: Thu Apr 15 16:08:54 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):64512
                                                                        Entropy (8bit):5.222279462324983
                                                                        Encrypted:false
                                                                        SSDEEP:768:3QvYhxbQkQmhQ5NM9maf1iZxIHbWCLnWnJ8nOvuquin:3r0kQmsMRTDWn8sak
                                                                        MD5:881CE3142335B809B9C88D3BAF0F1AC5
                                                                        SHA1:54316525510D401A686BA152A69E658C74F73481
                                                                        SHA-256:373BA0BB70D83F47E9F15967318379C42FC4FCDA8C1FF8CD3F7EE4AF47DBF6B7
                                                                        SHA-512:6F3C6088109D4FE2331A0DDC5A23B4894D0A9709209B042934794CAF72C05FC79187407D199476D7DD5BBABC2D95834097F194BAD3FCC8A211EF9F1B76C8AB14
                                                                        Malicious:false
                                                                        Preview:......................>.......................Y...........V...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.1........................................................................F........."......."................O.l.e............................................................................................................. .............O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.3........................................................................F........

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-4000.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Wed Jul 23 21:08:46 2003, Create Time/Date: Tue Mar 18 18:48:23 2003, Last Saved Time/Date: Wed Sep 29 16:09:05 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):160055
                                                                        Entropy (8bit):5.274194490059007
                                                                        Encrypted:false
                                                                        SSDEEP:1536:LXM5UzLaFCbFD8UlI7wLS4s63a2EPo5FGyy:LXMiLaEbFD8UlI7wLS4s62
                                                                        MD5:37EB610A634C1DDFC81FFB4990591935
                                                                        SHA1:84E81DAED249A25AA2AEB41F15B57DE8867CC93C
                                                                        SHA-256:5D15551981C1099F202823541E981A577372E458BA345752B9B3B0E0E0E2D059
                                                                        SHA-512:72DCAA38E5BA795C56F2E5076064BCD683570FBC8ED4DBA83E88CFEC04AD7B30DBA6A78D7D92F8B8AC16BC5671E0D4359D1AEC1500CEC29D99EF68EAD158C17D
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................g........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...............................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-4010.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: programmer, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Mon Mar 8 13:36:18 2004, Create Time/Date: Tue Mar 25 14:52:47 2003, Last Saved Time/Date: Wed Sep 29 17:55:29 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):143872
                                                                        Entropy (8bit):4.929485413721053
                                                                        Encrypted:false
                                                                        SSDEEP:3072:/im9jlbEsrtvnwTDCI/dIj8yI5Fik6ulE69OsccKy5:
                                                                        MD5:4B55DAB27519155A12B873F1D7D44498
                                                                        SHA1:8B9BE194A8DAAECAD472660DB008326326A1C63B
                                                                        SHA-256:87BC25D6D57B23CE6CA2E6DB3E7FAB777FA5DE415B7347723EDBA7BF7FA43ED6
                                                                        SHA-512:F66495BD44022833DE875DC3788E45CED74D595A8099EB2938B6D2BD2B15DE156FD20557991E946D0CC17D14050A583E7AA3AEF823469C4BAFB805386069431B
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................Q.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-4100.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 16 15:54:41 2003, Create Time/Date: Tue Mar 18 18:48:47 2003, Last Saved Time/Date: Wed Sep 29 17:56:45 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):145920
                                                                        Entropy (8bit):4.9925301432159035
                                                                        Encrypted:false
                                                                        SSDEEP:1536:wHgr56AinkrRcycDCTCQd4iNbBm5+q+zG2F:wHc6AinkrRcycDCTCQd4iNbEN2F
                                                                        MD5:FC038A5D0FD1B115F67ABE16A2B997EE
                                                                        SHA1:F385AC3E5FBD3C5C7E463EA55714797FBA3D3FC1
                                                                        SHA-256:B4E8D00C75260301D54369D88E0EEEEF0D83FD4FB7D8D845D927738453497CD6
                                                                        SHA-512:85F600ABC3EFB7D782396F347F3CB8F723FCE58671002D75E769714387C7D0E35F456DE32FE5F1DCBA271F4E6780A6E8C64F922EAA884D0D5DE77965FA638DE4
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................m...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-4110.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: programmer, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 3 14:49:58 2003, Create Time/Date: Tue Mar 25 14:35:37 2003, Last Saved Time/Date: Wed Sep 29 18:00:44 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):109056
                                                                        Entropy (8bit):4.763335759409982
                                                                        Encrypted:false
                                                                        SSDEEP:768:xnbQqAqLbqr/Su9ySWOQLISXQv+ZN5Zxftt/LIEKjGn:txgLD9yNqSf5ZxV6EKj4
                                                                        MD5:65F9BEB9749339F9E44355A5C809AD4B
                                                                        SHA1:C9F242F2C6E3361F1ECB802984059CD7C911992C
                                                                        SHA-256:B4D9FCAE9C80A489BB0070B090F924B7B21DFAB7ECF45D06C8998287CB1082E3
                                                                        SHA-512:9CF7CEB35B63CBA41C3F3EB0C9104D82729531D9426BB8A27536F594CD96A690D4B05C3029A1A7021D417591475E7A8DA5BFA713E53438122A3738D0858CF39D
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................eld Definitions Only)....RD:\DEV\CR Code\Remote Filing App\Version 2004\CF_Remote\reports\2002\cro-4110.ttx..........cro-4110.ttx.............................................................0.........................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-4200.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Mon Mar 8 13:38:49 2004, Create Time/Date: Tue Mar 18 18:49:06 2003, Last Saved Time/Date: Wed Sep 29 18:02:28 2004, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):156017
                                                                        Entropy (8bit):5.153834479799729
                                                                        Encrypted:false
                                                                        SSDEEP:768:R997ilTTQnZqWBCtvOL1HuQL3psNw8I7e+8xiZJSSZJTLenAjM:1fnUd8H0wt7pvLQqM
                                                                        MD5:85D19DDF6412ADC30E4582B09B12C81D
                                                                        SHA1:2A9E3E70365EDD7E63AF98CC928B1861AF149334
                                                                        SHA-256:0D4EA12E2607E86CC5C7F1052832331678005D9E8A64C818BF4D9BF2E131A71B
                                                                        SHA-512:2A8A070AD593871890BCF825836AF861F5CD6371C832B406E456F5B35D524E85D27DF5E7B4DA90998BFC890068D79252A353CE98AA3660E8E35FA405227250AA
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................A...............................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.........................................................#...%...........................................B...........T.h.i.s.W.o.r.k.b.o.o.k.................................................&...........................................2..........._.V.B.A._.P.R.O.J.E.C.T.................................................................................................`.......E.m.b.e.d.d.i.n.g. .2.1.....................................................(..................F.....(

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-5200.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 4.10, Code page: 1252, Title: Media Complaint, Author: CRO, Template: Normal.dot, Last Saved By: programmer, Revision Number: 4, Name of Creating Application: Microsoft Word 9.0, Total Editing Time: 39:00, Last Printed: Mon Feb 11 16:23:00 2002, Create Time/Date: Mon Feb 11 14:32:00 2002, Last Saved Time/Date: Mon Feb 11 16:23:00 2002, Number of Pages: 1, Number of Words: 121, Number of Characters: 694, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):77312
                                                                        Entropy (8bit):5.1864279109289395
                                                                        Encrypted:false
                                                                        SSDEEP:768:WvRwuJIBchkLEFbzOew7A6irPH9Y2ZVwCFgDv6FoYsHSb:W4BA2SLpzj
                                                                        MD5:46278C5B8F40632A170C005DA9D59E16
                                                                        SHA1:3FF09C3EA468C6DDEAA8B70E780C1C23987A4B9C
                                                                        SHA-256:50D66013ADAEEC5730A46ADB656C69CE53CBA22AC905D6939198ABCD56E6190D
                                                                        SHA-512:12E5C6A70A0001AF370D1A82F8931E9F4F1CCD8728C3A7BB67F6D80E8247BCB5272D2C2C2A316D9C7A2C11125A3D747C2B2C0BC2B9895E58B772820A1C0D8B7B
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................c...............................................................................................................................................................................................................................................................................................................................................................................................................................................S.a.v.e.d.R.e.c.o.r.d.s.S.t.r.e.a.m. .3.4.l.........................................................................>...........R.e.p.o.r.t.P.a.r.a.m.e.t.e.r.s.S.t.r.e.a.m. .0.l...............4...................................................l...H.......A.n.a.l.y.s.i.s.G.r.i.d.s.S.t.r.e.a.m. .3.5.l...................0...................................................n...........V.i.e.w.I.n.f.o.r.m.a.t.i.o.n.S.t.r.e.a.m. .0.l.................2.......................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-6000.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 16, Total Editing Time: 01:19:16, Last Saved Time/Date: Thu Apr 15 16:15:03 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):90112
                                                                        Entropy (8bit):5.462546839098408
                                                                        Encrypted:false
                                                                        SSDEEP:768:+nYhxbQkQmhQ5NM9maf1iZxIHbWCc+nBn3IP3r8anGFfti:J0kQmsMRTNNMek
                                                                        MD5:3250FC4FD11C15C54822054C28780B01
                                                                        SHA1:215184E6327FE1AC1D273BADCCED85E782923AD9
                                                                        SHA-256:1E7672885014E6B7C146889E2220D70D08901E7C49208B651DD234936AB2A544
                                                                        SHA-512:4F73F3CF649EFCA18472C01B431646327F69DE1F5048427471344041BE5A721AE505A9B544BCA1DD1D9616EB098FA0DC1299C1652691AE217F5FFE9FA6CE69A7
                                                                        Malicious:false
                                                                        Preview:......................>.......................R...........N...................Z...............................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.2........................................................................F.....>lm."...>lm."................O.l.e.............................................................................................................2.............O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.4........................................................................F....`=.m

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-6100.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 19, Total Editing Time: 01:29:13, Last Saved Time/Date: Thu Apr 15 16:35:31 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):46080
                                                                        Entropy (8bit):5.043756431144704
                                                                        Encrypted:false
                                                                        SSDEEP:384:7VOicAD99Eq1HqIbOqWLgBe5lnq+jJqa+k9OdV9d:B9hD99CISbgBon
                                                                        MD5:26D7904E98C4826EC8C737C66BDCBC12
                                                                        SHA1:7CA4829A3E5F1BBFEDA5E3AEFBC156C39874DA4E
                                                                        SHA-256:8C347894CA7949613D31E39D033063A1AF4CF3FE757333C4F1BE2579CF920473
                                                                        SHA-512:F1B514950453EA4F92BC5103E0138A23ED6354780A4D29DE127A0E6056C888C320E248B1E2126013271BBC844D0DA8A20E84AD8E9BF757F5B36F75743C552E8B
                                                                        Malicious:false
                                                                        Preview:......................>.......................4...........1...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.3........................................................................F......I."....I."................O.l.e.............................................................................................................&.............O.l.e.P.r.e.s.0.0.0...................................................................................................l.......E.m.b.e.d.d.i.n.g. .1.2........................................................................F.....8.I

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-6200.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 21, Total Editing Time: 01:30:00, Last Saved Time/Date: Thu Apr 15 16:16:31 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):30720
                                                                        Entropy (8bit):5.045260314109269
                                                                        Encrypted:false
                                                                        SSDEEP:192:tL7OOnPkQ0hIdHb5xjvNOJMHCdrx38bW/9sn0A/qmDSAmeCDtF2MjTDIRzDwOaUe:tfOEB7n0tPRjTDJxUe8U5Ba2EBnUU
                                                                        MD5:452A7EB0E5D50CCA95CD8005C00F58B6
                                                                        SHA1:D28E656B06ED04270698665896266CED2D8864B2
                                                                        SHA-256:E9B38C68D490F2CDA0F40BBD13DCEFDB49E20954704AEBE1111068C97ECFBBB3
                                                                        SHA-512:3078578BC5CBA6866B27E0D8B4B63818D5A776867BD36859AE50B1D78EAED6EE45D68BC1D8FE2B7A12304E04977E53B30A5425409144293DA1FFF93969C2DF27
                                                                        Malicious:false
                                                                        Preview:......................>......................."...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.4........................................................................F.....*.."...*.."................O.l.e.............................................................................................................".............O.l.e.P.r.e.s.0.0.0...................................................................................................n.......E.m.b.e.d.d.i.n.g. .1.3........................................................................F........

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-6300.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 22, Total Editing Time: 01:42:27, Last Saved Time/Date: Thu Apr 15 16:17:09 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):261632
                                                                        Entropy (8bit):1.9491111808148631
                                                                        Encrypted:false
                                                                        SSDEEP:384:/meSOY8bNrkn5G4LLHPI7AroarCIC7eVl5nnm3PVbWkPTf:umkn5vnHoADnncPZ
                                                                        MD5:2BDAB01E7B8095BB8FDEBE7AF3926965
                                                                        SHA1:BA9DEB25822C3E374CC2B2E07FE661F4E9502282
                                                                        SHA-256:34B8F59F480FCAF32C09E1B8427FAF5E0CF80DC39918B8E1BBF0DAE220B9B386
                                                                        SHA-512:7D00C4F622E969B22416AD3C2C5C7A768CD3D95E61109DA061FACD98F7BBD43AA5EE0CA7C600F2FF7B26201ED341187F2DE4C7E2A587ACE2AE1458978F89022C
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.5........................................................................F......r.."....r.."................O.l.e.............................................................................................................#.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .1.6........................................................................F........

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\5531FB74\1998_NC_Disclosure.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: 1998 Discloure Report, Subject: 1998 Discloure Report, Author: James Lell, Last Saved By: James Lell, Revision Number: 101, Total Editing Time: 08:02:50, Last Printed: Sun Jun 27 21:04:02 1999, Last Saved Time/Date: Tue Feb 22 13:39:32 2005, Create Time/Date: Tue Jun 15 22:03:11 1999, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):442368
                                                                        Entropy (8bit):5.764291489711934
                                                                        Encrypted:false
                                                                        SSDEEP:1536:gqriKCi4JCS0DlTzwKg3Vj/I+HJL9uEXueM5g2ggLR4BZG3OF6OIIKE85+DN:gq0I5cJXXuQ4
                                                                        MD5:4623BE2BABA8AF4A48897E14029EE29F
                                                                        SHA1:12F217A06B3ADD4A579D6E6F4BFF0D60D44F256D
                                                                        SHA-256:24A472D4FD42007DE58116171D84B77906C90D6781C835CCFFF1F3DD704A074B
                                                                        SHA-512:423FD6ECC7F377CAC0EECB7F5B173171E6545FFBAE2964CC33A85114D9D62F783D0ABB6B83C3E00C127A58E74ABDD3CD28B420E503EDAA78B0BF485C22CF7235
                                                                        Malicious:false
                                                                        Preview:......................>...................................................~...............0...................................................................................................................................................................................................................................................................................................................................................................................................................................S.u.b.d.o.c.u.m.e.n.t. .8.9.....................................................................................................C.o.n.t.e.n.t.s..........................................................................................................L......D.a.t.a.b.a.s.e. .(.T.L.V.).............................................................................................t.......S.u.b.d.o.c.u.m.e.n.t. .1.0.1................................... ...................................0...

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\5531FB74\Accounts.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Account List, Subject: Account List, Author: James Lell, Last Saved By: James Lell, Revision Number: 47, Total Editing Time: 07:03:51, Last Printed: Sun Jun 27 21:04:02 1999, Last Saved Time/Date: Tue Feb 22 13:38:30 2005, Create Time/Date: Tue Jun 15 22:03:11 1999, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):17408
                                                                        Entropy (8bit):5.353280867175744
                                                                        Encrypted:false
                                                                        SSDEEP:192:en+EcA/aGyp318p8x3Wb5vNxjOJMHCdrYvQqFvAi1mnYuA8Z7Bu7P7Z7b7gUSA7Q:BjASGyp3uNhJ73O
                                                                        MD5:1A6030B5072235B0965869D19E08A9BB
                                                                        SHA1:BB3A30F534C655B1E2726219CA5BF49B817A2C58
                                                                        SHA-256:17098538A0A0EB865ECBAA17D00CFD09AB83400DA70BC9AE467C506E0F05CBA7
                                                                        SHA-512:2313A99DA787F451009A3BEC94BD4BFECA8A9FCBCAED3954F2923918B0DC1BBEE9E69E82AC978E864E1291692020F246D22F30D5FEF1EB8BBE78901B516EB3F9
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...........................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\5531FB74\Contributions.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Contributions List, Subject: Contributions List, Author: James Lell, Last Saved By: James Lell, Revision Number: 113, Total Editing Time: 12:36:42, Last Printed: Tue Aug 18 20:22:57 1998, Last Saved Time/Date: Tue Feb 22 13:33:52 2005, Create Time/Date: Sun Feb 9 18:04:38 1997, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional
                                                                        Category:dropped
                                                                        Size (bytes):47104
                                                                        Entropy (8bit):5.729017991338511
                                                                        Encrypted:false
                                                                        SSDEEP:384:gYbjI9PoSInCZuHqSTMRHXu+I3PWoCYnp:gYXGoB
                                                                        MD5:A02E3ED15993B8B8CF631068941EFDFA
                                                                        SHA1:68609F9F0CCBF698D602F15DF2783ED919B48DE3
                                                                        SHA-256:19EEE76FD82EC48C325BC696D85989C20BA39DC4D9903C440ECC8A3A91A9E2CC
                                                                        SHA-512:997B08C754A5D0625F39311971BB6113C44EE69F9DB7C3B6D1EC676C9591FCFFD40E428A042A677CB2237DCBE1AD7CDCB463BF721365C9541BD2CEFEB27EDC29
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\5531FB74\Cover.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Disclosure Report Cover, Subject: Disclosure Report Cover, Author: James Lell, Last Saved By: James Lell, Revision Number: 71, Total Editing Time: 09:09:36, Last Printed: Sun Jun 27 21:04:02 1999, Last Saved Time/Date: Mon Feb 21 14:12:42 2005, Create Time/Date: Tue Jun 15 22:03:11 1999, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):102993
                                                                        Entropy (8bit):5.775513240751137
                                                                        Encrypted:false
                                                                        SSDEEP:384:8iPllYflrU4GTGvsz057kQz5xACSYwp3m6MgqGFSIU5DmQ6rfmsduaaahWpQCcxI:ZllI+DQzXAgg3cDtjpM3a
                                                                        MD5:D6C23BB2D2B74DE1C9C452C58ECB7477
                                                                        SHA1:63409B79C746B01C0F12A76BB511849D77B709A2
                                                                        SHA-256:956C888758279B814FEDD7F48D76DFD49F5DF7C75A3FD23FDE0F97BAF0D710AE
                                                                        SHA-512:A43BEACAD2716DF068C68F5FEEB529BBBB2D89706ECC9604BF86F422F26558C98C304387CE134408E329D550E0978F385E0825ED15F4ACD88B94095EB0473A96
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\5531FB74\Debts.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Debts and Obligations List, Subject: Debts and Obligations List, Author: James Lell, Last Saved By: James Lell, Revision Number: 74, Total Editing Time: 05:41:49, Last Printed: Wed Dec 18 13:51:44 1996, Last Saved Time/Date: Tue Feb 22 13:38:41 2005, Create Time/Date: Sun Feb 9 19:12:49 1997, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional
                                                                        Category:dropped
                                                                        Size (bytes):52224
                                                                        Entropy (8bit):5.638520545168639
                                                                        Encrypted:false
                                                                        SSDEEP:384:VA3VCHSQW4z84Bd9CGLVJkhzWRajCIFaydsm4GM:VA3VCyVR4BRyK
                                                                        MD5:C5B71EFA6AFA72802DFD0D8055D128D8
                                                                        SHA1:77DA5148A255488EB4BD30493D2D3BD6DF11735C
                                                                        SHA-256:8F16CC0CB03D6406F4C6A7612F4C9D94D43DA774FC1C6662D76329B177B91F19
                                                                        SHA-512:5C8F634210E3E75F0EFF3975112E7C30AD166B1F8067AFBA65155F6339D198F10E5B5CC2D89CBD2422C32E0AA44EE75F4B00E5F3D936C03C360A3DBA1F0F45EE
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...........................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\5531FB74\Expenditures.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Expenditures List, Subject: Expenditures List, Author: James Lell, Last Saved By: James Lell, Revision Number: 74, Total Editing Time: 09:02:18, Last Printed: Wed Dec 18 13:51:44 1996, Last Saved Time/Date: Tue Feb 22 13:38:47 2005, Create Time/Date: Sun Feb 9 19:12:49 1997, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional
                                                                        Category:dropped
                                                                        Size (bytes):45056
                                                                        Entropy (8bit):5.681619568331793
                                                                        Encrypted:false
                                                                        SSDEEP:192:DNBaBX0B2BUz5jTRE8gxgdPk4tHze8yYWU8M1lt/EsrAmbaplydwDyTgzIF8WPka:ohmNx/zLbkuMC9OqjHWN/VYQBSSu/p
                                                                        MD5:761DBD0A2426A34D51F3362C051B37F9
                                                                        SHA1:5CC1CC3206398C6D7C121EBD2F676C36E9833A94
                                                                        SHA-256:1C0FC5BD6548947A189BED1A0EC51661528A725202E35792D9699C73C095B796
                                                                        SHA-512:D437D6041EC1A412415AE1F99EFB040D8E137378A53CCD9B03F26B1CE38C32ED1294C23D7264C6D8FF59CF39D26B9FF86747AFE7AC99EC7CB50DAB89F5F13C70
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\5531FB74\LoanEndorsers.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Endorsers List, Subject: Endorsers List, Author: James Lell, Last Saved By: James Lell, Revision Number: 45, Total Editing Time: 03:21:14, Last Saved Time/Date: Tue Feb 22 13:38:54 2005, Create Time/Date: Thu Dec 19 13:29:16 1996, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):17920
                                                                        Entropy (8bit):5.421908987486584
                                                                        Encrypted:false
                                                                        SSDEEP:192:2LAHPNxk0i2OLPU8GV8BErS8x3Wb5vNxjOJMHCdr5w7lqm9AmAYm9quAm97ZyPbF:W47k33/MrM4A
                                                                        MD5:BFCC78606337F1ADD7B87FC8E1C8C734
                                                                        SHA1:99B2673556D8A8730DDF60BA15A58BDAAFC9FC4A
                                                                        SHA-256:85CE8C392A2E7FEEE7FABE7A1F3E0F70C7F61F0EF20203EA343F025017803EEA
                                                                        SHA-512:7CC684AE706896B4D4C624941C7D71E6CF8D4C388FC02ABA50DAA23FDE8F9A145C0E998788FF01A9902AF469103281FC8B378F902BCD5E9DBB21DF2C6FADA27A
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!.......................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\5531FB74\LoanProceeds.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Loan Proceeds List, Subject: Loan Proceeds List, Author: James Lell, Last Saved By: James Lell, Revision Number: 71, Total Editing Time: 05:07:43, Last Saved Time/Date: Tue Feb 22 13:39:05 2005, Create Time/Date: Thu Dec 19 13:29:16 1996, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):59904
                                                                        Entropy (8bit):5.764839915499194
                                                                        Encrypted:false
                                                                        SSDEEP:384:2VsucDl8+hn7iszAu1YYDJP99qdKjHFCvCiZ/sHxz/JJ2afOj:isu+uu1YY1Pb
                                                                        MD5:DEF0B47C2A857A3380C7DD9FC55BD7AA
                                                                        SHA1:A42C01237FCEB20AF3C679ACAE403EE64FF0A080
                                                                        SHA-256:AC75DAC13D2DA4BB0AA279C8FB4C45EB2235111F30C76602861768147D61ED98
                                                                        SHA-512:CBA2B92BEA3EEA5E8ACC866AEE856BEEEC8DFCFF7470E5CDB22C7DA5E0AB48682EBD9966D00B11EAF750533FDFB0409145671FAABA93FEDC1EFAFA6386B7234D
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...............................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\5531FB74\LoanRepayments.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Loan Repayments List, Subject: Loan Repayments List, Author: James Lell, Last Saved By: James Lell, Revision Number: 33, Total Editing Time: 02:32:42, Last Saved Time/Date: Tue Feb 22 13:39:11 2005, Create Time/Date: Fri Dec 20 15:00:22 1996, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):41472
                                                                        Entropy (8bit):5.6245741985399995
                                                                        Encrypted:false
                                                                        SSDEEP:192:22EQNdickudiauN8dEZEQcAmbUipjatZkLWkC6lnU/c5HhW8x3b5vNxjOJMHCdru:0QN3ub55LOnz1BNdZSkw4fjjfnWX2R
                                                                        MD5:D96F0BFA34C620CB0904A5C7CD652D76
                                                                        SHA1:8848F994A2873BFA2BC73DFF35A8D1C617575DFF
                                                                        SHA-256:367CC798B9F28285A257274083D43D9CA34822AFBD0026BD7A6B407651AF5F38
                                                                        SHA-512:5207ACF7F10F23DB57FAB85126A7BE970C104088562128B2D982F9CF23C5177558DAAD6063E3A1897C0A1AE65A46D313FE9C32F4B394434455F00BB0E650D97E
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...............................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\5531FB74\Summary.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Summary, Subject: Summary, Author: James Lell, Last Saved By: James Lell, Revision Number: 50, Total Editing Time: 06:54:28, Last Printed: Sun Jun 27 21:04:02 1999, Last Saved Time/Date: Fri Jul 9 19:49:26 2004, Create Time/Date: Tue Jun 15 22:03:11 1999, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):93814
                                                                        Entropy (8bit):5.439847807690734
                                                                        Encrypted:false
                                                                        SSDEEP:384:SGmlkmzysH867TSqxdEjuPCPN2ScQ12ScrOgVzRDoYsg7VSclhhy6gGhJA1zfcOy:gtc67TSqtPCV2S0/
                                                                        MD5:AE82C60145B9DB14E62CFFEDCFDA30E6
                                                                        SHA1:8853BB15A95A0C0BAA23AFC99EC7CDB9303D4974
                                                                        SHA-256:164E5BD41A118A0075260EF11CC157C3AE23D6EC287E1C0F6C56AC0D97CBB627
                                                                        SHA-512:9189A0A9FD15A60BB293F3DDC9D9DBA1AA4EFBF23C70DB81E6A0CA12528F541ED09CB8B9359CEF9F7367BA05D22FF1C46DE8504154F41147CA00F9B462E74EAB
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\2007_Electioneering_Report.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Oct 15 14:21:07 2010, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Mon Feb 14 13:42:12 2011, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):607232
                                                                        Entropy (8bit):5.407342130384767
                                                                        Encrypted:false
                                                                        SSDEEP:6144:DPJo8DExbYmh3gZ+RwPONXoRjDhIcp0fDlavx+W/WEjGSZ+RwPONXoRjDhIcp0fe:DPJo8DExbuG6GA0
                                                                        MD5:B54AEDB3AEEA8EDEF964AB865229C237
                                                                        SHA1:D4037247E61D6ECE36F3534F38427E3F59B8B9B2
                                                                        SHA-256:9E3BC47402EFBF6F9E1217D2353B4ED2D633E4E0B889A8A14C4D1A2A5F48A67E
                                                                        SHA-512:99842D7DAFEB366E76004A6B5306ECCF6EC9AC92E76782F12B94DA6C37EE3552522DA3CE7B1381686B44BA210785959949AB0B2D363D2282F27E2906821C2B2D
                                                                        Malicious:false
                                                                        Preview:......................>.......................d.......................................}...\...[...Z...f.......o.................................................................................................................................................................................................................................................................................................................................................................................................................C.o.m.p.O.b.j.....................................................................................................~...r.........O.l.e.P.r.e.s.0.0.0...................................................................................................l ......S.u.b.d.o.c.u.m.e.n.t. .5.5.............................................@..............................:......:...............C.o.n.t.e.n.t.s.........................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\2007_FED_Disclosure.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Oct 16 21:17:12 2007, Create Time/Date: Tue Mar 18 18:48:47 2003, Last Saved Time/Date: Mon Oct 22 19:28:02 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):625664
                                                                        Entropy (8bit):4.950657383336972
                                                                        Encrypted:false
                                                                        SSDEEP:3072:TQrFH2RZraHzLWTkjqEMONv9tKAd0oNhzwcAS66emLo4cOfpkcUd3MDwC6SaHfs5:TmqHeuZgz+OSXG/inxkDo
                                                                        MD5:740F31D396DCEF3D05BDED7BD483AFB1
                                                                        SHA1:F8F66D67B56C7033DEB75E51521F5A447AD34996
                                                                        SHA-256:FBED39F9C33EB26E82A9C20B6F90DE125D74D8168E596CD3D40D00ED7998CAB8
                                                                        SHA-512:7F4E86B98968760E6E7DF03FF65E4BDF99B961FB3768C7DB49DA5796302D6F711C3CAB22733FB2B20F84F9222F33E6B849BD6AABE51AB574954A34DC50E9C57A
                                                                        Malicious:false
                                                                        Preview:......................>...............................................................c.......~...............h...............................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.3.5.......................................................3...5...........................................|...:.......T.h.i.s.W.o.r.k.b.o.o.k.................................................6...........................................l..........._.V.B.A._.P.R.O.J.E.C.T.............................................................................................>...O.......S.u.b.d.o.c.u.m.e.n.t. .6.8.................................................:...........................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\2007_Independent_Expenditure_Report.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 77, Total Editing Time: 03:30:42, Last Saved Time/Date: Tue Feb 15 18:26:50 2011, Create Time/Date: Mon Mar 22 15:03:08 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):488448
                                                                        Entropy (8bit):5.4462079439186635
                                                                        Encrypted:false
                                                                        SSDEEP:3072:dH3+Wiq7/cnF9G6Hlx/6uGUZdle9R/R1f4qzta896JboUEednkO8X7W:0rG6nSaZHQ4qJa896GsnkZ
                                                                        MD5:7AC4C6D7C7069B28B2EB439657BA0494
                                                                        SHA1:992D6D9DB36178139DBA882992E2D7ED9C175592
                                                                        SHA-256:87046ECB5B9DE39287DFDA261139352FAF81E8CF6A37FDF964A20BD9616FE732
                                                                        SHA-512:9716FC62672228B374FB537C8B02621DFAB592A2E8D757A474E001AF154214D1424A5AD9D1BFF70D77862F1F3BC4F681CF4B56DCA388E30B71809915BE0AD2BE
                                                                        Malicious:false
                                                                        Preview:......................>...............................................................................q.........................................................................................................................................................................................................................................................................................................................................................................................................................C.o.m.p.O.b.j.....................................................................................................D...r.........O.l.e.P.r.e.s.0.0.0...................................................................................................dB......S.u.b.d.o.c.u.m.e.n.t. .5............................................................................`..=....`..=...............C.o.n.t.e.n.t.s.........................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\2007_Muni_Voter-Owned_Election_Qualify_Report.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:51:41 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Wed Apr 29 22:15:36 2009, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):192512
                                                                        Entropy (8bit):5.007944223673486
                                                                        Encrypted:false
                                                                        SSDEEP:1536:RktWZ7Ut5HHsDYP8my+MXHwKY0/abtfiYIiVSfaSfV:r45HHsDSMXHwKY0/JtF
                                                                        MD5:A7F2BE0A9C76BEC9C49EB1373D5090D4
                                                                        SHA1:7369379F50FC341D466CC8A2B28EEDB854AB8C64
                                                                        SHA-256:FAA0526CA53536BEB1316741D680356DC81479982B2250C8798D0E6F91FD896E
                                                                        SHA-512:05AD1783BD4A2EE920C335CF2AB392C9DB856F15DA13EE7C509F59DB44900B17E93C901A862C540D6267CC75E322989D1C852F661D4E7BE2135D350DBC935EAE
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................V...........S.u.b.d.o.c.u.m.e.n.t. .6.2.................................................!...................................................C.o.n.t.e.n.t.s.........................................................#...............................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\2007_NC_Disclosure.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 12 20:34:40 2007, Create Time/Date: Tue Mar 18 18:36:59 2003, Last Saved Time/Date: Wed Dec 19 20:19:48 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):4794368
                                                                        Entropy (8bit):5.157456740228194
                                                                        Encrypted:false
                                                                        SSDEEP:12288:m9v/Mkrk2keuK63GyEhFKT8Y6IOm8XqQEJj+8fZvR7S/z0Ie2tXK:m98GyR6NKSLt6
                                                                        MD5:544DA1BE09475C44146130A8FCB9B3BE
                                                                        SHA1:4513DFA718004166D674C9E6573FBBAF9C186B70
                                                                        SHA-256:09A127F8DD521F7E1D029B922EA63CB1BD6C75BFF74025C78758500DB481320D
                                                                        SHA-512:3DCC434E59EEFA896DBC4BDC97E13D06A4757804BB8EA04F17F7EEA86DB6B5F6C31E1C94867C177A4E84B4756A66678D93F54D4AC2126AFF42B24ED49504D95E
                                                                        Malicious:false
                                                                        Preview:......................>...................J...[#..............f...............Y...........2...........................).......v...........t.......................!.......S...........................P...|...~...1...2...............M ..O ..............w..."...{...........v.......x.......z...y...............{.../.......}.......: ..K.......F...4....!...!..."..]#...#..U...............................................................................................................................................S.h.e.e.t.3.5.......................................................3...5...............................................A.......T.h.i.s.W.o.r.k.b.o.o.k.................................................6......................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................X...O.......S.u.b.d.o.c.u.m.e.n.t. .3.7.7................................... ...........:.......................P<d.

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\2007_Voter-Owned_Election_Qualify_Report.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:51:41 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Wed Apr 29 22:15:36 2009, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):188416
                                                                        Entropy (8bit):5.010132586463127
                                                                        Encrypted:false
                                                                        SSDEEP:1536:OO5mMgUei51+DbPc4MIwMXHwKY0/mbtPVYI9cSfaSfJ:ATi51+DanMXHwKY0/C3F
                                                                        MD5:A4F078FF359ADA243E48087C2CF00052
                                                                        SHA1:5E12458C8146DD365637A89B5B21930E48C108B2
                                                                        SHA-256:861FE0412A7C7BDBC203F4C8E70959F03DF97949DAD70E725CCD6B193E972A48
                                                                        SHA-512:250DF78987D7DCC9CD13B17EC00CA67AE5AE23FF0356F7D9096C9F948CEDB1EB334E818BEC3B3E945A5A6F575EDAF7EB42CD3FC2072F043B0797C6B0EAED6499
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.3.5...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................V..._.......S.u.b.d.o.c.u.m.e.n.t. .5.5.............................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1000.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Sep 29 22:25:01 2008, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Tue Sep 30 17:11:16 2008, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):277199
                                                                        Entropy (8bit):4.955204919765509
                                                                        Encrypted:false
                                                                        SSDEEP:3072:A83b1ABghpv/5/vR6xyPk3kHgC6tgd9bA3wOsWU7YoWIGLtXqSEB6Wrp9RdrW+Z+:AQABghpv/5/vR6xyPk3kj8fZvRwY
                                                                        MD5:C1C49AEF91B5BD6B09A0D16DE5B5A1A8
                                                                        SHA1:3BCEAFC0D57E4806D853E5CAFBDF83C58D9AD543
                                                                        SHA-256:68F186EB404BB675258B7A37F436EF8CAE0CE0C99CE99A3E7405AD73014FC213
                                                                        SHA-512:1DAD02580762635B05900A44F272F64AC084EEB913B904B9BA69A44E56A116D92B6E73EF4E1A2495441D1D1F6E6678DAA584B1D07116F2BAE0F04A7C3A83AD1A
                                                                        Malicious:false
                                                                        Preview:......................>....................................................... .......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1010.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Dec 10 15:09:59 2007, Create Time/Date: Tue Mar 18 18:32:55 2003, Last Saved Time/Date: Wed Dec 19 19:22:20 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):115712
                                                                        Entropy (8bit):4.729959959151051
                                                                        Encrypted:false
                                                                        SSDEEP:1536:yYQlKGozYa7z986/yv/C/vABgvp5RhnJvq:yYQlKGozYa7z9byv/C/vABgvp5RhnJv
                                                                        MD5:6106AD996499E23B00951728597CCFA9
                                                                        SHA1:2A0925E3FA17D899BEACA18C7FDA025CFC23594E
                                                                        SHA-256:39165D6F20199D558C3DD18966B64523636C0C9ADA65C4A1BA3A4E8DB9999B61
                                                                        SHA-512:6AC84F98E24B1BAF384BDAA7B7DB12BA7B427E895FD1B81EB2B8902820E606227FEC837BB0C2C3519E94F12B16D6E5601FD1EC89235C28CE024CE3C6EE6D361D
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1100.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Wed Sep 24 18:58:40 2008, Create Time/Date: Tue Mar 18 18:33:40 2003, Last Saved Time/Date: Wed Oct 8 17:43:19 2008, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):179642
                                                                        Entropy (8bit):5.166216624571424
                                                                        Encrypted:false
                                                                        SSDEEP:768:/pwcx63BOdZ8FNq+cqbVozkajO32K9E9vjwWR9OqQHuqXhoOunwXyRZL7W:6cx/dqFNEqhoA3XwvAF6xnwiRxW
                                                                        MD5:62F7E5138E3377191BA9809FD25E3052
                                                                        SHA1:AA896EECBB096365E52FC60D1D971EDCE8C45D73
                                                                        SHA-256:27BE3E35FBDED425853F321AA82115B85D4E9D03BDA9986F58ED78D174AE3259
                                                                        SHA-512:D015AE587566DDB0520C47021684C3F1B373B3A9647445F937B60A6BF1175A22DF4BF41E35CB140999BB58BEAF33D627589F3755AFB84FD04408407EEDE251BE
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................k........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...%.......&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...].......................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1205.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 12 20:37:09 2007, Create Time/Date: Wed Mar 19 14:57:07 2003, Last Saved Time/Date: Mon Oct 22 14:25:42 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):182784
                                                                        Entropy (8bit):4.952399645110275
                                                                        Encrypted:false
                                                                        SSDEEP:3072:TXrzxidmGZKpR/V1Z2gnM815Usm8oPKcz4JyKYFf4XgQLtIyumEk/np0aVfUOBGW:5SkIDk6Fk
                                                                        MD5:D4132237EB41C001172379B0CFBD2716
                                                                        SHA1:F650B72162CFE3C41FBC3BB060A1F7A61025E922
                                                                        SHA-256:B639182A4F1DD0297405DB3123413041F130C8358545AEBB8346132FEC5FBE1C
                                                                        SHA-512:4027D8DD1303EB2A2BF0274F4D62AA38553B2C2520F448BDCA49B0B84DB5E4CD80A5BC172E2FB77EEC0F6B47BFC3E24BD056EDA5154B5D6FCFC04030F40CB26D
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................n...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1210.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 12 20:08:58 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Mon Oct 22 14:29:10 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):185201
                                                                        Entropy (8bit):5.240949811968868
                                                                        Encrypted:false
                                                                        SSDEEP:3072:lZ4aXxE0IeiZAqCfBFANfkF/CamYMfXFpAaZ5mSAAmTvC8s7GopsOG+8F/I:a
                                                                        MD5:CDDFB8A098D01B326568A8934542E6FD
                                                                        SHA1:810056460BCD69778469E80499B1B8A5ABF10689
                                                                        SHA-256:23EFA47355AC238926FDD2F156959CB828F3B56F233B32B6191E590620D845DF
                                                                        SHA-512:17F5AAAB78AD19DA3B44260E3142E928558C1C28BD30DC0357D2E841072BC88AE9ADC08C0479F7D14C79190A4EDA814FE81D8DDD4AA802B1A77BCEAFD60675DE
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...[.......\...]...^..._...`...a...b...c...d...e...f...g...h...........................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1215.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Jan 3 14:48:09 2008, Create Time/Date: Tue Mar 18 18:37:23 2003, Last Saved Time/Date: Thu Jan 3 14:48:33 2008, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):168448
                                                                        Entropy (8bit):5.202527529762482
                                                                        Encrypted:false
                                                                        SSDEEP:3072:6urIsxEywEw+001sKJY0yNnQiawtVanTTWukckYPSKjggF0M61LIiOIE1zeG9GXn:+yp3
                                                                        MD5:921173462DF6CC5BE5AA6E7F1C9F19D0
                                                                        SHA1:64A7090A11E0DED04E3F13AA70C0AED377DB0EDF
                                                                        SHA-256:CCF9CC5D1E823E08443BE7ADCD00B20B2975B694226DE83CE4D66F8A2E7F985B
                                                                        SHA-512:BBF4A1E7380D727BA46223032CBBB8FEAB208C08291DCF5C588F205628FEC74672EFA2A61A03B9EE302E02811245C1A335D2D3E2D5A29E47EA6D2270AB519BC3
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................H...[...........................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1220.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Apr 13 20:48:40 2007, Create Time/Date: Tue Mar 18 18:36:01 2003, Last Saved Time/Date: Mon Oct 22 14:45:49 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):150016
                                                                        Entropy (8bit):5.205596829097363
                                                                        Encrypted:false
                                                                        SSDEEP:1536:2W6NZmGBWou83Gngj6uPMzsWT3fki8oaKo/M4iTuRR:2W6NZmGBWoBGngj6uPMzxB8oaKo/M
                                                                        MD5:A088F0800E0E423C554231B891E59390
                                                                        SHA1:C345820606D84BB6529876F4F02D82C25DE22707
                                                                        SHA-256:C7AB5E1C7436A1A4C405A77975716247FB177B19AF52DD58E8275B68A524E3B9
                                                                        SHA-512:CE0D4E040DC1426274E2BC96CC3F997866EEE53E8A6CF8E77246E38E9C2D537A32FBC2190657667E047994DA39A0033F75D2ADFE9BA1A29881B40D1DDDF98882
                                                                        Malicious:false
                                                                        Preview:......................>.......................w...............................y...H...........................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1230.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 12 20:12:11 2007, Create Time/Date: Tue Mar 18 18:36:29 2003, Last Saved Time/Date: Mon Oct 22 14:51:19 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):206658
                                                                        Entropy (8bit):5.156970374644571
                                                                        Encrypted:false
                                                                        SSDEEP:3072:gMPxdYIMwBzRn3Y5LoGMicjtGTD8x/0LUdheW/zXni8yV5Gr920W8y8a50032gSs:EKhK
                                                                        MD5:B6C3CE1000718B8957385CAE877FAEE5
                                                                        SHA1:0725EA60150FBA6EC4D98719193AF6A7212B609C
                                                                        SHA-256:5D45D44FFDBEE1BDEAFD1082651EF382164B646F75C53720D0D37E1FEB9C1BEA
                                                                        SHA-512:0D29BBCF4DBBD8E1DB670D662BB3471E315DFA90DBF23D36E921B39F7A98E8A5DED836CD2E4AB643FEF9039D8F68A2D0C2EDF440967D494EFDF30E59EA29C0EB
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................S.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1240.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 12 20:34:40 2007, Create Time/Date: Tue Mar 18 18:36:59 2003, Last Saved Time/Date: Wed Dec 19 20:19:59 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):207407
                                                                        Entropy (8bit):5.130835054236678
                                                                        Encrypted:false
                                                                        SSDEEP:3072:6mmZR4NTY+fBFvgipoLoJtpu6ndNVE6JsjNNKuX4Nrr9fO0Ehz0tmlgkArzOQAI5:6b8tx
                                                                        MD5:83E657E047E43622F4BBCEAE2E3ED26C
                                                                        SHA1:6B57E3230F7EB72E477AEDB6E48414E756108C2B
                                                                        SHA-256:CBF8CC5001E9509BB035677C6106EF50B74AF9146FDBBD6CB1A2D273A59C7C93
                                                                        SHA-512:D6514F1D0BF39089B7DE336BFA0BAC1983E006373CFAC35BC8F03D6A656F8CE1A40499558F8289A1D0D1727C3D3662E9AA169ABE35E033C4DE814CAC37F8FD69
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................H.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1250.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Wed Dec 12 20:36:55 2007, Create Time/Date: Tue Mar 18 18:37:23 2003, Last Saved Time/Date: Wed Dec 19 20:23:26 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):165376
                                                                        Entropy (8bit):5.204630458042751
                                                                        Encrypted:false
                                                                        SSDEEP:3072:JQZ7yok/viUkLZqhZnQeGfJDLsPO46kG/B+:Ig
                                                                        MD5:6742E11F8276F6F9B4310F9A505922C6
                                                                        SHA1:B63BD30E24C7310953E5C93E24FD41E32E742902
                                                                        SHA-256:DF570C2774335D78B52FE6F814C2CC28EC7A550D779E1FBAC909BE924F319977
                                                                        SHA-512:76E07A69587EF15CF26071D0CE3FD7438182F779AEB85EDEEB8512EA81DFF949FBF6D49B1D83F5A7BD2F11C29C2686D5B01F75C7563E86D1971762CEACB5F75B
                                                                        Malicious:false
                                                                        Preview:......................>...........................................................U...........................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.................................................................................................7...................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1260.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 77, Total Editing Time: 13:19:08, Last Printed: Fri Nov 19 19:45:23 2004, Last Saved Time/Date: Fri Jan 21 14:19:25 2005, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):87552
                                                                        Entropy (8bit):5.292860622249849
                                                                        Encrypted:false
                                                                        SSDEEP:384:0IVAgpIDVV3pdY7J84+ZEHnUzmLmCnFJBPncQ5olvPmKgTQVbDpdTC0xIBpIlxyi:UBHpS64+ZEHn0CnVPncxcA
                                                                        MD5:D57ABF650F3A7C4ABAFE3A95464A576E
                                                                        SHA1:888CC2AB4F445D3C25F5030ABC91839D7A75F015
                                                                        SHA-256:4F11CC3F6D5DBA4EC2B1A05ABF3819BA081F21131B80F092F0E8A4EC0E8109A4
                                                                        SHA-512:C46831025A5856D9559A9EE045105931441F2EF813202FCA6DFD7E33D71CF63175103BAB94E4F0F07E98E66E21746B182C9F550942E3CECBCB655437FC48509C
                                                                        Malicious:false
                                                                        Preview:......................>.......................@...........0...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .3.2........................................................................F......5....`|.5..................O.l.e.............................................................................................................8.............O.l.e.P.r.e.s.0.0.0....................................................................................................:......E.m.b.e.d.d.i.n.g. .3.4........................................................................F.... ..5

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1265.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Oct 2 21:58:32 2008, Create Time/Date: Tue Mar 18 18:38:43 2003, Last Saved Time/Date: Tue Oct 7 22:00:07 2008, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):179200
                                                                        Entropy (8bit):4.971791860235385
                                                                        Encrypted:false
                                                                        SSDEEP:3072:8gDFkCHwgaAaIpyGreKLZOpjlbu9yz1LCAcZ/8z5tSZOcOtuA8YLahxbRvaZJSCf:8Qcjwf
                                                                        MD5:C39EC68DC1C973913E5680996790FE4D
                                                                        SHA1:D9EB6D942E3F5F7901D9242F8C63A0982090544F
                                                                        SHA-256:2F1987D27D8BF22DAAC561C2C7A078BCC9EAFA35414ED36C624A6E72A1FED69B
                                                                        SHA-512:B97B290FF58EF29C3A29282FFAE0E878A3232BA2F6EAF7368BB5A75643E32BB7BA6F3BD2F756AFF772CDAAB0434211F61C1E1AC8C92098A8810034CA872C5264
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................G...............................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.3.2.......................................................#...%...............................................Y.......T.h.i.s.W.o.r.k.b.o.o.k.................................................&......................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................U...y.......E.m.b.e.d.d.i.n.g. .3.4.............................................O......./... ..............F....`..y

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1270.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Nov 16 20:33:18 2009, Create Time/Date: Tue Mar 18 18:37:23 2003, Last Saved Time/Date: Mon Dec 21 15:58:40 2009, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):258048
                                                                        Entropy (8bit):4.950934717075591
                                                                        Encrypted:false
                                                                        SSDEEP:3072:1P1JR2biO95hFqzw8mFJjefgL/ezzrUt6rDTUVykn3T+sNdhKnJgHxXbyjQYmxFQ:Xu
                                                                        MD5:D46A8E06CF758CE784DAB6A346C18CC2
                                                                        SHA1:5FC8A9A21870F50138241F374A9EC4F81C308827
                                                                        SHA-256:EFB54DCAA6451E8820004655327485E7A9C76E57766819A3285B29536F0AD5B2
                                                                        SHA-512:1E2AC43866C5C3AB826955DAF76FEDD6C1DEACC48D208F28DF68E7DF46C7AF4D48A10F5298732B5AB8485F065F40542329C4CF93A77756E30E2325FFF01B49CE
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................r...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................l...............................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1305.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue May 8 15:48:55 2007, Create Time/Date: Wed Mar 19 14:57:07 2003, Last Saved Time/Date: Mon Oct 22 15:14:45 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):186880
                                                                        Entropy (8bit):4.934801965469349
                                                                        Encrypted:false
                                                                        SSDEEP:3072:o87jT9+1SaVWBR7VFlScnEQVJIwqccjmUr0tGCMhH0bgkbVci2REk7EXX6lHMqVX:oMjkDkPHk
                                                                        MD5:3C139956F2E1AAAC4FBA589907644095
                                                                        SHA1:E1E86F73DAEA1EDD3B5C1361DCEC1DD2A7B42697
                                                                        SHA-256:F1638B572DF258D7BB77E2F4DA6CF00B30DCCB40A5B43DBB82B251673DB41559
                                                                        SHA-512:139BEB1D1FAEFBDE2EBB39909102444BF87A5A64E8AAF1269C3B7AF930FF5413FC5ED33AFE346ED40C26C955BA98C7AE9862F8A121E7476983835BE2D994CB9B
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................n...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.................................................................................................\...................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1310.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Nov 17 16:11:09 2009, Create Time/Date: Tue Mar 18 18:39:02 2003, Last Saved Time/Date: Mon Dec 21 16:03:24 2009, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):253952
                                                                        Entropy (8bit):4.88787880649354
                                                                        Encrypted:false
                                                                        SSDEEP:3072:4OpY1fX4D+QYNyPyELBJ6s0HBp08DS/X/UMmoDX48jp+oUP1jRnx+Us/56AxRqm4:y02Zz
                                                                        MD5:BB8CEB43E879AFFC33789AB3A02C78FA
                                                                        SHA1:0C75F019D84546AF18C10B0CB4DA2F4F41D43DAA
                                                                        SHA-256:1A9EA3240F75F09A639DA23CADCB1523E6EA5C9D3E37DC3D1AEC8D309D29CE1C
                                                                        SHA-512:E64DA3919089C1F32CB9F53C7A1A0647D477D84AFE48621FE0318770DB17E324E6A782D50E85556F139D509D45A2EE1A7A7334C9E3E07A189A15B8FC9BCC9F1F
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................]..............................................................................................................................................................................................................................................................................................................................................................................................................................................._._.S.R.P._.3.......................................................+...-.......................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................u...........E.m.b.e.d.d.i.n.g. .5.1.............................................[.......7... ..............F.....T0.

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1315.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: Template, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Wed Dec 23 13:23:38 2009, Create Time/Date: Fri Sep 18 14:41:55 2009, Last Saved Time/Date: Wed Dec 23 13:29:52 2009, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):221696
                                                                        Entropy (8bit):4.852220976251422
                                                                        Encrypted:false
                                                                        SSDEEP:3072:lyx6XPLzL0eeyD3xPNkzv5OLJYFRydDaQTD6lo5wUixc2CwfVzkFt4htDDXPUK+8:cxPk0v
                                                                        MD5:F75B99D5796990BA2E531D625E00FB2E
                                                                        SHA1:4CC6F255FB99858909B7CF37476F3822678C0F6D
                                                                        SHA-256:DE6274B458ABB143F4832E93E7BE4D8C13044204ADB442A235D8DCA18A06C860
                                                                        SHA-512:EB71CE8F3641C01551EB9AD28D6B746028D8A5786F3C055C9C7F6106318E0A10572C8A902AB080AE39EA8E33DAFA03AC55383039E05179B66271172D0AF8EA10
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................r...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1320.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jul 6 16:30:49 2007, Create Time/Date: Tue Mar 18 18:39:25 2003, Last Saved Time/Date: Mon Oct 22 15:23:52 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):209920
                                                                        Entropy (8bit):5.072464260495382
                                                                        Encrypted:false
                                                                        SSDEEP:3072:HLIBwkq9NAIoSzQ0S7SIZGBRA4R7BnRMbp9Rt7rG6+sdoaSYt9awFUYBaNERBAQU:r8t
                                                                        MD5:2FBD7AAF164C869883BEC2BCA05010A7
                                                                        SHA1:FE725E820949A2C5D065ECFE0DFA0E8AE7A69F5B
                                                                        SHA-256:3DDEDB67316FE565FFAD865ED2D6DD574C3D6AA230A35E20C7E1C01344C8E0F1
                                                                        SHA-512:7AB12BBC73486ABFB52D94C147B70981B90271609AAFE45BD25535F28B2A53179A389670758640D839A3A8EC67E6A615599008251887E3C9BFEF71AC13E421C9
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................I.......l.......................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1330.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Dec 10 15:31:24 2007, Create Time/Date: Tue Mar 18 18:39:46 2003, Last Saved Time/Date: Thu Dec 20 12:45:54 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):225792
                                                                        Entropy (8bit):4.958937507406109
                                                                        Encrypted:false
                                                                        SSDEEP:3072:HlrC1rCMbggED9nSChJ5BGPIrjTG2ldhg4Z0TlLFhd7pq753VLW3wLEdZGGS+F0y:UxV
                                                                        MD5:CD5E5B4E39ECA860862276250E7F25D2
                                                                        SHA1:531B5ABB29CEA928C9CCD01B0C721AA0188F342E
                                                                        SHA-256:908A0E47CF765F28A66ED79EC769792FA715CBBD3861EBAD833CFCE93375FCA6
                                                                        SHA-512:E9A2AFFB0DC8ACD871E13E777CD09A5C9E4BB912252AFC4AB4EF40E088536E5DFE54CE4DEDDF5BEB8B1ABC64CDB221BDF3F96DED417B191038EAA22184848B7E
                                                                        Malicious:false
                                                                        Preview:......................>...................................................W...Y...............................................................................................................................................................................................................................................................................................................................................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k.................................................9......................................................._.V.B.A._.P.R.O.J.E.C.T.................................................................................................q.......E.m.b.e.d.d.i.n.g. .5.0.............................................p.......J... ..............F....P.D..C...E..C................O.l.e.................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1410.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Apr 13 21:15:00 2007, Create Time/Date: Tue Mar 18 18:40:06 2003, Last Saved Time/Date: Mon Oct 22 15:34:20 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):149504
                                                                        Entropy (8bit):5.15953513117498
                                                                        Encrypted:false
                                                                        SSDEEP:768:Ycv3JYOB0T8OEpgwJmvmEGcDKCwaEzJGmG1OnS6fJwaEPz54:YiO8OEp30vOcDKtPVGmGInS6fWPPC
                                                                        MD5:4C745F24AB6AD29C007BBCC4ACBD0192
                                                                        SHA1:5A40DFC1CE95AAFD3869E55A91250239A35A2944
                                                                        SHA-256:DBB69B1CCE9B73FAD9CE55FF4E340131AA3DFCCA7C641551E5CF6FCD586CD4EF
                                                                        SHA-512:9001287CF61BFDFF81B20F6864FAAA3A2EC7DA7D278D411130CE1C89086E38DE643FB9D402C09D3B203009E181B57013D6A9A3FC13C213DFE19DB0D653C09B4B
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1420.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Dec 10 15:45:28 2007, Create Time/Date: Tue Mar 18 18:40:26 2003, Last Saved Time/Date: Thu Dec 20 12:49:10 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):146432
                                                                        Entropy (8bit):5.063673625152432
                                                                        Encrypted:false
                                                                        SSDEEP:1536:BGf37BCzwSJ43KyN3DEXrz4wn7KKgKLli1+49:Af37BCzwSWKyN3DEXfn7KKgKLli4
                                                                        MD5:16E2E8C47A83FA4CBA0EF9969DD3EAEA
                                                                        SHA1:7B9CF6EB74205A42A27166F24347F17433AAE122
                                                                        SHA-256:30D816129634F858170327E77DDD28C02F631FE76EAC00D28434CA167E635C57
                                                                        SHA-512:046C63E6135EC52EEEDA975A69BC159E004A5EF58D6729C6766E28AD56B5599AA5F3495F8AA0B9ACBC13D523B1F71B9DC0CD7F5A828DE1069879206A4287DE33
                                                                        Malicious:false
                                                                        Preview:......................>.......................{...............................}...J...........................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1430.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 11 21:22:12 2007, Create Time/Date: Tue Mar 18 18:40:48 2003, Last Saved Time/Date: Thu Dec 20 12:51:53 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):143872
                                                                        Entropy (8bit):5.048937898720221
                                                                        Encrypted:false
                                                                        SSDEEP:3072:SEgHKAt1aapBgC9y3Nu/2eX76vUbBKYe/CTLlm1:SEgHKAt1aa1/HKF
                                                                        MD5:37BF265114AC548A613E0F811A4E14AA
                                                                        SHA1:7EEBD6C38835BC0E2561D3CCBFD0682E5C125889
                                                                        SHA-256:27ED2A6B9FE0961396D609EC771E13FB96AE8771BDD125AB45B0849224CA9A91
                                                                        SHA-512:D9C9F8EE1C66C2255C9A03057FA29563791A4309E6B299D91B83190EC06F173247DC2B6883C4C403AEA20C75774D567F7D1D07D09A4398FBDD2069CC6CD744BC
                                                                        Malicious:false
                                                                        Preview:......................>.......................x...............................}..............................................................................................................................................................................................................................................................................................................................................................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................U...........E.m.b.e.d.d.i.n.g. .5.8.............................................5.......!... ..............F.....hO.C...hO.C................O.l.e.........................................................................................................................C.t.l.s................................................................. ...............................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1440.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: sboetest, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 11 20:56:44 2007, Create Time/Date: Fri Apr 4 21:28:15 2003, Last Saved Time/Date: Thu Dec 20 12:55:10 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):131072
                                                                        Entropy (8bit):5.157600548856342
                                                                        Encrypted:false
                                                                        SSDEEP:768:2AuLeepR5sEeSGQk9dq7WEbZFFeQkhwX06timb2/WxDjVaj6gKQk2nuKQ:2AqbsEeEPbZFdYS0K2/Wx/Vaj6m7a
                                                                        MD5:1AB6467BB94BFA8E94830B2C7857ECEE
                                                                        SHA1:D0571B1EEEA6411F837FBF725F2365A8C52F022F
                                                                        SHA-256:14F8DEB2F3CA26B3B5890CA042D3BAE02080A105789EB05504DFE0B956285ABF
                                                                        SHA-512:FEDC72819025644B7CEBC93C1AF7008E2F4E05C5ECFDF2E62947705CD0B7F8CBF13C33CD27BBC68A50DFDE27AE08514D0E62125EBFD02BB9ED1A22C8FF76326D
                                                                        Malicious:false
                                                                        Preview:......................>.......................o...............................r...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1510.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Dec 10 15:57:10 2007, Create Time/Date: Tue Mar 18 18:41:35 2003, Last Saved Time/Date: Thu Dec 20 13:08:22 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):196608
                                                                        Entropy (8bit):5.043187868752451
                                                                        Encrypted:false
                                                                        SSDEEP:3072:OFoAmv0dDkBDZ5DolqUzTHvUmq7qAap18NCXxrJftxOqfUCfOWenNZwUq73aRYdH:0x7wkZ
                                                                        MD5:B3A51CE1A4426170A893BD555B37F02E
                                                                        SHA1:863DF9EB5D3CEBE077CBF887656E86B7E4D73397
                                                                        SHA-256:0924764EAABC8A2D479EB9DA07A9B03780F3382C8DE6B72BE6DFFFF346607A34
                                                                        SHA-512:D9A1FB8C6362B17494574D9C718C931FE7DEA85CD0420180B0A48196AF1568E6CCD9013D1E03339AA0E2D903EC57555314105B1EEAE5F4447707D6CB9EEE94D0
                                                                        Malicious:false
                                                                        Preview:......................>...................................................M...N...............................................................................................................................................................................................................................................................................................................................................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k.................................................-......................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................s...........E.m.b.e.d.d.i.n.g. .6.0.............................................X.......>... ..............F.... ..D.d.....D.d................O.l.e.................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1610.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 116, Total Editing Time: 1d+04:18:33, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 5 12:05:46 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):334424
                                                                        Entropy (8bit):5.342674465414266
                                                                        Encrypted:false
                                                                        SSDEEP:1536:7jO3+tEK0cDamfB2LkNBn0FVs3J0E43q0cmfB2LkNBn0ICGcLI4DMHdjuTEzrIIw:G32EKF6VEJ0EtKCGH9jGEz0IeSdq
                                                                        MD5:F17BF9315C6397B804496247421E8E24
                                                                        SHA1:3DF470B8684DAC414FF7D6AF3175AA35A14B84DC
                                                                        SHA-256:98605AEE454F9557B227622FB414270301E4F63B79947D766129DCE16CD17E66
                                                                        SHA-512:B45CACD79F16664A2923635F70083130AA9C6637B6A1AAACE52670DCE21D28064C682CDC751BBE188CBB0544AB6861587836435DABB6188DA865AB795AE2777D
                                                                        Malicious:false
                                                                        Preview:......................>...........................................................r...s.......M.................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .6.6.........................................................0..............F.....}.j.....}.j..................O.l.e.........................................................................................................................P.a.c.k.a.g.e...........................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1620.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 11 21:26:45 2007, Create Time/Date: Tue Mar 18 18:43:28 2003, Last Saved Time/Date: Thu Dec 20 13:16:27 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):170496
                                                                        Entropy (8bit):5.077195832841005
                                                                        Encrypted:false
                                                                        SSDEEP:3072:lg6OZuzT6RBP01esKcdOPfsL2FVrm57oQ+a:7/k
                                                                        MD5:403056F1D56084DC1034682F28C069B2
                                                                        SHA1:552AED44B6D7CD1D691B4E519C89DFA37764FB5C
                                                                        SHA-256:EC17AC16E8F9F10D26357F53A3ECA16C2E3692B07D0A0B49F8618BC3C7F5595A
                                                                        SHA-512:30F5900C8777AED243911549BF7113F10722B74A303AA8D79B83BE9D59221E907307587CD4E2A0186BE3EE756F8259D786C58D6C2D95E80244C2E220E907FA0E
                                                                        Malicious:false
                                                                        Preview:......................>...........................................................P..........................................................................................................................................................................................................................................................................................................................................................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................(...........E.m.b.e.d.d.i.n.g. .6.6.....................................................1... ..............F.........C.......C................O.l.e.........................................................................................................................C.t.l.s.................................................................0...............................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1710.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 11 21:08:44 2007, Create Time/Date: Tue Mar 18 18:43:53 2003, Last Saved Time/Date: Thu Dec 20 13:19:54 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):122880
                                                                        Entropy (8bit):4.960800429743342
                                                                        Encrypted:false
                                                                        SSDEEP:768:54C7x0agTFz+OSXG/inAMXOFwPSZcP74zvD8QrqFrQDYB:5LEz+OSXG/inzXOFCSuD4zb8Q8r6YB
                                                                        MD5:909287CDC971C0D4B31C5D32B688A6BC
                                                                        SHA1:EFF5CE5BAC01F247903A402BBDBF409EFF9B725C
                                                                        SHA-256:31BD8F97745B70084DC405A219C9ACC90E0C22580CEAB06486EF13B3789EC639
                                                                        SHA-512:6D7D694DF5904D20C44195DCD9905A239BB1B8632EC03D7D90787F7D351A82EC56429DA6E22E8A2F9BBA74A2C2ACDA8A70D99F76C8E6BF01FD4604F159F07490
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.0.......................................................................................................|...........T.h.i.s.W.o.r.k.b.o.o.k.............................................................................................l..........._.V.B.A._.P.R.O.J.E.C.T.............................................................................................?...=.......E.m.b.e.d.d.i.n.g. .7.4.............................................)........... ..............F.......6

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1720.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Dec 10 15:38:38 2007, Create Time/Date: Tue Mar 18 18:44:11 2003, Last Saved Time/Date: Thu Dec 20 13:21:49 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):181248
                                                                        Entropy (8bit):4.919450248953279
                                                                        Encrypted:false
                                                                        SSDEEP:3072:utTgm+uUSbiaPH82Yy1uK8PJRG33hD2Hutv+Ud1mXtNB61s+X2Kp5AKSFGAtjm3R:5Ha8Dm1
                                                                        MD5:1A1174381B327B0BE6AEA5AFD221DB4D
                                                                        SHA1:5E005EED30F08BCFDC2DC666DC2E54D4AE9E2BE7
                                                                        SHA-256:5EA0AC5B9592134749833BB0803ABC6BE782C7FD57CFD0971A7E2E9B80CFE20C
                                                                        SHA-512:AE7EEA2A39429B0EB694039026329F252B3ADEBC0DBB6E444E9319DEEAE0F6582D45F6F181DA25CE82634505AC075C49F2168EFF0B9BD46A57662AF042CD7FD5
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................p...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2210A.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 55, Total Editing Time: 14:49:41, Last Saved Time/Date: Tue Feb 15 18:01:58 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):158720
                                                                        Entropy (8bit):5.268140724248468
                                                                        Encrypted:false
                                                                        SSDEEP:1536:HZLzpe9R/R1gGWx2oLnq0qwA1s3A85Yh:5Lle9R/R1fEqzt8
                                                                        MD5:4882CF47C2091D38AF98D8287394A284
                                                                        SHA1:0B4F8D02922F66C946ACBE312382E06245C8C040
                                                                        SHA-256:03C156AF47054845AB03DAC77350A3C34D013E332EDC8E6596978B46FEB05244
                                                                        SHA-512:9554817DB5026E3F4CC350FAFF41BC2C7DB39A452B1549B6E4184F1FD6FAE828C200FF684D2532BCFCDF5CB6D242E6577CAFA4006347140BE790E10885CD93B3
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................eld Definitions Only).....D:\VersionControl\SEIMS1.0\Development\2010 YearEnd\Applications\CR Code\CFRS Common\CF_Common\CF_Reports\2007 Forms\cro-2210A.ttx..........cro-2210A.ttx.............................................................0.......................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2210B.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 135, Total Editing Time: 1d+04:13:02, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Jan 3 19:00:05 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):103936
                                                                        Entropy (8bit):5.592327674224524
                                                                        Encrypted:false
                                                                        SSDEEP:768:zeHskQ4XJukQLWS6lZaqkbDdHkdxkBNox3XRXhTBPSWlPGRCAIIrZTretmXV8hBv:zuhX/6uGRCOX6HHFxGXF6DwNS
                                                                        MD5:2AB980981BB08FC87E4B8E885C775867
                                                                        SHA1:F72DF109611C6E5A83BA7282C9E8E9ED4E4D9B1E
                                                                        SHA-256:3A11440931E4AF31F03346CAF6DEB28AA9592A50B12126DD434D708D4EDB1C39
                                                                        SHA-512:B6FEC7CCFFE987A8C4A16A15714014565B6CB19F55ACEBA887336DF297706FE23AC0BA3148BCC7821CB4664187B614FCFB66E0A601BA08F1C049F4A4E0320A13
                                                                        Malicious:false
                                                                        Preview:......................>.......................}...........|.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0...................................................................................................dB......E.m.b.e.d.d.i.n.g. .3.1.........................................................0..............F.....>.nx....>.nx.................O.l.e.............................................................................................................1...........P.a.c.k.a.g.e...........................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2210C.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 174, Total Editing Time: 1d+13:39:25, Last Printed: Tue Nov 2 15:30:29 2004, Last Saved Time/Date: Tue Feb 15 18:24:24 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):222452
                                                                        Entropy (8bit):5.4064762014400065
                                                                        Encrypted:false
                                                                        SSDEEP:1536:kp1HN2XddW26XOTh3B0Zld7gpi1ELoAdMLg6:kp1H87WtOL0j6pOmFWM6
                                                                        MD5:FADE02A6571C1E7B61F7D2912843299B
                                                                        SHA1:5B02062FD22BE8F768CE81B7F6500D0658DD6447
                                                                        SHA-256:CAECEBCE8CF9785948FC753AAD941939A8644C61DEEBC32DB66BD020FD60B219
                                                                        SHA-512:013E9CC58F5F0EC7C379777CFFA5D25A27EC1673F861A4A52F746E6AC63C8231B8969F7D03E3E63BCA6E531FA2B7657BF0E38B05429BEEF5BFF4D1F59E5BCE2F
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................'.......v.........................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................+......E.m.b.e.d.d.i.n.g. .4.1.........................................................0..............F.......=......=.................O.l.e.............................................................................................................H...........P.a.c.k.a.g.e...........................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2310.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 56, Total Editing Time: 14:47:29, Last Saved Time/Date: Tue Feb 15 18:02:08 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):163840
                                                                        Entropy (8bit):5.228829883731787
                                                                        Encrypted:false
                                                                        SSDEEP:768:dg+RR+r9hPq0TcyUwDFOkZ8E7VFFyhufjMVok2HKrs0yhjtLvjMVokT6X4GyBBC5:dg+R+y6s6oagYnysA0VWeDm6iE43qf
                                                                        MD5:F51BEAB10802D8F46CD91524C29A78A9
                                                                        SHA1:825EC58150D825C5245F1FFA0AAE8A8E39EACD4B
                                                                        SHA-256:2D4E4ED8AC8175EAE07D880B467815C561E31410E75F33CABA41CD16534E71AE
                                                                        SHA-512:60B5ED2AA7DBEFEE444B6B12110A80104B5C6EBAD2F82B9CF73939857AD255F4EFC419766BFAF63B8AB8D1EC48C14996082C7E3F4309CFE151A82FC2B4C15D23
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................eld Definitions Only).....D:\VersionControl\SEIMS1.0\Development\2010 YearEnd\Applications\CR Code\CFRS Common\CF_Common\CF_Reports\2007 Forms\cro-2310.ttx..........cro-2310.ttx.............................................................0.........................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2320.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 122, Total Editing Time: 1d+03:59:21, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Jan 3 12:16:34 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):83456
                                                                        Entropy (8bit):5.617886733447368
                                                                        Encrypted:false
                                                                        SSDEEP:768:kLjO/+KGidgXJBPjjZTX4BPBPn5925VhljMVokLqhdXpBPNZXP8h:kHX/ZX85/5scqhdXfr
                                                                        MD5:E708CF7FC5A36DCFB21C4C71D3D3830E
                                                                        SHA1:524E043B77C72E1AF8DFE79029FF4843EC93693C
                                                                        SHA-256:E1D8DA0491FFE506F325D2FE0A0292A3FE1A3700CA1D8A2E780876E8E4964D7C
                                                                        SHA-512:C5A59C922BDE6E6BF36AEA1A6655E4A6743DE391721B233FA1BB54F8A82BA9066551F8815507CC01E25DE00D6800D4421071CEE65591D042FA9476ED04847BBE
                                                                        Malicious:false
                                                                        Preview:......................>.......................d...........c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0...................................................................................................l ......E.m.b.e.d.d.i.n.g. .2.8.........................................................0..............F........@.......@.................O.l.e.............................................................................................................j...........P.a.c.k.a.g.e...........................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2330.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 133, Total Editing Time: 1d+04:11:03, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Jan 3 13:05:25 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):104448
                                                                        Entropy (8bit):5.571042801433939
                                                                        Encrypted:false
                                                                        SSDEEP:768:hkvnrY8fsuk9LCS87Q4kh6+ubXbFiNExN2HXbdBP+VtzY1g5pL8lQM1KXVTBP657:XNyNOXbrctpUKXbuT4WhZXF6Bqn
                                                                        MD5:A0C044D33CB4F0DB844EC13C156BDF6F
                                                                        SHA1:9FC9F3526F3E9785B898BBC239590DED15AF9AE0
                                                                        SHA-256:82EDAF0D98E22A5BF59CB851687DDC0DE7B974DA2BC10AA528BEBA1BEB0F5064
                                                                        SHA-512:832F30833ABA02BEF0172AAC47175D9B9A16C3B50AEAC12DD8FF01F13D215DC18BB39A1113EE785C4C3A310B07886FCFD361F76A2A2447A1D77507B17471D34C
                                                                        Malicious:false
                                                                        Preview:......................>.......................~...........}.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................B......E.m.b.e.d.d.i.n.g. .2.9.........................................................0..............F.....$..F....$..F.................O.l.e.............................................................................................................1...........P.a.c.k.a.g.e...........................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2340.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Oct 15 14:21:07 2010, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Mon Feb 14 13:42:24 2011, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):252750
                                                                        Entropy (8bit):5.25060703850526
                                                                        Encrypted:false
                                                                        SSDEEP:6144:YZ+RwPONXoRjDhIcp0fDlavx+W/WEtZ+RwPONXoRjDhIcp0fDlavx+W/WEp3FZ+m:kGo
                                                                        MD5:D386DF49CA08E8BC94B632AE6BEF1DB1
                                                                        SHA1:4D236FB675BD56A0CCB979BB26809A6278B45C58
                                                                        SHA-256:6C7F2A579D4218ABF8375315255417A740D4964E9DE361B6B00E9F6BF1E4AB92
                                                                        SHA-512:44BEC47D9E91DED6E741D82FE4C0D98E73A109CD5A9E9543FE47DC1A28D0619E9CB20F607C30BD620918EEE34AA813253DE302A339435EC7835E7BD3081EAC92
                                                                        Malicious:false
                                                                        Preview:......................>...................................E.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................+........S.u.m.m.a.r.y.I.n.f.o.r.m.a.t.i.o.n...........................(...................................................D.............D.o.c.u.m.e.n.t.S.u.m.m.a.r.y.I.n.f.o.r.m.a.t.i.o.n...........8...................................................@...........E.m.b.e.d.d.i.n.g. .3.5......................................................... ..............F.....)

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2500.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:40:21 2007, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Mon Oct 22 19:22:13 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):86528
                                                                        Entropy (8bit):4.881958494433561
                                                                        Encrypted:false
                                                                        SSDEEP:768:Fl8E2XX+tjZyfSiy947UelYPLVEr+HClN61P:OyjZyWEUelyEr+MN6
                                                                        MD5:E34AF91588EF52750B571461438523FC
                                                                        SHA1:060DAAD994AD9CA194CF2745B197524AF01E4981
                                                                        SHA-256:F05461F9C2DE1E0B19F4F2C4C44BCB9BFEF39586B18EB9D403497586DA5FE981
                                                                        SHA-512:0971601CC34A99B221F284D5865323FD060E5F3DAF95EECCB2C0F434A6AC6FB12E77C5E4544BEE59BEFAEA704814979A94C0DC9BA5AEBF510A8F9E177CE44E54
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2501.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:40:21 2007, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Tue Oct 23 14:18:36 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):86528
                                                                        Entropy (8bit):4.88633501894969
                                                                        Encrypted:false
                                                                        SSDEEP:768:al8E2XBaqD5vSiyV7UeikdtZ81+D9FCl9w:V5OUei51+D969
                                                                        MD5:4C8430FEB6682068847DE23E43B28916
                                                                        SHA1:BBC51A81B9A85354CD567DC39EF69579D4320DA7
                                                                        SHA-256:C8BE4F958AA658009028FAAD99474AEE6E1834558AFC655BEE3F086E24EC394E
                                                                        SHA-512:4547A4CD0869296621E0684AAF030133250DB8E4335BCDBFAB924CE389AAA826C477486176199688719CE7FBB00D628E079BD89033D7D1B32F0B94144ED03155
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2502.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Apr 28 17:00:15 2009, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Wed Apr 29 22:24:07 2009, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):90112
                                                                        Entropy (8bit):4.881150690200426
                                                                        Encrypted:false
                                                                        SSDEEP:768:O4l8E2XlCGZJgtiSCg5Ut5Zl8MlHsDllxW:O5ZMUt5HHsD1
                                                                        MD5:1A8B9BAB9A26DE6C4D078DE140FAEFAA
                                                                        SHA1:108F6E387FFA826F7E52BCD4CC9A01B7428FB809
                                                                        SHA-256:2FDEB8A9E37FB4B225AB55F317F06D00F280890466F03C0309EF76D577C29DE1
                                                                        SHA-512:95A587D23889964C05FD9AB1C90F189947526697C0060386EE8CDDB26152E758E3F1C3167341CBE13815B5907017820AC20A1B97C799C162EA99BA3CEEBD7CEF
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................~................................................................................................................................................................................................................................................................................................................................................................................................................................................d.....gdldd.dddddedd........ddddddde.dcddddtdA..dd..ddd.dddddddddddddddddddddddddddddddddddddddddd$dddddddddle.f.....cfkfffffffffffd.fffffffgfgfgfffffffffgfffffefffffffffgfffff.fffffgfgffff.7affffl7776777777_4afffffgf...........................c....._..._....8....o..... ..hoooo}..................oooooo.s.....I..tssssQ.p......ppp~3........>...p{qppppqpc{sh...^AFCA,...]0........=...s.s.....K..tssssP.p......ppp.3........94>..p{pepppqpc{so...^AFCA,...]0........:7=..s.s.....A..tssssm.p..

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2510.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:51:41 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Mon Oct 22 19:25:35 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):97280
                                                                        Entropy (8bit):4.977162636578716
                                                                        Encrypted:false
                                                                        SSDEEP:768:iR0jbfG0fYJfrpgAnVY7IfsUMXHwKY0/Oxlu7cimw:HbtfofTVxf/MXHwKY0/AuIi7
                                                                        MD5:896F8A0D7E194A0685F0955C6FCD724D
                                                                        SHA1:32AFD8CA6ADBFE20CB4D818F3C90FB4FD81BA04E
                                                                        SHA-256:9AA224A1B697BCC8292EA5FFDC9BAF52F81287B157EA48A230F60024631A4614
                                                                        SHA-512:BEC97B6CFF0656AC4F2AC8ABD20A4139C1B0E501AE69EF02840BD6DC9C0129D13BBBB19D2DCC19E41A342C18CC8726BE6BEB20A7BAB6391C95DA4310A0174026
                                                                        Malicious:false
                                                                        Preview:......................>.......................b...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.3.............................................................!.......................................................T.h.i.s.W.o.r.k.b.o.o.k................................................."......................................................._.V.B.A._.P.R.O.J.E.C.T.................................................................................................).......E.m.b.e.d.d.i.n.g. .2.2.....................................................%... ..............F.....P..

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2520.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 19:02:52 2007, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Fri May 16 18:49:41 2008, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):136704
                                                                        Entropy (8bit):5.122314043578528
                                                                        Encrypted:false
                                                                        SSDEEP:1536:xv1oKLyI9q8o4zTcb2UlgcWK+xTrz7axPzUsdiallTonTIn2:xv1oY3z7
                                                                        MD5:CEB12F669CCD7F4EECDA6E6526546E0F
                                                                        SHA1:0DD99622131222D076229E0F8C407F74625E1CAE
                                                                        SHA-256:9046CA568975FAD9DF681D3330D74EB9D0DA3649DD2D047E18578B91073B6F8A
                                                                        SHA-512:DCB2B77ABE0973ABC483B9248754E57CBBDBF9BA989B62CA4C200851B26C09B6C894C593FC14375E6FFEF93FE5A77B822FBC57A89E054A0866B4BB52508A9217
                                                                        Malicious:false
                                                                        Preview:......................>...........................................................P...........................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.4...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................U...........E.m.b.e.d.d.i.n.g. .3.1............................................."........... ..............F.......

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2600-1.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Certification of Inactive Status, Author: James Lell, Template: Normal.dot, Last Saved By: msteffens, Revision Number: 3, Name of Creating Application: Microsoft Word 10.0, Total Editing Time: 01:00, Last Printed: Wed Oct 15 21:58:00 2008, Create Time/Date: Thu Oct 16 12:01:00 2008, Last Saved Time/Date: Thu Oct 16 12:02:00 2008, Number of Pages: 1, Number of Words: 178, Number of Characters: 1019, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):180224
                                                                        Entropy (8bit):5.3712177177850355
                                                                        Encrypted:false
                                                                        SSDEEP:1536:+fpOF0kQmsMRT9CrDc0QrilK3dQKDj2MQCFju:8py0kQm9RT9CrFQXDj2gA
                                                                        MD5:AA19D7736F3EF3BC68B25908B726999A
                                                                        SHA1:3E2A28FA79CD93F0D47CD8E6FA9F09E8A2F12ED9
                                                                        SHA-256:FB22AB8A19306CF0CBC659A6353A22880960907DD5182A83A713C94DA95DBFC9
                                                                        SHA-512:D4510269FC2294B89C4AC530F2684F596953BDE1F5585576D2659ABE657BE436D08C2965343FB0A0713FEB09BF941FA203536E26E2805200124A835FC30C5242
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................:................................................................................................................................................................................................................................................................................................................................................................................................................................................d.....gdldd.dddddedddA..dd.fddddddde.dcddddtdA..dd.fddd<dddddddddddddddddddddddddddddddddddddddddd$dddddddddle.f.....cfkfffffffffffg.ffg.fffgfgfgfffffffffgfffffefffffffffgfffff.fffffgfgffff.7affffl7776777777_4afffffgf..........8....o..... ..hoooo}..."..............oooooo.s.....K..tssssQ.p......ppp~3........>...p{p.pppqpc{sn...^AECC^B,...]0........=...s.s.....O..tssssW.p......ppp` ...4..........p{p.pppqpc{sl...^AECC^B,...]#...7..........s.s.....K..tssssQ.p......ppp~$........>...p{p.p

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2600-2.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Certification of Inactive Status, Author: James Lell, Template: Normal.dot, Last Saved By: msteffens, Revision Number: 3, Name of Creating Application: Microsoft Word 10.0, Total Editing Time: 01:00, Last Printed: Wed Oct 15 21:58:00 2008, Create Time/Date: Thu Oct 16 12:02:00 2008, Last Saved Time/Date: Thu Oct 16 12:03:00 2008, Number of Pages: 1, Number of Words: 42, Number of Characters: 241, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):463360
                                                                        Entropy (8bit):4.580779504933828
                                                                        Encrypted:false
                                                                        SSDEEP:3072:Xx0kQm9RT0PhzfHiQ+z0kQm9RT0PhzfH7QKR50kQm9RT0PhzfHBQ:h4yRTAM4yRTAPr4yRTA
                                                                        MD5:3E283F1FD6FE821EF531355E09CD8FAC
                                                                        SHA1:DE14DF4F69EB7123F4CD2AFF72F093C6BBF7BDF5
                                                                        SHA-256:77EA4BF10E6EB2AB9F8C4A752D67A65F268C6D9F4501DABCEABD1B0E8236A714
                                                                        SHA-512:B256F3E0AC5282F399C7DDEC15E896FDEF25E73559A0630CC036EB3A849F9AEC22267776DA851E77B34950D0B6BAA0B273B72B63682D7D59EC24F88C853F2E1B
                                                                        Malicious:false
                                                                        Preview:......................>.......................7...........6...........................f...T...c.................................................................................................................................................................................................................................................................................................................................................................................................................................D.o.c.u.m.e.n.t.S.u.m.m.a.r.y.I.n.f.o.r.m.a.t.i.o.n...........8...............................................................E.m.b.e.d.d.i.n.g. .1.7........................................................................F......Nx./....Nx./................O.l.e.........................................................................................................................D.a.t.a.................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2600.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Certification of Inactive Status, Author: James Lell, Template: Normal.dot, Last Saved By: msteffens, Revision Number: 3, Name of Creating Application: Microsoft Word 10.0, Total Editing Time: 01:00, Last Printed: Wed Oct 15 21:58:00 2008, Create Time/Date: Thu Oct 16 12:01:00 2008, Last Saved Time/Date: Thu Oct 16 12:02:00 2008, Number of Pages: 1, Number of Words: 178, Number of Characters: 1019, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):646656
                                                                        Entropy (8bit):4.870802515688482
                                                                        Encrypted:false
                                                                        SSDEEP:3072:9n0kQm9RT0PhzfHtQfl0kQm9RT0PhzfHFQ+l0kQm9RT0PhzfHyQuU5pD0kQm9RTC:J4yRTAc4yRTAD4yRTAyU5h4yRTwrdOi
                                                                        MD5:0AF05A4650FDF343A9C13262E16F986E
                                                                        SHA1:9D7EDAFFC85356249BCABCC8A25B556E8615B36E
                                                                        SHA-256:C87F73A359565D04941EB305AF7C9FE5B4818F577CA1319F8B578B69F2E4A947
                                                                        SHA-512:C8FC8A1C1E3EBEA9927D0ACCD8A0C27D6F60F4A13E642DF894CE7387097D76B1F557B184A18DB80EDC7D7E50EF47BBAC65D8B35ACC349F415B9707698ACA69D2
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................a...............................%.................................................................................................................................................................................................................................................................................................................................................................................................................S.u.m.m.a.r.y.I.n.f.o.r.m.a.t.i.o.n...........................(.......!...........................................t.............D.o.c.u.m.e.n.t.S.u.m.m.a.r.y.I.n.f.o.r.m.a.t.i.o.n...........8...................................................l...........S.u.b.d.o.c.u.m.e.n.t. .7...................................................%..........................t./..@..t./..............C.o.n.t.e.n.t.s.........................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-4100.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Oct 16 21:17:12 2007, Create Time/Date: Tue Mar 18 18:48:47 2003, Last Saved Time/Date: Mon Oct 22 19:28:02 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):162304
                                                                        Entropy (8bit):4.830184722169816
                                                                        Encrypted:false
                                                                        SSDEEP:768:HIVX+tXppv5JZp8scM0UET/5r9//PSfdNI46B4yGUbV2fiWwhgVQwq+1o:HIVX+IJafdNH6B4yZbV2fiWwIq+1o
                                                                        MD5:B1056B83A838C1A1050782D8DE2B86FA
                                                                        SHA1:A813E6A224949231A9B9AB4E7B7F675125D25D47
                                                                        SHA-256:19F4FDA329AF5201897E76EB13A18FF469BB6C1C90D63679182A0E631C943026
                                                                        SHA-512:DD3A5E08193527DF583206CBAA51B2AE0BE6A428A5FF37FA6BC37BD08601BDB24238D5C615FAE54B47136D154E49B503D9A100034BAEE40125F43B2BDE68DAB9
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................0.........................SQL.....PdSMON.DLL....%Active Data (Field Definitions Only)....RD:\DEV\CR Code\Remote Filing App\Version 2004\CF_Remote\reports\2002\cro-4100.ttx..........cro-4100.ttx.............................................................0.........................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-4110.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: programmer, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue May 29 15:40:58 2007, Create Time/Date: Tue Mar 25 14:35:37 2003, Last Saved Time/Date: Mon Oct 22 20:27:11 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):116224
                                                                        Entropy (8bit):4.831635357966716
                                                                        Encrypted:false
                                                                        SSDEEP:768:FZMVR2jqTkOCsKswrOnHz9rm32Q3cpFHfuis3+nc:FVWTkOLKZraHzZmT3cpFHfur3+nc
                                                                        MD5:5379BC15FFA3C25789C420B782932967
                                                                        SHA1:E9C3245791ED044E567EA105AEBE066A3DD2DC66
                                                                        SHA-256:01B3854F730104522577E3BF28277EA5808DAE318690B7DF3F2934C382C957DC
                                                                        SHA-512:1E65192F90136EA88EFE3DD2F335FA5568538EA390DA7B1EAE50ACBCD4946590BD608AB4FF0D4A65BCBD2803AB6F3697CB966B09DA09433EF15E39017785696E
                                                                        Malicious:false
                                                                        Preview:......................>.......................v...............................y...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-4200.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Oct 16 21:22:03 2007, Create Time/Date: Tue Mar 18 18:49:06 2003, Last Saved Time/Date: Mon Oct 22 20:31:02 2007, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):222577
                                                                        Entropy (8bit):4.92535757129126
                                                                        Encrypted:false
                                                                        SSDEEP:3072:IfsIsefpkcEtHsDwC6Sag1Lo4cOfpkcUd3MDwC6SaXaoONv9tKAd0oNhzwcAS66p:kn
                                                                        MD5:7770B0334CFBBE2CAF0B823D0D73024E
                                                                        SHA1:38152A320F374F5115C0E4C4A249C4484D194CAB
                                                                        SHA-256:F3CB0021FC58775DF1965E1AA682EDD8B228991ACBE3C7ECBBB50872CDAC5032
                                                                        SHA-512:AF64DBBEE6A881D6C024CDC63B5C63A9DC7FC378B95D1FC3ECC61B421F9B3EDCE2715D5EA2F8C8290D96AACE5910561A12E7B6E8E2A6DE759989D3B97A999705
                                                                        Malicious:false
                                                                        Preview:......................>.......................................................T.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\7C02DA3A\CF_Remote.exe

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4243456
                                                                        Entropy (8bit):5.904631501447873
                                                                        Encrypted:false
                                                                        SSDEEP:98304:j24cB0pukTqkRXBpPw0l3mpkaL8vmN0sPVYaCKlOO5BRBwqyPQbgZ5WEVMRJT3VB:fcB0pukTqkRXBpPw0l3mpkaL8vmN0sPn
                                                                        MD5:8963AF52B51008AA64C0DFC38978E561
                                                                        SHA1:C76A9A66AFDB305791674B365B078B48343B7C98
                                                                        SHA-256:F8D68F5A2685B78B8AD9B7FF3C1BD720AFC1F337EAE521AB8AAB6ACB5E5337BE
                                                                        SHA-512:C2EF66D6AB3D075C706DCFC85B67DDDA7261A052B037B0E1854B64A9D58054503EB25214B62AFE565A9A7EDE8A981B280F4CCBCF253336000A7D42C3F6E19C06
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y....................................Rich............PE..L...a.ie..................@......... .........@...@...........................B.....{.@......................................{@.(.....A.~...................................................................(... .......d............................text....z@.......@................. ..`.data...`T....@.......@.............@....rsrc...~.....A.. ....@.............@..@..^............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\7C02DA3A\CF_Remote.exe.manifest

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):525
                                                                        Entropy (8bit):5.0713464478909565
                                                                        Encrypted:false
                                                                        SSDEEP:12:MMHdt4N5SgVQ9TNRRgAhxAQkrEHUi95Jz:Jdt4XSgOTNRyADAQkrEHUiDt
                                                                        MD5:E9CECB1E5CFDDF82CE102D096FC6DB92
                                                                        SHA1:EEA233E02455050A95B7AD30FA42E077ED473293
                                                                        SHA-256:499E0178C9C74ACC9DED7E9F66A99C2915C6ADEBF08D33907538180466D1535B
                                                                        SHA-512:B61B1B718B9FF3F84174E3BA8CC2B6F1135659AADDA8C0FE1CFE3561F206A1746C48F16DD669C7E36AC960B0A4B1404739DADED074956A7454B738E37E1D6F47
                                                                        Malicious:false
                                                                        Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">...<assemblyIdentity version="1.0.0.0".processorArchitecture="X86".name="ExeName".type="win32"/>...<description>elevate execution level</description>...<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">....<security>.....<requestedPrivileges>......<requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>.....</requestedPrivileges>....</security>...</trustInfo>..</assembly>

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\7C02DA3A\Campaign Finance Remote.chm

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:MS Windows HtmlHelp Data
                                                                        Category:dropped
                                                                        Size (bytes):302779
                                                                        Entropy (8bit):7.927639628283951
                                                                        Encrypted:false
                                                                        SSDEEP:6144:SVRZVBdxgL1ART/Q+4Ghr6qUeaLAOw6cxf8JYxjv029IDuuj7Y79d/wq5fgSk:SVXVBzWAtQDGtnUxAfx0JEtGDR/Yj/dU
                                                                        MD5:286D69BB312003FA01ECBCAF6587C7D5
                                                                        SHA1:C611D2D743FC45A5BC419D0A255DB4A174100F77
                                                                        SHA-256:F7EDE38A17EC24C0AFA54815DBEA222E17452C4A9A872B7FE462741B70199B6A
                                                                        SHA-512:07A9D2C6F327873C4B2836FD6F434B1012C13CEE3816594C43430B0CA356814AAF0CAE4B490FEF8D89ED51112C3BF2FC240A2AA03B7183D135903B7E9B03F384
                                                                        Malicious:false
                                                                        Preview:ITSF....`..................|.{.......".....|.{......."..`...............x.......T@.......@..............................ITSP....T...........................................j..].!......."..T...............PMGLV................/..../#BSSC...7../#IDXHDR....../#ITBITS..../#STRINGS..B..q./#SYSTEM..n.+./#TOPICS.....P./#URLSTR.....*./#URLTBL..P.H./#WINDOWS....L./$FIftiMain.....g./$OBJINST......./$WWAssociativeLinks/..../$WWAssociativeLinks/Property....../$WWKeywordLinks/..../$WWKeywordLinks/BTree..[..L./$WWKeywordLinks/Data...'.(./$WWKeywordLinks/Map...O.../$WWKeywordLinks/Property...i ./AccountTransferAdd.htm...B.~./AccountTransferDelete.htm...@.7./AccountTransferEdit.htm...m.+./AddingACandidateCommittee.htm..._.C,/AddingAElectioneeringCommunicationFiler.htm......'/AddingAIndependentExpenditureFiler.htm...".0%/AddingAIndependentExpenditurePAC.htm...7..#/AddingAJointCandidateCommittee.htm.....`&/AddingAJudicialCandidateCommittee.htm...".w./AddingALegalExpenseFund.htm...U.D./AddingAPAC

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\89A86E6C\contlist.rpt

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Revision Number: 19, Total Editing Time: 04:03:46, Last Saved Time/Date: Wed Mar 18 14:37:02 2009, Create Time/Date: Wed Jan 4 17:35:48 2006, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
                                                                        Category:dropped
                                                                        Size (bytes):45568
                                                                        Entropy (8bit):5.362863051604835
                                                                        Encrypted:false
                                                                        SSDEEP:384:dOOtOnXLo80Y31Q7yrelcg6BfJnuewBc18:dftOilH
                                                                        MD5:F333AB5364641E71074B186AAB1753BD
                                                                        SHA1:BD37BB9C3814C0B6CAFD478DD317C19FB35BB81F
                                                                        SHA-256:ECEB4597F02DBAC4C570E53EEFAA40D45862058609DCFF34B4E612CB5CA8E165
                                                                        SHA-512:8E0BF47C1FC1A55D0EC0D9BD435235EA3D8F66235DC075F5C32EDD46D9D03088A4743607C96F12D5C3E298F384CC14BB8D8094B912AC0B69F24A4A8872698C5A
                                                                        Malicious:false
                                                                        Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...............................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\B70202BD\EE5448BA\cf_data_empty.mdb

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Microsoft Access Database
                                                                        Category:dropped
                                                                        Size (bytes):4894720
                                                                        Entropy (8bit):2.4562849415129704
                                                                        Encrypted:false
                                                                        SSDEEP:6144:aduPCcaI/tlAIZ8Jo3Vw3QWjz3dwDQW8SypfZ3L1vLMqeFjFJJomc5S:xCF4tlAIK7IEEhOmcY
                                                                        MD5:FED4926EDE0F27BB72EFFFAC8FC55876
                                                                        SHA1:1136FC24FD788D3912F01B415A7A9CFD1A1C2E61
                                                                        SHA-256:EA2D8537CF76616D0EDA204F64E617A4989CC1AAF1C31B5F297400EFFADAB8E5
                                                                        SHA-512:162FB0823FC97AF70CDCB6CC0E617C2906D3EEF52440C5A76E577745407C0628D444FF7570ED9107DB1D632B356DAF7C3CE1BC9D86DD884D493BED311193684E
                                                                        Malicious:false
                                                                        Preview:....Standard Jet DB......n.b`..U.gr@?..~.....1.y..0...c...F...N.U.7g....(.)..`n:{6...MZ.C...3..y[..|*..|.........8..f_...$.g..'D...e....F.x....-b.T...4.0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\BA3E37E4\1517B7F7\CF_CR_control.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):53248
                                                                        Entropy (8bit):4.697011427073727
                                                                        Encrypted:false
                                                                        SSDEEP:768:O2D7zfksOUes48TUcv89F3/RtZ1i/I4496Ix5:O2Dffks8F3/N1i/IrN5
                                                                        MD5:6F1FABBAA954167A7EE0804799566C44
                                                                        SHA1:5FEF159646BA7E9027791F7A884D1171D2D7F306
                                                                        SHA-256:B366327146822DF33AE1ABF77EC056F5F93C51CF02AEAA538CDD693276E7CB8C
                                                                        SHA-512:C2EAC10E3D10DBCAB8F4F62E3CEA4D2D55A75DB9BAAC68B476BF4C7F25E31830D34879E759569E81C6FE3D42DDF1218E9E050FC6E1962DCA1B9F844780D91C6E
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f..........&......%.....$....Z'....Rich...................PE..L......C...........!.....p...P.......................................................3..............................0x.......r..(........"..................................................................`... .......4............................text....h.......p.................. ..`.data...............................@....rsrc....".......0..................@..@.reloc..............................@..B.$.>............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\BB709D56\1517B7F7\CF_Trans_bus.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):61440
                                                                        Entropy (8bit):5.145978013039395
                                                                        Encrypted:false
                                                                        SSDEEP:768:vuOmIzS+LDqxem3lIYd8f6Wt8JFyFqhH0:vuO5S+3qxemVY6WCFyK
                                                                        MD5:E457039B3F64986B7EC9CEE4B5E54ED1
                                                                        SHA1:6D102676A531F2E6735EFDC8709C2E8017850205
                                                                        SHA-256:DE69AE859C578FA7D9DB1C675A650573CF2B81B4E4292CD0E1CFC49435CB1371
                                                                        SHA-512:778329349FD3D97F3E6CCD4C3A4F3250DA76DE97435080E23363F905326B7ADF79B0C7F4899B5C393879875A3D8AC1245CD7E0218B44546758E7AA078F85730D
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................N....................2......Rich...................PE..L......C...........!.........@......................................................................................@...........(...........................................................................`... .......\............................text.............................. ..`.data...4...........................@....rsrc............ ..................@..@.reloc..............................@..B..:@............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\BED664EA\7204BF44\Crpaig80.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):622592
                                                                        Entropy (8bit):6.077970194897055
                                                                        Encrypted:false
                                                                        SSDEEP:12288:H31fVUPM+u1u6RS/olZNeQ1d6JjH/bldq8CMKtBBxSftKaXnDsju:7UP3u17xJ1cHrqTxGt9Xg
                                                                        MD5:48713A483F2C48ECE4AF4F098A13469F
                                                                        SHA1:D8F6BEDF737C52DA16B560E96DCE45889162D50B
                                                                        SHA-256:D6E26D47CC578B701FBB9491D8DC5B3CAB317FE92F447387905755AB8F2DC991
                                                                        SHA-512:2F01361C7B3D5326B2BC9D86DA47F49E98380DFA967C33E4DBB446C02278F412EDE5D9088F431E2E3EF3960E7F6F858C94F53F576CE3C87C2356FA7919758849
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X..c...c...c..o...c.,.m...c...i...c...g...c..p...c...b.=.c...S...c...R...c.h.e...c.P.g...c.Rich..c.........PE..L...8Y.<...........!.........p......U...............................................................................@...........d....`..|....................p..L.......................................................P............................text...V........................... ..`.rdata........... ..................@..@.data...<"...0... ...0..............@....rsrc...|....`.......P..............@..@.reloc.......p... ...`..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\C2C59FBE\1517B7F7\CF_File_Export.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):208896
                                                                        Entropy (8bit):5.44595307121718
                                                                        Encrypted:false
                                                                        SSDEEP:6144:LrsfggETxTPkLjo5OzzJ6ZrkTkFkwyVbKBJZZOp//:Re/
                                                                        MD5:C701584A3CE8290E70D71BD1B61A65D8
                                                                        SHA1:E33B28B6A41117E04F45A6A99B7C201DBBECA243
                                                                        SHA-256:696F40AF1C271E0D721F0F0E6223020051A5FCABF79C02E7BEA1193F55DAAA2D
                                                                        SHA-512:C0041AE2311F56D4C6868C30C2A190C1575B16DE94D12DFBAB439F03A138FC987845253B64621D6C7ADD23D7DDFFE2028354C45DC88A8C649B15946CD3CF49B2
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f..........&......%.....$....Z'....Rich...................PE..L.....M...........!.........P...............................................0.......c.............................. ...........(.......T.......................@...........................................`... ....................................text............................... ..`.data...............................@....rsrc...T........ ..................@..@.reloc........... ..................@..B...E............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\C4A3B122\34510A4\DAO2535.TLB

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):73184
                                                                        Entropy (8bit):5.1031501057723725
                                                                        Encrypted:false
                                                                        SSDEEP:768:qBTk6x6X4jwg6QttykgHGj+7RgazewxdgQlLZ6f152H/smzMGbRmHYGQSupZWye0:q/XjcegHbjEve/4e
                                                                        MD5:87A2ADF125BE51CDD5D8D3843E0F0B7E
                                                                        SHA1:F86F98587DC8193E197979714574AC127FDFB250
                                                                        SHA-256:6C6CFB4E9A8DC9A0E65630A6718A87D6E3F962D87F4836845D8023FBF87F640C
                                                                        SHA-512:7C9B5B1D3883D540E1A7A6CAB7C36509C59EC4766F91B79632B842269CE2349104F40B5E1D508A7D0AA713D8BD8C9F6797C82D2A73E0CFE0AABF1193E87D2ED8
                                                                        Malicious:false
                                                                        Preview:MSFT................Q...........L...............D...........0....... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...........h.......0...........\.......$...........P...........|.......D...........p.......8...........d.......,...........X....... ...........L...t................&.............. &...............%..............$ ............... ..............<&..............<(...6...........^...:..............H..............................h........................................................... !..D............................................................................................... !..................................................0............................................... !.....@...........................................H............................................... !.................................................h...................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\C7D8D83E\34510A4\SSubTmr6.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):40960
                                                                        Entropy (8bit):4.345293075550214
                                                                        Encrypted:false
                                                                        SSDEEP:768:vjBzwlSCIuAXEDsyPFHhOlLA57EkcAZnhtyFmNj:vLuAUocFHMlL07fRZPH
                                                                        MD5:DC7A3BC0FC185CD68848DC6F7D7B026B
                                                                        SHA1:C661CB1198F5E3927A67884E71CA95FF33026224
                                                                        SHA-256:6618B3AB331642449F0B07E4F39ABF9FC3BB90AE90B298F1B9FFD58CA5397399
                                                                        SHA-512:22C9B2B7930E9E442699E37F43944F7CB4CD2562ED8319B4341C59475FA8071B501F4908227378B7883930F14C3059F66531BF876B386DEA0027151B08006577
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.._>.._>.._>..."..^>......Z>......^>......^>..Rich_>..........PE..L.....3>...........!.....P...@...............`......................................_................................W.......S..(....p......................................................................X... ....................................text....H.......P.................. ..`.data........`.......`..............@....rsrc........p... ...p..............@..@.reloc..z...........................@..B'.};............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\C847D812\1835CB68\Cdo32.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):53248
                                                                        Entropy (8bit):5.118134691683147
                                                                        Encrypted:false
                                                                        SSDEEP:768:SbaGLiyxVx9+qtwWRnqZk0ca8lKLRT7vGUsbONP0B4s6r1BW:iLlx79+qtwWFqzrlT7vGUqONsFUO
                                                                        MD5:81C8142EED021D18D4ACCEEA8D950068
                                                                        SHA1:435173BAFE04157D0EC140B4F77E1C174A304911
                                                                        SHA-256:C86E55610D35F87CBB29A89ECD0B838C2710BADE0E772977FCEA336FDCFF6451
                                                                        SHA-512:4F169BC6011F8A23C6A71A6C6469EFB26A0ED24BBAA022FF153FC975E762C1FBBDB24D144E1A186ECF1792C353BB7B29E8970687DD333697CC19839B6B13E9D7
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H.3O..]...]...]...S...].Q.V...].Q.W...].Q.Y...]...V...]...Y...]...]...].Z.N...]...\.V.].n.N...].S.V...]...[...]...Y...].Rich..].........................PE..L....`l:...........!.....`...`....../k.......p.....A................................{8.......................................y.......................................................................................p...............................text....^.......`.................. ..`.rdata..R....p... ...p..............@..@.data...............................@....rsrc............ ..................@..@.reloc..2...........................@..B.$.>H....$.>U....v1?_....$.>j.....G?w....$.>....UA.<.....$.>............KERNEL32.dll.NTDLL.DLL.USER32.dll.ADVAPI32.dll.ole32.dll.OLEAUT32.dll.MSVCP60.dll.MSVCRT.dll............................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\C8E76B1B\1835CB68\u2lexch.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):28672
                                                                        Entropy (8bit):3.267042919287219
                                                                        Encrypted:false
                                                                        SSDEEP:384:KXcrE+FLvbmBhm1xgv/89aZ8EDQgeNQnKkG:KXc4+hvbehU2v/PZ8zQnKkG
                                                                        MD5:BBBC65FDFBE05CF8D64602D96D1CC73C
                                                                        SHA1:3AEDB477B3FCFE064998627DEC3F3E40F11C60D3
                                                                        SHA-256:6A0255417D2197E016BBCA41E3C8849CDE951F30C2168225D550B19A7C3C5DBF
                                                                        SHA-512:66526FBFC157984334C83C42B13DE2DD56C610DFA513637A5B4A9298B4F05AA4015C8532D640FD4A9524080D92B56A7D847575E0E48AB0513B1B66413F276FB1
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...ir..ir..ir...n..hr..ir..Nr...m..lr...R..kr...R..nr...t..hr...R..jr..Richir..................PE..L....Y.:...........!..... ...@.......).......0.....@.........................p.......6...............................3.......0..P....P.......................`..................................................D....0...............................text............ .................. ..`.rdata..^....0.......0..............@..@.data...,....@.......@..............@....rsrc........P.......P..............@..@.reloc..p....`.......`..............@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll......................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\C964AC44\1835CB68\u2lfinra.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):49152
                                                                        Entropy (8bit):5.717620044022021
                                                                        Encrypted:false
                                                                        SSDEEP:768:TuiZXiv6x2/PBTx30WGdoxJ3jiB9WQgK1JJ+Fo7YIi8E1u:Tupv6EZTx3CoxJRQDUoGE
                                                                        MD5:EEACE14739B3E836F44D661C0042F223
                                                                        SHA1:24F5967B7B12DA1ED343A73D723FE6FDFEA7F301
                                                                        SHA-256:11DF90CC11DFEA9D9D7F2DA22CFFEF805CE658F6AB3E2150861EEBF03D690CA1
                                                                        SHA-512:912FBB92B92A3A0BE65514FF13BEB6195A4631EFCDDE4231D48AA516DD59BAEC8D6FD125525B991A95D78B93EB0D6CE75C59D32A2463A83928ECEA8D1BDA5894
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........<...o...o...o9.o...o9.o...oR.o...o..o...o...o...o..o...o..o...o...o...o..o...oRich...o................PE..L....Y.:...........!.....`...p......y .......p.....@................................_g...............................|..[....v..<...............................................................................D....p...............................text...._.......`.................. ..`.rdata..[....p.......p..............@..@.data....<....... ..................@....rsrc...............................@..@.reloc..L...........................@..B.$.> ....$.>-....v1?7...........KERNEL32.dll.NTDLL.DLL.USER32.dll.......................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\CBB1E6D9\1517B7F7\CF_Transaction.ocx

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):49152
                                                                        Entropy (8bit):4.429834468814966
                                                                        Encrypted:false
                                                                        SSDEEP:768:slkL9UsJCrigg6oh+D4w/yYTfRRCe0FR:saavE+j/yeffL0v
                                                                        MD5:EB4C26E80D3B38124E657E309F266670
                                                                        SHA1:B99894894AB502473975E72FD18EAFCE0E9D710C
                                                                        SHA-256:E5C8A078A4820D2DD959BE32FD0DF50F82522F8DF1C8558DC90C5AF1EAB84409
                                                                        SHA-512:D53B79D792DF4109DD0D45691F4B646109D72C84C0E6732A2431C112B47FA892124C37B4A6E7D1776189DD88CCAA683CA33A42BA246E0E73C1B18F35A667CD26
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y{N... ... ... ....... .R8)... ..9-... ..:$... .Rich.. .........PE..L....?`@...........!.....p...P.......................................................e...............................w.......q..(.......8...................................................................X... .......|............................text....h.......p.................. ..`.data...|...........................@....rsrc...8........ ..................@..@.reloc..h...........................@..B'.};............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\CE1E931F\7204BF44\sscsdk80.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1179648
                                                                        Entropy (8bit):6.521473588938597
                                                                        Encrypted:false
                                                                        SSDEEP:24576:Xm2hiJswkzSpq5Z3jVecFRe+2x3sK6Ms203zviblO8kqO5NnibsBfhUy:X8kQsIOvfhUy
                                                                        MD5:D2D3AB42E0FB3AFA8FF6AA9E965D9595
                                                                        SHA1:34F244003EF1D43209823CDD946F801AE7A85466
                                                                        SHA-256:5AC379FCFBDA3F8DB51CA02BE2C509BD057F17690359F09D4CBB292A67572D6A
                                                                        SHA-512:80D468D7495C44988FB655E824575C0DA5ED38FD8A88141FDED106029057E66609CA2E1FF3BA55B0D429FFD737E401F32857A3C92EBCC2ADF97D0B8C49EFEC76
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w..q3.r"3.r"3.r"n.y"0.r"..|"..r"n.x"..r"Q.a"?.r"3.s"5.r"3.r"5.r"..p"7.r"l.y"#.r"l.x"..r"..t"2.r".v"2.r"Rich3.r"........PE..L...R(i>...........!.........@......<......................................................................................$........P..`$.......................b...................................................................................text............................... ..`.rdata..............................@..@.data..............................@....rsrc...`$...P...0...`..............@..@.reloc..^o.......p..................@..B................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\D25B4F4E\7204BF44\CRBAS15.DLL

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):307200
                                                                        Entropy (8bit):6.383146474711384
                                                                        Encrypted:false
                                                                        SSDEEP:6144:mzdLJkXstL6iKvwzVLb34armOHi7+m463cG/CzQYQ8rk4TCmiSippnec:mxJkXWL6iKvwzVLb34armOHi7+oXzff6
                                                                        MD5:FD64262820E74C63BB0D97061776C234
                                                                        SHA1:28FC641E0154BCFDF383EDB9D28245F2873E4A12
                                                                        SHA-256:2AE2BC42BC655010F11C2686EE4C318F07D6C1CF3EBC79A8E1FBDB57A49A2CC4
                                                                        SHA-512:C26D4400EB99A425C886C1707D00A87018D4B0375FCFF39F127DC8CD26DA5114D73233868B99317C7415366D9B26D861DE321110F0F14E31623560A7F0F66826
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?..l{.{?{.{?{.{?..w?z.{?{.{?z.{?..h?..{?..u?z.{?..q?..{?{.z?..{?..p?W.{?..}?z.{?...?}.{?Rich{.{?................PE..L... .t9...........!.....@...`......./.......P.....(....................................................................\......d....`.......................p...4...................................................P..4............................text....4.......@.................. ..`.rdata......P.......P..............@..@.data....V.......`..................@....rsrc........`.......`..............@..@.reloc..N8...p...@...p..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\D4B1A979\1835CB68\u2l2000.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):24576
                                                                        Entropy (8bit):2.0998953021911198
                                                                        Encrypted:false
                                                                        SSDEEP:96:rIzc50xqjhJtVyhbHxXoCcRXTTpQidqDJpAmJq+QGCGYmotqDMhoDp0LNf:rB5DXwVxXRc9TpQikDDAmJ5QcDMz
                                                                        MD5:3DEE1017263C8973FB882989858A5C2F
                                                                        SHA1:819B77196B265FE25E12BC26B8298C2B20DFF5A7
                                                                        SHA-256:5D64F25968DD379EC2E4C463D0F181463AD7EF476B03D7BA4C730A08FCF8ACD8
                                                                        SHA-512:4557B400B2D8E29B6F82D1F32F74A71E64FC21C45CD9B42BD8976C5BF4811A272FFDC703A7C213DF84EAE0C81239EEFD0EFACFC35392A51D47BF1F7FC49ECABE
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................j................................Rich..........................PE..L....Y.:...........!.........@............... .....@.........................`......................................."..F.... ..P....@..0....................P..................................................D.... ..d............................text...T........................... ..`.rdata..&.... ....... ..............@..@.data........0.......0..............@....rsrc...0....@.......@..............@..@.reloc..~....P.......P..............@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll..............................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\D63D429\1517B7F7\CF_document_bus.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):262144
                                                                        Entropy (8bit):5.864729781432924
                                                                        Encrypted:false
                                                                        SSDEEP:3072:Nu9TYaMJzIOmFRfnCQuNtybMx8j0vZNSv:49fMJOFR+3ybMxE0hNSv
                                                                        MD5:962A83A511ECDB73EA9AC8B00036B898
                                                                        SHA1:5DA22EBDA48F16D2A77B778F4672CD94B924D198
                                                                        SHA-256:CA7EFD83EF71B00F9203490309278A7EABFA019DA955DB35A5DF7DF203B91BE4
                                                                        SHA-512:93547C27A4ECB1DB99C5AF0C48911D7F1D9246F72A9E395FD2EEFC25EFDA109B873E17DCD4A12542CFC5211F7BB25BEBB93135434BBF6A6F5892E9F4A71F943E
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Vy..7...7...7...+...7.......7.......7..n....7..Rich.7..........................PE..L...t.Nc...........!..... ..........h'.......0...................................................................... +.......#..(....@...f.......................D..........................................h... ....................................text............ .................. ..`.data...p....0.......0..............@....rsrc....f...@...p...@..............@..@.reloc...L.......P..................@..B..^............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\D71275EF\1517B7F7\CF_org_bus.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):970752
                                                                        Entropy (8bit):6.069974860037566
                                                                        Encrypted:false
                                                                        SSDEEP:6144:cOF/1nEiJcDvsRjMEunILaC1rdodjiSLYOxxe1AUVrTc:FrnEieDExDLaC5dQBLYOxxXUxc
                                                                        MD5:F4C3228B8EFF49592EE2B8C303CD2E40
                                                                        SHA1:A343B1278B73D8EE635A76872FE83928CC29CC5E
                                                                        SHA-256:1CF1C86CCC0DC864EACDA1481C85CD8D75F2EFF58BAE04C4A1DE2ED1BA8BF133
                                                                        SHA-512:89CC58E9039C13EB6CEA1E775ECB40E828DEEFDD3B94BE9CD15BFE21B4FC8428EE3FD6EA772976B76AD78551DFCEDF6D624E1A49D6C31A97CC310B5EF748B00E
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#O..M...M...M.Z.C...M...D...M...@...M.&.I...M.Rich..M.........................PE..L.....]...........!..... ..........Ta.......0......................................t_..............................p'..........(....`...Z..................................................................h... ....................................text............ .................. ..`.data.... ...0.......0..............@....rsrc....Z...`...`...@..............@..@.reloc..B+.......0..................@..Bl.[J............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\D77E7C08\7204BF44\crwrap32.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):66560
                                                                        Entropy (8bit):5.764637632023211
                                                                        Encrypted:false
                                                                        SSDEEP:1536:5a/5Ni0La7Q4JpxsxrkVE55QbK/kglgp8P7M:k/580La7jJpqxrk4/LlgKPo
                                                                        MD5:6AF7E771B815A4CEBCB57214B049CE52
                                                                        SHA1:99935155D7C4E5693884F1E46955180437070296
                                                                        SHA-256:F87575DB6FFCBE1C170A803EA3979D9885A4F13665BCE5DA44FEF5199A9C82B7
                                                                        SHA-512:F7765C85F2A5517B2974F26B06794D154F75E8F66589045C6DEEFA99CFF65C6406630A45F057CA1A696AA65B40463E137338C2F1CB4AA047099C3B1B2D7D9F7D
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............`..O.....L.....Rich...........PE..L....T.8...........!................`:............nB.................................M.................................._...p...P....`.......................p..........................................................4............................text.............................. ..`.rdata..?...........................@..@.data...........:..................@....rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\DAE69E8\7204BF44\craxdrt.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5206077
                                                                        Entropy (8bit):6.315774370780597
                                                                        Encrypted:false
                                                                        SSDEEP:98304:LSZEWBxyRHvEK6Y/aZ8HhzAhCpmwks9XiyINsv:8zoRHvE8/i0wzwlssv
                                                                        MD5:557903CB9179A5A8CFA6B852049E3884
                                                                        SHA1:CDB5AEDA1D9E08E9A3AEE6CA58E0542571050680
                                                                        SHA-256:F4E3E3B0699A3F80B7911C64AB17A74F8018B456DCA94A4F5F936B7A7F268466
                                                                        SHA-512:77537EACF5D8204C998FA3731FB345C2439DE5672D5C256520BC731F8A8C4937E7F7D7E3A42BFD79E7E401375083F7E5706A24AB97B1D3E1FCEFD9F252AC39FF
                                                                        Malicious:false
                                                                        Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.............C...C...C..C...C..C...C..C...C...C...C..C...C...C...C...C...C...C...C...C...C..C...C..C...C...C3..Cl..C...Cl..C..C...C...C...C...CT..C...Cl..C...CRich...C........................PE..L.....g>...........!......4..@......cS1.......4...............................O......................................*=.....p.=.......?.......................K..w....4...............................................4.|............................text.....4.......4................. ..`.rdata........4.......4.............@..@.data........@=.. ...@=.............@..._CODE...P*....>..0...`>.............@....rsrc.........?.......>.............@..@.reloc..2.....K......pK.............@..B................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\DC878553\34510A4\AtalaImaging.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1224704
                                                                        Entropy (8bit):6.559778036335788
                                                                        Encrypted:false
                                                                        SSDEEP:24576:wN1DzA5ePgWwS2zmQjyO2M/U1uW0PysgrG00mvwREQhi7VxT1ZOSw:yDz3PgYnQjXFKrk/EQujTXOSw
                                                                        MD5:9AD69E823BBB916012E6188E4A3FCA98
                                                                        SHA1:A21BC401A64B503639581DBC493660E00BCB3F64
                                                                        SHA-256:1F54E088CE730AC08B7DF8C28DEBBC89F354713602ED9E7C260252167588E940
                                                                        SHA-512:1E8D8F27DAE11ED4068B3E8F6EB1E842EEA38CF58964E0559E9B5020709891C67A5B40BD5A3A2C6A5A41CCFE1C70B2755B1C6A5284BA8ECB77251D8FEC112919
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S...2...2...2...:...2...>...2...:...2..H:...2...2..\2...>...3...>...2...>...2..'9...2...>...2..Rich.2..........PE..L....@B...........!.....0...................@.......................................................@..............p...|A......d....0.......................@...m......................................H............@..@............................text...j).......0.................. ..`.rdata......@.......@..............@..@.data....H.......0..................@....rsrc........0......................@..@.reloc......@....... ..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\DCDC5FB4\1517B7F7\CF_File_Import.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):102400
                                                                        Entropy (8bit):5.455894620968054
                                                                        Encrypted:false
                                                                        SSDEEP:3072:FsIW2IQ7o+58dXtUaBFgl2LMxCq14vzVsjkwg3j+KsOpDdaX4GwXHnCTzAbgRunW:FsFQ7o+58TUaPgl2LMxCq14vzVsjkwgD
                                                                        MD5:D3EB6533ABBC9ED6EBB4CE6357610C49
                                                                        SHA1:F5FF9C94094B7521507F0A982BC85C417D7B0CB8
                                                                        SHA-256:B50E896328C2C432FE8E1F03A55FEDE9DE4A83616B3A3256A2476945BE6C3F12
                                                                        SHA-512:D17D4EA44645FE1F9B46F6770AAA6B6E22277702EF00D3C57C1A09F98EADCB72A5BFDC1078DA88C41042A5B9B90E2385DB63CC16B70DA74BD22911493D0246E7
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Mo.................F,....?(..........Rich...................PE..L..."r.V...........!.....0...P...............@.......................................................................0.......*..(....P..P....................p..<...........................................`... .......L............................text...+!.......0.................. ..`.data........@.......@..............@....rsrc...P....P... ...P..............@..@.reloc..`....p... ...p..............@..Bl.[J............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\DD3D7189\34510A4\COMCT332.OCX

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):415176
                                                                        Entropy (8bit):5.974954032052747
                                                                        Encrypted:false
                                                                        SSDEEP:6144:dLIXG/SBt0iiVoY/pWEKDzPJxPPUIK1qDqNw:gG/vCY/M5hM8q6
                                                                        MD5:821AB1F1CF9904CB9026C686F13F0F05
                                                                        SHA1:398F64C00B026D1C6D94A6EFD180F20C010F5EE9
                                                                        SHA-256:332E6A1CB4BF722092F9E774ECC14ACDDBF95A9655BEA021681B11AAC37AC716
                                                                        SHA-512:D63C0FACD14ADFCA4E7E1E6D99D1FD1C2BE89C2C03E9835C506418A6A3FACB745888062BDF97CDAB0AD67CC8BCCB385AE10955F58150D9C4AC4A7C61E5C1E559
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r...6..6..6.....7..y..&..2..7.....7..Rich6..........................PE..L....D.9...........!.....`...........L.......p.....(.........................p......................................pn.......c..(.......Xg...........@....... ..|C..........................................h... .......X............................text...._.......`.................. ..`.data....7...p.......p..............@....rsrc...Xg.......p..................@..@.reloc..4L... ...P..................@..B.A.9............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\DF17326D\1835CB68\Crxlat32.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):24576
                                                                        Entropy (8bit):1.7494209933404663
                                                                        Encrypted:false
                                                                        SSDEEP:96:ejTU6VrXNd5zIrxKnlPJvBCaWNWpUi8par5VqxQDhoK/+YiyhotqG0hoN:ejTU6pP8rYTvCu8pcSQDxwyjG0
                                                                        MD5:449045FAE688D76B18624FE566E32A54
                                                                        SHA1:EA98B0853BA3A310362C43FA9F619238E7CAF947
                                                                        SHA-256:5343CCFE98B12E0D9B064A9AC7291E17086C5853D40E8BC2AEFAADAA09113F67
                                                                        SHA-512:7C366DA72221E9FB01D9927970B7539F89232CD77CD0C3C5C8ADEFF0203D68DD811AFFCA3E198941F28121B0ACEB212459EA8077CF7F5D65D5AC9D2F4BE647EA
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@..!...!...!..*=...!..V....!...>...!...!...!..V....!..n'...!..V....!..Rich.!..........................PE..L...7..9...........!.........@............... ....V@.........................`.......G..............................0"..U.... ..<....@.......................P..................................................0.... ..P............................text...v........................... ..`.rdata....... ....... ..............@..@.data...h....0.......0..............@....rsrc........@.......@..............@..@.reloc..&....P.......P..............@..B.$.>.....$.>%...........KERNEL32.dll.MSVCRT.dll.................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\E04462E5\1517B7F7\CF_Report_Verify_bus.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):126976
                                                                        Entropy (8bit):5.428325754445499
                                                                        Encrypted:false
                                                                        SSDEEP:1536:WsF6hjb3IfW+SSzXFc+20WTCWADW0C90Qpi3UMDhHyj1oVU:7SjDcRSSzXFc+20GC9C90ki3vDUgU
                                                                        MD5:AF80415CDC8AD1D8304FE8E1645743D2
                                                                        SHA1:89F256E9280AF6159D89D0CC0289C7509C0AE735
                                                                        SHA-256:AAB949FF5B13E7FFD8DD89D6DCAA491320DCBCFAD42B044D6988868304538DA1
                                                                        SHA-512:41DF6C4F76373588873B230A9BA63D5DE0624D14F1CE970ED30B3E6C1FBE153A32A171BB520FC4DF042DDA011F23CEF648EFB9F916D01E30E81C09F11CEE3E1D
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........AN. .. .. ..<... ...).. ...-.. .~.$.. .Rich. .................PE..L......`...........!.....`...................p.....................................................................0c......d\..(........@..................................................................`... ....................................text....S.......`.................. ..`.data...x....p.......p..............@....rsrc....@.......P..................@..@.reloc........... ..................@..B..^............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\E2BBEE13\1835CB68\p2ixbse.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):245760
                                                                        Entropy (8bit):6.5511171261787196
                                                                        Encrypted:false
                                                                        SSDEEP:3072:awe+BmVTUODP/IcpBxWeZlHEphpV9K8yKD4PtBeGiXdMj5Cn:tHBmdUODP/IcpBcCNEphLK5k
                                                                        MD5:B4748AEEB6EDF8C05123B6542A2BE350
                                                                        SHA1:F7165A96833C5ED0A30D15492499FC9DCFD998AF
                                                                        SHA-256:527093225D1B40925B19A3100E305513AD94D1461ECA862B6D4D9642EA0B6885
                                                                        SHA-512:380C9EE7DC5F32563BDBB0D66A25BD7249F91902299B6CECAA4DCBB04564FCA98B95132E9154CE6082A183A1116094120A7325754A9F5EFCB08866FB05C58303
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s..7...7...7...L...2......4..............C..........n..2...7...S......?.....6.....6...Rich7...........................PE..L....Y.:...........!.........`....................h@................................I...........................................<.......`$.......................8..............................................D.......d............................text...T~.......................... ..`.rdata..S........ ..................@..@.data...p...........................@....rsrc...`$.......0...P..............@..@.reloc...?.......@..................@..B.$.> ....$.>-....v1?7...........KERNEL32.dll.NTDLL.DLL.USER32.dll.......................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\E3BD0475\1517B7F7\LogFile.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):28672
                                                                        Entropy (8bit):3.485382050322971
                                                                        Encrypted:false
                                                                        SSDEEP:192:i9NOy89Skl9gzr3HUZTNzEOsrt/V8Rhfv67fSryIAuAhqLaPXGOS:i9NOGFH3HYTNzjsrt/V8vOSryShLaP/
                                                                        MD5:BB46C0B126E28AED97D3DDFC96BE0902
                                                                        SHA1:BAAA2A2CE2BA8563E4F6298A9EE2BF5D38D1AB2F
                                                                        SHA-256:BB2469FC8087D0CF223E2344525A8FC536CF2CCEBC213F43F765FFAFEE44729E
                                                                        SHA-512:747C578E3D44ACDF079693A8887EB898A6A213DD190AE98FECC348EAA371772F4BC98BE4C195F0C5A68BDB38EEB3D9F57B81189E46E284551B10F7F7664EA643
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k!../@../@../@...\...@..`b...@...f...@...`...@..Rich/@..................PE..L......B...........!.....0...0......l........@...............................p......&h..............................P8.......3..(....P..4....................`..............................................`... ....................................text....(.......0.................. ..`.data...H....@.......@..............@....rsrc...4....P.......P..............@..@.reloc.......`.......`..............@..B..:@............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\E76BBEDE\7204BF44\crviewer.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):734504
                                                                        Entropy (8bit):6.288077088983874
                                                                        Encrypted:false
                                                                        SSDEEP:12288:nLC3ZqLXl9ZZVvBMISsHHGg17SnXR2HKg/AggAVKBHFEWl:nLIZKXfVvGaGg1mnX8agDy2Wl
                                                                        MD5:7AADDC7C334AE959674073439FA92FE3
                                                                        SHA1:ABFD7C6ACCE89009D85C619E91010C307E2C06FA
                                                                        SHA-256:C0DB8920AC1E460EE34313829245D2F05F2D71617C69F6B568C5C921747E62F2
                                                                        SHA-512:FB0BDC3B495C3541AA5DF5D50C020A377F7C024727C95953984B2DA184091AD0FDE9D2B03D7E5AA2D86C8F454EA484ED16741353123E23CC8D9A35624139A277
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O.u...&...&...&.2.&...&^2.&...&.1.&...&.1.&J..&...&...&.1.&...&51.&...&...&...&...&./.&.1.&...&...&...&.(.&...&"..&...&Rich...&................PE..L...'.G>...........!................Q..............`.........................P.......|..............................P.......$........`..pE..........@ ...........v.......................................................... ........................text............................... ..`.rdata..............................@..@.data............p..................@....rsrc...pE...`...P...0..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\EABD308B\1835CB68\u2dnotes.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):53248
                                                                        Entropy (8bit):5.320336268402508
                                                                        Encrypted:false
                                                                        SSDEEP:1536:MnYrP/rZDN5Cz6y9LUXlnsiUG3eJ/TdY9G:tXrZDazf0lsLY
                                                                        MD5:FE8A13548CB544D484496B67D7D6589B
                                                                        SHA1:933C66BA98D6090E14E04DB3264D674D4C14921D
                                                                        SHA-256:B351DCFBFE03D00A688C488046830D1178A06E6CA86D581388250259098C0C11
                                                                        SHA-512:73FEB19916CC5E25B591D5B197AA38E9DEABBCA71A559A5AEA47DB73E9461E720F0674D2A757026E2076B5A0E67F8460B42278084C614E7EA7918023EEDAC785
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\.Y.=...=...=..Z!...=..&....=...=...=..."...=...!...=.......=.......=...;...=..&....=..Rich.=..........PE..L.....`;...........!.........P............................................................................................h...P.......................................................................................8............................text....x.......................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc..d...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\ED7284FA\1517B7F7\CF_report_export_bus.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):143360
                                                                        Entropy (8bit):5.181324418041009
                                                                        Encrypted:false
                                                                        SSDEEP:1536:0azJfbOWDflv3L92tgdvy3SGBQESCI1IzpISZ6Vz6wQ/WN5kNM:08pCWD5+GvsSvCI1IuSMpVQ4k
                                                                        MD5:D11EE0F19F05D867D8A2D8B5AA4EA94C
                                                                        SHA1:2300ED6EF1859D0ECACFB5B0D8020BB4098563F2
                                                                        SHA-256:2558BB08A4AACE37A4FDB667766F0D93D368BD0100C429854CA40AC7DBECD3BE
                                                                        SHA-512:6009BBCC8B25C9F4CDA822905051B7B6F037625E04559FD8E2CCE1CBA33579D8600A5A8921A9FA560F15CCB086292D89C6DC5B5D2C5045EC58AA4469886AC39D
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k!../@../@../@...\...@..`b...@...f...@...`...@..Rich/@..................PE..L.....ET...........!.........P......0........................................0......lD..........................................(...........................................................................`... .......d............................text............................... ..`.data...X...........................@....rsrc............ ..................@..@.reloc..n........ ..................@..Bl.[J............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\EEBF1E87\7204BF44\exlate32.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):675897
                                                                        Entropy (8bit):6.33183612141127
                                                                        Encrypted:false
                                                                        SSDEEP:6144:szNfL5Tx1o6Ky/9vCgchDAhy6Q0KQ7a3spjQ91fsu6UyepsMtt2+cH9ofSNXczFw:sDR5y0hy6aOa3spjQ9lmMEoqxchYIo
                                                                        MD5:CD98432FDB8E13C7C5A940C01D3CCE77
                                                                        SHA1:B4C5C3979883252DDBD4534CBB09F2D80F82F3D3
                                                                        SHA-256:86C6FFBC5463F3A3410BA18B192556BE39ACC1D99CEC94783A5A9A38610B3CC4
                                                                        SHA-512:1AC21A31E613C6D3D0518B3A497364BBEFFB33439F21A8D83A62D25123F4EBCA3A8D3BEF371B09187027BD5D84BBB9DEF7942FDB6B1A51A91F7F426BF1009A54
                                                                        Malicious:false
                                                                        Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$........=Y.V\7.V\7.V\7.C<.U\7.-@;.T\7..C$.U\7.V\7.Q\7.9C<.U\7..@9.U\7.9C=.R\7.9C3.T\7./}<.U\7./}3.T\7.|<.Z\7.|=..\7.V\6.^7.4C$.E\7.P.=.T\7.P.<.y\7.Z1.W\7.|3.W\7.RichV\7.........................PE..L...e6.?...........!.........`...............................................`.......................................D......$6...................................T...........................................................5..@....................text...N........................... ..`.rdata...U.......`..................@..@.data........P.......P..............@..._CODE...p...........................@....rsrc...............................@..@.reloc..p...........................@..B................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\F0E0F85C\1517B7F7\cf_rpt_link_bus.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):204800
                                                                        Entropy (8bit):5.6625050399442545
                                                                        Encrypted:false
                                                                        SSDEEP:1536:WFBHOaDV8SWAqRfU4R1PEgItQQN6sVB0TfJaoEGzAfNuyxPAhX6ORnKNmvzcrGjn:WpVZ8F+xuJ3AF5mnKNawrGjn
                                                                        MD5:79381368BC9D996F6F4722D85FEC175F
                                                                        SHA1:C28C7738636FF10DE781A6C87137F48335EE9F1C
                                                                        SHA-256:618FF68ED9141B5A17506B08EF1378B29E5A14D7ECBD98577236139A521D7C62
                                                                        SHA-512:4F1B94F62E63968DFB83BA77047868851BF6F8F48FBC6CA5850AC8077FC7D4F00F733816EC04B3DCA4D9C3E9755B49C51AB7EABAECBF9F230EAFDFE7C2B2413A
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......i..-..-..-.....,..b..$..)..,....,..Rich-..........PE..L......M...........!.....p........... ....................................... ......................................`q.......k..(.......8L......................T0..........................................X... .......h............................text....b.......p.................. ..`.data...............................@....rsrc...8L.......P..................@..@.reloc..07.......@..................@..B...E............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\F7CFC206\7204BF44\Implode.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):18944
                                                                        Entropy (8bit):6.082251537771566
                                                                        Encrypted:false
                                                                        SSDEEP:192:Isp6yEkGeVt7mdxy6BhUDwDBEKhixWPGqLukwRWxlRYlRXwHV1UBoN4GI6slUx:Vp6yGeVABrKcb7hjYjXwHHU04GJso
                                                                        MD5:0A0324A4282DF0F2C3129E5BD84077BC
                                                                        SHA1:5A4FB357AD6A245F75213C5F5593AB8F57E613DF
                                                                        SHA-256:11B4C417769C5C4729165C8CA0567F7D3B06D4B82998AB297D59ADBAD9F74D5F
                                                                        SHA-512:6074AE20F520449B5F3842F866BB8455B16E488C6D81BFBF898844C821D35EFC036B4DEEB9600502A54287050FE392BDA533FEB112B8A593F30CE779D1045646
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...-..2...........!...2.$...".......".......@....(%...................................................................h....p.......................................................................................................................text...?#.......$.................. ..`.bss....$....@...........................data........P.......(..............@....idata.......p.......>..............@....edata..h............@..............@..@.rsrc................B..............@....reloc.. ............F..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\FAAEA181\7204BF44\ExportModeller.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):294912
                                                                        Entropy (8bit):6.112628297874781
                                                                        Encrypted:false
                                                                        SSDEEP:3072:I5BjEZYf0mpCQWkmQFkC7SmmNLT1uEfhuVQA6nBgvWKwnvOtzC/8gfPACQ1pH2pE:zYf0mpC3kdFkC7SLLsmA6ESubhD+TU
                                                                        MD5:70B34D924E4DBA93BDB051C50B76A935
                                                                        SHA1:F3E1B375A577585F89482A78ACBCD92D3CC37796
                                                                        SHA-256:80E70DFB52DF7F6DEE86C1DC174799FAC4E189550ED9E0B07AEB26F29E072F40
                                                                        SHA-512:124584D8857A604C6B4026C36150074AFB3760893E464A5B2323551BD1E385D763A7FF2E5F5ACAA265AEEB766C08F486673BC9C13ADB53F9EBC03C380AF5C7D5
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=..uy..&y..&y..&...&...&...&l..&...&v..&x..&{..&y..&x..&/..&s..&...&p..&y..&...&&..&_..&...&x..&...&x..&Richy..&................PE..L...y.R;...........!.................................................................................................3.......+..........p....................@..$9...................................................................................text............................... ..`.rdata..[...........................@..@.data....O...@...@...@..............@....rsrc...p...........................@..@.reloc...H...@...P...0..............@..B........................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\FBA4A636\1835CB68\p2lodbc.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):135168
                                                                        Entropy (8bit):5.712557269847559
                                                                        Encrypted:false
                                                                        SSDEEP:1536:yOHs9nZRvH2PP034ynzO8i9smTlTrHi1w9rDQtztKZChBohB1DcXvvhdBJ1Q:1WPvH2P7yzOJ9zTrHi1w9nQBzKWXvz5
                                                                        MD5:23D3B53421DB2010647BB2379292863E
                                                                        SHA1:49220E4A10E20876CB896DB389345C7B6A9333CE
                                                                        SHA-256:B8CBBA9370F4011891B8DAEF34438DC3E3EF2EE9297D3C207FFE3F5ED380A024
                                                                        SHA-512:8DF554AB0509BFD7B755342E6C78DC4DB7CFAA9D5C42439052EAFECF8853D5753B8975E8B214B75A46DE2C4FF973F8C93F5C358C29158D707F2544FF3901148D
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x@....................,.......P.......,.......T.......................................,.......Rich............................PE..L......<...........!.........p......................................................................................@.......`...x....................................................................................................................text...H........................... ..`.rdata..............................@..@.data............ ..................@....rsrc............ ..................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\FCE647BF\1835CB68\u2ldts.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):24576
                                                                        Entropy (8bit):1.3865196823068335
                                                                        Encrypted:false
                                                                        SSDEEP:96:pvhwqwhJhOjVYee/c5T3mqlh+RIQYcHYmotqYnhoajt5:AqwhJhOBYZ/Q6qT+aQbYnJjt
                                                                        MD5:965D0761E6321DB219C4DA55DE285278
                                                                        SHA1:D36E872C3D44FE152B1707A57D6165F09275C800
                                                                        SHA-256:B61529675C236BE1824D6779C8ECE1363A9BA5470B6F171ACFFBF7009ECEC83F
                                                                        SHA-512:5B321F47D03919C5B77853E8BFFF4BC4D5627FD40E069B693EA259048331BB62A14D9D457A1782E208D0692EEDAC34CB72EA118B6A158DAC7E3D74DDBE159841
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y./.=.A.=.A.=.A...O.<.A.=.@.1.A._.R.>.A...K.:.A...G.<.A...E.>.A.Rich=.A.........................PE..L....Y.:...........!.........@............... .....@.........................`.......N..............................P!..Y...` ..<....@.......................P..................................................0.... ..0............................text...T........................... ..`.rdata....... ....... ..............@..@.data........0.......0..............@....rsrc........@.......@..............@..@.reloc.......P.......P..............@..B.v1?.....$.>#...........USER32.dll.MSVCRT.dll...........................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\FE57A718\1517B7F7\CF_DB_Connect.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):73728
                                                                        Entropy (8bit):5.0754106893091615
                                                                        Encrypted:false
                                                                        SSDEEP:768:L8YJkGS97VlcvFGHstC7jrJQR8fT+VoiAz+Gyzkza0+CH8BC+JoEJo:L8iWRy4cKfae3+NzkW0dcBFJxJ
                                                                        MD5:68D168F9E83DFAB14AA6D907290E2E15
                                                                        SHA1:5E3328C43E765C5C272014189ACF996C8ADA1652
                                                                        SHA-256:9866348EE2B19557194C357C57D9766B0628E4F15126510FD5D405962D42A575
                                                                        SHA-512:E439C92A317338A87B682839F3F313117FB4667E149586B0636E00833BF79EE9D5E3720B0F5D485D7B2A3BABCE3F38870B533CD24281185AC603BFF8372CB7F8
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Mo.................F,....?(..........Rich...................PE..L...7..C...........!.........P............................................... .................................................(...............................X...........................................`... ....................................text...Z........................... ..`.data...`...........................@....rsrc............ ..................@..@.reloc..>........ ..................@..B..:@............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\mDown.dll\mDownExec.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1608992
                                                                        Entropy (8bit):6.641020171993679
                                                                        Encrypted:false
                                                                        SSDEEP:24576:9RuZ5AUvWT9hg3EXGxpkrBoSO6rmsj96CWWc9lyg6+nsq:m5eERkrKSjWCdcjCBq
                                                                        MD5:B3E42EA6551FD32F4B95E004186CD87B
                                                                        SHA1:66A6F070E7029526BCC0280E3D428BE4B6247139
                                                                        SHA-256:EF558752377ECE9E6ABF2F8CB31F4AA90D93D2DA513B2F674B810FA3F3F63EF0
                                                                        SHA-512:979E63CA3E6D659A63CA9523670DE5CBB4C3520AAEAAD55848082DC0D22D12ED2446361EF008F97CDF14F38326EBF5662C82E84BB92292352727EFEA03C0AFFF
                                                                        Malicious:false
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....;.b.................H..........4U.......`.....Q................................)................................p..P.... ...8...`...............6.. W..........................................................L*.......`..^....................text............0.................. ..`.itext.......@.......4.............. ..`.data...DV...`...X...L..............@....bss.....V...............................idata...8... ...:..................@....didata.^....`......................@....edata..P....p......................@..@.rdata..............................@..@.reloc..............................@..B.rsrc........`......................@..@.....................6..............@..@........................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1402144
                                                                        Entropy (8bit):6.695361468175675
                                                                        Encrypted:false
                                                                        SSDEEP:24576:WPm3mUFHlLsBXTZGZQ2crKYAKRBaSTGkvwIAsJlpC1IMXVZ:WPm2goth0KR0STGkvZlg1IMXL
                                                                        MD5:EAD95E71017BCC7D5A75B508C82997C7
                                                                        SHA1:0FEA2F23EA969EC134684CFCB4F7DA279F2F7C15
                                                                        SHA-256:BA4DBCF376957742C83E9D82322C46D68BBED301458D876F7A6D5A7333B8414D
                                                                        SHA-512:B675C6269B730A50433653CB92C7339910B45DAE6CC826628B3546A88570E82B46E6437A59284CF6AAFB43AD51B80119AE37D4B93CB309CC3B4A008196C6D2A9
                                                                        Malicious:false
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....;.b.................~.........................Q....................................................................O....P..@=...`...Z.............. W..........................................................d[..\............................text....i.......j.................. ..`.itext...............n.............. ..`.data....O.......P..................@....bss....(T...............................idata..@=...P...>..................@....didata.............................@....edata..O...........................@..@.rdata..............................@..@.reloc..............................@..B.rsrc....Z...`...Z..................@..@....................................@..@........................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\mVB.dll\mVBExec.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1357600
                                                                        Entropy (8bit):6.676037472083791
                                                                        Encrypted:false
                                                                        SSDEEP:24576:BbQr0YK8Usasyc0ZP0rqqTKOdB4Ssab0IOb/Ng/r0GEj:13CaZzqrdSSfW/WTjEj
                                                                        MD5:7084D611F4646FD3652B1ED603A1F4CD
                                                                        SHA1:9CA06B546644D37A62F11F79B1463FEBD974EC74
                                                                        SHA-256:DEA658AA6156AD4C54BDD4BDE1883CA088D38CDD0E220946F3CE44767FF42BAE
                                                                        SHA-512:9D00AC1C77EFEABA6AD59E461C2E396B716D4B888DF8D0FC2CBB7D9D1572C3AF12B7DF4822E19CD73DDDCC346AC6C481B9D725A1E1B5994BCDF74EEC93E41981
                                                                        Malicious:false
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....;.b.....................x.....................Q................................[~..................................N.......\7.......Z...........`.. W... ......................................................,................................text............................... ..`.itext.............................. ..`.data....O.......P..................@....bss.....S...P.......8...................idata..\7.......8...8..............@....didata..............p..............@....edata..N............z..............@..@.rdata...............|..............@..@.reloc....... .......~..............@..B.rsrc....Z.......Z..................@..@.....................`..............@..@........................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\OFFLINE\mWinRun.dll\mWinRunExec.dll

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1353504
                                                                        Entropy (8bit):6.674591083664776
                                                                        Encrypted:false
                                                                        SSDEEP:24576:sff3GymQgwTKYZe9YNTUPTBAS5m0WrSu/CScsOE:EmjtTT6S5ro/CzsOE
                                                                        MD5:F7FF3D6E5359DA5243D7889D3200E32B
                                                                        SHA1:6B4B02BBE68B09DF0D0CD680ECB56DF6C7F4463C
                                                                        SHA-256:69DD649F0D3A05149E048EE216F8F68D8B81AE32473EF511A144C99352FCA960
                                                                        SHA-512:9B11E90E0C50826EE571C3B6AA7D039AAD4B18481619404D3E578A41585214943FFC8C2A551E2B883C7C4F3544635A1BF5DF178F94B654C63F11E7ABF494B69E
                                                                        Malicious:false
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....;.b.....................v.....................Q....................................................................R......."6.......Z...........P.. W... .........................................................\.......^....................text...H........................... ..`.itext.............................. ..`.data....O.......P..................@....bss....|S...P.......*...................idata.."6.......8...*..............@....didata.^............b..............@....edata..R............l..............@..@.rdata...............n..............@..@.reloc...... .......p..............@..B.rsrc....Z.......Z..................@..@.....................P..............@..@........................................................

                                                                        C:\ProgramData\miaDC6F.tmp\data\cfrv_4_0_setup_ALL.msi

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Template: Intel;1033, Revision Number: {D529246B-78E5-4E65-A3A2-8E1040E91E59}, Number of Words: 0, Number of Pages: 200, Title: CF Remote, Subject: CF Remote, Keywords: Installer, MSI, Database, Author: NC SBoE, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):868352
                                                                        Entropy (8bit):6.2772030756930395
                                                                        Encrypted:false
                                                                        SSDEEP:12288:gmLYSxeFmPBKXsbzlDSJjQ8guBoN2KA2wKc7wMz7:XLYSxHW5BqPA2fc7wMz7
                                                                        MD5:C42393B9643339D7F19EC2C717562646
                                                                        SHA1:2D6F6B8CE8DE076516095B9E35157055F530EF41
                                                                        SHA-256:2C3F9688DD4A7D3AFB3A28DDFA9A3A584C94E9029887DE5B3EF50F1DBB3D334E
                                                                        SHA-512:72BCBA2C66EBD01BDDF1490A65BB7E640D967B86AABE22C93E15C1EDF560C6C3E4A22D7601D2C085466E8E05F2129417DA2BBE21B4F342641741667BEF6E80E8
                                                                        Malicious:false
                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\miaDC6F.tmp\mia.lib

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):606266
                                                                        Entropy (8bit):6.509399522017653
                                                                        Encrypted:false
                                                                        SSDEEP:6144:77mkzB4Do4JUqptRCwCzae0LYPpeBnVZ8w4toZAcLrJa/liSVHUPk:nmkzB+dtRRReCYRo38KLg/lIk
                                                                        MD5:6017C5F8EA6382684DEF62597535B277
                                                                        SHA1:1ED79B319B3B0E47BD3B08C194B4CFE1A06F12A8
                                                                        SHA-256:F4BB9CF2E03832F23B407D4BDEF1D44D4DFD6A510F2FDC1A6BE263241914B55B
                                                                        SHA-512:65A0E4505294C621C031F64051017C9BEE36EF4B5F793C39010A516E84443CD85DBF092A1B4D6526ABEFD499994739326E0B55B2480523DE7C8189B6DD3FF0F6
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).n.m...m...m...d.......d...@...J.m.l...J.{.d...m.......d...y...d...%...d...l...s...l...d...l...Richm...........................PE..L....QkT...........!.................e.......0...............................0............@.........................`...........d....0...............................................................................0...............................text............................... ..`.rdata......0......................@..@.data....^......."..................@....rsrc........0......................@..@.reloc...C.......D..................@..B........................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.dat

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):315
                                                                        Entropy (8bit):5.31187543825682
                                                                        Encrypted:false
                                                                        SSDEEP:6:SzgSDBk2r5ezoYLpyX5w3eLpy9kfOkknTzAz7jM41wb8AkV:S0SDBk2teztpyXuEpyefOkkf8MXbS
                                                                        MD5:A69CAEA5767280A354593D87CF87AD20
                                                                        SHA1:97F93DD38326F28CFCEF88166695513EE8493240
                                                                        SHA-256:EB5C7F44DF975D0E44C18AFEEC828A77D341F6C13F297408501D4925F8A47B59
                                                                        SHA-512:248E9DD8C0FED2F0F468D76C6AAA30127E3C7E4456058EBC0F0ACF56151B4CFF4085A52DEA1B33B6DD9954D6285C61557C0C645C1A222B95C116A0DE5CC9E0D1
                                                                        Malicious:false
                                                                        Preview:MYAH-PREDEF-COMPONENT..New Project..$..TRUE..TRUE..$..$..$..$..MYAH-PREDEF-COMPONENT..73649591..NEW PROJECT..0..$..C:\Program Files (x86)\\SBoE\Campaign Finance\CF Remote..TRUE..Campaign Finance..C:\PROGRA~3\miaDC6F.tmp\data\..MYAH64WOW..Win32..OVERRIDECACHE....NATIVE_ENGINE..FALSE..ANAPPLYINSTALLWASCALLED..TRUE..

                                                                        C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.exe

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5675007
                                                                        Entropy (8bit):6.48705961905541
                                                                        Encrypted:false
                                                                        SSDEEP:98304:2hG63qsl7dEhYCHnWzXzLbVI9AB5dECNhc6ZzH2oYK13icjqsNTUjJG:2Jah2zXzL5IWB5JhnHfFIG
                                                                        MD5:3B2D532673D1567116105D04C621CDBA
                                                                        SHA1:F0892A2DCF772529C115C15E6B1A510B4DC214E1
                                                                        SHA-256:FD6D2298B1B5DD14A9F02207FAA4D7D7DC5F5B399E71F2F4EC3680C2DBC6DF0E
                                                                        SHA-512:15ABF21DCF9ABF346DDFB6B35F75C607B4E6CF4518B629C39ADCA5E4690955D70C46C5A842F73FE7373FA6A7F7860DB514D3815DD04D1280DAD7A7D1A315B672
                                                                        Malicious:false
                                                                        Yara Hits:
                                                                        • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.exe, Author: Joe Security
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?..`.................z;..........e;.......;...@.......................... Y..................@............................?..Y... D.......................................................?.......................?......`?......................text.....:.......:................. ..`.itext.......;.......:............. ..`.data...(.....;......~;.............@....bss.....}....=......Z=..................idata...Y....?..Z...Z=.............@....didata......`?.......=.............@....tls.....A...p?.......=..................rdata........?.......=.............@..@.reloc...I....?.......=.............@..B.rsrc........ D.......=.............@..@.............pY......\W.............@..@........................................................

                                                                        C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.lnk

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):159
                                                                        Entropy (8bit):4.892774327669993
                                                                        Encrypted:false
                                                                        SSDEEP:3:PXZkRErG+fyM1K/RFofD6GeLpyXjF3A39q1Jj4I52toYLpyXjF3A3OmGw3mkAy:vWaH1MUmGeLpyX5w4t52toYLpyX5w+jq
                                                                        MD5:21D22691174AA25728C4CD7F7D5A85CA
                                                                        SHA1:994695A289A7861C4040B602AEA778EAFB440771
                                                                        SHA-256:D25F005EEE9EF910E5E4BDF0CE76F6FFB904A004FC9A401ED75AD4078D6F5DF8
                                                                        SHA-512:483CCF0669E6820E300F2FC785A413C46A2D5A340784237E0F8BFE3DC997D8C9DCC7E1369DF9D9A2BA99C740C271ACA9FC5549F52D35501DE21B184982AE0A8F
                                                                        Malicious:false
                                                                        Preview:.C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Campaign Finance\CF Remote.lnk|8|C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\CF_Remote.exe..

                                                                        C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.msi

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Template: Intel;1033, Revision Number: {D529246B-78E5-4E65-A3A2-8E1040E91E59}, Number of Words: 0, Number of Pages: 200, Title: CF Remote, Subject: CF Remote, Keywords: Installer, MSI, Database, Author: NC SBoE, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0
                                                                        Category:dropped
                                                                        Size (bytes):868352
                                                                        Entropy (8bit):6.2772030756930395
                                                                        Encrypted:false
                                                                        SSDEEP:12288:gmLYSxeFmPBKXsbzlDSJjQ8guBoN2KA2wKc7wMz7:XLYSxHW5BqPA2fc7wMz7
                                                                        MD5:C42393B9643339D7F19EC2C717562646
                                                                        SHA1:2D6F6B8CE8DE076516095B9E35157055F530EF41
                                                                        SHA-256:2C3F9688DD4A7D3AFB3A28DDFA9A3A584C94E9029887DE5B3EF50F1DBB3D334E
                                                                        SHA-512:72BCBA2C66EBD01BDDF1490A65BB7E640D967B86AABE22C93E15C1EDF560C6C3E4A22D7601D2C085466E8E05F2129417DA2BBE21B4F342641741667BEF6E80E8
                                                                        Malicious:false
                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.par

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):7513
                                                                        Entropy (8bit):4.985112886613449
                                                                        Encrypted:false
                                                                        SSDEEP:192:nqm9BigrTDd/WdZRH3HyrvM0cusqyaKVCci2AoIhmgmidS02Y8eUZFIqD3+It0KK:qm9BigPDd/2PHijM0CqyaCCci2Ao+mgX
                                                                        MD5:3DC48DDC37E2D4A5D2FB89D46B7D9CD8
                                                                        SHA1:6AF19AAAC4181F7A2D1D32919885BD9EE8A93107
                                                                        SHA-256:AB1681AFC18A4DB43F1CBB6B8A7CD354F35D0290FFB11F2C3E94326D90850F54
                                                                        SHA-512:95398449F09F5BFA6A561C9C5E800056505629F1CCC3998480B934F96378C08A03E8171EC05A38B2F65D96B5F38BCE6F4144073BC5BAA8DC6E415D7E3D1F2BFE
                                                                        Malicious:false
                                                                        Preview:.AAE4ED6BA..FALSE..AAE68B5EB..FALSE..A2AFAD2D7..FALSE..A47890F43..FALSE..AABF0EABC..FALSE..A5303394E..FALSE..A36C4273F..FALSE..ABEFE417A..FALSE..A2AFAD2D7..FALSE..A1AAFDCA9..FALSE..A4D583000..FALSE..A47890F43..FALSE..A392822E1..FALSE..A9202CBED..FALSE..A2AFAD2D7..FALSE..A5B95B812..FALSE..A1983855A..FALSE..A392822E1..FALSE..A6C969A31..FALSE..A86FEDFFB..FALSE..A280378AD..FALSE..A895B52CC..FALSE..A96D781B4..FALSE..A303D489..FALSE..A36C4273F..FALSE..A4D583000..FALSE..A47890F43..FALSE..A9EDFEF92..FALSE..A33529D6E..FALSE..AD400EB86..FALSE..A9202CBED..FALSE..A2AFAD2D7..FALSE..A5B95B812..FALSE..A1983855A..FALSE..A392822E1..FALSE..A96D781B4..FALSE..A4D583000..FALSE..A47890F43..FALSE..A759968E7..FALSE..A705D4320..FALSE..A108A6B0C..FALSE..A9202CBED..FALSE..A747EDAC0..FALSE..A31A38C9B..FALSE..AF2139E01..FALSE..ABAD9EF7A..FALSE..ACA4B8A8B..FALSE..A832FC268..FALSE..A2D3E0D90..FALSE..ABED664EA..FALSE..AF7CFC206..FALSE..AD77E7C08..FALSE..ADAE69E8..FALSE..AE76BBEDE..FALSE..ACE1E931F..FALSE..A43981525

                                                                        C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.res

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:7-zip archive data, version 0.3
                                                                        Category:dropped
                                                                        Size (bytes):8694055
                                                                        Entropy (8bit):6.569101251424524
                                                                        Encrypted:false
                                                                        SSDEEP:98304:6bCyTWyZzxtJNL05f9tAYnA3U9XHsHcCXq8vXKEUo/wRZlV:Ia8KEUo/wdV
                                                                        MD5:FDC346FFDFDD1F15F1DBA95695960160
                                                                        SHA1:4983376DAB7201E8AF1728D2F6FD9AEE0CCAD376
                                                                        SHA-256:74924F08BD5817B532B441E57C5D9C7CB55AD001C410C038DE1F54427D1160E9
                                                                        SHA-512:AE7F0A4EC374A78816B7DDF3B90BD358729BC6E0C153C08CA4AC17741F6E72C0A3E43B822DD3A55FA15C603314B78B4D7E43D8F131ED60143CFB9B7C65E0B66E
                                                                        Malicious:false
                                                                        Preview:7z..'.....%........{........fX....TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.|\9..P...W...^..._...e...c...i...l...s...{...y...z...|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(..*..-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..

                                                                        C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\instance.dat

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):91
                                                                        Entropy (8bit):4.482202581850587
                                                                        Encrypted:false
                                                                        SSDEEP:3:LibnEUsuISYov+ZjYXIkjwrQ4UNA3fvn:+bnSuvYo2WJwrQ4US3
                                                                        MD5:78D8E6169CFDB028A983F4DB3CAF4EF2
                                                                        SHA1:E75A4F0D2B4A080C94FA698F216EEEDBC34025F8
                                                                        SHA-256:8D1F063948F245FD9E7D7B65A76D1CA274AC40199A0DD4D75C01640BED392B24
                                                                        SHA-512:4AE130200E4D2C926DBEAF7042D662FB52E67974B3E08702221BE8FCE607FF0AEA696D0A0B1372567E27AB6148E050EEEFFFB12C1393769F12BD2D0D56D37A14
                                                                        Malicious:false
                                                                        Preview:{152D390A-DD7B-4E57-B3A5-14CADE7E1207}..{D529246B-78E5-4E65-A3A2-8E1040E91E59}..CF Remote..

                                                                        C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\mia.lib

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):606266
                                                                        Entropy (8bit):6.509399522017653
                                                                        Encrypted:false
                                                                        SSDEEP:6144:77mkzB4Do4JUqptRCwCzae0LYPpeBnVZ8w4toZAcLrJa/liSVHUPk:nmkzB+dtRRReCYRo38KLg/lIk
                                                                        MD5:6017C5F8EA6382684DEF62597535B277
                                                                        SHA1:1ED79B319B3B0E47BD3B08C194B4CFE1A06F12A8
                                                                        SHA-256:F4BB9CF2E03832F23B407D4BDEF1D44D4DFD6A510F2FDC1A6BE263241914B55B
                                                                        SHA-512:65A0E4505294C621C031F64051017C9BEE36EF4B5F793C39010A516E84443CD85DBF092A1B4D6526ABEFD499994739326E0B55B2480523DE7C8189B6DD3FF0F6
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).n.m...m...m...d.......d...@...J.m.l...J.{.d...m.......d...y...d...%...d...l...s...l...d...l...Richm...........................PE..L....QkT...........!.................e.......0...............................0............@.........................`...........d....0...............................................................................0...............................text............................... ..`.rdata......0......................@..@.data....^......."..................@....rsrc........0......................@..@.reloc...C.......D..................@..B........................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\Public\Desktop\CF Remote.lnk

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Dec 1 14:44:33 2023, mtime=Tue Jan 23 14:43:32 2024, atime=Fri Dec 1 14:44:33 2023, length=4243456, window=hide
                                                                        Category:dropped
                                                                        Size (bytes):1200
                                                                        Entropy (8bit):4.673404671229661
                                                                        Encrypted:false
                                                                        SSDEEP:24:8amESbdOEcKy+KXW97DAGsLy4ACdIzoUUkWyfm:8aZ2dOX+kWeGz43dK97
                                                                        MD5:CEE0E7D5991E4BBC8B0D5B6361011CA8
                                                                        SHA1:0A7CE3178D7CC8ED19CD0CE1DB55A87D4EF4CBBC
                                                                        SHA-256:AAA9E9A83ABC0F9B686CEF6E48DCAA831CC44146FE93EFF5C4B70B8056952120
                                                                        SHA-512:A31C1AA9985E70D543E00C8D24219B6FA042DA85DA35CAFC78A2E9948495435982C42134B5D9DDFA5A782D3C2BF97568BDCF2C901B84663FB6259B5316838857
                                                                        Malicious:false
                                                                        Preview:L..................F.... ......Gm$..y....N.....Gm$....@.....................C....P.O. .:i.....+00.../C:\.....................1.....7Xn}..PROGRA~2.........O.I7Xn}....................V.....<...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....N.1.....7Xn}..SBoE..:......7Xn}7Xn}..........................<...S.B.o.E.....j.1.....7Xn}..CAMPAI~1..R......7Xn}7Xn}.... .....................<...C.a.m.p.a.i.g.n. .F.i.n.a.n.c.e.....\.1.....7Xq}..CFREMO~1..D......7Xn}7Xq}....!.....................E7..C.F. .R.e.m.o.t.e.....h.2...@..W.} .CF_REM~1.EXE..L......W.}7Xq}.....I......................P.C.F._.R.e.m.o.t.e...e.x.e.......s...............-.......r....................C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\CF_Remote.exe..J.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.S.B.o.E.\.C.a.m.p.a.i.g.n. .F.i.n.a.n.c.e.\.C.F. .R.e.m.o.t.e.\.C.F._.R.e.m.o.t.e...e.x.e.........*................@Z|...K.J.........`.......X.......721680...........h

                                                                        C:\Users\user\AppData\Local\IIIQF\7z.dll

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):174080
                                                                        Entropy (8bit):6.279217790646268
                                                                        Encrypted:false
                                                                        SSDEEP:3072:xyljBP/VZjAISqyTFjoZAO1h7BTF1rJa//diUTTBXJxO8hlIhb0:xeBnVZ8w4toZAcLrJa/liSVHU
                                                                        MD5:31CAD6A3EDD1C32981AD6B565CBEAC94
                                                                        SHA1:9338978C85A9423EE2A38CBA027F79192D684F1B
                                                                        SHA-256:B8521ABDA09EC17DDAD36528C1BC50395DC8C5F7C11C026A5B3FF23110C54182
                                                                        SHA-512:02E198B8EF192DE55DB35AE00A16A80B3309A9373A596C20D617B43DD7159A635BC303F371859E704375521A1242D02754807E2E9DFEF63FFD06993B24C17D3D
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D..P....................6...>..............._...........6...P...o.^.....o.j....................Rich............................PE..L....S.L...........!........................................................@.......................................@.......9..P...............................@.......................................................,............................text............................... ..`.rdata...@.......B..................@..@.data.......P...4...4..............@....sxdata..............h..............@....rsrc................j..............@..@.reloc...%.......&..................@..B................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Temp\lang.loc

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):161850
                                                                        Entropy (8bit):4.662047306059787
                                                                        Encrypted:false
                                                                        SSDEEP:3072:VmLCDQ9xl64bNmso7f4vqp/Mp+WD7UB4/YQfl:s
                                                                        MD5:6D2EA67B5892DC26D5ABD01608BC086A
                                                                        SHA1:14BC24724509E44918252D155FA3E7152FE232F3
                                                                        SHA-256:76AA59963903F0299CDA780A1DA7583227CB4C84F4EFF213A101841CE02C39C7
                                                                        SHA-512:1842D801325A1FD6F479A42A98A1C5A49EE7707B682E45BC95AE23C0E073288E9C4889710F6D925B6E852540355CB66565E2B745CFA7C76F34BF26FDDAAD9D7E
                                                                        Malicious:false
                                                                        Preview:Please install the common controls update from Microsoft before attempting to install this product...Setup resource not found..Setup resource decompression failure..Setup database not found..Runtime error in install: ..bytes..KB..MB..Attempting to get value of undefined variable ..Attempting to set value of undefined variable ..Copying: ..Unable to copy installation data to local folders..Downloading Web Media: ..Unable to download installation data from the web..Extracting Web Media: ..Unable to extract installation data downloaded from the web..Please locate your original setup sources to continue operation..Original setup sources required to complete operation, sources not found..General setup failure..Runtime error in setup script:..% complete..bytes received..InstallAware Wizard..InstallAware is preparing the InstallAware Wizard which will install this application. Please wait...Retry Download?..Downloading of installation data from the web has failed. Would you like to try again?

                                                                        C:\Users\user\AppData\Local\Temp\mia.tmp

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):252415
                                                                        Entropy (8bit):5.5406407126482025
                                                                        Encrypted:false
                                                                        SSDEEP:3072:+XjjjjNOJUu/4UHSteLixAkrQitNfyvobIAGrnj6VywfGMCz8OlsAI:+XjjjjNOZfSSk3Qow0f2I
                                                                        MD5:44F77F1BBD46DEC6862CE4FB1DC89234
                                                                        SHA1:0DE617D1E836141E31CCE8BB248FF21CCA5620E3
                                                                        SHA-256:EF6C4F89F829BE9B225AF46788BD5D1ACEA2D0B665FDA4FBED1960E66B8A155C
                                                                        SHA-512:C99DE199196F5B901CD2F584D79F5EBF4E2ED0827E861725D154E28098B440A82B87FB560EC49CD8DECD9A509DB4F450403CCD032811E855DC635F8493D2ABB2
                                                                        Malicious:false
                                                                        Preview:.Comment..Comment..Code Folding Region..Code Folding Region..Comment..Set Variable..Set Variable..Set Variable..Set Variable..Create Folder..Set Access Control..Set Variable..Comment..Code Folding Region..Get System Settings..If..Write to Text File..MessageBox..Terminate Install..End..Get System Settings..If..Write to Text File..MessageBox..Terminate Install..End..Comment..If..If..If..If..Does File/Folder Exist..If..Write to Text File..MessageBox..Terminate Install..End..End..End..End..End..Code Folding Region..Comment..Code Folding Region..Comment..Code Folding Region..Comment..Set Variable..Set Variable..Comment..If..Set Variable..Set Variable..End..If..Write to Text File..Set Variable..Windows Installer..If..Set Variable..Set Variable..End..Comment..End..Write to Text File..Set Variable..Visual Basic VM..If..Set Variable..Set Variable..End..Comment..Comment..Code Folding Region..Comment..Code Folding Region..Comment..If..Comment..If..Terminate Install..End..Display Dialog..Comment

                                                                        C:\Users\user\AppData\Local\Temp\mia1\cfrv_4_0_setup_ALL.msi

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Revision Number: {D529246B-78E5-4E65-A3A2-8E1040E91E59}, Number of Pages: 200, Title: CF Remote, Subject: CF Remote, Keywords: Installer, MSI, Database, Author: NC SBoE, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0, Template: Intel;1033, Number of Words: 8
                                                                        Category:dropped
                                                                        Size (bytes):868352
                                                                        Entropy (8bit):6.274787053787206
                                                                        Encrypted:false
                                                                        SSDEEP:12288:jvLiSxEFm3BKXsbzlDSJjQ8guBoN2KA2wKc7wMz7:rLiSxdW5BqPA2fc7wMz7
                                                                        MD5:1F0A68D287D329F3417FF4A00030E695
                                                                        SHA1:4C2CAEF856CA27CA5E9364519AF6E078C01C2CF3
                                                                        SHA-256:E91BB183C1AF1B31B10B25D7CB2E2FF9337239EE103CB20D4DE1F67A80E8D85D
                                                                        SHA-512:55444F59936DC13834127C428CAD25A2F2CAE47D6ABCC3864212049E2FB5E89A9DF9E2D36037D19DF10EA5267C73CAEA90E7F32B28A02426C4ED7D1EE9E75B1B
                                                                        Malicious:false
                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Temp\mia1\componentstree.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):33309
                                                                        Entropy (8bit):3.3772470427001995
                                                                        Encrypted:false
                                                                        SSDEEP:768:pJHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfTE:phXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Dt
                                                                        MD5:F1BA2D0A20CF4290FCDB45B3CF54840C
                                                                        SHA1:EC808EBC2563D3D00866BDE0AFF4059C3C995C03
                                                                        SHA-256:F27A9B4D468632780547E3FC26A59993B3108A18CB096852A302577BFA4C6F2F
                                                                        SHA-512:C4073CE6F58447B858901389D52BD479C888370CD6328499B516B9C919A728C4099F00DFA19005AC65BC986A79FF2A9A0E4CAAE9BCC0A5E3A72747696B4BC126
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.|\9..P...W...^..._...e...c...i...l...s...{...y...z...|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(..*..-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\componentstree.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):374
                                                                        Entropy (8bit):4.773773154848379
                                                                        Encrypted:false
                                                                        SSDEEP:6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82dukT:7INIkU3lkimkU3MIkT
                                                                        MD5:8101E0CC3186C05F85B2CD484D26AE9D
                                                                        SHA1:B3CF33E0784E3A6F3B3FEB2B2501E0BDA5932EFA
                                                                        SHA-256:A0E750466327E92E2DCC96D72A19A7738A65AB765262DF4801E6677528F14D6C
                                                                        SHA-512:DF3692D29CDF0434806A0BCF034AFE6869B0BF5C0BE24F18637D373374C1E1803AC5B6D1F671CCD6E89B313E26F85657EA487A2EBAEAE0B99359A66F21DF910B
                                                                        Malicious:false
                                                                        Preview:IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\destination.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):15242
                                                                        Entropy (8bit):7.84777952977126
                                                                        Encrypted:false
                                                                        SSDEEP:384:50OxsRBdY8cwyJ+Ic+GJQrSAhn37QpYaGwrCR:5kbdY8To+G7kY3
                                                                        MD5:66B51FD9D148F40B906CDF17F206475C
                                                                        SHA1:2A1C8284B6919C9527DBC386DBD58DCC6D245675
                                                                        SHA-256:DF3404C11235C94FAB877B0474F5FA4020DAD0109F4AE309FA046A0618599896
                                                                        SHA-512:D9AC3B86ED42EF6F74D0B6A65220FA652338A545B9B9C46EA45155480929B38119E6A78867E26E46F998B133E37DE24BDAAE98BBE7EF9C6067B891775BC45C70
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0.v;..TPF0.TfrmDesign.frmDesign.Left....Top.|.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.DoubleBuffered..Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...GlassFrame.Bottom./.OldCreateOrder..Position..poDesigned.Touch.ParentTabletOptions..Touch.TabletOptions..toPressAndHold.toPenTapFeedback.toPenBarrelFeedback.toFlicks.toFlickFallbackKeys..PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data../...TPngImage.PNG........IHDR.......;......T$L....sRGB.........gAMA......a.....pHYs..........o.d../.IDATx..gx...?....{..".n.m....Kh.$.Z ......B..C.!.@......Kl.eK.%Y.m...5........\...m.=.{...p...Yk.. .C6666...ZoM.../.#4.........Q4!A_..?o..........2.....).D$.Aq...WB..hM...i$.;q...l".... M6H.5Q....*....,..QN4..ep..5..A1.P.A_.p.<.g.f4W...>Y...&.....Q.#...../....

                                                                        C:\Users\user\AppData\Local\Temp\mia1\destination.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):377
                                                                        Entropy (8bit):4.815324246200539
                                                                        Encrypted:false
                                                                        SSDEEP:6:s82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82dukT:IINIkU3lkimkU3MIkT
                                                                        MD5:F7956EFDD257F64C607FC35CE295D625
                                                                        SHA1:6AB4DB64B18631E2CD9C8234E9C31B4238CF4FDD
                                                                        SHA-256:F25B4D0DE61024212EA4E18135EE9A4D6F145A92AC32C73746CB2619A6E1EC8D
                                                                        SHA-512:94243359CED16C96E7DBF886912E1A68A1896DF13384CFFB5617AD48E5ECFAEA5EF076EB6D8C6F8126314656281B49F09450C82ADA8764FF481DC10113197BD3
                                                                        Malicious:false
                                                                        Preview:.IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\finish.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):48434
                                                                        Entropy (8bit):7.966771896841437
                                                                        Encrypted:false
                                                                        SSDEEP:768:D+2E2XFXd2pbhliaeVSCqLgle/miee9GIqeK7+72g4krhh:D+R2XbaewCsX2eLc+72gbrhh
                                                                        MD5:978E3FBC366DFAE2E799E0D7CA673E01
                                                                        SHA1:C312BBF3FDFEC3E2E97DE481732E2FD9D0282F20
                                                                        SHA-256:995C3C9E62AEE9C2C35488D6ECC656459E3D43F0E9CF0066DA736AF6E3F87F57
                                                                        SHA-512:5E41808A2C0BD825AF6E7ACFA7DA8EB818E294BDCA6AB336AAF253260D1A8B06E994E313DE90AC8D1A620DAA0A386484F5A62E790F4BED1609D2194EF5537332
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.:..Picture.Data......TPngImage.PNG........IHDR.......:........]....sRGB.........gAMA......a.....pHYs..........o.d....IDATx.........d.....9.s8t."E.X..T....."z.k.+z..*.T.D@...4A.Io.r..:.M.I2.L... ....z...e....L.ik=...7>..1 :x!........^ppz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x.

                                                                        C:\Users\user\AppData\Local\Temp\mia1\finish.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1600
                                                                        Entropy (8bit):5.007774942158045
                                                                        Encrypted:false
                                                                        SSDEEP:24:UuikSi+nfi0Zi5ai/pZSruicvSi+pipUiOsIi/pEai/fi/pTvSgREii/p51i/p56:U56AGHbR1ZRMfkf3faWYxVh
                                                                        MD5:75A2E981E48B4697263548CB79B523CD
                                                                        SHA1:52A5958B06D0B064420E7B882AAD64ADA14906FE
                                                                        SHA-256:D65470903C956152C8BC2788F0E9689C52E2FA44B0A193E0F686854383A7519B
                                                                        SHA-512:23D92DFF49399745EDBFADE604B1ED54115A7ED7BDE513381B66C4B46222525419E4EE2320BA2F10B6F80EF185F41340CDB8A93B655BE080D19111D2F669D2DA
                                                                        Malicious:false
                                                                        Preview:IF (checkSuccess.Caption = COMPLETE) THEN textComplete.Visible := True;..IF (checkSuccess.Caption = REBOOT) THEN textReboot.Visible := True;..IF (checkSuccess.Caption = CANCEL) THEN textCancelled.Visible := True;..IF (checkSuccess.Caption = ERROR) THEN textError.Visible := True;..IF (checkRemove.Caption = TRUE) THEN textRemove.Visible := True;..IF (checkSuccess.Caption = REBOOT) THEN RebootNow.Visible := True;..IF (checkSuccess.Caption <> COMPLETE) THEN textComplete.Visible := False;..IF (checkSuccess.Caption <> REBOOT) THEN textReboot.Visible := False;..IF (checkSuccess.Caption <> CANCEL) THEN textCancelled.Visible := False;..IF (checkSuccess.Caption <> ERROR) THEN textError.Visible := False;..IF (checkRemove.Caption <> TRUE) THEN textRemove.Visible := False;..IF (checkRemove.Caption = TRUE) THEN textComplete.Visible := False;..IF (checkSuccess.Caption = CANCEL) THEN textRemove.Visible := False;..IF (checkSuccess.Caption <> REBOOT) THEN RebootNow.Visible :=

                                                                        C:\Users\user\AppData\Local\Temp\mia1\icon.ico

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:MS Windows icon resource - 2 icons, 32x32, 16 colors, 16x16, 16 colors
                                                                        Category:dropped
                                                                        Size (bytes):1078
                                                                        Entropy (8bit):3.8897554644986423
                                                                        Encrypted:false
                                                                        SSDEEP:24:hEi/gV/XZhmF6VBY6+yat7liXoj1NQCSj/:pOW0Y6+3Y6E/
                                                                        MD5:D22667C1806E0F83E9247F7AA9BD17A9
                                                                        SHA1:24DFB34D17D06D32DDB7C269CD0975DC4EBB459B
                                                                        SHA-256:00055DDFD7AA9E48E8ABA6593F4167E0F3CD5C0E0F2A14FEF6F10CFE68D1E318
                                                                        SHA-512:CE6F94B6B58870D439EC4AD4CC6852BB0A031F6670749B6B470C7745FB33897B7059A778816D16D170D6A571F17054A11089D316D58C2ADDC820F6D9B83A78E8
                                                                        Malicious:false
                                                                        Preview:...... ..........&...........(.......(... ...@.................................................................................................................wx.......................wz.......x.....wwz.......w.....wwz.......wx.....wz.......wx...w.w..wp....wx...ww...wp.L..wx...ww..wwp.L..Gx...wz..wwp.L..Dx...w..w.wp.L..DH.ww...w.w......D.ww..ww......pD.wwx.wwp..x..........wx....w..............xwp..........p........wwwwwx.....p.........x.........DDDDDOx..........vfl.Ox..........wff.Ox...........vflOx...........wffOx............vfOx.........~..wfOx.........w...vOx.........w~..wOx.........DDDDDOx.........................wwwwwww............................?.....................................................................................................................(....... ......................................................................................................p.....wz...p.......w..p.p..w...wp..w....p......w........x............www.....Gf.....Nvg.....G.g.....DDG...

                                                                        C:\Users\user\AppData\Local\Temp\mia1\installaware.png

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                        Category:dropped
                                                                        Size (bytes):1597
                                                                        Entropy (8bit):7.871063017224323
                                                                        Encrypted:false
                                                                        SSDEEP:24:X93kpZjQLmEcxtIwWXPAGpKpkZcks41xdrqUaBdJbYfxpJgx7YWg/uLwdCnq:N3Yj8mEcxywiPrpKpNMdr07SxgSt
                                                                        MD5:B7225A16DAF9DE1D514AEFE567FDF2F5
                                                                        SHA1:D6A00C526C425FCD5EF49B0C87814F2CF476CB59
                                                                        SHA-256:0E2DEFC9B470D3F9BD184D254493EFAD94EA0273C1FE17FC8FC651D47B01734E
                                                                        SHA-512:31412603AE87F2B9C9DAD2D0BA64868105586D1778846DE5F1C14667C4292DE36FC193B54670BDF130019B0B42AB59EEF2C2D8672226BA755181FEA894BD9246
                                                                        Malicious:false
                                                                        Preview:.PNG........IHDR... ... .....szz.....IDATx.W.L.W...!..dl.'.@.10.a.....2.T'.....SD..-PK@t.....:53.... :#F.......|"...L....6 m)Lw........9...K.+.b...z.x........=...J.V....n3[.B..v[m..../....o0.L....Q...&...$~?%%?PG..S<..]...$.Z......O.3".k....m]..2S9..4,.k+.xf..k.F...V..4[Ec'K.2.2..PK.....H$..H.....kA...M..>.zs.....^.*..K"...j..:..Hu.T..Q.....N...y'.+9.dR.{..Xn....w.f...R.KQB.]z........6>..,.......q.%........;.,......U{.i....Z.....)._I..7..J.q..d)...CM....;...,R~.B.S...E...p[-O........].F...%..A.%....{.%.*...]Q..>.-..f..C..i.Q..+5.......A'~.....J...M.mtN..0..r.>.@K.....D...<...CI^#.-.P.}?R..M.-.7..GS...Z^9s..<6.....>......<..g.~.9....{]Ju..}`..Z(..ikw^.,)X..g...|G.LQ9A^...9pe....7d.......SE.Q..../nx.}_..F...$..I..K...o4.^ ..e.X.Q.H......&........Q..............\n....J......./...7.....E.9.....$...K..!...c.`.=.Jd.nq.n.W.Q...Q.#s.w._.d....u...Q].-U.N.J..&.O..=......a+.k.....%.$..(.....@`...lx.......tDC..=.{...^"...@.....\{;#.^...G.q./AA.

                                                                        C:\Users\user\AppData\Local\Temp\mia1\licensecheck.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):32515
                                                                        Entropy (8bit):3.2392237095249325
                                                                        Encrypted:false
                                                                        SSDEEP:768:j2HXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfE:juXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5D1
                                                                        MD5:9A87495839CA4357F293308C86139F03
                                                                        SHA1:0529F4612D004BAA1FE8806F6EAD5E78B3E76E55
                                                                        SHA-256:C623B82A8BE3EAD16900164C09AFEE00215DC1749A6DE8D4F381CF983A3F5CEB
                                                                        SHA-512:75F64D527924764598066D157C406FD18A00FA59EAB8D418724EF7E87B8B718EF57595118284710A08B17D7C287723AAF5F06383F877ADF77EFF7F7573AD665E
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0..~..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.|\9..P...W...^..._...e...c...i...l...s...{...y...z...|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(..*..-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\licensecheck.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):502
                                                                        Entropy (8bit):4.896842553280578
                                                                        Encrypted:false
                                                                        SSDEEP:6:aHi6GKuMtrk86i6euMtrkeuN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+J:0IMtgfjMtgxINIkU3lkimkU3MIkT
                                                                        MD5:D312F2FDC09193A04578D688A2CA292D
                                                                        SHA1:54BD3AA4CC72E68FC613A4227CADA7AD702D795E
                                                                        SHA-256:DB1C3A93A00A46C77F3E8D19C5DA4D42C54CE58C9EB71B586E512ABEE2D46967
                                                                        SHA-512:A71514B0F31010F7BF23954BCE707A277CA765BC14DDED7D7870615528A7751E4B26E72BB826781BC4F57C2A7C75FCFB92C4BA781AAD58372CF6CECE39832D19
                                                                        Malicious:false
                                                                        Preview:IF (LicenseCheck.Checked = True) THEN Next.Enabled := True;..IF (LicenseCheck.Checked = False) THEN Next.Enabled := False;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\mDownExec.dll

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1608992
                                                                        Entropy (8bit):6.641020171993679
                                                                        Encrypted:false
                                                                        SSDEEP:24576:9RuZ5AUvWT9hg3EXGxpkrBoSO6rmsj96CWWc9lyg6+nsq:m5eERkrKSjWCdcjCBq
                                                                        MD5:B3E42EA6551FD32F4B95E004186CD87B
                                                                        SHA1:66A6F070E7029526BCC0280E3D428BE4B6247139
                                                                        SHA-256:EF558752377ECE9E6ABF2F8CB31F4AA90D93D2DA513B2F674B810FA3F3F63EF0
                                                                        SHA-512:979E63CA3E6D659A63CA9523670DE5CBB4C3520AAEAAD55848082DC0D22D12ED2446361EF008F97CDF14F38326EBF5662C82E84BB92292352727EFEA03C0AFFF
                                                                        Malicious:false
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....;.b.................H..........4U.......`.....Q................................)................................p..P.... ...8...`...............6.. W..........................................................L*.......`..^....................text............0.................. ..`.itext.......@.......4.............. ..`.data...DV...`...X...L..............@....bss.....V...............................idata...8... ...:..................@....didata.^....`......................@....edata..P....p......................@..@.rdata..............................@..@.reloc..............................@..B.rsrc........`......................@..@.....................6..............@..@........................................................

                                                                        C:\Users\user\AppData\Local\Temp\mia1\mMSIExec.dll

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1402144
                                                                        Entropy (8bit):6.695361468175675
                                                                        Encrypted:false
                                                                        SSDEEP:24576:WPm3mUFHlLsBXTZGZQ2crKYAKRBaSTGkvwIAsJlpC1IMXVZ:WPm2goth0KR0STGkvZlg1IMXL
                                                                        MD5:EAD95E71017BCC7D5A75B508C82997C7
                                                                        SHA1:0FEA2F23EA969EC134684CFCB4F7DA279F2F7C15
                                                                        SHA-256:BA4DBCF376957742C83E9D82322C46D68BBED301458D876F7A6D5A7333B8414D
                                                                        SHA-512:B675C6269B730A50433653CB92C7339910B45DAE6CC826628B3546A88570E82B46E6437A59284CF6AAFB43AD51B80119AE37D4B93CB309CC3B4A008196C6D2A9
                                                                        Malicious:false
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....;.b.................~.........................Q....................................................................O....P..@=...`...Z.............. W..........................................................d[..\............................text....i.......j.................. ..`.itext...............n.............. ..`.data....O.......P..................@....bss....(T...............................idata..@=...P...>..................@....didata.............................@....edata..O...........................@..@.rdata..............................@..@.reloc..............................@..B.rsrc....Z...`...Z..................@..@....................................@..@........................................................

                                                                        C:\Users\user\AppData\Local\Temp\mia1\mVBExec.dll

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1357600
                                                                        Entropy (8bit):6.676037472083791
                                                                        Encrypted:false
                                                                        SSDEEP:24576:BbQr0YK8Usasyc0ZP0rqqTKOdB4Ssab0IOb/Ng/r0GEj:13CaZzqrdSSfW/WTjEj
                                                                        MD5:7084D611F4646FD3652B1ED603A1F4CD
                                                                        SHA1:9CA06B546644D37A62F11F79B1463FEBD974EC74
                                                                        SHA-256:DEA658AA6156AD4C54BDD4BDE1883CA088D38CDD0E220946F3CE44767FF42BAE
                                                                        SHA-512:9D00AC1C77EFEABA6AD59E461C2E396B716D4B888DF8D0FC2CBB7D9D1572C3AF12B7DF4822E19CD73DDDCC346AC6C481B9D725A1E1B5994BCDF74EEC93E41981
                                                                        Malicious:false
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....;.b.....................x.....................Q................................[~..................................N.......\7.......Z...........`.. W... ......................................................,................................text............................... ..`.itext.............................. ..`.data....O.......P..................@....bss.....S...P.......8...................idata..\7.......8...8..............@....didata..............p..............@....edata..N............z..............@..@.rdata...............|..............@..@.reloc....... .......~..............@..B.rsrc....Z.......Z..................@..@.....................`..............@..@........................................................

                                                                        C:\Users\user\AppData\Local\Temp\mia1\mWinRunExec.dll

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1353504
                                                                        Entropy (8bit):6.674591083664776
                                                                        Encrypted:false
                                                                        SSDEEP:24576:sff3GymQgwTKYZe9YNTUPTBAS5m0WrSu/CScsOE:EmjtTT6S5ro/CzsOE
                                                                        MD5:F7FF3D6E5359DA5243D7889D3200E32B
                                                                        SHA1:6B4B02BBE68B09DF0D0CD680ECB56DF6C7F4463C
                                                                        SHA-256:69DD649F0D3A05149E048EE216F8F68D8B81AE32473EF511A144C99352FCA960
                                                                        SHA-512:9B11E90E0C50826EE571C3B6AA7D039AAD4B18481619404D3E578A41585214943FFC8C2A551E2B883C7C4F3544635A1BF5DF178F94B654C63F11E7ABF494B69E
                                                                        Malicious:false
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....;.b.....................v.....................Q....................................................................R......."6.......Z...........P.. W... .........................................................\.......^....................text...H........................... ..`.itext.............................. ..`.data....O.......P..................@....bss....|S...P.......*...................idata.."6.......8...*..............@....didata.^............b..............@....edata..R............l..............@..@.rdata...............n..............@..@.reloc...... .......p..............@..B.rsrc....Z.......Z..................@..@.....................P..............@..@........................................................

                                                                        C:\Users\user\AppData\Local\Temp\mia1\maintenance.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):160624
                                                                        Entropy (8bit):1.9662006432706152
                                                                        Encrypted:false
                                                                        SSDEEP:192:tdMMfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4Cwtq69wWnUgK:tfI/kwAgK
                                                                        MD5:B3C9C9EE0C9C2DCB15CF24D5DF20F4F3
                                                                        SHA1:3B1660EB617CB2751D9CCC79B8C025BD5A7B153B
                                                                        SHA-256:23D6D6041B3025A8B1817B5FC455067B534AD91DCB19A1D09509A3AE55065CED
                                                                        SHA-512:93C5B855AF462D9772754CB46307F5890735F7476D8ECF0F9CF213BC3A32EB4E19E3C48842A68F9D1DD29EAF2A8A2EE4712E917AB05BC121C18BFA77E3250811
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0.\s..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP*.tP).sR..{W..}Y*.vU2.|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...|...r...z...q...w...|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8.....................................

                                                                        C:\Users\user\AppData\Local\Temp\mia1\maintenance.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):374
                                                                        Entropy (8bit):4.773773154848379
                                                                        Encrypted:false
                                                                        SSDEEP:6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82dukT:7INIkU3lkimkU3MIkT
                                                                        MD5:8101E0CC3186C05F85B2CD484D26AE9D
                                                                        SHA1:B3CF33E0784E3A6F3B3FEB2B2501E0BDA5932EFA
                                                                        SHA-256:A0E750466327E92E2DCC96D72A19A7738A65AB765262DF4801E6677528F14D6C
                                                                        SHA-512:DF3692D29CDF0434806A0BCF034AFE6869B0BF5C0BE24F18637D373374C1E1803AC5B6D1F671CCD6E89B313E26F85657EA487A2EBAEAE0B99359A66F21DF910B
                                                                        Malicious:false
                                                                        Preview:IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\pPin32.cpl

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):748544
                                                                        Entropy (8bit):6.286323674013261
                                                                        Encrypted:false
                                                                        SSDEEP:12288:e+hZ8e1+K41szV/m21kOR3kkkZkkIkwkpL88888F888nr8H8J28c9fsxkkKO:B8nK41u4
                                                                        MD5:773A12BFB25161AD84023B21C241A919
                                                                        SHA1:A88488A8BAC4E6615F8A606049D402387DC7076C
                                                                        SHA-256:8A4664B28646291B1FA5C8E16B5709E59D48A3E6B297A2C696F2A65F88A78C35
                                                                        SHA-512:4C7F3950A6ADD9BBF053AAEAA1E365ABF76CF04C87A89F26B4B112CF6A2412F8B2C0FBDFABB305C2FB14B986832122870C7554B7C9362C01CF7A047C5E85B03F
                                                                        Malicious:false
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....T.....................|....................@.......................... ..........................................E............`..............................................................................................................text...4........................... ..`.itext.............................. ..`.data....%.......&..................@....bss.....P...0...........................idata..............................@....didata.............................@....edata..E............0..............@..@.reloc...............2..............@..B.rsrc........`......................@..@............. .......l..............@..@................................................................................................

                                                                        C:\Users\user\AppData\Local\Temp\mia1\pPin64.cpl

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1016832
                                                                        Entropy (8bit):5.979344965125846
                                                                        Encrypted:false
                                                                        SSDEEP:12288:2GBRhi9pc8mQQoBc8wwA21kOR3kkkZkkIkwkpL88888F888nr8H8J28c9fsxkkKO:Px+r
                                                                        MD5:A5646553AE51847135D436820C1F21C1
                                                                        SHA1:F8601BC366E964DBA7F57C71278F451E2A5E49DA
                                                                        SHA-256:740F122FE9707BD4A90048C75B1EB79C86B1B7E852B866517721D2F91CF646C5
                                                                        SHA-512:04E97E2120A4805DCABEE5F3E03AFB1DA3646803F86461DD826A44BB39B99DB3E2600A2F4C24A51450F976660B02DC97C0F7FC349A8E38B131C49E56BF5E1F35
                                                                        Malicious:false
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..d......T.........." ................ .........@..............................p....................................... ..................E.......p............0...z...............f..............................................................h....................text............................... ..`.data...............................@....bss.....................................idata..p........ ..................@....didata.h...........................@....edata..E...........................@..@.reloc...f.......h..................@..B.pdata...z...0...|...T..............@..@.rsrc...............................@..@.............p......................@..@................................................................................

                                                                        C:\Users\user\AppData\Local\Temp\mia1\prereq.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):32639
                                                                        Entropy (8bit):3.2633511856005843
                                                                        Encrypted:false
                                                                        SSDEEP:768:scHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibfi:scXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Dp
                                                                        MD5:3B989C7730DF816A13A88B722A25B021
                                                                        SHA1:882F64912D28ED7C1EE1D59333E934CC73E1C50A
                                                                        SHA-256:9E7054257B4D608BC16547468B0E6D4AA06B0A0CF467CF76CD7ED169979E0B2C
                                                                        SHA-512:36E42A53E3F4956DD87DCBF6E36B43E9210B8A5195684228CCF7C465ECB7105505EAFF01F705B8B4D48631E21C02B443AB871D84415A1597FC4B52B22D18689F
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0.k...TPF0.TfrmDesign.frmDesign.Left....Top.{.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.|\9..P...W...^..._...e...c...i...l...s...{...y...z...|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(..*..-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...

                                                                        C:\Users\user\AppData\Local\Temp\mia1\prereq.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):744
                                                                        Entropy (8bit):4.963019277603885
                                                                        Encrypted:false
                                                                        SSDEEP:12:qITMDIb6UIJTc6S6juINIkU3lkimkU3MIkT:qIMIb6UIJA6SsuINI53ldm53MIk
                                                                        MD5:172D6845744A1EC7DC233E9335C5A47C
                                                                        SHA1:F0E3CB9C55F0F0961EF496D3EBF532943FB155E1
                                                                        SHA-256:7AEF8EF0D965D2AEDDDF2FBC2B99BA2A3E5E96517BCD38ADB1A3315456D16E6F
                                                                        SHA-512:639D0D336EA949B877E12A0DB026FC3D085F3DD2B25A7C5CDCC8850CCD998FCA4364BB18D167454AEDB763793E9D251E08A1A3A06A46117FF0B5B2AE22E06643
                                                                        Malicious:false
                                                                        Preview:IF (checkWINST.Caption <> TRUE) THEN WINST.Visible := True;..IF (checkJS.Caption <> TRUE) THEN JS.Visible := True;..IF (checkDotNET.Caption <> TRUE) THEN dotNET.Visible := True;..IF (checkWINST.Caption = TRUE) THEN WINST.Visible := False;..IF (checkDotNET.Caption = TRUE) THEN dotNET.Visible := False;..IF (checkJS.Caption = TRUE) THEN JS.Visible := False;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\progress.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):25280
                                                                        Entropy (8bit):7.001411886189215
                                                                        Encrypted:false
                                                                        SSDEEP:384:UDxsRBdY8cwyJ+Ic+GJQrSAhn37QpYapNeLNek+vDFNe+sbG7:UibdY8To+G7kYU
                                                                        MD5:BEE5A08C5D6026897685C17652F76383
                                                                        SHA1:BB82039AF48C28009478FCF86F55AF4EAF37D3A5
                                                                        SHA-256:9C7C515DDB9864737330B339F581B2A9562099686930D85793C807AA451429BC
                                                                        SHA-512:D59086FD7176C31B8C3B1271C5D2D63CE9E68D499E2B47DA4B504E72DFB2B9B2D3B5D81EF704D455C69C642C77F990E42DA3A5B3F53DDEE11B27FA5311490E25
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0..b..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data../...TPngImage.PNG........IHDR.......;......T$L....sRGB.........gAMA......a.....pHYs..........o.d../.IDATx..gx...?....{..".n.m....Kh.$.Z ......B..C.!.@......Kl.eK.%Y.m...5........\...m.=.{...p...Yk.. .C6666...ZoM.../.#4.........Q4!A_..?o..........2.....).D$.Aq...WB..hM...i$.;q...l".... M6H.5Q....*....,..QN4..ep..5..A1.P.A_.p.<.g.f4W...>Y...&.....Q.#...../....nccs.....tOr.\.u9.O.11."Y..+.6x~#%.|[3..Ni.A.$......T#...dG.Q..=..G$.A!..!8.s.....v89Q"..E..fB..t.`&..D.8,....D,.8i...'....9:!M%0..J...}YN...

                                                                        C:\Users\user\AppData\Local\Temp\mia1\progress.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):666
                                                                        Entropy (8bit):4.809149901341814
                                                                        Encrypted:false
                                                                        SSDEEP:6:a3jF2duukAiRcjjuukTDoRcjF2duukTDQTjjuukA6uN82du+wg4RBN82dukU3ekd:csIrqar1sIroarIINIkU3lkimkU3MIkT
                                                                        MD5:03D007FB3FC47A2F8CA6EB2C13881052
                                                                        SHA1:3212C3FB7FAA97630F849AD7EBA205D90EAC7EE3
                                                                        SHA-256:692786FB6BF3363DFDD0CDA8013986F4F63FD9209DA6BD1299CC8CF06275DF89
                                                                        SHA-512:A2193DFBB22D9F8EFB3CFFD8F2E4021A3213667F13F218EF1AA9B1DD2BF3044AF1E71CFB19497762A386B6CFB841C4C642C739A52471556ED7C3877907D6EA9E
                                                                        Malicious:false
                                                                        Preview:IF (TestRemove.Caption <> TRUE) THEN CaptionInstall.Visible := True;..IF (TestRemove.Caption = TRUE) THEN CaptionUninstall.Visible := True;..IF (TestRemove.Caption <> TRUE) THEN CaptionUninstall.Visible := False;..IF (TestRemove.Caption = TRUE) THEN CaptionInstall.Visible := False;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\progressprereq.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):24914
                                                                        Entropy (8bit):6.9942673423298425
                                                                        Encrypted:false
                                                                        SSDEEP:384:XAxsRBdY8cwyJ+Ic+GJQrSAhn37QpYapNeLNek+vDFNe+WR+7:X3bdY8To+G7kY5m
                                                                        MD5:6D70B06FDC393A0BDCE00687D3D3C799
                                                                        SHA1:83B092EC82DDF8F54417A9925AD7B002FD23AEAE
                                                                        SHA-256:3DED25DB2B92E4A3932BAA32AA1957C08A8748039552827F4C5D54A487F23D6E
                                                                        SHA-512:1875BE4270EC41829908C3E3FD4663E3C5EFA94F3D161FE709DAE6E9A73FE6868BDD88F2F795875B3893554BD5F6C9CBE2A12A2776AE92DE7B0DE960ED33A416
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0.>a..TPF0.TfrmDesign.frmDesign.Left....Top.w.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data../...TPngImage.PNG........IHDR.......;......T$L....sRGB.........gAMA......a.....pHYs..........o.d../.IDATx..gx...?....{..".n.m....Kh.$.Z ......B..C.!.@......Kl.eK.%Y.m...5........\...m.=.{...p...Yk.. .C6666...ZoM.../.#4.........Q4!A_..?o..........2.....).D$.Aq...WB..hM...i$.;q...l".... M6H.5Q....*....,..QN4..ep..5..A1.P.A_.p.<.g.f4W...>Y...&.....Q.#...../....nccs.....tOr.\.u9.O.11."Y..+.6x~#%.|[3..Ni.A.$......T#...dG.Q..=..G$.A!..!8.s.....v89Q"..E..fB..t.`&..D.8,....D,.8i...'....9:!M%0..J...}YN....

                                                                        C:\Users\user\AppData\Local\Temp\mia1\progressprereq.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):374
                                                                        Entropy (8bit):4.773773154848379
                                                                        Encrypted:false
                                                                        SSDEEP:6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82dukT:7INIkU3lkimkU3MIkT
                                                                        MD5:8101E0CC3186C05F85B2CD484D26AE9D
                                                                        SHA1:B3CF33E0784E3A6F3B3FEB2B2501E0BDA5932EFA
                                                                        SHA-256:A0E750466327E92E2DCC96D72A19A7738A65AB765262DF4801E6677528F14D6C
                                                                        SHA-512:DF3692D29CDF0434806A0BCF034AFE6869B0BF5C0BE24F18637D373374C1E1803AC5B6D1F671CCD6E89B313E26F85657EA487A2EBAEAE0B99359A66F21DF910B
                                                                        Malicious:false
                                                                        Preview:IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\readme.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):32365
                                                                        Entropy (8bit):3.210637703795355
                                                                        Encrypted:false
                                                                        SSDEEP:768:F2HXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfMR:FuXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Dn
                                                                        MD5:8DB37E945737A642476551E6EA537ED5
                                                                        SHA1:2579ECFFD229F167398337358778E032AAAE3E3D
                                                                        SHA-256:4221122F990055367BE3AF2CCD9A8A6A28E4E8A8889B74BD543C70E96FF63527
                                                                        SHA-512:461CD4C6F01A82AC1C6D97968AF1B3CCD6E5D5D8C76C5CDD92822869335C379E8DD07A562DF787232D173588D9DCBC1E3071A5E5BE873D02DE6744BEE599AA92
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0.Y~..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.|\9..P...W...^..._...e...c...i...l...s...{...y...z...|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(..*..-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\readme.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):502
                                                                        Entropy (8bit):4.896842553280578
                                                                        Encrypted:false
                                                                        SSDEEP:6:aHi6GKuMtrk86i6euMtrkeuN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+J:0IMtgfjMtgxINIkU3lkimkU3MIkT
                                                                        MD5:D312F2FDC09193A04578D688A2CA292D
                                                                        SHA1:54BD3AA4CC72E68FC613A4227CADA7AD702D795E
                                                                        SHA-256:DB1C3A93A00A46C77F3E8D19C5DA4D42C54CE58C9EB71B586E512ABEE2D46967
                                                                        SHA-512:A71514B0F31010F7BF23954BCE707A277CA765BC14DDED7D7870615528A7751E4B26E72BB826781BC4F57C2A7C75FCFB92C4BA781AAD58372CF6CECE39832D19
                                                                        Malicious:false
                                                                        Preview:IF (LicenseCheck.Checked = True) THEN Next.Enabled := True;..IF (LicenseCheck.Checked = False) THEN Next.Enabled := False;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\registration.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):32609
                                                                        Entropy (8bit):3.2576929890359447
                                                                        Encrypted:false
                                                                        SSDEEP:768:ewVHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibfg:ewdXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5v
                                                                        MD5:357DC1A87B637A95C2255C15ABDB9765
                                                                        SHA1:B41DBE26DB3C8F489E32096535E7DF8AF5F7859C
                                                                        SHA-256:005829185AC1A56337D40D515C7E8DA84B06A8E7B7487477DE521861248645D0
                                                                        SHA-512:ABBBD816EDDE10AF7612ACCF8858434BD9C17443B92CD7E3966F44B2F624822EE123EAD2DA7F1EF686D76D13FE7C4923F1E3460E0681CB9C239462638D14F677
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0.M...TPF0.TfrmDesign.frmDesign.Left....Top.z.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TLabel.Label5.Left.(.Top.H.Width.8.Height...Caption..&User Name:.FocusControl..Name...TLabel.Label6.Left.(.Top.x.Width.A.Height...Caption..&Organization:.FocusControl..Company...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.|\9..P...W...^..._...e...c...i...l...s...{...y...z...|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a......................................................

                                                                        C:\Users\user\AppData\Local\Temp\mia1\registration.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):576
                                                                        Entropy (8bit):4.8398488933566055
                                                                        Encrypted:false
                                                                        SSDEEP:12:+GYMtg+YMtgdmMtgpMtgxINIkU3lkimkU3MIkT:+ffFmB5INI53ldm53MIk
                                                                        MD5:FF697C2FFA89894EC61F9ADF6839926E
                                                                        SHA1:25CA863E1866D72D2AB76F76B15A7705F2C0CD12
                                                                        SHA-256:C8FDC1180440954E7773ABFA450D153194FA675B8B2764F0300C00A73C989BAC
                                                                        SHA-512:A67389FBA944DEA454F7D4559911F745ADE10A8B3B5ED57A6741546AA4EF77FC47017BC7711A586A19EDFA3825517D78BA46A841B0AB7291B6145EA9B0E63A76
                                                                        Malicious:false
                                                                        Preview:IF (Name.Text <> ) THEN Next.Enabled := True;..IF (Company.Text <> ) THEN Next.Enabled := True;..IF (Name.Text = ) THEN Next.Enabled := False;..IF (Company.Text = ) THEN Next.Enabled := False;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\registrationwithserial.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):33341
                                                                        Entropy (8bit):3.3842477874818355
                                                                        Encrypted:false
                                                                        SSDEEP:768:JdHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfM4:JFXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Dk
                                                                        MD5:8616C794648FD69FAC8F0F88EDB22E4E
                                                                        SHA1:DDDFECF6EA3719E9CEF5C406FD4D525AF7D74A61
                                                                        SHA-256:7E5099588AC9EB46983021CFDFCDDDBEFEBFE4CBD8388A531EDAD35FC3DA842D
                                                                        SHA-512:B1288B55785B0CA40F331AE92460F213A1C8D77037D5ABA6BBBD74882024ABDC8985E10899F4476CFF64D83F424957B11FD0B759B537E2216DB4E146B1CD09ED
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0.)...TPF0.TfrmDesign.frmDesign.Left....Top.v.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.|\9..P...W...^..._...e...c...i...l...s...{...y...z...|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(..*..-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...

                                                                        C:\Users\user\AppData\Local\Temp\mia1\registrationwithserial.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1096
                                                                        Entropy (8bit):4.80637071596533
                                                                        Encrypted:false
                                                                        SSDEEP:12:+GYMtg+YMtgPt0YMtgPrYMtgP0ZYMtgPpDYMtgPuYMtgdmMtgpMtg6tkMtg63Mtz:+ff7kkKSHFmBBApVeN5INI53ldm53MIk
                                                                        MD5:E30F9BD0EB3C6A3372F67E0F8886E28C
                                                                        SHA1:B390AAEDCE02E0A1A031506EE73C313221367BBF
                                                                        SHA-256:905BBFEDE6E19926541295E4599A14169CDC21392388DAE0EE1974A5C827D608
                                                                        SHA-512:CBDCA01D6A8E060307DA35E6F5F5F52D691F0245E285548454B391543680817783CB443046263BEF5BC3B7A774C503771403FC5B76069F02ADD8A72972CE67F8
                                                                        Malicious:false
                                                                        Preview:IF (Name.Text <> ) THEN Next.Enabled := True;..IF (Company.Text <> ) THEN Next.Enabled := True;..IF (Serial1.Text <> ) THEN Next.Enabled := True;..IF (Serial2.Text <> ) THEN Next.Enabled := True;..IF (Serial3.Text <> ) THEN Next.Enabled := True;..IF (Serial4.Text <> ) THEN Next.Enabled := True;..IF (Serial5.Text <> ) THEN Next.Enabled := True;..IF (Name.Text = ) THEN Next.Enabled := False;..IF (Company.Text = ) THEN Next.Enabled := False;..IF (Serial1.Text = ) THEN Next.Enabled := False;..IF (Serial2.Text = ) THEN Next.Enabled := False;..IF (Serial3.Text = ) THEN Next.Enabled := False;..IF (Serial4.Text = ) THEN Next.Enabled := False;..IF (Serial5.Text = ) THEN Next.Enabled := False;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THE

                                                                        C:\Users\user\AppData\Local\Temp\mia1\setuptype.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):33637
                                                                        Entropy (8bit):3.431633511700928
                                                                        Encrypted:false
                                                                        SSDEEP:768:+YHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfQd:+YXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Dp
                                                                        MD5:0ED309FE577738BE9F9EC6E6D4630658
                                                                        SHA1:3D22B4956C8DA2C4E91D99C590E165710915AEC3
                                                                        SHA-256:D65D017C4E6F112F1959F6BBC50FDFF35348596BE68183A5570257A199EAC1A6
                                                                        SHA-512:10E4E1D32E0A47196D18EAFA4FFF03C7F7D36F3AF37E1A0A3DCDE04ADEB3BBF2B3CE51A76D8236CE60AF63D813469BB20E28E997F10BB7986E39DF97B851BFC7
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0.Q...TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TLabel.Label4.Left.(.Top.H.Width.I..Height.!.AutoSize..Caption..Please select a setup type..WordWrap....TBevel.Bevel2.Left...Top.:.Width....Height...Shape..bsTopLine...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.|\9..P...W...^..._...e...c...i...l...s...{...y...z...|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................)..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\setuptype.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):374
                                                                        Entropy (8bit):4.773773154848379
                                                                        Encrypted:false
                                                                        SSDEEP:6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82dukT:7INIkU3lkimkU3MIkT
                                                                        MD5:8101E0CC3186C05F85B2CD484D26AE9D
                                                                        SHA1:B3CF33E0784E3A6F3B3FEB2B2501E0BDA5932EFA
                                                                        SHA-256:A0E750466327E92E2DCC96D72A19A7738A65AB765262DF4801E6677528F14D6C
                                                                        SHA-512:DF3692D29CDF0434806A0BCF034AFE6869B0BF5C0BE24F18637D373374C1E1803AC5B6D1F671CCD6E89B313E26F85657EA487A2EBAEAE0B99359A66F21DF910B
                                                                        Malicious:false
                                                                        Preview:IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\startinstallation.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):47304
                                                                        Entropy (8bit):7.975218070187998
                                                                        Encrypted:false
                                                                        SSDEEP:768:O62E2XFXd2pbhliaeVSCqLgle/miee9GIqeK7+72g4krhEF:O6R2XbaewCsX2eLc+72gbrhi
                                                                        MD5:0F83894104A961DF18AF122437921981
                                                                        SHA1:035D3BCFF5061491EDDD2DD61E06824A6E40F0D2
                                                                        SHA-256:745A0A9C58B0DE05C941D3CD2EE9C88CF56499EBB5B28CFAAA3108A8E65E86B8
                                                                        SHA-512:82CF13239DF3AAED763DF7AC335C3F1431DF6AE4F24A6240398FAF9AFC10F71DD1504B97EA6383F0384D3C8FADB89AC7AACA62D1FE6897F6E257DF35D9F4210C
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top.~.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.:..Picture.Data......TPngImage.PNG........IHDR.......:........]....sRGB.........gAMA......a.....pHYs..........o.d....IDATx.........d.....9.s8t."E.X..T....."z.k.+z..*.T.D@...4A.Io.r..:.M.I2.L... ....z...e....L.ik=...7>..1 :x!........^ppz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\startinstallation.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):374
                                                                        Entropy (8bit):4.773773154848379
                                                                        Encrypted:false
                                                                        SSDEEP:6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82dukT:7INIkU3lkimkU3MIkT
                                                                        MD5:8101E0CC3186C05F85B2CD484D26AE9D
                                                                        SHA1:B3CF33E0784E3A6F3B3FEB2B2501E0BDA5932EFA
                                                                        SHA-256:A0E750466327E92E2DCC96D72A19A7738A65AB765262DF4801E6677528F14D6C
                                                                        SHA-512:DF3692D29CDF0434806A0BCF034AFE6869B0BF5C0BE24F18637D373374C1E1803AC5B6D1F671CCD6E89B313E26F85657EA487A2EBAEAE0B99359A66F21DF910B
                                                                        Malicious:false
                                                                        Preview:IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\startmenu.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):33346
                                                                        Entropy (8bit):3.385772495039534
                                                                        Encrypted:false
                                                                        SSDEEP:768:27HXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibftPV:27XQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Di
                                                                        MD5:79A6D4AC0D44492941DBF1BCF729FCE0
                                                                        SHA1:B9A4351BA665D5F190FDCEAAC2F278214E402628
                                                                        SHA-256:ED50635652C5E71DD4EE1FBEB5B64E312235D3215C519E2DA2966FF44C61745B
                                                                        SHA-512:D0B8A675193F05FFB8A71624E67A0FB63BE6433C73798B675486F6D86181DDE52E1910E51A27E7A61932A0360E2236BE3493196497D9B7C198A8B8CE5F6C2808
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top.z.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.|\9..P...W...^..._...e...c...i...l...s...{...y...z...|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(..*..-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...

                                                                        C:\Users\user\AppData\Local\Temp\mia1\startmenu.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):602
                                                                        Entropy (8bit):4.858794405298382
                                                                        Encrypted:false
                                                                        SSDEEP:12:jOYMtgQeMtg1dsdrHEUxIsdrHExINIkU3lkimkU3MIkT:jXoe3GI1INI53ldm53MIk
                                                                        MD5:5622CBE0342EA56DBEDDB3F036450AE9
                                                                        SHA1:97D52E9CE2FE1BA92BA141BCC66D2ECC6EC93978
                                                                        SHA-256:19878CE6F272ECDBE413786244A8476214F99445EBB85F307E92B07F2A4C8869
                                                                        SHA-512:C1E7CB7493635D368FBB7DA741353C82CB389488E1D8C32CB769FADACE21BC27416E59D2A9525A8DAC1D69195679CE91120496E7A74BF44377E91D97267B231F
                                                                        Malicious:false
                                                                        Preview:IF (MenuGroup.Text <> ) THEN Next.Enabled := True;..IF (MenuGroup.Text = ) THEN Next.Enabled := False;..IF (ISNT.Caption = TRUE) THEN AllUsers.Enabled := True;..IF (ISNT.Caption <> TRUE) THEN AllUsers.Enabled := False;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\update_download.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):32653
                                                                        Entropy (8bit):3.2660830298663956
                                                                        Encrypted:false
                                                                        SSDEEP:768:ytHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibf+:yVXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DV
                                                                        MD5:CB602028339D00C4DBB706C86DF9E389
                                                                        SHA1:F75C115A08686D6A83A660240F54E5234F815688
                                                                        SHA-256:19761B22486D4041528899F9CF8F689648BF17CF8D5418459C67E2F8A0C82CC3
                                                                        SHA-512:1DD03D35D4E9DC4AC7EC1A1403072FD2D092BA8265F045C59B557B191C73839A0DF12223E76B357B37DDBB6BF4D1E8935B86E709B961F1679BC80E18D0CFDD43
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0.y...TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.|\9..P...W...^..._...e...c...i...l...s...{...y...z...|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(..*..-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...

                                                                        C:\Users\user\AppData\Local\Temp\mia1\update_download.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):372
                                                                        Entropy (8bit):4.766720372869046
                                                                        Encrypted:false
                                                                        SSDEEP:6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82duka:7INIkU3lkimkU3MIka
                                                                        MD5:94AD21CCA6267AE8B311FF711DFFAB58
                                                                        SHA1:7D1B91BCD6695D60504A4C37524213CB1D72F113
                                                                        SHA-256:E8853FE461B20AC2EBE5CABB577D2BFCB786D64B2AF63CC882119400A800BA7A
                                                                        SHA-512:CB2DCC281C0D6F07B5448C1195BAD726AE789105CD4B22DC33DB923B900C3627B843E132D38EDBB69D5EC7BDFFE165FD8E6552DFCE677E136EE24ADF32174398
                                                                        Malicious:false
                                                                        Preview:IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

                                                                        C:\Users\user\AppData\Local\Temp\mia1\update_install.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):32712
                                                                        Entropy (8bit):3.276188088838966
                                                                        Encrypted:false
                                                                        SSDEEP:768:TtHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibf3:TVXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5D2
                                                                        MD5:B34F26CDAA44F4052F6E5492DA03A6AF
                                                                        SHA1:C72C7C891DBB2AD7387618B340974EF2E35F2CC0
                                                                        SHA-256:A9DCE5F9493CAD5A2059F3485D37F3B104C3D2F620E707FF5CA01AB441BF2462
                                                                        SHA-512:C23332865986AA058B7677BEF749C42C92F394E495382AF30D4FD761ABA824C634FE22F1F84D3DD2DB8F7BFCC738DB9F18EA20FCEA47F3DD571C79D93714CFF9
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.|\9..P...W...^..._...e...c...i...l...s...{...y...z...|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(..*..-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...

                                                                        C:\Users\user\AppData\Local\Temp\mia1\update_install.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):372
                                                                        Entropy (8bit):4.766720372869046
                                                                        Encrypted:false
                                                                        SSDEEP:6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82duka:7INIkU3lkimkU3MIka
                                                                        MD5:94AD21CCA6267AE8B311FF711DFFAB58
                                                                        SHA1:7D1B91BCD6695D60504A4C37524213CB1D72F113
                                                                        SHA-256:E8853FE461B20AC2EBE5CABB577D2BFCB786D64B2AF63CC882119400A800BA7A
                                                                        SHA-512:CB2DCC281C0D6F07B5448C1195BAD726AE789105CD4B22DC33DB923B900C3627B843E132D38EDBB69D5EC7BDFFE165FD8E6552DFCE677E136EE24ADF32174398
                                                                        Malicious:false
                                                                        Preview:IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

                                                                        C:\Users\user\AppData\Local\Temp\mia1\update_notify_download.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):33015
                                                                        Entropy (8bit):3.3312339385168404
                                                                        Encrypted:false
                                                                        SSDEEP:768:dPHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfW:dvXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Dj
                                                                        MD5:11F85D2CF8875B6F3319A1A04E67D808
                                                                        SHA1:C148A7AC0723FE6246B4DD8FBADF36BE90B74D8E
                                                                        SHA-256:D4ECD2325508B27B31E2A9FD4A996FC449B06469C018E6FF107325D29700E119
                                                                        SHA-512:9D9D08B218CE5634F810FC32CF35146C5183DD7CB51C11A265B3FFFBCAE17737E756BEB34EBBCA8A00B6CD4377C0A0D4E5576AAC923D609E9FA426C8FFB7DE43
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TBevel.Bevel2.Left...Top.:.Width....Height...Shape..bsTopLine...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.|\9..P...W...^..._...e...c...i...l...s...{...y...z...|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(..*..-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\update_notify_download.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):516
                                                                        Entropy (8bit):4.934215231943702
                                                                        Encrypted:false
                                                                        SSDEEP:6:a2P2J2du+P2pVw6P2/u+P2pVIRBN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgf:tI5V50INIkU3lkimkU3MIka
                                                                        MD5:E9C9A11806C14939C22C7EA9FF05EB45
                                                                        SHA1:8E82BDE4A7B9024195641649BF4ACF1DD5F92499
                                                                        SHA-256:F98E5CEB427FD0F0FED3FCF1125856F580547972AF05ECA6D6BE0358F626ECCA
                                                                        SHA-512:E8D605167D01C77964DC649676FD5C5ECEBEE11020951A3DA9D10C49368E46B0FFA761DF6DFF08508214A220B0CCFB539C154F2536ABA7ECD7B63DC2C1B50008
                                                                        Malicious:false
                                                                        Preview:IF (Scheduling.Caption <> TRUE) THEN SchedulingLink.Visible := False;..IF (Scheduling.Caption = TRUE) THEN SchedulingLink.Visible := True;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

                                                                        C:\Users\user\AppData\Local\Temp\mia1\update_notify_install.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):33046
                                                                        Entropy (8bit):3.336672790672221
                                                                        Encrypted:false
                                                                        SSDEEP:768:rPHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibfu:rvXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5D9
                                                                        MD5:673178885A74C5200D7171E1B4E183E3
                                                                        SHA1:5818381EF74CC6B69ECDBCB97705869C059577C4
                                                                        SHA-256:1BBC1EE74DFD9A03B95C25C9B011965A9EB7F5DE01C696992FF88E2DE052806D
                                                                        SHA-512:983AB426C7F766D5656272A1044716D592DA49DEF880B17002AE46F39A9B6EB1C49190A15FAAB6A90934DE2572BB7E06AFC28E3D233E1BBDD6D62AF76C555A48
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TBevel.Bevel2.Left...Top.:.Width....Height...Shape..bsTopLine...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.|\9..P...W...^..._...e...c...i...l...s...{...y...z...|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(..*..-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\update_notify_install.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):516
                                                                        Entropy (8bit):4.934215231943702
                                                                        Encrypted:false
                                                                        SSDEEP:6:a2P2J2du+P2pVw6P2/u+P2pVIRBN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgf:tI5V50INIkU3lkimkU3MIka
                                                                        MD5:E9C9A11806C14939C22C7EA9FF05EB45
                                                                        SHA1:8E82BDE4A7B9024195641649BF4ACF1DD5F92499
                                                                        SHA-256:F98E5CEB427FD0F0FED3FCF1125856F580547972AF05ECA6D6BE0358F626ECCA
                                                                        SHA-512:E8D605167D01C77964DC649676FD5C5ECEBEE11020951A3DA9D10C49368E46B0FFA761DF6DFF08508214A220B0CCFB539C154F2536ABA7ECD7B63DC2C1B50008
                                                                        Malicious:false
                                                                        Preview:IF (Scheduling.Caption <> TRUE) THEN SchedulingLink.Visible := False;..IF (Scheduling.Caption = TRUE) THEN SchedulingLink.Visible := True;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

                                                                        C:\Users\user\AppData\Local\Temp\mia1\update_reboot.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):877
                                                                        Entropy (8bit):5.549505671141563
                                                                        Encrypted:false
                                                                        SSDEEP:24:7a2XxbXGAwkMLcByKiIabA5SUws88Ya+PR4SoPRebZ9D9KHxWl:m2XxbXGAwkriIr4pkebZ9IHMl
                                                                        MD5:624DE50A4A6C0437D980DEA773109FF8
                                                                        SHA1:F249E26093386FFE926030F28FE2B0B4873625DA
                                                                        SHA-256:C4ACFDD3B07FEFA0DB03CD681ECAA839BFB04EB777E526434599B5A41FF59BCB
                                                                        SHA-512:63C82867571F41ADCDE0BF0E6DABABD86A7700D707E3BD302B7375BAFBE5495C8A58233521F5DFA1D39B1F428A07662738ED529EF8E5231869149453C011EB30
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0.Y...TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.k.ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TLabel.Label2.Left...Top...Width....Height.!.AutoSize..Caption.cUpdating $TITLE$ is almost complete. You must restart your computer for the updates to take effect..WordWrap....TLabel.Label5.Left...Top.0.Width....Height...AutoSize..Caption.)Do you want to restart your computer now?.WordWrap....TButton.Next.Tag...Left....Top.E.Width.T.Height...Caption..Restart &Now.Default..TabOrder.....TButton.Back.Tag...Left.I..Top.E.Width.P.Height...Caption..Restart &Later.TabOrder.....

                                                                        C:\Users\user\AppData\Local\Temp\mia1\update_reboot.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):372
                                                                        Entropy (8bit):4.766720372869046
                                                                        Encrypted:false
                                                                        SSDEEP:6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82duka:7INIkU3lkimkU3MIka
                                                                        MD5:94AD21CCA6267AE8B311FF711DFFAB58
                                                                        SHA1:7D1B91BCD6695D60504A4C37524213CB1D72F113
                                                                        SHA-256:E8853FE461B20AC2EBE5CABB577D2BFCB786D64B2AF63CC882119400A800BA7A
                                                                        SHA-512:CB2DCC281C0D6F07B5448C1195BAD726AE789105CD4B22DC33DB923B900C3627B843E132D38EDBB69D5EC7BDFFE165FD8E6552DFCE677E136EE24ADF32174398
                                                                        Malicious:false
                                                                        Preview:IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

                                                                        C:\Users\user\AppData\Local\Temp\mia1\update_setup_account.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):36152
                                                                        Entropy (8bit):3.715506555383873
                                                                        Encrypted:false
                                                                        SSDEEP:768:V/HXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfW:VfXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DZ
                                                                        MD5:6CF506036ACDBE8554FEC0CAD8B54B0F
                                                                        SHA1:5AAEF6089C2410141B02DEC3D33F69CF49FAA1B3
                                                                        SHA-256:33BE77CEB619494276458E4E460FEF863493B4481620B5A67B3A1316D72C1732
                                                                        SHA-512:0668694E92E75FD8224EC27C73855ACC5016ACE6636D441B517030AA14C37751933DF4427D2A2BF9BD9AFE51E55A1615797745D7D8308EA406B6F49DC1B37F03
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0.$...TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TBevel.Bevel2.Left...Top.:.Width....Height...Shape..bsTopLine...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.|\9..P...W...^..._...e...c...i...l...s...{...y...z...|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(..*..-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\update_setup_account.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):872
                                                                        Entropy (8bit):4.899823733661456
                                                                        Encrypted:false
                                                                        SSDEEP:12:7VGYMtgnWMtgn6o1p6o2bMtgCyYo1yYo1vVmMtgxINIkU3lkimkU3MIka:7Vf+youoE4opoVVm5INI53ldm53MIt
                                                                        MD5:6C44799F82A9E3C3F0033400312E777D
                                                                        SHA1:484155839C215464D63745A5A144079E52614D57
                                                                        SHA-256:BD611C8203E1BD9AA67F8D1F99D8F9C103E8B7384FA7BE037ACA92B077DBA74A
                                                                        SHA-512:5C8D32592471A7A9C09479864C48FC80CBFF65F30F673CF01E03C502FD6B70F02C145FE1E6FB30D8EAF0FAA3A00C8AC11F21904921D5B66A822480567CF01D1E
                                                                        Malicious:false
                                                                        Preview:IF (UserName.Text <> ) THEN Next.Enabled := True;..IF (Password.Text = PasswordConfirm.Text) THEN Next.Enabled := True;..IF (Password.Text = ) THEN Exclamation.Visible := True;..IF (Password.Text = ) THEN ExclamationText.Visible := True;..IF (Password.Text <> PasswordConfirm.Text) THEN Next.Enabled := False;..IF (Password.Text <> ) THEN ExclamationText.Visible := false;..IF (Password.Text <> ) THEN Exclamation.Visible := false;..IF (UserName.Text = ) THEN Next.Enabled := False;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

                                                                        C:\Users\user\AppData\Local\Temp\mia1\update_setup_finish.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):160068
                                                                        Entropy (8bit):1.934119010860282
                                                                        Encrypted:false
                                                                        SSDEEP:192:XAMMfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4Cump6KDhT5mI:XeI/STn9
                                                                        MD5:F9ADFD6EC9732629EA7FCDB171B49987
                                                                        SHA1:3092A623D0E27BC5E03DB9EC67997D0E6354E808
                                                                        SHA-256:72ECEDF679889DFE4A64EDB63C9EEFE44E9DBA5DFC0251518B9C06CE0C97AFA0
                                                                        SHA-512:6085EE32FBA8D9E12B26EE0459A7E16EBA3539913AD4272B9B5EF590EC9389F92E0908E1E091A9C0D0E6856C0A79A822701DE9B37512DC4560A91F2E41F05C60
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0.0q..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP*.tP).sR..{W..}Y*.vU2.|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...|...r...z...q...w...|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8.....................................

                                                                        C:\Users\user\AppData\Local\Temp\mia1\update_setup_finish.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):372
                                                                        Entropy (8bit):4.766720372869046
                                                                        Encrypted:false
                                                                        SSDEEP:6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82duka:7INIkU3lkimkU3MIka
                                                                        MD5:94AD21CCA6267AE8B311FF711DFFAB58
                                                                        SHA1:7D1B91BCD6695D60504A4C37524213CB1D72F113
                                                                        SHA-256:E8853FE461B20AC2EBE5CABB577D2BFCB786D64B2AF63CC882119400A800BA7A
                                                                        SHA-512:CB2DCC281C0D6F07B5448C1195BAD726AE789105CD4B22DC33DB923B900C3627B843E132D38EDBB69D5EC7BDFFE165FD8E6552DFCE677E136EE24ADF32174398
                                                                        Malicious:false
                                                                        Preview:IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

                                                                        C:\Users\user\AppData\Local\Temp\mia1\update_setup_schedule.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):33902
                                                                        Entropy (8bit):3.4840746856844267
                                                                        Encrypted:false
                                                                        SSDEEP:768:kHHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfajKk:knXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5D1
                                                                        MD5:FB8DB7BC2352BC8B2189821161CEF379
                                                                        SHA1:B6E94A9213291A2D289C62C4859492A1787D6699
                                                                        SHA-256:189B671D789580967E60E4C8B3ADD804CD4BF16EE1845250260B828D8761E658
                                                                        SHA-512:68DE9CE306C0938988F8CD51FF670A204573591FF8424CFF2C48585EAF7E5E1DE8A396623A2D45497083AF7FE4661AA377A2499A982292FDF21AA708A1CDB369
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0.Z...TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TBevel.Bevel2.Left...Top.:.Width....Height...Shape..bsTopLine...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.|\9..P...W...^..._...e...c...i...l...s...{...y...z...|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(..*..-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\update_setup_schedule.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):974
                                                                        Entropy (8bit):4.892952093471582
                                                                        Encrypted:false
                                                                        SSDEEP:24:o7wKA7wY7wHvWvXvK/vqvqA77wz7wqAPINI53l53dm53MI53k:o7Q7P7e+vaiD77A7MPWq/icqU
                                                                        MD5:D77CCDD3A7937D2219195F35873311D1
                                                                        SHA1:7327FFEBD4F904CE4E1351662D4F26FEE272B973
                                                                        SHA-256:8089C47E824035E10F1CCF9478F72EA4D09FD946AA0AD71C9B8F7471922C3464
                                                                        SHA-512:9DAEDE3C919827762F066D0F3A28AB0174DF6077240B92D49846B9A5B694E0C3DF33B72F7B8FFAB0C1B18315E849052E33BE04BB40927C7D533A669D52D4D5B8
                                                                        Malicious:false
                                                                        Preview:IF (Keep.Checked <> False) THEN Notify.Enabled := True;..IF (Keep.Checked <> False) THEN Download.Enabled := True;..IF (Keep.Checked <> False) THEN Install.Enabled := True;..IF (Keep.Checked = False) THEN Install.Enabled := False;..IF (Keep.Checked = False) THEN Download.Enabled := False;..IF (Keep.Checked = False) THEN Notify.Enabled := False;..IF (Keep.Checked = False) THEN Time.Enabled := False;..IF (Keep.Checked = False) THEN Date.Enabled := False;..IF (Keep.Checked <> False) THEN Time.Enabled := True;..IF (Keep.Checked <> False) THEN Date.Enabled := True;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN InstallAwareX.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN InstallAwareX.Visible := False;..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\update_setup_welcome.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):160143
                                                                        Entropy (8bit):1.9385323471953442
                                                                        Encrypted:false
                                                                        SSDEEP:192:wbMMfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4CBtLzg6T5mWC:wdI/gVK
                                                                        MD5:35F172C45DA2C84338CD11889AE3F058
                                                                        SHA1:57159FC6A38D63A1D776654A13F5EAE6B5A52808
                                                                        SHA-256:77888A511656391F3864564314ECB416797E6D78FBCB4FC8E81F61CE371DD373
                                                                        SHA-512:FF3A9A6952AEACBB94FFFD5759C4BAADBB6172052948874B78520FCB370A05B2F2840274CB9804F59D09172EEBF8EC6ABE0F3A69837FCF16207CD721A661F0F0
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0.{q..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP*.tP).sR..{W..}Y*.vU2.|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...|...r...z...q...w...|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8.....................................

                                                                        C:\Users\user\AppData\Local\Temp\mia1\update_setup_welcome.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):372
                                                                        Entropy (8bit):4.766720372869046
                                                                        Encrypted:false
                                                                        SSDEEP:6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82duka:7INIkU3lkimkU3MIka
                                                                        MD5:94AD21CCA6267AE8B311FF711DFFAB58
                                                                        SHA1:7D1B91BCD6695D60504A4C37524213CB1D72F113
                                                                        SHA-256:E8853FE461B20AC2EBE5CABB577D2BFCB786D64B2AF63CC882119400A800BA7A
                                                                        SHA-512:CB2DCC281C0D6F07B5448C1195BAD726AE789105CD4B22DC33DB923B900C3627B843E132D38EDBB69D5EC7BDFFE165FD8E6552DFCE677E136EE24ADF32174398
                                                                        Malicious:false
                                                                        Preview:IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

                                                                        C:\Users\user\AppData\Local\Temp\mia1\welcome.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):47223
                                                                        Entropy (8bit):7.975755688019769
                                                                        Encrypted:false
                                                                        SSDEEP:768:VG2E2XFXd2pbhliaeVSCqLgle/miee9GIqeK7+72g4krh/:VGR2XbaewCsX2eLc+72gbrh/
                                                                        MD5:197A9BB509D5943B7A9F2ADE53FFB0C9
                                                                        SHA1:56A00C20656B5C6146DBC5622DF9FC2456682CB9
                                                                        SHA-256:514CA52E32550096CB51CADB1FF36CF6B2B03CF0A46E0FA8D37679F0FFE67945
                                                                        SHA-512:B2C57E17F7BEAE3B53D41CCDE26EA05136746E028DE5AC2A06968A1674620E34C179FCA2A24053A35BE94D9DB8FA269F17CEAC4EFA9159E9F3BB1A3AB48EB18F
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0.c...TPF0.TfrmDesign.frmDesign.Left....Top.~.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.:..Picture.Data......TPngImage.PNG........IHDR.......:........]....sRGB.........gAMA......a.....pHYs..........o.d....IDATx.........d.....9.s8t."E.X..T....."z.k.+z..*.T.D@...4A.Io.r..:.M.I2.L... ....z...e....L.ik=...7>..1 :x!........^ppz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\welcome.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):374
                                                                        Entropy (8bit):4.773773154848379
                                                                        Encrypted:false
                                                                        SSDEEP:6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82dukT:7INIkU3lkimkU3MIkT
                                                                        MD5:8101E0CC3186C05F85B2CD484D26AE9D
                                                                        SHA1:B3CF33E0784E3A6F3B3FEB2B2501E0BDA5932EFA
                                                                        SHA-256:A0E750466327E92E2DCC96D72A19A7738A65AB765262DF4801E6677528F14D6C
                                                                        SHA-512:DF3692D29CDF0434806A0BCF034AFE6869B0BF5C0BE24F18637D373374C1E1803AC5B6D1F671CCD6E89B313E26F85657EA487A2EBAEAE0B99359A66F21DF910B
                                                                        Malicious:false
                                                                        Preview:IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

                                                                        C:\Users\user\AppData\Local\Temp\mia1\wizard.dfm

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:JPEG XL codestream
                                                                        Category:dropped
                                                                        Size (bytes):32251
                                                                        Entropy (8bit):3.1896653509607855
                                                                        Encrypted:false
                                                                        SSDEEP:768:arHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfH:arXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DI
                                                                        MD5:8AA68DEE4B3D18226980261469A560ED
                                                                        SHA1:E359A76C34D1F906690054A871C85DFA3A1C88A4
                                                                        SHA-256:D2267023E1F38FA5E44AFDF55B6DD485E25F2F1A8EC82C9E93EB8F137F0FBA2F
                                                                        SHA-512:6FC30F309A79C6A5661E6673B94258B0C1A240ED9934CB3D6A65C76CAAEDA032001A8F4C79416C76D9F278A0ADDFF595D04B1D60A0924363CEBB97311659CF6C
                                                                        Malicious:false
                                                                        Preview:...TFRMDESIGN.0..}..TPF0.TfrmDesign.frmDesign.Left....Top.z.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.|\9..P...W...^..._...e...c...i...l...s...{...y...z...|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(..*..-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...

                                                                        C:\Users\user\AppData\Local\Temp\mia1\wizard.dfm.miaf

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):374
                                                                        Entropy (8bit):4.773773154848379
                                                                        Encrypted:false
                                                                        SSDEEP:6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82dukT:7INIkU3lkimkU3MIkT
                                                                        MD5:8101E0CC3186C05F85B2CD484D26AE9D
                                                                        SHA1:B3CF33E0784E3A6F3B3FEB2B2501E0BDA5932EFA
                                                                        SHA-256:A0E750466327E92E2DCC96D72A19A7738A65AB765262DF4801E6677528F14D6C
                                                                        SHA-512:DF3692D29CDF0434806A0BCF034AFE6869B0BF5C0BE24F18637D373374C1E1803AC5B6D1F671CCD6E89B313E26F85657EA487A2EBAEAE0B99359A66F21DF910B
                                                                        Malicious:false
                                                                        Preview:IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

                                                                        C:\Users\user\AppData\Local\Temp\{152D390A-DD7B-4E57-B3A5-14CADE7E1207}

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):13062
                                                                        Entropy (8bit):5.208134279576298
                                                                        Encrypted:false
                                                                        SSDEEP:192:UVdrqNZrGleRnHmxwvoMb1PXFW15e/K6++SFBGhjXf9nXA7e5lIbfO5t+:KR5+HmxwNPXx/5++SFBG1Cq5lIbfOz+
                                                                        MD5:642B3787730FC08EFA2E300D67B439FE
                                                                        SHA1:433F77E6C9E37D843677582EE361D945D06D0033
                                                                        SHA-256:E1B63B35FBC7338B087828D3E3EFFF7E8B705019D45E96912E56615F869B05B9
                                                                        SHA-512:75C42E207EAC6EF3C0F1C5FA07D4A1D170D02BFB2EDF5D074FF7B559B382C7D0F0F430F888F4191FC5A277B2EA9B9B3244190142709231196E562DC9049FF947
                                                                        Malicious:false
                                                                        Preview:SourceDir..C:\PROGRA~3\miaDC6F.tmp\data\..$ex..MEDIAPACKAGEPATH..\PROGRA~3\miaDC6F.tmp\..$ex..AAE4ED6BA..FALSE..$ex..AAE68B5EB..FALSE..$ex..A2AFAD2D7..FALSE..$ex..A47890F43..FALSE..$ex..AABF0EABC..FALSE..$ex..A5303394E..FALSE..$ex..A36C4273F..FALSE..$ex..ABEFE417A..FALSE..$ex..A2AFAD2D7..FALSE..$ex..A1AAFDCA9..FALSE..$ex..A4D583000..FALSE..$ex..A47890F43..FALSE..$ex..A392822E1..FALSE..$ex..A9202CBED..FALSE..$ex..A2AFAD2D7..FALSE..$ex..A5B95B812..FALSE..$ex..A1983855A..FALSE..$ex..A392822E1..FALSE..$ex..A6C969A31..FALSE..$ex..A86FEDFFB..FALSE..$ex..A280378AD..FALSE..$ex..A895B52CC..FALSE..$ex..A96D781B4..FALSE..$ex..A303D489..FALSE..$ex..A36C4273F..FALSE..$ex..A4D583000..FALSE..$ex..A47890F43..FALSE..$ex..A9EDFEF92..FALSE..$ex..A33529D6E..FALSE..$ex..AD400EB86..FALSE..$ex..A9202CBED..FALSE..$ex..A2AFAD2D7..FALSE..$ex..A5B95B812..FALSE..$ex..A1983855A..FALSE..$ex..A392822E1..FALSE..$ex..A96D781B4..FALSE..$ex..A4D583000..FALSE..$ex..A47890F43..FALSE..$ex..A759968E7..FALSE..$ex..A705D4320.

                                                                        C:\Windows\Crystal\Cdo32.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):53248
                                                                        Entropy (8bit):5.118134691683147
                                                                        Encrypted:false
                                                                        SSDEEP:768:SbaGLiyxVx9+qtwWRnqZk0ca8lKLRT7vGUsbONP0B4s6r1BW:iLlx79+qtwWFqzrlT7vGUqONsFUO
                                                                        MD5:81C8142EED021D18D4ACCEEA8D950068
                                                                        SHA1:435173BAFE04157D0EC140B4F77E1C174A304911
                                                                        SHA-256:C86E55610D35F87CBB29A89ECD0B838C2710BADE0E772977FCEA336FDCFF6451
                                                                        SHA-512:4F169BC6011F8A23C6A71A6C6469EFB26A0ED24BBAA022FF153FC975E762C1FBBDB24D144E1A186ECF1792C353BB7B29E8970687DD333697CC19839B6B13E9D7
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H.3O..]...]...]...S...].Q.V...].Q.W...].Q.Y...]...V...]...Y...]...]...].Z.N...]...\.V.].n.N...].S.V...]...[...]...Y...].Rich..].........................PE..L....`l:...........!.....`...`....../k.......p.....A................................{8.......................................y.......................................................................................p...............................text....^.......`.................. ..`.rdata..R....p... ...p..............@..@.data...............................@....rsrc............ ..................@..@.reloc..2...........................@..B.$.>H....$.>U....v1?_....$.>j.....G?w....$.>....UA.<.....$.>............KERNEL32.dll.NTDLL.DLL.USER32.dll.ADVAPI32.dll.ole32.dll.OLEAUT32.dll.MSVCP60.dll.MSVCRT.dll............................................................................................................

                                                                        C:\Windows\Crystal\Crxlat32.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):24576
                                                                        Entropy (8bit):1.7494209933404663
                                                                        Encrypted:false
                                                                        SSDEEP:96:ejTU6VrXNd5zIrxKnlPJvBCaWNWpUi8par5VqxQDhoK/+YiyhotqG0hoN:ejTU6pP8rYTvCu8pcSQDxwyjG0
                                                                        MD5:449045FAE688D76B18624FE566E32A54
                                                                        SHA1:EA98B0853BA3A310362C43FA9F619238E7CAF947
                                                                        SHA-256:5343CCFE98B12E0D9B064A9AC7291E17086C5853D40E8BC2AEFAADAA09113F67
                                                                        SHA-512:7C366DA72221E9FB01D9927970B7539F89232CD77CD0C3C5C8ADEFF0203D68DD811AFFCA3E198941F28121B0ACEB212459EA8077CF7F5D65D5AC9D2F4BE647EA
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@..!...!...!..*=...!..V....!...>...!...!...!..V....!..n'...!..V....!..Rich.!..........................PE..L...7..9...........!.........@............... ....V@.........................`.......G..............................0"..U.... ..<....@.......................P..................................................0.... ..P............................text...v........................... ..`.rdata....... ....... ..............@..@.data...h....0.......0..............@....rsrc........@.......@..............@..@.reloc..&....P.......P..............@..B.$.>.....$.>%...........KERNEL32.dll.MSVCRT.dll.................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\P2smon.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):192512
                                                                        Entropy (8bit):5.9642286021294835
                                                                        Encrypted:false
                                                                        SSDEEP:3072:068MaRFejZOvjqOTN9cWLBuQVNysFsfEz1vUgfK/vsIzx4yEo9:3cpAW9uQVUpMJvKMaxB
                                                                        MD5:D24020E137BD588D955ACEF0A8E389CF
                                                                        SHA1:7836AAA05532145E85C770EFA6B06398E5DDEF7B
                                                                        SHA-256:815F428668D75B9328ACA5199A601F1DADB949D50D29E510E73E260B76323852
                                                                        SHA-512:EC91F81F66B365D7C4C291D066F64D74A964D3535AFBC72A29C0B6F0DB1B7B260565F26A3CFFB5D4E48C63342B637A65B127019F58982C43593DC81FFD569852
                                                                        Malicious:false
                                                                        Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......'$.cE..cE..cE...Y..dE...Y..aE...Z..gE..=g..`E...Z..gE...Z..gE..Z..aE..e..bE..cE..`E..5Z..pE...Z..nE..cE...E..ef..@E..C..bE..e..bE..RichcE..........................PE..L....A>=...........!.................................................................................................@.......,.......p.. C...........................................................................................................text...%........................... ..`.rdata...J.......P..................@..@.data........P... ...P..............@....rsrc... C...p...P...p..............@..@.reloc...$.......0..................@..B................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\crxf_pdf.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):270336
                                                                        Entropy (8bit):6.270731532321854
                                                                        Encrypted:false
                                                                        SSDEEP:6144:shwrCzCaYgTe2I3J1un3m6fdjR4vAkGh+:shwmPrI3u3pd9kAM
                                                                        MD5:A14947F6BA9E75C5E5C2263157E886CE
                                                                        SHA1:0E39F13BEC51D6CB2F1CFF3F35660B0A2E3C4F40
                                                                        SHA-256:E43F008E7E57BACDD29E02570C4728B720BA2D11D9D269FCFCA54C875715ABF8
                                                                        SHA-512:B7CA2D08D9D5C9D1374CF541BFFF5AC87C2D5C82857AEF1B84BA6307A5157B192AABA62BE399B2B25AAE5176D39E198625A1CBB109B494AEDDC33B4783C73401
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:Km.[%>.[%>.[%>yD/>.[%>yD.>.[%>.G)>.[%>.y.>.[%>.G+>.[%>.y/>.[%>.y/>.[%>.D6>.[%>.D6>.[%>.[$>![%>.y.>.[%>V]#>.[%>n{!>.[%>Rich.[%>........PE..L.....{:...........!......... .......=.......................................0.......................................x.......m..x.......x........................,..............................................|....................................text...b........................... ..`.rdata...j.......p..................@..@.data....[.......P..................@....rsrc...x...........................@..@.reloc...=.......@..................@..B(.m=8......>E......=O....#.?Z...".m=d...'.m=q...........KERNEL32.dll.NTDLL.DLL.USER32.dll.ole32.dll.OLEAUT32.dll.GDI32.dll......................................................................................................................................................................

                                                                        C:\Windows\Crystal\crxf_rtf.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):180275
                                                                        Entropy (8bit):6.1633040175705185
                                                                        Encrypted:false
                                                                        SSDEEP:3072:nl3w8fl441BooG039ZYWI7ge5JC3t11WX3V0v4zSuoMZmbesm:nlrfZfAQ5efC911y3V0qZ2y
                                                                        MD5:A636F5E7FF78759D5F3C677A2875FA2D
                                                                        SHA1:DDCE4DC55DF00A4B6B92FBADDA6CF444B4D82F35
                                                                        SHA-256:7C33447829876F22FA5D5FD5EF2E67AE06B48BB2BA32840CF44F940F2F547DF7
                                                                        SHA-512:8C7A23B9B01075C0355E8889DE007D962E24E84EBA13B896FA8251EF2750D620CDCE74AD423003BFED70C39F7144803089B17C4D949DC9F71714BACC02668E15
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........lx..+..+..+...+...+...+...+p..+..+...+...+...+...+..+...+...+...+4..+..+...+..+Rich..+........................PE..L...M..;...........!.................B....... ...................................................................... ].......Q..x...................................0"............................................... ..0............................text............................... ..`.rdata...?... ...@... ..............@..@.data...08...`...0...`..............@....rsrc...............................@..@.reloc..l........ ..................@..B................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\p2ixbse.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):245760
                                                                        Entropy (8bit):6.5511171261787196
                                                                        Encrypted:false
                                                                        SSDEEP:3072:awe+BmVTUODP/IcpBxWeZlHEphpV9K8yKD4PtBeGiXdMj5Cn:tHBmdUODP/IcpBcCNEphLK5k
                                                                        MD5:B4748AEEB6EDF8C05123B6542A2BE350
                                                                        SHA1:F7165A96833C5ED0A30D15492499FC9DCFD998AF
                                                                        SHA-256:527093225D1B40925B19A3100E305513AD94D1461ECA862B6D4D9642EA0B6885
                                                                        SHA-512:380C9EE7DC5F32563BDBB0D66A25BD7249F91902299B6CECAA4DCBB04564FCA98B95132E9154CE6082A183A1116094120A7325754A9F5EFCB08866FB05C58303
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s..7...7...7...L...2......4..............C..........n..2...7...S......?.....6.....6...Rich7...........................PE..L....Y.:...........!.........`....................h@................................I...........................................<.......`$.......................8..............................................D.......d............................text...T~.......................... ..`.rdata..S........ ..................@..@.data...p...........................@....rsrc...`$.......0...P..............@..@.reloc...?.......@..................@..B.$.> ....$.>-....v1?7...........KERNEL32.dll.NTDLL.DLL.USER32.dll.......................................................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\p2lodbc.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):135168
                                                                        Entropy (8bit):5.712557269847559
                                                                        Encrypted:false
                                                                        SSDEEP:1536:yOHs9nZRvH2PP034ynzO8i9smTlTrHi1w9rDQtztKZChBohB1DcXvvhdBJ1Q:1WPvH2P7yzOJ9zTrHi1w9nQBzKWXvz5
                                                                        MD5:23D3B53421DB2010647BB2379292863E
                                                                        SHA1:49220E4A10E20876CB896DB389345C7B6A9333CE
                                                                        SHA-256:B8CBBA9370F4011891B8DAEF34438DC3E3EF2EE9297D3C207FFE3F5ED380A024
                                                                        SHA-512:8DF554AB0509BFD7B755342E6C78DC4DB7CFAA9D5C42439052EAFECF8853D5753B8975E8B214B75A46DE2C4FF973F8C93F5C358C29158D707F2544FF3901148D
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x@....................,.......P.......,.......T.......................................,.......Rich............................PE..L......<...........!.........p......................................................................................@.......`...x....................................................................................................................text...H........................... ..`.rdata..............................@..@.data............ ..................@....rsrc............ ..................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\u252000.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):24576
                                                                        Entropy (8bit):1.8691527276214883
                                                                        Encrypted:false
                                                                        SSDEEP:96:2IIUH5yvzjhJe5klNxxL3bU1ogumEoQTbbQBCxYmotqDNhoUN:2Ih5yc5klNxxL3boRumErQcDN
                                                                        MD5:9CECBCFF995CF75B752130D3137D39F1
                                                                        SHA1:6893B2B9F32E12E16F2F5C5D9CBEC3E603B4EEED
                                                                        SHA-256:3CCC9887261965B99EC0F2751D3D3096F2E31CBF281E7EA1A9902C814985DB9B
                                                                        SHA-512:DB464E70B3141248B3E63449F15D3CD9937F81207B6E32878AAF570FE7B027E1651061F808AA9670017A00B3694824061F06F03E3F446423A633C892AB08C638
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?...Q...Q...Q.j._...Q...P...Q...B...Q...Z...Q...[...Q...W...Q...U...Q.Rich..Q.................PE..L....Y.:...........!.........@............... .....@.........................`......................................."..6.... ..P....@.......................P..................................................D.... ..T............................text............................... ..`.rdata....... ....... ..............@..@.data...L....0.......0..............@....rsrc........@.......@..............@..@.reloc..b....P.......P..............@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll......................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\u25dts.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):24576
                                                                        Entropy (8bit):1.5243719406147602
                                                                        Encrypted:false
                                                                        SSDEEP:96:R5XacropfVAbDWmqXUv+lzoY9W2+xiRfhDbRIQYcvEYmotqYC1hoa:NrCmbDBqXw+hbWM1aQDmYC1J
                                                                        MD5:6D669FC0192A4F685147B5C7BCF637CD
                                                                        SHA1:ED0FECDD48D49645C89CF23056F9310EEA0BB23C
                                                                        SHA-256:3F75A0AC5BECFB33C9CC0312B486D45BCD528992FD6EABA7FA7A1539FC7F4F49
                                                                        SHA-512:2E23EA333461FE9110E2FA6F83214BA9C83C002EB3CBFF53CB13A30E44619526D00A8ECD87089DEFCED83947D90726BE5687BC4A9B09C07CCC2333A8299C10DA
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........OD..*...*...*..2$...*...+...*.~. ...*.~.!...*.F(,...*.~.....*.Rich..*.................PE..L....Y.:...........!.........@......!........ .....@.........................`.......................................!......` ..(....@.......................P....................................................... .. ............................text............................... ..`.rdata....... ....... ..............@..@.data........0.......0..............@....rsrc........@.......@..............@..@.reloc.......P.......P..............@..B.$.>............MSVCRT.dll......................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\u2dapp.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):28672
                                                                        Entropy (8bit):3.124598839033411
                                                                        Encrypted:false
                                                                        SSDEEP:192:LJ2lGLpG+9B8Rzg1auG+i3OeJrcTtWrgwx9r+jCNFeOp5m:LJ2l69Y4a6eJrUtWrgS9r+jCN3Y
                                                                        MD5:347E011F0164DB9CFAC6BB066BAADEC0
                                                                        SHA1:116E90AD2358FC31F0C9F86035895BFE9A55A8AE
                                                                        SHA-256:67263AF5AD1B9E0CD7A9088B8BA0CA2D05995E73F6E2ADBDDABD53E075BA9533
                                                                        SHA-512:707FA48E83BF497540A8D688975D8A885E005ABA321C179BDD95B123573786BBB29E4CB176D46291E945068D8EFE6047C393E6303F925ADC2F64F9CF551912B9
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1=..u\x.u\x.u\x..@t.w\x..@v.t\x.u\y.[\x..Ck.|\x..|s.w\x..|r.p\x.Z~.t\x..||.v\x.Richu\x.................PE..L....Y.:...........!..... ...@.......*.......0.....@.........................p.......<...............................4.......0..x....P.......................`..................................................l....0...............................text...0........ .................. ..`.rdata.......0.......0..............@..@.data...d....@.......@..............@....rsrc........P.......P..............@..@.reloc..,....`.......`..............@..B.$.>0....v1?=....$.>H....$.>U....$.>a...........KERNEL32.dll.USER32.dll.comdlg32.dll.SHELL32.dll.MSVCRT.dll.....................................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\u2ddisk.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):28672
                                                                        Entropy (8bit):2.744540447798788
                                                                        Encrypted:false
                                                                        SSDEEP:192:X/62KJlTcY9alIW9avJMdVxWH/Y9VP0QCKFYOpf:X/62EcY9JEavOdVxWHQ9VcQCOT
                                                                        MD5:7C94ECB0391127848A8F20AFA8FD63F6
                                                                        SHA1:53B7FC88913CAB7E4E030504E58DFDA87E395ED1
                                                                        SHA-256:BE4C2FE0AF5612C91EAE9AB4D67F5276C46963FACE2D5B734BE7E40B382B7332
                                                                        SHA-512:1AF94DE58B00BE9F49046A0EC5A326957B00550DF5E9F7359CF97FFAF219540C98EBEEA10EEF8CEE7388D4690C9B322624D48962F4628D4D65852D07AE9C1BDF
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................@......<......................................<.......Rich...........PE..L...D.5<...........!..... ...@.......'.......0...............................p.......................................4.......0..x....P.......................`.......................................................0...............................text...`........ .................. ..`.rdata..X....0.......0..............@..@.data...T....@.......@..............@....rsrc........P.......P..............@..@.reloc.......`.......`..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\u2dmapi.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):40960
                                                                        Entropy (8bit):4.318216925570331
                                                                        Encrypted:false
                                                                        SSDEEP:384:6W2HDi9HjAqwwbEdrakQnfsm4taun3RICVM6Db9S6echEFROQk9D7:6WIDiJwuEN/3auBIKMcIHRED
                                                                        MD5:E09FEC233CCD2C6E9D390787D2F87DDA
                                                                        SHA1:264F65809115879521DAAD866792C92D9D3C6539
                                                                        SHA-256:709EFD24B655E782C423D2A73A7B6DB687ADA69FEDC8DED6A0C6081A416E8742
                                                                        SHA-512:E9388F6645A586BCCEE14C5DCABEC47F7B64505C6998C9100A19E32B8ED98BD058458859E2CD6D063CD61E90CD4D812FC47F42BEC54502DEAA31ED13F2F6A4B7
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........a.....................h.......................................,...............Rich....................PE..L...7<.<...........!.....P...@......-S.......`......................................................................Pe......Ha..P...............................(....................................................`...............................text....C.......P.................. ..`.rdata.......`.......`..............@..@.data........p.......p..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\u2dnotes.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):53248
                                                                        Entropy (8bit):5.320336268402508
                                                                        Encrypted:false
                                                                        SSDEEP:1536:MnYrP/rZDN5Cz6y9LUXlnsiUG3eJ/TdY9G:tXrZDazf0lsLY
                                                                        MD5:FE8A13548CB544D484496B67D7D6589B
                                                                        SHA1:933C66BA98D6090E14E04DB3264D674D4C14921D
                                                                        SHA-256:B351DCFBFE03D00A688C488046830D1178A06E6CA86D581388250259098C0C11
                                                                        SHA-512:73FEB19916CC5E25B591D5B197AA38E9DEABBCA71A559A5AEA47DB73E9461E720F0674D2A757026E2076B5A0E67F8460B42278084C614E7EA7918023EEDAC785
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\.Y.=...=...=..Z!...=..&....=...=...=..."...=...!...=.......=.......=...;...=..&....=..Rich.=..........PE..L.....`;...........!.........P............................................................................................h...P.......................................................................................8............................text....x.......................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc..d...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\u2dpost.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):102400
                                                                        Entropy (8bit):5.440036346891534
                                                                        Encrypted:false
                                                                        SSDEEP:1536:1rKnUevheUuLzGUT842VxV40Zi8ooiWC:QtZ6LzLgxhooiW
                                                                        MD5:D6AC6D930525ED743418E29802510BBB
                                                                        SHA1:F4AD2AE3E144F6BD1E103DF5E40654EEAC29A728
                                                                        SHA-256:06228AC38A5052A9430195B1D00546B05E23D0EBE4E93F6E0364D14282369DC4
                                                                        SHA-512:DE41F832F2EB4BDA0C158FEFAD0C0DB9170736A0DF916773286564FADC7E32F1713024CCD4EE8DEF3658F4612AF933DF1A8B6FA312B4B92B5F79E9670C864B05
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Xz.z...)...)...)...)...)...)...)A9.)u..)A9.)...)...)...)~..)...)...)...)...)...)C9.)...)...)...).;.)...)Rich...)........................PE..L...B.|:...........!.................~.............@...............................................................`.......x...d....`..........................................................................l....................................text...z........................... ..`.rdata..8........ ..................@..@.data....N.......@..................@....rsrc........`... ...P..............@..@.reloc........... ...p..............@..B.$.>0....$.>=....$.>J....v1?T....$.>_...........COMCTL32.dll.KERNEL32.dll.NTDLL.DLL.USER32.dll.GDI32.dll........................................................................................................................................................................................

                                                                        C:\Windows\Crystal\u2dvim.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):57344
                                                                        Entropy (8bit):4.985155994169938
                                                                        Encrypted:false
                                                                        SSDEEP:768:r/LUjp/k9cBvKyKjvyalzmxzaoxz8VeqiX9WHFN1T8Oqm/TKFIJsa:8jp/kWBC0aR8nmLKFIf
                                                                        MD5:C57A3BFF1408C33DE5DA5BB1C62ECC5B
                                                                        SHA1:1A4DE7F1677689E71C2AC78080AE62687808FAB5
                                                                        SHA-256:83EFCAC4F78331E6F8F25ABBEBBC11667E11F46627AB188EC7E00BEB51B9DAC9
                                                                        SHA-512:D2E7B4FDF32E45B032823B7A515BB348DB63A1CD63A3EC7D286521FCCDD39870BABD4E82038FE8937CBC8C30F2FF6D2BFBD05F9CE34CFF2A153654B77AFED08E
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^~..?...?...?...#...?..H#...?..4....?...?...?... ...?..4....?...9...?..4....?..Rich.?..........PE..L....Y.:...........!.........P.....................@.................................5..............................p...........P...............................................................................D....................................text...3........................... ..`.rdata..............................@..@.data...............................@....rsrc............ ..................@..@.reloc..............................@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll......................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\u2fcr.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):28672
                                                                        Entropy (8bit):2.6466214442096905
                                                                        Encrypted:false
                                                                        SSDEEP:192:soGk2GtWbZ97gEjWzhQEjIhNFeI59g2jQ66FupdS:soGk2LZ97qljIhNFeW9g2jQ66s
                                                                        MD5:B86749B441E49EBD58141871DA7F8DD7
                                                                        SHA1:83C1D25B2D2803CAB684ECB6F36F2FEAEB79EB4A
                                                                        SHA-256:492C644DBEBB7999EA02E2F2CB562C41D1BB10296BCC72900A59F2CA4D5090B4
                                                                        SHA-512:84DFF0CEA5E6239090AD3797F5062A1F54DA16FF2387998C415A01C175266F9127CC4A123ECBE98DADD4940E125DCD7A08FF9993DC4B671FF058BC251C6DA5FE
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.a./k../k../k...w...k..rI..+k..rI..-k../k...k..Mt..*k..pI..,k...m...k...K...k..Rich/k..........PE..L...B.|:...........!..... ...@.......$.......0.....@.........................p.......)...............................3.......0..P....P.......................`..................................................D....0...............................text............ .................. ..`.rdata.......0.......0..............@..@.data........@.......@..............@....rsrc........P.......P..............@..@.reloc.......`.......`..............@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll......................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\u2fhtml.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):45056
                                                                        Entropy (8bit):3.954164176068831
                                                                        Encrypted:false
                                                                        SSDEEP:384:qi9tF0bg81ZrH7b34Fu2NFuYNFD5Gl8m369SLQJ9yuFpzDt:qiXKbgWrHH3KuIuYzol8m34yuTzD
                                                                        MD5:F61DC6C03816ED80201D25FBBB30FED1
                                                                        SHA1:3AA785941B1FF7A880228248F94148718FC47146
                                                                        SHA-256:5CDC8ADB1C10223A4C3AF25BB192E2FD47F8E83539714661AD4A6FCABB47F163
                                                                        SHA-512:E802DD73A1CA937004B3A47E00FF75B744BB2B00A962559684FA01AFBDFC40C3ED4755BC8B5ACA1C57B9A5075B0FB39B1FBB3DD875D5A4F2CB6A88B4CB4BFDEB
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y........................W.....B.............Rich..................PE..L..../;...........!.....P...P.......O.......`......................................................................ph.......a.......................................................................................`..8............................text....@.......P.................. ..`.rdata..-....`.......`..............@..@.data........p.......p..............@....rsrc............ ..................@..@.reloc..<...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\u2fsepv.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):40960
                                                                        Entropy (8bit):4.1158608664095375
                                                                        Encrypted:false
                                                                        SSDEEP:384:o0a2aB9b6YzTIy2EdQicNtkjmxHSxb/SI9mviJ4zZ95ewFkK492/T:o0aBBMGMy2EdQicNpR2SiqzWQ/T
                                                                        MD5:1AF1B68553F1D5D59158727F6EB49DBB
                                                                        SHA1:7386BEAE5AC29E8240F7C1D651F1B0D09B535957
                                                                        SHA-256:006D43D8400DD964907D0797A9B9E29A8A8964C11BAD3E7A0E35DBE0DB0506D8
                                                                        SHA-512:336C996DDC17F8A7AB39486C6980C88F113B96A672D7243B2971850D3055DC767ED285457374D9B5CEBDAD3BFAA56F7D4774222C7B0CA5D2D63B079B9D354D80
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........cu......................................................!......H.......p"......Rich............................PE..L.....c>...........!.....P...@.......O.......`.......................................................................g.......b..d...............................d....................................................`...............................text....@.......P.................. ..`.rdata.......`.......`..............@..@.data........p.......p..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\u2fxls.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):221184
                                                                        Entropy (8bit):6.073107874518051
                                                                        Encrypted:false
                                                                        SSDEEP:3072:KegzPMHKTjDd/fW+uTASAnjAmqvgvks5eXIm2099RX9O+84IEo5lDNy:hAP0KbdXUAFgZsqImx9OGfo59
                                                                        MD5:E1DCB4C37FCCD79578F1B8E376D1B3F6
                                                                        SHA1:9351C62C6302F62049485E4C15BA909B8E902C08
                                                                        SHA-256:A3186DDE55B8F897C5D953F986B4F0A77797E9617609909C49DA6F3E285AE4B5
                                                                        SHA-512:F5D34E397B5075603384DA42A8617A46834C696720B8B71D3E1384EF6B368422E785127165F34F71A92413980DB510BDD72F24D89E7FAC7C65ED3CE251C36A7B
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P...1.R.1.R.1.R.-.R.1.R...R.1.RI-.R.1.R...R.1.R...R.1.R.1.R.1.R...R.1.R...R.1.R.7.R.1.R5..R.1.RRich.1.R........PE..L.....=...........!.........................................................`......................................`.......p........ .......................@.......................................................................................text...5........................... ..`.rdata..o........0..................@..@.data...............................@....rsrc........ ... ... ..............@..@.reloc.......@... ...@..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\u2fxml.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):225280
                                                                        Entropy (8bit):5.724903191036286
                                                                        Encrypted:false
                                                                        SSDEEP:3072:q54c1n/ypBau8j3dzRTGT2Idm2tbBu5Y6obbliT/mV:q54vaBtzRTf2Bgmb4TmV
                                                                        MD5:F122F3946E0C78A8782BA78153E0A4DB
                                                                        SHA1:2932A0217CF396C3EA1D0014E09D24BA7FD6DFD7
                                                                        SHA-256:33F3970E1C14EDC4962F8394CA7A30F619516EE6A89535DDDF31017EB084DB69
                                                                        SHA-512:15EC323EAA5B1D2863B4AC50A21BCB4647B08A776F7A3C981CCEFB4F0CB6E628A305C060721D0C5494BFDF557706D7415ADD88E5FF6C87B4F0E1F2C83F42B3F4
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@ .w.A.$.A.$.A.$.^.$.A.$Yc.$.A.$.].$.A.$Yc.$xA.$f^.$.A.$.A.$wA.$[c.$.A.$[c.$.A.$.G.$.A.$.a.$.A.$Rich.A.$........................PE..L.....{:...........!..... ...`.......{.......0.......................................a...............................O......xF..d....@.......................`..................................................l....0...............................text............ .................. ..`.rdata..:$...0...0...0..............@..@.data...Q....`.......`..............@....rsrc........@... ... ..............@..@.reloc... ...`...0...@..............@..B.$.>0....$.>=....v1?G....$.>R....$.>\...........KERNEL32.dll.NTDLL.DLL.USER32.dll.GDI32.dll.comdlg32.dll................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\u2l2000.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):24576
                                                                        Entropy (8bit):2.0998953021911198
                                                                        Encrypted:false
                                                                        SSDEEP:96:rIzc50xqjhJtVyhbHxXoCcRXTTpQidqDJpAmJq+QGCGYmotqDMhoDp0LNf:rB5DXwVxXRc9TpQikDDAmJ5QcDMz
                                                                        MD5:3DEE1017263C8973FB882989858A5C2F
                                                                        SHA1:819B77196B265FE25E12BC26B8298C2B20DFF5A7
                                                                        SHA-256:5D64F25968DD379EC2E4C463D0F181463AD7EF476B03D7BA4C730A08FCF8ACD8
                                                                        SHA-512:4557B400B2D8E29B6F82D1F32F74A71E64FC21C45CD9B42BD8976C5BF4811A272FFDC703A7C213DF84EAE0C81239EEFD0EFACFC35392A51D47BF1F7FC49ECABE
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................j................................Rich..........................PE..L....Y.:...........!.........@............... .....@.........................`......................................."..F.... ..P....@..0....................P..................................................D.... ..d............................text...T........................... ..`.rdata..&.... ....... ..............@..@.data........0.......0..............@....rsrc...0....@.......@..............@..@.reloc..~....P.......P..............@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll..............................................................................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\u2lcom.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):106496
                                                                        Entropy (8bit):5.19516961379927
                                                                        Encrypted:false
                                                                        SSDEEP:1536:gw/iTp1rZP6UpbRfOdkWY+o9uLtOpaYlga+gi4+m6bnStQgc:A1lSUTf2YhatKJogi44nStU
                                                                        MD5:1EDC1124D987025B4539C6CCD86FE52C
                                                                        SHA1:76C6558A038714C0671BE517DC3FAA47A9804BCA
                                                                        SHA-256:54EC7365B4C8AF951C0447493D6D0A32CCBE9C1139CAE4D2252D44DC7B1B8E6F
                                                                        SHA-512:18EE07CBAA4A443AD8B61E89BA0E466C065B7BFBE5E14258F280E2C3DD266B0D9F78C0C5580C0F2E3EC3A502D9F7A4AE3A38543F0C8B8178E85EA3C9290CCA72
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............H...H...H`..H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H(..H...H...H$..H...H...H...HRich...H........PE..L...4.v=...........!................;................................................................................:..e....2.......P..@....................`.......................................................................................text............................... ..`.rdata.............................@..@.data...T....@.......@..............@....rsrc...@....P.......P..............@..@.reloc..x:...`...@...`..............@..B........................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\u2ldts.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):24576
                                                                        Entropy (8bit):1.3865196823068335
                                                                        Encrypted:false
                                                                        SSDEEP:96:pvhwqwhJhOjVYee/c5T3mqlh+RIQYcHYmotqYnhoajt5:AqwhJhOBYZ/Q6qT+aQbYnJjt
                                                                        MD5:965D0761E6321DB219C4DA55DE285278
                                                                        SHA1:D36E872C3D44FE152B1707A57D6165F09275C800
                                                                        SHA-256:B61529675C236BE1824D6779C8ECE1363A9BA5470B6F171ACFFBF7009ECEC83F
                                                                        SHA-512:5B321F47D03919C5B77853E8BFFF4BC4D5627FD40E069B693EA259048331BB62A14D9D457A1782E208D0692EEDAC34CB72EA118B6A158DAC7E3D74DDBE159841
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y./.=.A.=.A.=.A...O.<.A.=.@.1.A._.R.>.A...K.:.A...G.<.A...E.>.A.Rich=.A.........................PE..L....Y.:...........!.........@............... .....@.........................`.......N..............................P!..Y...` ..<....@.......................P..................................................0.... ..0............................text...T........................... ..`.rdata....... ....... ..............@..@.data........0.......0..............@....rsrc........@.......@..............@..@.reloc.......P.......P..............@..B.v1?.....$.>#...........USER32.dll.MSVCRT.dll...........................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\u2lexch.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):28672
                                                                        Entropy (8bit):3.267042919287219
                                                                        Encrypted:false
                                                                        SSDEEP:384:KXcrE+FLvbmBhm1xgv/89aZ8EDQgeNQnKkG:KXc4+hvbehU2v/PZ8zQnKkG
                                                                        MD5:BBBC65FDFBE05CF8D64602D96D1CC73C
                                                                        SHA1:3AEDB477B3FCFE064998627DEC3F3E40F11C60D3
                                                                        SHA-256:6A0255417D2197E016BBCA41E3C8849CDE951F30C2168225D550B19A7C3C5DBF
                                                                        SHA-512:66526FBFC157984334C83C42B13DE2DD56C610DFA513637A5B4A9298B4F05AA4015C8532D640FD4A9524080D92B56A7D847575E0E48AB0513B1B66413F276FB1
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...ir..ir..ir...n..hr..ir..Nr...m..lr...R..kr...R..nr...t..hr...R..jr..Richir..................PE..L....Y.:...........!..... ...@.......).......0.....@.........................p.......6...............................3.......0..P....P.......................`..................................................D....0...............................text............ .................. ..`.rdata..^....0.......0..............@..@.data...,....@.......@..............@....rsrc........P.......P..............@..@.reloc..p....`.......`..............@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll......................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\u2lfinra.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):49152
                                                                        Entropy (8bit):5.717620044022021
                                                                        Encrypted:false
                                                                        SSDEEP:768:TuiZXiv6x2/PBTx30WGdoxJ3jiB9WQgK1JJ+Fo7YIi8E1u:Tupv6EZTx3CoxJRQDUoGE
                                                                        MD5:EEACE14739B3E836F44D661C0042F223
                                                                        SHA1:24F5967B7B12DA1ED343A73D723FE6FDFEA7F301
                                                                        SHA-256:11DF90CC11DFEA9D9D7F2DA22CFFEF805CE658F6AB3E2150861EEBF03D690CA1
                                                                        SHA-512:912FBB92B92A3A0BE65514FF13BEB6195A4631EFCDDE4231D48AA516DD59BAEC8D6FD125525B991A95D78B93EB0D6CE75C59D32A2463A83928ECEA8D1BDA5894
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........<...o...o...o9.o...o9.o...oR.o...o..o...o...o...o..o...o..o...o...o...o..o...oRich...o................PE..L....Y.:...........!.....`...p......y .......p.....@................................_g...............................|..[....v..<...............................................................................D....p...............................text...._.......`.................. ..`.rdata..[....p.......p..............@..@.data....<....... ..................@....rsrc...............................@..@.reloc..L...........................@..B.$.> ....$.>-....v1?7...........KERNEL32.dll.NTDLL.DLL.USER32.dll.......................................................................................................................................................................................................................................................

                                                                        C:\Windows\Crystal\u2lsamp1.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):24576
                                                                        Entropy (8bit):1.965175828785223
                                                                        Encrypted:false
                                                                        SSDEEP:192:xGqtPxX4u8XuBxGkkUiRh8jJmmj2sucQgeh:xGqdSP4xPibOMm/Qgeh
                                                                        MD5:7BBBE3749D17CD539623C60F5E023992
                                                                        SHA1:E0769AEA1E7EC30DD33AC022E8C1D0F79983BE36
                                                                        SHA-256:D8F7E302FD89ACD8EE36FAA07214ED3B6039F91EC45F72FC954967C04FE906FF
                                                                        SHA-512:86AEC1D8FC59DD7B8F86815928196798FD6C0288B331B552298CDD157025B7BD3CD9ED84C0A07D4B3D5ED347AC0B2944931AEC9FA15D9ABA1DDFC8796619AE40
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...ir..ir..ir...n..hr..ir..Nr...m..lr...R..kr...R..nr...t..hr...R..jr..Richir..................PE..L....Y.:...........!.........@............... .....@.........................`.......!..............................."......h ..P....@..(....................P..................................................D.... ..h............................text...~........................... ..`.rdata....... ....... ..............@..@.data........0.......0..............@....rsrc...(....@.......@..............@..@.reloc.......P.......P..............@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll......................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Installer\4e3b09.msi

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Revision Number: {D529246B-78E5-4E65-A3A2-8E1040E91E59}, Number of Pages: 200, Title: CF Remote, Subject: CF Remote, Keywords: Installer, MSI, Database, Author: NC SBoE, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0, Template: Intel;1033, Number of Words: 8
                                                                        Category:dropped
                                                                        Size (bytes):868352
                                                                        Entropy (8bit):6.274787053787206
                                                                        Encrypted:false
                                                                        SSDEEP:12288:jvLiSxEFm3BKXsbzlDSJjQ8guBoN2KA2wKc7wMz7:rLiSxdW5BqPA2fc7wMz7
                                                                        MD5:1F0A68D287D329F3417FF4A00030E695
                                                                        SHA1:4C2CAEF856CA27CA5E9364519AF6E078C01C2CF3
                                                                        SHA-256:E91BB183C1AF1B31B10B25D7CB2E2FF9337239EE103CB20D4DE1F67A80E8D85D
                                                                        SHA-512:55444F59936DC13834127C428CAD25A2F2CAE47D6ABCC3864212049E2FB5E89A9DF9E2D36037D19DF10EA5267C73CAEA90E7F32B28A02426C4ED7D1EE9E75B1B
                                                                        Malicious:false
                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Installer\4e3b0c.msi

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Revision Number: {D529246B-78E5-4E65-A3A2-8E1040E91E59}, Number of Pages: 200, Title: CF Remote, Subject: CF Remote, Keywords: Installer, MSI, Database, Author: NC SBoE, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0, Template: Intel;1033, Number of Words: 8
                                                                        Category:dropped
                                                                        Size (bytes):868352
                                                                        Entropy (8bit):6.274787053787206
                                                                        Encrypted:false
                                                                        SSDEEP:12288:jvLiSxEFm3BKXsbzlDSJjQ8guBoN2KA2wKc7wMz7:rLiSxdW5BqPA2fc7wMz7
                                                                        MD5:1F0A68D287D329F3417FF4A00030E695
                                                                        SHA1:4C2CAEF856CA27CA5E9364519AF6E078C01C2CF3
                                                                        SHA-256:E91BB183C1AF1B31B10B25D7CB2E2FF9337239EE103CB20D4DE1F67A80E8D85D
                                                                        SHA-512:55444F59936DC13834127C428CAD25A2F2CAE47D6ABCC3864212049E2FB5E89A9DF9E2D36037D19DF10EA5267C73CAEA90E7F32B28A02426C4ED7D1EE9E75B1B
                                                                        Malicious:false
                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Installer\MSI3C42.tmp

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):389632
                                                                        Entropy (8bit):6.443465180760872
                                                                        Encrypted:false
                                                                        SSDEEP:6144:zgj8g8Sy2AoNSlkJAiL9svGFXFPvA2wKcWQwMYW7rmk:zQ8guBoN2KA2wKc7wMz7
                                                                        MD5:89B5903624F9CDED346676E88F918693
                                                                        SHA1:162201E4E31FB327E0B16531C81041DC574A04A4
                                                                        SHA-256:851BB0A420E47AF2F49518FAE86E4B9755BD5DAA6E9EB3B2F1FC4585B6F05163
                                                                        SHA-512:FD2587EF52E43EC131E4D06A34306E038B85B98E9EE2866FFD117E906B019FBA6972B794BEC2A9E0FEF357E199A0D13E64A89D4356EA8BF6CAFD6A289B1B48A7
                                                                        Malicious:false
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...>=xQ............................d........ ....@.....................................................................E............p...&.......................}...................................................................................text............................... ..`.itext..|........................... ..`.data....,... ......................@....bss.....P...P.......8...................idata...............8..............@....didata..............J..............@....edata..E............L..............@..@.reloc...}.......~...N..............@..B.rsrc....&...p...&..................@..@....................................@..@................................................................................................

                                                                        C:\Windows\Installer\MSI3CDF.tmp

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):144384
                                                                        Entropy (8bit):6.043448081977129
                                                                        Encrypted:false
                                                                        SSDEEP:1536:bzfplpotJ+Tc5x5XJAIu7+zc2X5X1DznQyrvDklgXUEfbSorHqSCdZQVTbe6Kion:bjbp4gcXsnuRfklg8orHqnzT9ioO
                                                                        MD5:6484BEE1546FEB56595EAACF5D019C55
                                                                        SHA1:CBFE2EBE0485E447F1887F52D5A3CFA480A8FBBE
                                                                        SHA-256:FB73F1E2A71635F6F1F10FB7C7B738E4CE5125C3841B1A656A5F2CD406BDDFB2
                                                                        SHA-512:538A1B8981BAF6F35FE58CC862FAA5AF27D68E93572C5E4EF6719E1CF4A9B1A4AC9E61FFA22EBC1E9AEC0FDEB88AF54FE8834B8C384B596A889C07E63C031ECE
                                                                        Malicious:false
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?=xQ.....................f......|.............@.....................................................................D....`..................................d+..................................................Xb.......p.......................text............................... ..`.itext.............................. ..`.data...h...........................@....bss.....N...............................idata.......`......................@....didata......p......................@....edata..D...........................@..@.reloc..d+.......,..................@..B.rsrc................"..............@..@.....................4..............@..@................................................................................................

                                                                        C:\Windows\Installer\MSI3D7C.tmp

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):144384
                                                                        Entropy (8bit):6.043448081977129
                                                                        Encrypted:false
                                                                        SSDEEP:1536:bzfplpotJ+Tc5x5XJAIu7+zc2X5X1DznQyrvDklgXUEfbSorHqSCdZQVTbe6Kion:bjbp4gcXsnuRfklg8orHqnzT9ioO
                                                                        MD5:6484BEE1546FEB56595EAACF5D019C55
                                                                        SHA1:CBFE2EBE0485E447F1887F52D5A3CFA480A8FBBE
                                                                        SHA-256:FB73F1E2A71635F6F1F10FB7C7B738E4CE5125C3841B1A656A5F2CD406BDDFB2
                                                                        SHA-512:538A1B8981BAF6F35FE58CC862FAA5AF27D68E93572C5E4EF6719E1CF4A9B1A4AC9E61FFA22EBC1E9AEC0FDEB88AF54FE8834B8C384B596A889C07E63C031ECE
                                                                        Malicious:false
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?=xQ.....................f......|.............@.....................................................................D....`..................................d+..................................................Xb.......p.......................text............................... ..`.itext.............................. ..`.data...h...........................@....bss.....N...............................idata.......`......................@....didata......p......................@....edata..D...........................@..@.reloc..d+.......,..................@..B.rsrc................"..............@..@.....................4..............@..@................................................................................................

                                                                        C:\Windows\Installer\MSI3DAC.tmp

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):144384
                                                                        Entropy (8bit):6.043448081977129
                                                                        Encrypted:false
                                                                        SSDEEP:1536:bzfplpotJ+Tc5x5XJAIu7+zc2X5X1DznQyrvDklgXUEfbSorHqSCdZQVTbe6Kion:bjbp4gcXsnuRfklg8orHqnzT9ioO
                                                                        MD5:6484BEE1546FEB56595EAACF5D019C55
                                                                        SHA1:CBFE2EBE0485E447F1887F52D5A3CFA480A8FBBE
                                                                        SHA-256:FB73F1E2A71635F6F1F10FB7C7B738E4CE5125C3841B1A656A5F2CD406BDDFB2
                                                                        SHA-512:538A1B8981BAF6F35FE58CC862FAA5AF27D68E93572C5E4EF6719E1CF4A9B1A4AC9E61FFA22EBC1E9AEC0FDEB88AF54FE8834B8C384B596A889C07E63C031ECE
                                                                        Malicious:false
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?=xQ.....................f......|.............@.....................................................................D....`..................................d+..................................................Xb.......p.......................text............................... ..`.itext.............................. ..`.data...h...........................@....bss.....N...............................idata.......`......................@....didata......p......................@....edata..D...........................@..@.reloc..d+.......,..................@..B.rsrc................"..............@..@.....................4..............@..@................................................................................................

                                                                        C:\Windows\Installer\MSI3EA7.tmp

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):83494
                                                                        Entropy (8bit):5.5896592705958685
                                                                        Encrypted:false
                                                                        SSDEEP:768:RSBy/r4EAt/D25v7l4NBf/TxNQ6b7Ndp8W7fZudiuKlbBWHRE9rDvZF3qUfQSUvG:4s4EAt/a5v7mbQq9PZVqUf6ji
                                                                        MD5:D6B7B225AE909AAF5D574E5CF3BEDCCB
                                                                        SHA1:F59C85AD19E09ED0CFF2EBBEAC79C5FA53F2D270
                                                                        SHA-256:45158E54481206B8DAA71DC6C5BE70DF5A2EF32108A4ECE2065110041D7E78ED
                                                                        SHA-512:A5C8B7605DD521D9084D7A2EB70C1B723224AB837764DE616634F039F91973A7176B6C59936D7ABD2AA75AAF3EBA198CA18BC3F65072109089856F3DF304AAD8
                                                                        Malicious:false
                                                                        Preview:...@IXOS.@.....@n.7X.@.....@.....@.....@.....@.....@......&.{152D390A-DD7B-4E57-B3A5-14CADE7E1207}..CF Remote..cfrv_4_0_setup_ALL.msi.@.....@!....@.....@........\PROGRA~3\miaDC6F.tmp\&.{D529246B-78E5-4E65-A3A2-8E1040E91E59}.....@.....@.....@.....@.......@.....@.....@.......@......CF Remote......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@_....@.....@.]....&.{DBAF7F90-6797-4BCB-8426-E799FE0D75FA}...@.......@.....@.....@......&.{10B1E2F4-E12B-4D18-847D-3579632C4DA0}...@.......@.....@.....@......&.{70233733-63B7-4686-8B22-F467B98A5511}...@.......@.....@.....@......&.{100D9843-4837-4C77-9382-C4AB79C16EC6}...@.......@.....@.....@......&.{360CA8FA-B89D-40E5-8E5D-E0358F8448B5}...@.......@.....@.....@......&.{AAA707EE-74C6-4091-8DF1-A6063B1CAF22}...@.......@.....@.....@......&.{9C72C003-1DC2-41F4-AD0C-E99FEB6FE846}...@.......@.....@.....@......&.{E66B3D7D-9A68-4B63-9A00-00FE935

                                                                        C:\Windows\Installer\SourceHash{152D390A-DD7B-4E57-B3A5-14CADE7E1207}

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Cannot read section info
                                                                        Category:dropped
                                                                        Size (bytes):32768
                                                                        Entropy (8bit):3.4406640450836017
                                                                        Encrypted:false
                                                                        SSDEEP:96:z1HN7gi1Iq+Y+cPnLqfVxNspq+9L3UXvbTllARl9SvR3cjVJY65B8iC+4sObNm:zFNh1I7ZcP+PNN+yXv692R+VJYwMvbU
                                                                        MD5:7C42777A7105857554B3DD11A18B9B8D
                                                                        SHA1:2A1B8634F156966C8D76BF4E7EC19CB92263B0EA
                                                                        SHA-256:B115F28554892421B83F89B32E0B95914EAAC02DCA1CFD9D5FF1C7151DFF9727
                                                                        SHA-512:0184EA0A7948310B9C86701843EC0300E2FCB4DE3C571D00335EC37204023FE4283B3BD271D535FF6C9C43D61CB5B3CC1B85F98BC5D8D3D52E18B8737FEF6434
                                                                        Malicious:false
                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Installer\inprogressinstallinfo.ipi

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Cannot read section info
                                                                        Category:dropped
                                                                        Size (bytes):20480
                                                                        Entropy (8bit):1.8467987279471032
                                                                        Encrypted:false
                                                                        SSDEEP:96:thN1nFT3IIhRT8lMTwCRmz8e/mqscIXbcP91GxbOVe:t1FcugIw94JrcF1He
                                                                        MD5:FECF5326CC167D6DA554E4C3A9776D82
                                                                        SHA1:3F7F3C30B365B0F5BA45AEB8F08A79397D044A09
                                                                        SHA-256:597AE0E5BF6E5E2C4CA512351A9697B889F39E7CF1E23AEBEB508C18C6C6C25C
                                                                        SHA-512:58F71C49C601FD3087693A96679B166277FEE4F210B287D0E0CC8331412E8F83096A9A3261404AD3095F2F4FC6F5E76F0B8233543458FAEE4399E8A906A326FC
                                                                        Malicious:false
                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):432221
                                                                        Entropy (8bit):5.375162936988493
                                                                        Encrypted:false
                                                                        SSDEEP:1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgau6:zTtbmkExhMJCIpErX
                                                                        MD5:85737CE898EEC61FAEB1D99252C8098F
                                                                        SHA1:24EB800D35C4612BE42AEB02DAD60F005B83D9CB
                                                                        SHA-256:B1C1EDE2DA67E1403A29452E58B5F4A40B49C703C2BBA9045C589FC8CCBA476D
                                                                        SHA-512:4317A9672DA8CA01E3F8B332E89591793FDB92F650D3C6B0880CC0FBFB8861E4EAF406B4C743A2FDDB245204A6E059EFC040AEC650C0F04D77DE3F4315973B3F
                                                                        Malicious:false
                                                                        Preview:.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

                                                                        C:\Windows\SysWOW64\CRBAS15.DLL

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):307200
                                                                        Entropy (8bit):6.383146474711384
                                                                        Encrypted:false
                                                                        SSDEEP:6144:mzdLJkXstL6iKvwzVLb34armOHi7+m463cG/CzQYQ8rk4TCmiSippnec:mxJkXWL6iKvwzVLb34armOHi7+oXzff6
                                                                        MD5:FD64262820E74C63BB0D97061776C234
                                                                        SHA1:28FC641E0154BCFDF383EDB9D28245F2873E4A12
                                                                        SHA-256:2AE2BC42BC655010F11C2686EE4C318F07D6C1CF3EBC79A8E1FBDB57A49A2CC4
                                                                        SHA-512:C26D4400EB99A425C886C1707D00A87018D4B0375FCFF39F127DC8CD26DA5114D73233868B99317C7415366D9B26D861DE321110F0F14E31623560A7F0F66826
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?..l{.{?{.{?{.{?..w?z.{?{.{?z.{?..h?..{?..u?z.{?..q?..{?{.z?..{?..p?W.{?..}?z.{?...?}.{?Rich{.{?................PE..L... .t9...........!.....@...`......./.......P.....(....................................................................\......d....`.......................p...4...................................................P..4............................text....4.......@.................. ..`.rdata......P.......P..............@..@.data....V.......`..................@....rsrc........`.......`..............@..@.reloc..N8...p...@...p..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\SysWOW64\CRBAS15R.DLL

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):32768
                                                                        Entropy (8bit):2.8457754129966433
                                                                        Encrypted:false
                                                                        SSDEEP:384:7GiZrKbKxGbk5MOqerr5iKVHHgEKZ2ajjH:tWbKxGbk5MOqirbngbj7
                                                                        MD5:2D9A1115B872258CFCD657E32A2955B8
                                                                        SHA1:23021F48D1F741BF04F79DB49202A0A3243F3D05
                                                                        SHA-256:5D137E1FE18A51D7A7AA6B5F67BA55E00ADB44155F771F81F56A22418FA8EB6F
                                                                        SHA-512:F08CEFE2F8D208CBD554B673300536C69C0F08B016B236293CAED0E62C7393CBABC4F8D377EC5BB05D902DAA96B3370648CF188C0B5A0989AFBEFCDFE0B3F205
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.hG]..A[.Rich.A[.................PE..L...M.t9...........!.........p...........................................................................................................]...................p.......................................................................................rsrc....].......`..................@..@.reloc.......p.......p..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\SysWOW64\CRUTL15.DLL

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):290816
                                                                        Entropy (8bit):6.551645416298201
                                                                        Encrypted:false
                                                                        SSDEEP:6144:sP1hcYD9DDW+j8PPk/axspmqPugvLRyoVLNMIrZO:sPPZ9Dq+oPkwspm2+uO
                                                                        MD5:DFCEEBC9D6DBB3DB56B735C7020A35D1
                                                                        SHA1:189F681C860D15E997F3ED4502D747F25656BAC1
                                                                        SHA-256:09687C007B9D0C4047BC42C58C54E6DB62B9614306AC6DCBCD1B7532CF5ACF17
                                                                        SHA-512:15E73EFE925572ED9FDD11C316255880F7F131BEE084121B28B8507AB88E95FC22CDB9D606481CA499BD2BFDB61E871A2F026CEC56F5B747388237E3FB752351
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'"..cC.OcC.OcC.OcC.O.C.O.\.OkC.O.\.OeC.O.\.O.C.O._.OvC.OcC.OfC.O.c.O.C.O.E.ObC.O.c.ObC.O.c.ObC.ORichcC.O........PE..L...K.j9...........!................G0.....................................................................................`...x....@.......................P...8...................................................................................text...R........................... ..`.rdata..............................@..@.data...............................@....rsrc........@....... ..............@..@.reloc...?...P...@...0..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\SysWOW64\CRUTL15R.DLL

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):20480
                                                                        Entropy (8bit):1.807152052248964
                                                                        Encrypted:false
                                                                        SSDEEP:96:5qsN56E9EADBVzBDaZBcG6fyXmuY+eQ5TMbKGbMH7x6sTFw+YprWUUsmn+sWiNBg:5qP1ADhAZXmuY+LubKRc6smh7
                                                                        MD5:859751A660914A75FB9062E47B7111B5
                                                                        SHA1:741752CECE787A377987A3C329238E87B1AEBBAE
                                                                        SHA-256:7DDDB9C0D38C2BC47EA44B0B5F73A1A6411BC0069AFD4B42AECD79C92D1666FE
                                                                        SHA-512:8D8D3278111BCEA19781A3523F863B378BDA40D8AB580775CE6664F080777E5F83C4F0EAA42A98363A0842F6DE9FD47CEDB1AE5DD42AC5D04BB046A6213A4F94
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.hG]..A[.Rich.A[.................PE..L...E.j9...........!.........@...............................................P..........................................................X!...................@.......................................................................................rsrc...X!.......0..................@..@.reloc.......@.......@..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\SysWOW64\CRXML15.DLL

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):167936
                                                                        Entropy (8bit):6.187995719559416
                                                                        Encrypted:false
                                                                        SSDEEP:3072:RiT9Mjz9fxT8ms8xHZaKV6AORqrkcNnVn6u7OtP:RvfxFHZdYOk4nVnf
                                                                        MD5:56A8FDC2477954D863C92D08675FFE57
                                                                        SHA1:00E91FC7856C20F05E7203CE3BA72F2F0F78BEB2
                                                                        SHA-256:B39FE18BFA62BA1A2F1D680B3505100448F3CB3ABE49B6D55B3DFFDF430E25BE
                                                                        SHA-512:233379A84A523A890E593C7550344CCA982E18A5F5A91B42209304279CD0F0798AEC67D9BC897769A537C2DB617E9A2210EB5A5E1A0E6C388AC0A70CE8A40FD6
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................%....Y..........Y.....a....Y.....Rich...........................PE..L...E.=9...........!.............................n(.................................................................................`.......................p..X....................................................................................text...r........................... ..`.rdata..sf.......p..................@..@.data....+...0...0...0..............@....rsrc........`.......`..............@..@.reloc.......p... ...p..............@..B................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\SysWOW64\CRXML15R.DLL

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):20480
                                                                        Entropy (8bit):2.452431739694398
                                                                        Encrypted:false
                                                                        SSDEEP:96:50f6X9EKZaMwah+RtQl9X8N5MMJigpFnUqmspl65z+muijdwMDRaaPp/MQaf:50CaKHwah1wF3TWd/Rama
                                                                        MD5:3243A8F5DB572EAE76FE2348B2E106C0
                                                                        SHA1:9DCEE517723C6B2206C83C065B4C0B889B69E0DD
                                                                        SHA-256:B7714239D578D588B1AECC55E89DC6327716F43A4CB68627ABFE30AB344AF460
                                                                        SHA-512:98F5F5BCACB3B86EA05E493883D62744E20351334A71D7E3066D177797BD132A51B647C60A485E05041E3A1F6003E0D093D267AEFD0AA5DD3008C44676426E05
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.hG]..A[.Rich.A[.................PE..L...G.=9...........!.........@...............................................P...........................................................+...................@.......................................................................................rsrc....+.......0..................@..@.reloc.......@.......@..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\SysWOW64\CRXML15S.DLL

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):40960
                                                                        Entropy (8bit):4.673313433135478
                                                                        Encrypted:false
                                                                        SSDEEP:384:xEXQnim4w2xSKOJtcLFZdMQzf3M7TnSYkN9A/hqycPGSpzuE8d+chaz:xEcim4uUFgQzf4nSH9A/hqycesuac4z
                                                                        MD5:1783A2BC9AB938AD923D2040B4ABB243
                                                                        SHA1:CA6EABACF16E56723429F65CC5D592699015783A
                                                                        SHA-256:0D4B4BAE969E25267C54B367AC9760A718869ACB793CC1380D3A37767BC8E63C
                                                                        SHA-512:1A3790C55A7015F4D867C76CB6F4E2D483818A9534E5F4EAD73E44E19B876672EE4A9AEA9A4960E37F729B3C428C40755023FDA7D197064793002B2FFD5AFC20
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*...*...*...*...*...5...*..X6...*..$....*...*...*..$....*...,...*..$....*..Rich.*..........................PE..L...].=9...........!.....0...`......j6.......@.......................................................................N...... C..................................@....................................................@...............................text....,.......0.................. ..`.rdata..d....@... ...@..............@..@.data........`... ...`..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\SysWOW64\CRxmlx07.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):942080
                                                                        Entropy (8bit):6.65646975675861
                                                                        Encrypted:false
                                                                        SSDEEP:12288:c30LOWsXFbwAlSc96WPwYW0WxgERNUzD71h1PTMNy:vLOWsXiAlS86WPhOvNUANy
                                                                        MD5:4FCCBA7B1CDF3BC6EA31F1B0627AE8EC
                                                                        SHA1:770725AF1E58CA070AD3456D8572B3E04A70B7EA
                                                                        SHA-256:D97B3B00646FED52DF6855EFBA4269B63F1263EF32B3E477E1E2236A7F126F4E
                                                                        SHA-512:0786A923077CC4BA30E79C052590D571F54DF3E3B01BC6F9781B7E0ACF0E3F5D2549641C1CA11ABDCA064D88728F33B7E63C07DFE0D09D19AE339ECB6F86F6E3
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^x4...Z...Z...Z.a.V...Z.G;Q...Z..T...Z.G;P..Z.L.I.c.Z.D;Q...Z...[...Z.x.I...Z...Z...Z..9Q..Z.E;Q.0.Z...\...Z..9^...Z.Rich..Z.........PE..L......:...........!................g................................................................(..............p...>........................................v...................................................................................text............................... ..`.rdata..............................@..@.data....>..........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\SysWOW64\CRxmlx07r.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):69632
                                                                        Entropy (8bit):3.5687827741608045
                                                                        Encrypted:false
                                                                        SSDEEP:1536:ZWJaaymHs15LBdFElh9aaaD+FdhaG9AFqg24CHgSz+Qar:ZWJaaymHs15LBdFElh9aaaD+PUG9AFqQ
                                                                        MD5:E8C7545574E4D9E9992CB5B9331271CC
                                                                        SHA1:CF271D3B4A88DA069E61D1269DC8EE412695C69D
                                                                        SHA-256:14A788E493779B3FD96C1F94D7154642E79F34594B978A6A7E39C97BEC5F7E5B
                                                                        SHA-512:F4A5E5D7F2D162260F150E4F3069F707E0D3C291E0766720E813F5A40D410A67AC18DC03ED5DC7B5DF579A8A3BFCA4F5EF667D16733B853D11104F0C7F165E90
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.hG]..A[.Rich.A[.................PE..L......:...........!.................................................................................................................................................................................................................................rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\SysWOW64\Crpaig80.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):622592
                                                                        Entropy (8bit):6.077970194897055
                                                                        Encrypted:false
                                                                        SSDEEP:12288:H31fVUPM+u1u6RS/olZNeQ1d6JjH/bldq8CMKtBBxSftKaXnDsju:7UP3u17xJ1cHrqTxGt9Xg
                                                                        MD5:48713A483F2C48ECE4AF4F098A13469F
                                                                        SHA1:D8F6BEDF737C52DA16B560E96DCE45889162D50B
                                                                        SHA-256:D6E26D47CC578B701FBB9491D8DC5B3CAB317FE92F447387905755AB8F2DC991
                                                                        SHA-512:2F01361C7B3D5326B2BC9D86DA47F49E98380DFA967C33E4DBB446C02278F412EDE5D9088F431E2E3EF3960E7F6F858C94F53F576CE3C87C2356FA7919758849
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X..c...c...c..o...c.,.m...c...i...c...g...c..p...c...b.=.c...S...c...R...c.h.e...c.P.g...c.Rich..c.........PE..L...8Y.<...........!.........p......U...............................................................................@...........d....`..|....................p..L.......................................................P............................text...V........................... ..`.rdata........... ..................@..@.data...<"...0... ...0..............@....rsrc...|....`.......P..............@..@.reloc.......p... ...`..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\SysWOW64\Crpe32.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5042233
                                                                        Entropy (8bit):6.348947882126544
                                                                        Encrypted:false
                                                                        SSDEEP:98304:WJdA7Kn4uYmR88wV1s8dxnve1RZ3BUE9nPdf9avG37EuY:WJy7OymLH8dhg3jPdWGLO
                                                                        MD5:2517D67C02B04B3D07FEF74501D6E303
                                                                        SHA1:8FE46EFC7F3810358F31AC45B87BB54F08C4FFFE
                                                                        SHA-256:A1B0116C01EFB841A263DF2A7BA261FB1B131169C0974E90383535F90C704C83
                                                                        SHA-512:3032B05A178BA384693A02AC221B394CA3FDA60D7A0EB2D4039A31C527721FF458A1E486CC0C32834E35A3A2D3F4EF0237368D7E5F084267327EB650239CD3E1
                                                                        Malicious:false
                                                                        Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.........."..q..q..q..q..q...q..q..q..q..q..q..q..q..q..qn..q..q..q..q..q..q...q..q...q..q..q..q...q..q...q..q...q..q...qb.q*.q..q...q..qRich..q........................PE..L....t.?...........!......4.........#.2.......5...............................M......................................J<..j..l.<.......?......................I..^..`.5...............................................5.T.....<.@....................text...>.4.......4................. ..`.rdata..E.....5.......5.............@..@.data.........<.......<.............@..._CODE....*....>..0...@>.............@....rsrc........?......p>.............@..@.reloc..".....I...... I.............@..B................................................................................................................................................................................................

                                                                        C:\Windows\SysWOW64\ExportModeller.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):294912
                                                                        Entropy (8bit):6.112628297874781
                                                                        Encrypted:false
                                                                        SSDEEP:3072:I5BjEZYf0mpCQWkmQFkC7SmmNLT1uEfhuVQA6nBgvWKwnvOtzC/8gfPACQ1pH2pE:zYf0mpC3kdFkC7SLLsmA6ESubhD+TU
                                                                        MD5:70B34D924E4DBA93BDB051C50B76A935
                                                                        SHA1:F3E1B375A577585F89482A78ACBCD92D3CC37796
                                                                        SHA-256:80E70DFB52DF7F6DEE86C1DC174799FAC4E189550ED9E0B07AEB26F29E072F40
                                                                        SHA-512:124584D8857A604C6B4026C36150074AFB3760893E464A5B2323551BD1E385D763A7FF2E5F5ACAA265AEEB766C08F486673BC9C13ADB53F9EBC03C380AF5C7D5
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=..uy..&y..&y..&...&...&...&l..&...&v..&x..&{..&y..&x..&/..&s..&...&p..&y..&...&&..&_..&...&x..&...&x..&Richy..&................PE..L...y.R;...........!.................................................................................................3.......+..........p....................@..$9...................................................................................text............................... ..`.rdata..[...........................@..@.data....O...@...@...@..............@....rsrc...p...........................@..@.reloc...H...@...P...0..............@..B........................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\SysWOW64\Implode.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):18944
                                                                        Entropy (8bit):6.082251537771566
                                                                        Encrypted:false
                                                                        SSDEEP:192:Isp6yEkGeVt7mdxy6BhUDwDBEKhixWPGqLukwRWxlRYlRXwHV1UBoN4GI6slUx:Vp6yGeVABrKcb7hjYjXwHHU04GJso
                                                                        MD5:0A0324A4282DF0F2C3129E5BD84077BC
                                                                        SHA1:5A4FB357AD6A245F75213C5F5593AB8F57E613DF
                                                                        SHA-256:11B4C417769C5C4729165C8CA0567F7D3B06D4B82998AB297D59ADBAD9F74D5F
                                                                        SHA-512:6074AE20F520449B5F3842F866BB8455B16E488C6D81BFBF898844C821D35EFC036B4DEEB9600502A54287050FE392BDA533FEB112B8A593F30CE779D1045646
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...-..2...........!...2.$...".......".......@....(%...................................................................h....p.......................................................................................................................text...?#.......$.................. ..`.bss....$....@...........................data........P.......(..............@....idata.......p.......>..............@....edata..h............@..............@..@.rsrc................B..............@....reloc.. ............F..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\SysWOW64\QECR.LIC

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):796
                                                                        Entropy (8bit):2.1709395683364
                                                                        Encrypted:false
                                                                        SSDEEP:3:2Ao1ihaQDeFS4qs//l8AqjXF1WX0jpuqje2up1Y1p7vuV//14En:251peeFuE8Aqju0jFjenw7WVX1j
                                                                        MD5:892C3A800773081A9110542550B11EA4
                                                                        SHA1:A9D593E2FA8A59D4F4425DD7679B3D600B47D3F9
                                                                        SHA-256:03EEA05D4F15377229E49E38887D2B2BE57E80988FF9741F15F4A6C1EF377562
                                                                        SHA-512:68C3021FC86328473A45A56AAE1FF0207956C72392036DB6B4CD67803C701C61B686F925C527DFDAE1A1F98806C10C4A107949113E0306720B699844C97D6999
                                                                        Malicious:false
                                                                        Preview:........(.....Z`.O.K.$...?..-.{P./.;.T.x............`...................................DataDirect ODBC Driver Pack.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\SysWOW64\craxdrt.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5206077
                                                                        Entropy (8bit):6.315774370780597
                                                                        Encrypted:false
                                                                        SSDEEP:98304:LSZEWBxyRHvEK6Y/aZ8HhzAhCpmwks9XiyINsv:8zoRHvE8/i0wzwlssv
                                                                        MD5:557903CB9179A5A8CFA6B852049E3884
                                                                        SHA1:CDB5AEDA1D9E08E9A3AEE6CA58E0542571050680
                                                                        SHA-256:F4E3E3B0699A3F80B7911C64AB17A74F8018B456DCA94A4F5F936B7A7F268466
                                                                        SHA-512:77537EACF5D8204C998FA3731FB345C2439DE5672D5C256520BC731F8A8C4937E7F7D7E3A42BFD79E7E401375083F7E5706A24AB97B1D3E1FCEFD9F252AC39FF
                                                                        Malicious:false
                                                                        Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.............C...C...C..C...C..C...C..C...C...C...C..C...C...C...C...C...C...C...C...C...C..C...C..C...C...C3..Cl..C...Cl..C..C...C...C...C...CT..C...Cl..C...CRich...C........................PE..L.....g>...........!......4..@......cS1.......4...............................O......................................*=.....p.=.......?.......................K..w....4...............................................4.|............................text.....4.......4................. ..`.rdata........4.......4.............@..@.data........@=.. ...@=.............@..._CODE...P*....>..0...`>.............@....rsrc.........?.......>.............@..@.reloc..2.....K......pK.............@..B................................................................................................................................................................................................

                                                                        C:\Windows\SysWOW64\crtslv.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):49223
                                                                        Entropy (8bit):4.109718425650408
                                                                        Encrypted:false
                                                                        SSDEEP:768:+ccYopyfE7saYHK54TbAG9sAiw6SlglrtA:ZcYop1gaYO4oG9sAu/rA
                                                                        MD5:9B7EB9FB8DF4F52965CBC4808EA5062D
                                                                        SHA1:5D516D6F766A1911C7F1AFCC9B71A2A90F426B02
                                                                        SHA-256:30BA60E53FACB1F6AB703108688CE281DFEBEAE01A203DE0D800EC6DE5089538
                                                                        SHA-512:C69D998736D2F6CCF515D35436EE0CCC32403F0A6A0E22F28CCCBAF837D65D027E5470DC5805A02ED599DFDC32B113CB394EACBBDBD4B5879EC2C30805D55304
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......uFq.1'..1'..1'...;..4'..0...3'..g8..9'..1'..)'..S8..4'..n...4'...!..0'......0'..Rich1'..................PE..L..._.{:...........!.....@...p.......1.......P......................................"...............................PV.......S..d....p...3......................0....P..........................................h....P...............................text...E1.......@.................. ..`.rdata.......P.......P..............@..@.data...l....`.......`..............@....rsrc....3...p...@...p..............@..@.reloc..............................@..BN_.P0......N=...V|)LG....sXNQ...z.[J^...........KERNEL32.dll.NTDLL.DLL.ole32.dll.OLEAUT32.dll.ATL.DLL...........................................................................................................................................................................................................................

                                                                        C:\Windows\SysWOW64\crviewer.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):734504
                                                                        Entropy (8bit):6.288077088983874
                                                                        Encrypted:false
                                                                        SSDEEP:12288:nLC3ZqLXl9ZZVvBMISsHHGg17SnXR2HKg/AggAVKBHFEWl:nLIZKXfVvGaGg1mnX8agDy2Wl
                                                                        MD5:7AADDC7C334AE959674073439FA92FE3
                                                                        SHA1:ABFD7C6ACCE89009D85C619E91010C307E2C06FA
                                                                        SHA-256:C0DB8920AC1E460EE34313829245D2F05F2D71617C69F6B568C5C921747E62F2
                                                                        SHA-512:FB0BDC3B495C3541AA5DF5D50C020A377F7C024727C95953984B2DA184091AD0FDE9D2B03D7E5AA2D86C8F454EA484ED16741353123E23CC8D9A35624139A277
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O.u...&...&...&.2.&...&^2.&...&.1.&...&.1.&J..&...&...&.1.&...&51.&...&...&...&...&./.&.1.&...&...&...&.(.&...&"..&...&Rich...&................PE..L...'.G>...........!................Q..............`.........................P.......|..............................P.......$........`..pE..........@ ...........v.......................................................... ........................text............................... ..`.rdata..............................@..@.data............p..................@....rsrc...pE...`...P...0..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\SysWOW64\crwrap32.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):66560
                                                                        Entropy (8bit):5.764637632023211
                                                                        Encrypted:false
                                                                        SSDEEP:1536:5a/5Ni0La7Q4JpxsxrkVE55QbK/kglgp8P7M:k/580La7jJpqxrk4/LlgKPo
                                                                        MD5:6AF7E771B815A4CEBCB57214B049CE52
                                                                        SHA1:99935155D7C4E5693884F1E46955180437070296
                                                                        SHA-256:F87575DB6FFCBE1C170A803EA3979D9885A4F13665BCE5DA44FEF5199A9C82B7
                                                                        SHA-512:F7765C85F2A5517B2974F26B06794D154F75E8F66589045C6DEEFA99CFF65C6406630A45F057CA1A696AA65B40463E137338C2F1CB4AA047099C3B1B2D7D9F7D
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............`..O.....L.....Rich...........PE..L....T.8...........!................`:............nB.................................M.................................._...p...P....`.......................p..........................................................4............................text.............................. ..`.rdata..?...........................@..@.data...........:..................@....rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\SysWOW64\exlate32.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):675897
                                                                        Entropy (8bit):6.33183612141127
                                                                        Encrypted:false
                                                                        SSDEEP:6144:szNfL5Tx1o6Ky/9vCgchDAhy6Q0KQ7a3spjQ91fsu6UyepsMtt2+cH9ofSNXczFw:sDR5y0hy6aOa3spjQ9lmMEoqxchYIo
                                                                        MD5:CD98432FDB8E13C7C5A940C01D3CCE77
                                                                        SHA1:B4C5C3979883252DDBD4534CBB09F2D80F82F3D3
                                                                        SHA-256:86C6FFBC5463F3A3410BA18B192556BE39ACC1D99CEC94783A5A9A38610B3CC4
                                                                        SHA-512:1AC21A31E613C6D3D0518B3A497364BBEFFB33439F21A8D83A62D25123F4EBCA3A8D3BEF371B09187027BD5D84BBB9DEF7942FDB6B1A51A91F7F426BF1009A54
                                                                        Malicious:false
                                                                        Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$........=Y.V\7.V\7.V\7.C<.U\7.-@;.T\7..C$.U\7.V\7.Q\7.9C<.U\7..@9.U\7.9C=.R\7.9C3.T\7./}<.U\7./}3.T\7.|<.Z\7.|=..\7.V\6.^7.4C$.E\7.P.=.T\7.P.<.y\7.Z1.W\7.|3.W\7.RichV\7.........................PE..L...e6.?...........!.........`...............................................`.......................................D......$6...................................T...........................................................5..@....................text...N........................... ..`.rdata...U.......`..................@..@.data........P.......P..............@..._CODE...p...........................@....rsrc...............................@..@.reloc..p...........................@..B................................................................................................................................................................................................

                                                                        C:\Windows\SysWOW64\p2sodbc.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):307200
                                                                        Entropy (8bit):6.022609410600443
                                                                        Encrypted:false
                                                                        SSDEEP:6144:FpQDKIhkfJxWbuqzTZSDS03HSWAuV0W+td9x/LJL:FpQDKIhkfJxWiMTZSDS03yWAuV0BrH/R
                                                                        MD5:8394AF480C146EC7F7A554EA1FB8E9C4
                                                                        SHA1:C44B3BD7D524A0F37D1171F4066C7BD0AA7E3CF9
                                                                        SHA-256:73EE0E2B4822A03136B18AB32C951CFC5E7C68A40B046B82E68B1B156582FC18
                                                                        SHA-512:7E7BB50BFDDF3B69813F4A87DCBFC76A6A3DCCCD6CC9F459DCD56A222EF82C980B5B5A900293CE8A6DBDB1C68483443726D4834886AFB067A1A009B875D03E1C
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........oa8...k...k...k...k...kP..k...k...k...k...k...k...k...k...k...k...k...k...k...k.-.k...k...k...k,..k...kRich...k........................PE..L....Q.>...........!.......................................................................................................p........ ...S......................4....................................................................................text...;........................... ..`.rdata........... ..................@..@.data....+.......0..................@....rsrc....S... ...`... ..............@..@.reloc..X .......0..................@..B................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\SysWOW64\pg32conv.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):100352
                                                                        Entropy (8bit):6.01574608255945
                                                                        Encrypted:false
                                                                        SSDEEP:1536:W0/GIQTIfT9Q2qEB+Jk3gC7UfPnJQBJHl8UPif4xStOgkM:NGg98fC43nuBBGU+4
                                                                        MD5:59B610DF85409A13832B9B5B807DA4FE
                                                                        SHA1:FADFCE97D3D9F6935D5F6A4ACA53232D733AB4C6
                                                                        SHA-256:369C08452CE18AA2894442F63C524C4F8DB416F12D86E624099BE61DAD9F2F98
                                                                        SHA-512:117D144807C1BC38858859F8417CE69597FDF3B3FAF28D5567ECA58A84CBAC292C87EB54840E8DAC9A0F3CD66F755CE8CB31BC30D78B01A47B09FAA1C2C8B73C
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Nb#P/.pP/.pP/.pP/.p./.p.).pQ/.p.3.pL/.pRichP/.p........................PE..L....V.7...........!.................$.......0.......................................[..............................p5..f....1..d...............................................................................X....0...............................text...P........................... ..`.rdata.......0......................@..@.data...xt...@...D...*..............@....rsrc................n..............@..@.reloc...............p..............@..BN_.P(.../.[J5.....[J@...4..NJ...........KERNEL32.dll.USER32.dll.GDI32.dll.MSVCRT.dll............................................................................................................................................................................................................................................................................

                                                                        C:\Windows\SysWOW64\sscsdk80.dll

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1179648
                                                                        Entropy (8bit):6.521473588938597
                                                                        Encrypted:false
                                                                        SSDEEP:24576:Xm2hiJswkzSpq5Z3jVecFRe+2x3sK6Ms203zviblO8kqO5NnibsBfhUy:X8kQsIOvfhUy
                                                                        MD5:D2D3AB42E0FB3AFA8FF6AA9E965D9595
                                                                        SHA1:34F244003EF1D43209823CDD946F801AE7A85466
                                                                        SHA-256:5AC379FCFBDA3F8DB51CA02BE2C509BD057F17690359F09D4CBB292A67572D6A
                                                                        SHA-512:80D468D7495C44988FB655E824575C0DA5ED38FD8A88141FDED106029057E66609CA2E1FF3BA55B0D429FFD737E401F32857A3C92EBCC2ADF97D0B8C49EFEC76
                                                                        Malicious:false
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w..q3.r"3.r"3.r"n.y"0.r"..|"..r"n.x"..r"Q.a"?.r"3.s"5.r"3.r"5.r"..p"7.r"l.y"#.r"l.x"..r"..t"2.r".v"2.r"Rich3.r"........PE..L...R(i>...........!.........@......<......................................................................................$........P..`$.......................b...................................................................................text............................... ..`.rdata..............................@..@.data..............................@....rsrc...`$...P...0...`..............@..@.reloc..^o.......p..................@..B................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\System32\myah0.cpl

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1016832
                                                                        Entropy (8bit):5.979344965125846
                                                                        Encrypted:false
                                                                        SSDEEP:12288:2GBRhi9pc8mQQoBc8wwA21kOR3kkkZkkIkwkpL88888F888nr8H8J28c9fsxkkKO:Px+r
                                                                        MD5:A5646553AE51847135D436820C1F21C1
                                                                        SHA1:F8601BC366E964DBA7F57C71278F451E2A5E49DA
                                                                        SHA-256:740F122FE9707BD4A90048C75B1EB79C86B1B7E852B866517721D2F91CF646C5
                                                                        SHA-512:04E97E2120A4805DCABEE5F3E03AFB1DA3646803F86461DD826A44BB39B99DB3E2600A2F4C24A51450F976660B02DC97C0F7FC349A8E38B131C49E56BF5E1F35
                                                                        Malicious:false
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..d......T.........." ................ .........@..............................p....................................... ..................E.......p............0...z...............f..............................................................h....................text............................... ..`.data...............................@....bss.....................................idata..p........ ..................@....didata.h...........................@....edata..E...........................@..@.reloc...f.......h..................@..B.pdata...z...0...|...T..............@..@.rsrc...............................@..@.............p......................@..@................................................................................

                                                                        C:\Windows\Temp\~DF10268C2D74BFE13E.TMP

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):512
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:3::
                                                                        MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                        SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                        SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                        SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                        Malicious:false
                                                                        Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Temp\~DF19B9E36DC23D6D52.TMP

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):512
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:3::
                                                                        MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                        SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                        SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                        SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                        Malicious:false
                                                                        Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Temp\~DF34CC9FFA16280AFE.TMP

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Cannot read section info
                                                                        Category:dropped
                                                                        Size (bytes):81920
                                                                        Entropy (8bit):2.5046812323443923
                                                                        Encrypted:false
                                                                        SSDEEP:384:eeEI4JIFulo3BgghtzsoHmDWpO/Z6gsTbJl:34a/wMOR6TT
                                                                        MD5:2A81046FC979B0A9AE757145B3B0646D
                                                                        SHA1:95F5B435C884897C1729BC0EE6784A68133C662D
                                                                        SHA-256:9D9102770910D5A1DEB27C0DD4FF1C59A7DC86F65D8019BA3597DFB50D55A07C
                                                                        SHA-512:03C64CADF65B69E050A285ACA8759B5E92EBC6BD7108812DCE36F6402D7649E5712CC8F3A3A46D22CB9AAB00729745B4A06E4F2B71D9C171796984B3031A7988
                                                                        Malicious:false
                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Temp\~DF40082FD0F7814B19.TMP

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Cannot read section info
                                                                        Category:dropped
                                                                        Size (bytes):81920
                                                                        Entropy (8bit):2.5046812323443923
                                                                        Encrypted:false
                                                                        SSDEEP:384:eeEI4JIFulo3BgghtzsoHmDWpO/Z6gsTbJl:34a/wMOR6TT
                                                                        MD5:2A81046FC979B0A9AE757145B3B0646D
                                                                        SHA1:95F5B435C884897C1729BC0EE6784A68133C662D
                                                                        SHA-256:9D9102770910D5A1DEB27C0DD4FF1C59A7DC86F65D8019BA3597DFB50D55A07C
                                                                        SHA-512:03C64CADF65B69E050A285ACA8759B5E92EBC6BD7108812DCE36F6402D7649E5712CC8F3A3A46D22CB9AAB00729745B4A06E4F2B71D9C171796984B3031A7988
                                                                        Malicious:false
                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Temp\~DF4476195B7AEBACA5.TMP

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:data
                                                                        Category:modified
                                                                        Size (bytes):512
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:3::
                                                                        MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                        SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                        SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                        SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                        Malicious:false
                                                                        Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Temp\~DFAAD10CDD455BF074.TMP

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Cannot read section info
                                                                        Category:dropped
                                                                        Size (bytes):20480
                                                                        Entropy (8bit):1.8467987279471032
                                                                        Encrypted:false
                                                                        SSDEEP:96:thN1nFT3IIhRT8lMTwCRmz8e/mqscIXbcP91GxbOVe:t1FcugIw94JrcF1He
                                                                        MD5:FECF5326CC167D6DA554E4C3A9776D82
                                                                        SHA1:3F7F3C30B365B0F5BA45AEB8F08A79397D044A09
                                                                        SHA-256:597AE0E5BF6E5E2C4CA512351A9697B889F39E7CF1E23AEBEB508C18C6C6C25C
                                                                        SHA-512:58F71C49C601FD3087693A96679B166277FEE4F210B287D0E0CC8331412E8F83096A9A3261404AD3095F2F4FC6F5E76F0B8233543458FAEE4399E8A906A326FC
                                                                        Malicious:false
                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Temp\~DFC38A1450C4AA9A0B.TMP

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):98304
                                                                        Entropy (8bit):1.7242675292260081
                                                                        Encrypted:false
                                                                        SSDEEP:384:yI4JIFgbJlglo3BgghtzsoHmDWpO/Z6gs:eF3/wMOR6T
                                                                        MD5:C86C1E8CA555FD88B1AEBFD2AE79EDAC
                                                                        SHA1:79D128F75FEF23CB3FD562AE4975E1F705CF3606
                                                                        SHA-256:3FDB9B6B7785B5E26A1719ED0C842D7AD01FA4AF8DDF61A6B1894BC3355A81B2
                                                                        SHA-512:9B0E2D0783A462C44C732EF3AE28A8196A4377327009DADB4245ECF99EFA265945B0F4E2052DEA15D91555E0493B34FB0DE491DC0151B9A26A364C8EABA59EDE
                                                                        Malicious:false
                                                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Temp\~DFD0677C037C18C392.TMP

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Cannot read section info
                                                                        Category:dropped
                                                                        Size (bytes):20480
                                                                        Entropy (8bit):1.8467987279471032
                                                                        Encrypted:false
                                                                        SSDEEP:96:thN1nFT3IIhRT8lMTwCRmz8e/mqscIXbcP91GxbOVe:t1FcugIw94JrcF1He
                                                                        MD5:FECF5326CC167D6DA554E4C3A9776D82
                                                                        SHA1:3F7F3C30B365B0F5BA45AEB8F08A79397D044A09
                                                                        SHA-256:597AE0E5BF6E5E2C4CA512351A9697B889F39E7CF1E23AEBEB508C18C6C6C25C
                                                                        SHA-512:58F71C49C601FD3087693A96679B166277FEE4F210B287D0E0CC8331412E8F83096A9A3261404AD3095F2F4FC6F5E76F0B8233543458FAEE4399E8A906A326FC
                                                                        Malicious:false
                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Temp\~DFD3499CCF3A972488.TMP

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):40960
                                                                        Entropy (8bit):2.2938639420738385
                                                                        Encrypted:false
                                                                        SSDEEP:96:fnCaJqfVxNspq+9L3UXvbTllARl9SvR3cjVJY65B8iC+4sObNmh7gi1Iq+Y+:fCaAPNN+yXv692R+VJYwMvbUhh1I7Z
                                                                        MD5:3C38DAFBD8ABAA2BCDFCB203A7EF488C
                                                                        SHA1:AF4F5D6D91A052F7C411A1D717650AAEE87B14FB
                                                                        SHA-256:802ECCE9506FB43637B715778107ACDB746844003378F949EDCDFE9B8B2DFE2A
                                                                        SHA-512:8F174C733F0BE918C96FC15AFC061F4596855A61EE837014E81D817C80173E6CDC18003642FFCE907878DF62E5042259368DD963089483E2ACD75893D6920321
                                                                        Malicious:false
                                                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Temp\~DFDEE1F23CBCF39B85.TMP

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):512
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:3::
                                                                        MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                        SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                        SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                        SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                        Malicious:false
                                                                        Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Temp\~DFE134843F41993119.TMP

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:Composite Document File V2 Document, Cannot read section info
                                                                        Category:dropped
                                                                        Size (bytes):81920
                                                                        Entropy (8bit):2.5046812323443923
                                                                        Encrypted:false
                                                                        SSDEEP:384:eeEI4JIFulo3BgghtzsoHmDWpO/Z6gsTbJl:34a/wMOR6TT
                                                                        MD5:2A81046FC979B0A9AE757145B3B0646D
                                                                        SHA1:95F5B435C884897C1729BC0EE6784A68133C662D
                                                                        SHA-256:9D9102770910D5A1DEB27C0DD4FF1C59A7DC86F65D8019BA3597DFB50D55A07C
                                                                        SHA-512:03C64CADF65B69E050A285ACA8759B5E92EBC6BD7108812DCE36F6402D7649E5712CC8F3A3A46D22CB9AAB00729745B4A06E4F2B71D9C171796984B3031A7988
                                                                        Malicious:false
                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Windows\Temp\~DFFB45222063C2C43E.TMP

                                                                        Download File
                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):512
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:3::
                                                                        MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                        SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                        SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                        SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                        Malicious:false
                                                                        Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\tmp\log\installs\CF_Remote\install.log

                                                                        Download File
                                                                        Process:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):19181
                                                                        Entropy (8bit):4.8358621264795705
                                                                        Encrypted:false
                                                                        SSDEEP:384:e/zq0wHdqIqm/RDC1hOMpe7QIH+lErmwW:91C
                                                                        MD5:F33F0440F3138651AF053EF651E8C913
                                                                        SHA1:B205A57EC63F8BA14418A2C031953A1A9FC3DA2C
                                                                        SHA-256:7EEC4655924D88DB0B1B9AE2AD07E6EBBD9AFBD249FA295F9CB411F316240184
                                                                        SHA-512:9DE1B09230AF9B657CD12DA6D7F6844302F3EBE9AECF8CD7AFEA5214B276261877D49C1948A78A6CE96E7FF3DBA1B2399385276985B0B299C2F628437FBA682D
                                                                        Malicious:false
                                                                        Preview:.23/01/2024-16:43:13 | Check for Microsoft Windows Installer 2.0..23/01/2024-16:43:13 | Check for VB6..23/01/2024-16:43:13 | Define Setup Globals..23/01/2024-16:43:13 | First Time Install..23/01/2024-16:43:13 | Welcome Dialog..23/01/2024-16:43:18 | License Check..23/01/2024-16:43:18 | ReadMe Information..23/01/2024-16:43:18 | User Registration..23/01/2024-16:43:18 | Setup Type..23/01/2024-16:43:18 | Custom Setup..23/01/2024-16:43:18 | Destination Directory..23/01/2024-16:43:18 | Start Menu..23/01/2024-16:43:18 | Start Installation..23/01/2024-16:43:18 | Prepair Install..23/01/2024-16:43:18 | APP variable equals CF_Remote..23/01/2024-16:43:19 | Install Crystal..23/01/2024-16:43:19 | Install CF Remote..23/01/2024-16:43:19 | Install CF Remote dlls..23/01/2024-16:43:23 | Create Folders..23/01/2024-16:43:23 | Create Shortcuts..23/01/2024-16:43:23 | Before - Apply Install..23/01/2024-16:43:44 | After - Apply Install: COMPLETE - ..23/01/2024-16:43:45 | CRUTL15.DLL - Setup Version: 15.0.0.2

                                                                        Static File Info

                                                                        General

                                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Entropy (8bit):7.994170806029125
                                                                        TrID:
                                                                        • Win32 Executable (generic) a (10002005/4) 99.53%
                                                                        • InstallShield setup (43055/19) 0.43%
                                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                                        • DOS Executable Generic (2002/1) 0.02%
                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                        File name:cfrv_4_0_setup_ALL.exe
                                                                        File size:14'277'760 bytes
                                                                        MD5:9197aeadf996dd8cd3885a205927671e
                                                                        SHA1:3bf1368b4dae680e580d3958299f9636e255cba8
                                                                        SHA256:94e6740812caeb857ef6065984ab4138d56ad4b517c62f2611f303eab519676c
                                                                        SHA512:d9709a22c65f95f495d85dc8eb2f686ef1d7d67cb52d36f88c8304668ad91f049495adb1e16dc815297b57127a8dbfccc50fa1a5de334bc7ccc215e35ab1d6a4
                                                                        SSDEEP:196608:boV3MNPhVz6u87cGPfIjRHaiBsvZTkqUlrRqFRLRCLWE6UwN3dmjABs3lav9HAjs:u0PhVPfjVaLyrEFRLRCrfwBjUa8J+
                                                                        TLSH:E6E6335067EA8260F0FB3B751DB8A6A84937FC259734E1CF8299051EDE72AC19C74327
                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ew..............|.......|.......|........t.......b..............|.......V.......|......Rich............................PE..L..

                                                                        File Icon

                                                                        Icon Hash:46165f4553a1f271

                                                                        Static PE Info

                                                                        General

                                                                        Entrypoint:0x422c58
                                                                        Entrypoint Section:.text
                                                                        Digitally signed:false
                                                                        Imagebase:0x400000
                                                                        Subsystem:windows gui
                                                                        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                        DLL Characteristics:TERMINAL_SERVER_AWARE
                                                                        Time Stamp:0x62E46D6B [Fri Jul 29 23:29:47 2022 UTC]
                                                                        TLS Callbacks:
                                                                        CLR (.Net) Version:
                                                                        OS Version Major:5
                                                                        OS Version Minor:0
                                                                        File Version Major:5
                                                                        File Version Minor:0
                                                                        Subsystem Version Major:5
                                                                        Subsystem Version Minor:0
                                                                        Import Hash:b48671fed9d5ca4906417d42fcdb066b

                                                                        Entrypoint Preview

                                                                        Instruction
                                                                        call 00007FB0295D6DD9h
                                                                        jmp 00007FB0295D250Dh
                                                                        mov edi, edi
                                                                        push ebp
                                                                        mov ebp, esp
                                                                        sub esp, 00000328h
                                                                        mov dword ptr [0043E4B8h], eax
                                                                        mov dword ptr [0043E4B4h], ecx
                                                                        mov dword ptr [0043E4B0h], edx
                                                                        mov dword ptr [0043E4ACh], ebx
                                                                        mov dword ptr [0043E4A8h], esi
                                                                        mov dword ptr [0043E4A4h], edi
                                                                        mov word ptr [0043E4D0h], ss
                                                                        mov word ptr [0043E4C4h], cs
                                                                        mov word ptr [0043E4A0h], ds
                                                                        mov word ptr [0043E49Ch], es
                                                                        mov word ptr [0043E498h], fs
                                                                        mov word ptr [0043E494h], gs
                                                                        pushfd
                                                                        pop dword ptr [0043E4C8h]
                                                                        mov eax, dword ptr [ebp+00h]
                                                                        mov dword ptr [0043E4BCh], eax
                                                                        mov eax, dword ptr [ebp+04h]
                                                                        mov dword ptr [0043E4C0h], eax
                                                                        lea eax, dword ptr [ebp+08h]
                                                                        mov dword ptr [0043E4CCh], eax
                                                                        mov eax, dword ptr [ebp-00000320h]
                                                                        mov dword ptr [0043E408h], 00010001h
                                                                        mov eax, dword ptr [0043E4C0h]
                                                                        mov dword ptr [0043E3BCh], eax
                                                                        mov dword ptr [0043E3B0h], C0000409h
                                                                        mov dword ptr [0043E3B4h], 00000001h
                                                                        mov eax, dword ptr [0043C024h]
                                                                        mov dword ptr [ebp-00000328h], eax
                                                                        mov eax, dword ptr [0043C028h]
                                                                        mov dword ptr [ebp-00000324h], eax
                                                                        call dword ptr [000000BCh]

                                                                        Rich Headers

                                                                        Programming Language:
                                                                        • [C++] VS2008 SP1 build 30729
                                                                        • [ASM] VS2008 SP1 build 30729
                                                                        • [ C ] VS2008 SP1 build 30729
                                                                        • [ C ] VS2005 build 50727
                                                                        • [IMP] VS2005 build 50727
                                                                        • [RES] VS2008 build 21022
                                                                        • [LNK] VS2008 SP1 build 30729

                                                                        Data Directories

                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x3a5d80xa0.rdata
                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x450000x15748.rsrc
                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x352000x40.rdata
                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x320000x284.rdata
                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                        Sections

                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                        .text0x10000x302ed0x304002038b7d87842b64c67b899ba5e78dc0dFalse0.5152303270725389data6.494109860999288IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                        .rdata0x320000x93e80x94009065fae2bc62d08ab84e542ac170dd32False0.34588788006756754data4.655429443140589IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                        .data0x3c0000x84000x24003b1c2c3bd274b21289a8012d58d091b2False0.2587890625data4.215578104820278IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                        .rsrc0x450000x157480x15800b5e79db393609dd64cce69fe68a8673eFalse0.04630723110465116data3.441131579787985IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                        Resources

                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                        RT_ICON0x45c540x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishUnited States0.46639784946236557
                                                                        RT_ICON0x45f3c0x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishUnited States0.6216216216216216
                                                                        RT_DIALOG0x460640x1d8data0.5720338983050848
                                                                        RT_DIALOG0x4623c0x1bedata0.5605381165919282
                                                                        RT_DIALOG0x463fc0x54data0.7619047619047619
                                                                        RT_STRING0x464500x4a4dataArabicSaudi Arabia0.28703703703703703
                                                                        RT_STRING0x468f40x4a4dataCatalanSpain0.28703703703703703
                                                                        RT_STRING0x46d980x4a4dataChineseTaiwan0.28703703703703703
                                                                        RT_STRING0x4723c0x4a4dataCzechCzech Republic0.28703703703703703
                                                                        RT_STRING0x476e00x4a4dataDanishDenmark0.28703703703703703
                                                                        RT_STRING0x47b840x4a4dataGermanGermany0.28703703703703703
                                                                        RT_STRING0x480280x4a4dataGreekGreece0.28703703703703703
                                                                        RT_STRING0x484cc0x4a4dataEnglishUnited States0.28703703703703703
                                                                        RT_STRING0x489700x4a4dataFinnishFinland0.28703703703703703
                                                                        RT_STRING0x48e140x4a4dataFrenchFrance0.28703703703703703
                                                                        RT_STRING0x492b80x4a4dataHebrewIsrael0.28703703703703703
                                                                        RT_STRING0x4975c0x4a4dataHungarianHungary0.28703703703703703
                                                                        RT_STRING0x49c000x4a4dataItalianItaly0.28703703703703703
                                                                        RT_STRING0x4a0a40x4a4dataJapaneseJapan0.28703703703703703
                                                                        RT_STRING0x4a5480x4a4dataKoreanNorth Korea0.28703703703703703
                                                                        RT_STRING0x4a5480x4a4dataKoreanSouth Korea0.28703703703703703
                                                                        RT_STRING0x4a9ec0x4a4dataDutchNetherlands0.28703703703703703
                                                                        RT_STRING0x4ae900x4a4dataNorwegianNorway0.28703703703703703
                                                                        RT_STRING0x4b3340x4a4dataPolishPoland0.28703703703703703
                                                                        RT_STRING0x4b7d80x4a4dataPortugueseBrazil0.28703703703703703
                                                                        RT_STRING0x4bc7c0x4a4dataRomanianRomania0.28703703703703703
                                                                        RT_STRING0x4c1200x4a4dataRussianRussia0.28703703703703703
                                                                        RT_STRING0x4c5c40x4a4dataCroatianCroatia0.28703703703703703
                                                                        RT_STRING0x4ca680x4a4dataSlovakSlovakia0.28703703703703703
                                                                        RT_STRING0x4cf0c0x4a4dataSwedishSweden0.28703703703703703
                                                                        RT_STRING0x4d3b00x4a4dataThaiThailand0.28703703703703703
                                                                        RT_STRING0x4d8540x4a4dataTurkishTurkey0.28703703703703703
                                                                        RT_STRING0x4dcf80x4a4dataSlovenianSlovenia0.28703703703703703
                                                                        RT_STRING0x4e19c0x4a4dataEstonianEstonia0.28703703703703703
                                                                        RT_STRING0x4e6400x4a4dataLatvianLativa0.28703703703703703
                                                                        RT_STRING0x4eae40x4a4dataLithuanianLithuania0.28703703703703703
                                                                        RT_STRING0x4ef880x4a4dataVietnameseVietnam0.28703703703703703
                                                                        RT_STRING0x4f42c0x4a4dataBasqueFrance0.28703703703703703
                                                                        RT_STRING0x4f42c0x4a4dataBasqueSpain0.28703703703703703
                                                                        RT_STRING0x4f8d00x4a4dataChineseChina0.28703703703703703
                                                                        RT_STRING0x4fd740x4a4dataPortuguesePortugal0.28703703703703703
                                                                        RT_STRING0x502180x4a4data0.28703703703703703
                                                                        RT_STRING0x506bc0x2f2dataArabicSaudi Arabia0.42572944297082227
                                                                        RT_STRING0x509b00x2f2dataCatalanSpain0.42572944297082227
                                                                        RT_STRING0x50ca40x2f2dataChineseTaiwan0.42572944297082227
                                                                        RT_STRING0x50f980x2f2dataCzechCzech Republic0.42572944297082227
                                                                        RT_STRING0x5128c0x2f2dataDanishDenmark0.42572944297082227
                                                                        RT_STRING0x515800x2f2dataGermanGermany0.42572944297082227
                                                                        RT_STRING0x518740x2f2dataGreekGreece0.42572944297082227
                                                                        RT_STRING0x51b680x2f2dataEnglishUnited States0.42572944297082227
                                                                        RT_STRING0x51e5c0x2f2dataFinnishFinland0.42572944297082227
                                                                        RT_STRING0x521500x2f2dataFrenchFrance0.42572944297082227
                                                                        RT_STRING0x524440x2f2dataHebrewIsrael0.42572944297082227
                                                                        RT_STRING0x527380x2f2dataHungarianHungary0.42572944297082227
                                                                        RT_STRING0x52a2c0x2f2dataItalianItaly0.42572944297082227
                                                                        RT_STRING0x52d200x2f2dataJapaneseJapan0.42572944297082227
                                                                        RT_STRING0x530140x2f2dataKoreanNorth Korea0.42572944297082227
                                                                        RT_STRING0x530140x2f2dataKoreanSouth Korea0.42572944297082227
                                                                        RT_STRING0x533080x2f2dataDutchNetherlands0.42572944297082227
                                                                        RT_STRING0x535fc0x2f2dataNorwegianNorway0.42572944297082227
                                                                        RT_STRING0x538f00x2f2dataPolishPoland0.42572944297082227
                                                                        RT_STRING0x53be40x2f2dataPortugueseBrazil0.42572944297082227
                                                                        RT_STRING0x53ed80x2f2dataRomanianRomania0.42572944297082227
                                                                        RT_STRING0x541cc0x2f2dataRussianRussia0.42572944297082227
                                                                        RT_STRING0x544c00x2f2dataCroatianCroatia0.42572944297082227
                                                                        RT_STRING0x547b40x2f2dataSlovakSlovakia0.42572944297082227
                                                                        RT_STRING0x54aa80x2f2dataSwedishSweden0.42572944297082227
                                                                        RT_STRING0x54d9c0x2f2dataThaiThailand0.42572944297082227
                                                                        RT_STRING0x550900x2f2dataTurkishTurkey0.42572944297082227
                                                                        RT_STRING0x553840x2f2dataSlovenianSlovenia0.42572944297082227
                                                                        RT_STRING0x556780x2f2dataEstonianEstonia0.42572944297082227
                                                                        RT_STRING0x5596c0x2f2dataLatvianLativa0.42572944297082227
                                                                        RT_STRING0x55c600x2f2dataLithuanianLithuania0.42572944297082227
                                                                        RT_STRING0x55f540x2f2dataVietnameseVietnam0.42572944297082227
                                                                        RT_STRING0x562480x2f2dataBasqueFrance0.42572944297082227
                                                                        RT_STRING0x562480x2f2dataBasqueSpain0.42572944297082227
                                                                        RT_STRING0x5653c0x2f2dataChineseChina0.42572944297082227
                                                                        RT_STRING0x568300x2f2dataPortuguesePortugal0.42572944297082227
                                                                        RT_STRING0x56b240x2f2data0.42572944297082227
                                                                        RT_STRING0x56e180x106dataArabicSaudi Arabia0.5076335877862596
                                                                        RT_STRING0x56f200x106dataCatalanSpain0.5076335877862596
                                                                        RT_STRING0x570280x106dataChineseTaiwan0.5076335877862596
                                                                        RT_STRING0x571300x106dataCzechCzech Republic0.5076335877862596
                                                                        RT_STRING0x572380x106dataDanishDenmark0.5076335877862596
                                                                        RT_STRING0x573400x106dataGermanGermany0.5076335877862596
                                                                        RT_STRING0x574480x106dataGreekGreece0.5076335877862596
                                                                        RT_STRING0x575500x106dataEnglishUnited States0.5076335877862596
                                                                        RT_STRING0x576580x106dataFinnishFinland0.5076335877862596
                                                                        RT_STRING0x577600x106dataFrenchFrance0.5076335877862596
                                                                        RT_STRING0x578680x106dataHebrewIsrael0.5076335877862596
                                                                        RT_STRING0x579700x106dataHungarianHungary0.5076335877862596
                                                                        RT_STRING0x57a780x106dataItalianItaly0.5076335877862596
                                                                        RT_STRING0x57b800x106dataJapaneseJapan0.5076335877862596
                                                                        RT_STRING0x57c880x106dataKoreanNorth Korea0.5076335877862596
                                                                        RT_STRING0x57c880x106dataKoreanSouth Korea0.5076335877862596
                                                                        RT_STRING0x57d900x106dataDutchNetherlands0.5076335877862596
                                                                        RT_STRING0x57e980x106dataNorwegianNorway0.5076335877862596
                                                                        RT_STRING0x57fa00x106dataPolishPoland0.5076335877862596
                                                                        RT_STRING0x580a80x106dataPortugueseBrazil0.5076335877862596
                                                                        RT_STRING0x581b00x106dataRomanianRomania0.5076335877862596
                                                                        RT_STRING0x582b80x106dataRussianRussia0.5076335877862596
                                                                        RT_STRING0x583c00x106dataCroatianCroatia0.5076335877862596
                                                                        RT_STRING0x584c80x106dataSlovakSlovakia0.5076335877862596
                                                                        RT_STRING0x585d00x106dataSwedishSweden0.5076335877862596
                                                                        RT_STRING0x586d80x106dataThaiThailand0.5076335877862596
                                                                        RT_STRING0x587e00x106dataTurkishTurkey0.5076335877862596
                                                                        RT_STRING0x588e80x106dataSlovenianSlovenia0.5076335877862596
                                                                        RT_STRING0x589f00x106dataEstonianEstonia0.5076335877862596
                                                                        RT_STRING0x58af80x106dataLatvianLativa0.5076335877862596
                                                                        RT_STRING0x58c000x106dataLithuanianLithuania0.5076335877862596
                                                                        RT_STRING0x58d080x106dataVietnameseVietnam0.5076335877862596
                                                                        RT_STRING0x58e100x106dataBasqueFrance0.5076335877862596
                                                                        RT_STRING0x58e100x106dataBasqueSpain0.5076335877862596
                                                                        RT_STRING0x58f180x106dataChineseChina0.5076335877862596
                                                                        RT_STRING0x590200x106dataPortuguesePortugal0.5076335877862596
                                                                        RT_STRING0x591280x106data0.5076335877862596
                                                                        RT_GROUP_ICON0x592300x22dataEnglishUnited States0.9705882352941176
                                                                        RT_VERSION0x592540x1084dataEnglishUnited States0.09649952696310313
                                                                        RT_MANIFEST0x5a2d80x470XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.4507042253521127

                                                                        Imports

                                                                        DLLImport
                                                                        KERNEL32.dllGetLastError, ResetEvent, CreateEventW, CloseHandle, MultiByteToWideChar, WideCharToMultiByte, FreeLibrary, LoadLibraryW, GetModuleFileNameW, FormatMessageW, LocalFree, GetWindowsDirectoryW, CreateFileW, SetFileTime, SetFileAttributesW, RemoveDirectoryW, CreateDirectoryW, GetFileInformationByHandle, DeleteFileW, GetShortPathNameW, GetFullPathNameW, lstrlenW, GetCurrentDirectoryW, GetTempFileNameW, FindClose, FindFirstFileW, FindNextFileW, GetFileSize, SetFilePointer, ReadFile, WriteFile, SetEndOfFile, DeleteCriticalSection, GetStdHandle, EnterCriticalSection, LeaveCriticalSection, WaitForMultipleObjects, GetCurrentProcessId, InitializeCriticalSection, QueryPerformanceCounter, GetTickCount, Sleep, LocalAlloc, GetProcAddress, SetCurrentDirectoryW, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, SetThreadUILanguage, SetThreadLocale, GetVersion, GetCommandLineW, CreateProcessW, GetExitCodeProcess, FlushFileBuffers, CreateFileA, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, SetStdHandle, LCMapStringW, LCMapStringA, GetStringTypeW, GetStringTypeA, GetConsoleMode, GetConsoleCP, GetLocaleInfoA, IsValidCodePage, GetOEMCP, RaiseException, GetACP, GetCPInfo, LoadLibraryA, RtlUnwind, InitializeCriticalSectionAndSpinCount, GetSystemTimeAsFileTime, WaitForSingleObject, SetEvent, GetVersionExW, VirtualAlloc, GetCurrentThreadId, VirtualFree, GetFileType, SetHandleCount, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, HeapSize, InterlockedDecrement, SetLastError, InterlockedIncrement, TlsFree, TlsSetValue, TlsAlloc, HeapFree, HeapAlloc, ExitThread, CreateThread, HeapReAlloc, GetCommandLineA, GetStartupInfoA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapCreate, GetModuleHandleW, ExitProcess, GetModuleFileNameA, TlsGetValue
                                                                        USER32.dllSetForegroundWindow, CharUpperW, GetWindowRect, DestroyWindow, RegisterWindowMessageW, AdjustWindowRect, LoadImageW, LoadIconW, KillTimer, SetTimer, EndDialog, IsDlgButtonChecked, SetDlgItemTextW, GetDlgItem, SetWindowTextW, GetWindowTextW, GetWindowTextLengthW, LoadStringW, DialogBoxParamW, CreateDialogParamW, SystemParametersInfoW, PeekMessageW, GetDesktopWindow, MessageBoxW, SendMessageW, GetWindowLongW, SetWindowLongW, ShowWindow, MoveWindow, PostMessageW
                                                                        GDI32.dllGetObjectW
                                                                        ADVAPI32.dllRegSetValueExW, RegCreateKeyExW, RegCloseKey
                                                                        SHELL32.dllSHGetFolderPathW, ShellExecuteExW
                                                                        ole32.dllCoInitializeEx, CoInitialize, CoCreateInstance
                                                                        OLEAUT32.dllSysAllocStringLen, SysFreeString, VariantClear, SysAllocString

                                                                        Possible Origin

                                                                        Language of compilation systemCountry where language is spokenMap
                                                                        EnglishUnited States
                                                                        ArabicSaudi Arabia
                                                                        CatalanSpain
                                                                        ChineseTaiwan
                                                                        CzechCzech Republic
                                                                        DanishDenmark
                                                                        GermanGermany
                                                                        GreekGreece
                                                                        FinnishFinland
                                                                        FrenchFrance
                                                                        HebrewIsrael
                                                                        HungarianHungary
                                                                        ItalianItaly
                                                                        JapaneseJapan
                                                                        KoreanNorth Korea
                                                                        KoreanSouth Korea
                                                                        DutchNetherlands
                                                                        NorwegianNorway
                                                                        PolishPoland
                                                                        PortugueseBrazil
                                                                        RomanianRomania
                                                                        RussianRussia
                                                                        CroatianCroatia
                                                                        SlovakSlovakia
                                                                        SwedishSweden
                                                                        ThaiThailand
                                                                        TurkishTurkey
                                                                        SlovenianSlovenia
                                                                        EstonianEstonia
                                                                        LatvianLativa
                                                                        LithuanianLithuania
                                                                        VietnameseVietnam
                                                                        ChineseChina
                                                                        PortuguesePortugal

                                                                        Network Behavior

                                                                        ⊘No network behavior found

                                                                        Statistics

                                                                        CPU Usage

                                                                        Click to jump to process

                                                                        Memory Usage

                                                                        Click to jump to process

                                                                        High Level Behavior Distribution

                                                                        Click to dive into process behavior distribution

                                                                        Behavior

                                                                        Click to jump to process

                                                                        System Behavior

                                                                        General

                                                                        Target ID:0
                                                                        Start time:16:43:00
                                                                        Start date:23/01/2024
                                                                        Path:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
                                                                        Imagebase:0x400000
                                                                        File size:14'277'760 bytes
                                                                        MD5 hash:9197AEADF996DD8CD3885A205927671E
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:1
                                                                        Start time:16:43:11
                                                                        Start date:23/01/2024
                                                                        Path:C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:.\cfrv_4_0_setup_ALL.exe /m="C:\Users\user\Desktop\CFRV_4~1.EXE" /k=""
                                                                        Imagebase:0x400000
                                                                        File size:5'675'007 bytes
                                                                        MD5 hash:3B2D532673D1567116105D04C621CDBA
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:Borland Delphi
                                                                        Yara matches:
                                                                        • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000001.00000000.1735223416.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\miaDC6F.tmp\cfrv_4_0_setup_ALL.exe, Author: Joe Security
                                                                        Antivirus matches:
                                                                        • Detection: 0%, ReversingLabs
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:3
                                                                        Start time:16:43:20
                                                                        Start date:23/01/2024
                                                                        Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\mscomctl.ocx" /s
                                                                        Imagebase:0x6a0000
                                                                        File size:20'992 bytes
                                                                        MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:moderate
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:4
                                                                        Start time:16:43:20
                                                                        Start date:23/01/2024
                                                                        Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\COMDLG32.OCX" /s
                                                                        Imagebase:0x6a0000
                                                                        File size:20'992 bytes
                                                                        MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:moderate
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:5
                                                                        Start time:16:43:21
                                                                        Start date:23/01/2024
                                                                        Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\COMCT332.OCX" /s
                                                                        Imagebase:0x6a0000
                                                                        File size:20'992 bytes
                                                                        MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:Visual Basic
                                                                        Reputation:moderate
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:6
                                                                        Start time:16:43:21
                                                                        Start date:23/01/2024
                                                                        Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\TABCTL32.OCX" /s
                                                                        Imagebase:0x6a0000
                                                                        File size:20'992 bytes
                                                                        MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:moderate
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:7
                                                                        Start time:16:43:21
                                                                        Start date:23/01/2024
                                                                        Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Windows\system32\regsvr32.exe" "C:\Program Files (x86)\Common Files\microsoft shared\DAO\DAO350.DLL" /s
                                                                        Imagebase:0x6a0000
                                                                        File size:20'992 bytes
                                                                        MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:moderate
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:8
                                                                        Start time:16:43:22
                                                                        Start date:23/01/2024
                                                                        Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_CR_control.dll" /s
                                                                        Imagebase:0x800000
                                                                        File size:20'992 bytes
                                                                        MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:Visual Basic
                                                                        Reputation:moderate
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:9
                                                                        Start time:16:43:22
                                                                        Start date:23/01/2024
                                                                        Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_DB_Connect.dll" /s
                                                                        Imagebase:0x6a0000
                                                                        File size:20'992 bytes
                                                                        MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:Visual Basic
                                                                        Reputation:moderate
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:10
                                                                        Start time:16:43:22
                                                                        Start date:23/01/2024
                                                                        Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_File_Data.dll" /s
                                                                        Imagebase:0x6a0000
                                                                        File size:20'992 bytes
                                                                        MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:Visual Basic
                                                                        Reputation:moderate
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:11
                                                                        Start time:16:43:23
                                                                        Start date:23/01/2024
                                                                        Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_File_Export.dll" /s
                                                                        Imagebase:0x6a0000
                                                                        File size:20'992 bytes
                                                                        MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:Visual Basic
                                                                        Reputation:moderate
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:12
                                                                        Start time:16:43:23
                                                                        Start date:23/01/2024
                                                                        Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_Rmt_DB4_Update.dll" /s
                                                                        Imagebase:0x6a0000
                                                                        File size:20'992 bytes
                                                                        MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:Visual Basic
                                                                        Reputation:moderate
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:13
                                                                        Start time:16:43:25
                                                                        Start date:23/01/2024
                                                                        Path:C:\Windows\System32\msiexec.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\msiexec.exe /V
                                                                        Imagebase:0x7ff602f30000
                                                                        File size:69'632 bytes
                                                                        MD5 hash:E5DA170027542E25EDE42FC54C929077
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:high
                                                                        Has exited:false

                                                                        General

                                                                        Target ID:14
                                                                        Start time:16:43:25
                                                                        Start date:23/01/2024
                                                                        Path:C:\Windows\SysWOW64\msiexec.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding 9F821CD8835F26EFA91C6F67DA97DD7D
                                                                        Imagebase:0x50000
                                                                        File size:59'904 bytes
                                                                        MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:moderate
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:17
                                                                        Start time:16:43:32
                                                                        Start date:23/01/2024
                                                                        Path:C:\Windows\SysWOW64\msiexec.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\craxdrt.dll
                                                                        Imagebase:0x50000
                                                                        File size:59'904 bytes
                                                                        MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:18
                                                                        Start time:16:43:32
                                                                        Start date:23/01/2024
                                                                        Path:C:\Windows\SysWOW64\msiexec.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crviewer.dll
                                                                        Imagebase:0x50000
                                                                        File size:59'904 bytes
                                                                        MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:19
                                                                        Start time:16:43:32
                                                                        Start date:23/01/2024
                                                                        Path:C:\Windows\SysWOW64\msiexec.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\Crystal\Cdo32.dll
                                                                        Imagebase:0x50000
                                                                        File size:59'904 bytes
                                                                        MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:20
                                                                        Start time:16:43:32
                                                                        Start date:23/01/2024
                                                                        Path:C:\Windows\SysWOW64\msiexec.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crtslv.dll
                                                                        Imagebase:0x50000
                                                                        File size:59'904 bytes
                                                                        MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:21
                                                                        Start time:16:43:32
                                                                        Start date:23/01/2024
                                                                        Path:C:\Windows\SysWOW64\msiexec.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\ExportModeller.dll
                                                                        Imagebase:0x50000
                                                                        File size:59'904 bytes
                                                                        MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:23
                                                                        Start time:16:43:36
                                                                        Start date:23/01/2024
                                                                        Path:C:\Windows\explorer.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:"C:\Windows\explorer.exe" /separate /root,::{21ec2020-3aea-1069-a2dd-08002b30309d}
                                                                        Imagebase:0x7ff72b770000
                                                                        File size:5'141'208 bytes
                                                                        MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:24
                                                                        Start time:16:43:37
                                                                        Start date:23/01/2024
                                                                        Path:C:\Windows\explorer.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                        Imagebase:0x7ff72b770000
                                                                        File size:5'141'208 bytes
                                                                        MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:false

                                                                        Disassembly

                                                                        Reset < >

                                                                          Execution Graph

                                                                          Execution Coverage:12%
                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                          Signature Coverage:12%
                                                                          Total number of Nodes:2000
                                                                          Total number of Limit Nodes:139
                                                                          execution_graph 19982 40d740 19983 40d77f 19982->19983 19986 421dee 19983->19986 19985 40d7a3 19988 421dfa ___FrameUnwindToState 19986->19988 19987 421e73 ___FrameUnwindToState _realloc 19987->19985 19988->19987 19989 421e39 19988->19989 19999 422f9f 19988->19999 19989->19987 19990 421e4e RtlFreeHeap 19989->19990 19990->19987 19992 421e60 19990->19992 20016 422daa 19992->20016 19995 421e11 ___sbh_find_block 19998 421e2b 19995->19998 20006 423002 19995->20006 20013 421e44 19998->20013 20000 422fc7 EnterCriticalSection 19999->20000 20001 422fb4 19999->20001 20000->19995 20019 422edc 20001->20019 20003 422fba 20003->20000 20045 423cbc 20003->20045 20007 423041 20006->20007 20012 4232e3 20006->20012 20008 42322d VirtualFree 20007->20008 20007->20012 20009 423291 20008->20009 20010 4232a0 VirtualFree HeapFree 20009->20010 20009->20012 20275 4221a0 20010->20275 20012->19998 20279 422ec5 LeaveCriticalSection 20013->20279 20015 421e4b 20015->19989 20280 42446a GetLastError 20016->20280 20018 421e65 GetLastError 20018->19987 20020 422ee8 ___FrameUnwindToState 20019->20020 20021 422f0e 20020->20021 20052 42416f 20020->20052 20029 422f1e ___FrameUnwindToState 20021->20029 20098 424ade 20021->20098 20027 422f30 20031 422daa __filwbuf 67 API calls 20027->20031 20028 422f3f 20032 422f9f __lock 67 API calls 20028->20032 20029->20003 20030 422f04 20095 423d10 20030->20095 20031->20029 20034 422f46 20032->20034 20035 422f7a 20034->20035 20036 422f4e 20034->20036 20037 421dee __getptd_noexit 67 API calls 20035->20037 20104 42744e 20036->20104 20044 422f6b 20037->20044 20039 422f59 20041 421dee __getptd_noexit 67 API calls 20039->20041 20039->20044 20042 422f65 20041->20042 20043 422daa __filwbuf 67 API calls 20042->20043 20043->20044 20108 422f96 20044->20108 20046 42416f __FF_MSGBANNER 67 API calls 20045->20046 20047 423cc6 20046->20047 20048 423fc4 __NMSG_WRITE 67 API calls 20047->20048 20049 423cce 20048->20049 20050 42425a __decode_pointer 6 API calls 20049->20050 20051 422fc6 20050->20051 20051->20000 20111 427bd3 20052->20111 20054 424176 20056 427bd3 __set_error_mode 67 API calls 20054->20056 20058 424183 20054->20058 20055 423fc4 __NMSG_WRITE 67 API calls 20057 42419b 20055->20057 20056->20058 20059 423fc4 __NMSG_WRITE 67 API calls 20057->20059 20058->20055 20060 422efd 20058->20060 20059->20060 20061 423fc4 20060->20061 20062 423fd8 20061->20062 20063 427bd3 __set_error_mode 64 API calls 20062->20063 20094 424133 20062->20094 20064 423ffa 20063->20064 20065 424138 GetStdHandle 20064->20065 20066 427bd3 __set_error_mode 64 API calls 20064->20066 20067 424146 _strlen 20065->20067 20065->20094 20068 42400b 20066->20068 20070 42415f WriteFile 20067->20070 20067->20094 20068->20065 20069 42401d 20068->20069 20069->20094 20134 427b6b 20069->20134 20070->20094 20073 424053 GetModuleFileNameA 20074 424071 20073->20074 20079 424094 _strlen 20073->20079 20077 427b6b _strcpy_s 64 API calls 20074->20077 20078 424081 20077->20078 20078->20079 20081 424c1e __invoke_watson 10 API calls 20078->20081 20080 4240d7 20079->20080 20150 427a22 20079->20150 20159 4279ae 20080->20159 20081->20079 20085 4240fb 20088 4279ae _strcat_s 64 API calls 20085->20088 20087 424c1e __invoke_watson 10 API calls 20087->20085 20090 42410f 20088->20090 20089 424c1e __invoke_watson 10 API calls 20089->20080 20091 424120 20090->20091 20093 424c1e __invoke_watson 10 API calls 20090->20093 20168 427845 20091->20168 20093->20091 20094->20030 20219 423ce5 GetModuleHandleW 20095->20219 20100 424ae7 20098->20100 20101 422f29 20100->20101 20102 424afe Sleep 20100->20102 20223 421ecb 20100->20223 20101->20027 20101->20028 20103 424b13 20102->20103 20103->20100 20103->20101 20273 423a98 20104->20273 20106 42745a InitializeCriticalSectionAndSpinCount 20107 42749e ___FrameUnwindToState 20106->20107 20107->20039 20274 422ec5 LeaveCriticalSection 20108->20274 20110 422f9d 20110->20029 20112 427be2 20111->20112 20113 422daa __filwbuf 67 API calls 20112->20113 20114 427bec 20112->20114 20115 427c05 20113->20115 20114->20054 20117 424d46 20115->20117 20120 42425a TlsGetValue 20117->20120 20119 424d56 __invoke_watson 20121 424272 20120->20121 20122 424293 GetModuleHandleW 20120->20122 20121->20122 20123 42427c TlsGetValue 20121->20123 20124 4242a3 20122->20124 20125 4242ae GetProcAddress 20122->20125 20127 424287 20123->20127 20130 423c8c 20124->20130 20129 42428b 20125->20129 20127->20122 20127->20129 20129->20119 20131 423c97 Sleep GetModuleHandleW 20130->20131 20132 423cb5 20131->20132 20133 423cb9 20131->20133 20132->20131 20132->20133 20133->20125 20133->20129 20135 427b83 20134->20135 20136 427b7c 20134->20136 20137 422daa __filwbuf 67 API calls 20135->20137 20136->20135 20139 427ba9 20136->20139 20142 427b88 20137->20142 20138 424d46 __filwbuf 6 API calls 20140 42403f 20138->20140 20139->20140 20141 422daa __filwbuf 67 API calls 20139->20141 20140->20073 20143 424c1e 20140->20143 20141->20142 20142->20138 20195 4287c0 20143->20195 20145 424c4b IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 20146 424d27 GetCurrentProcess TerminateProcess 20145->20146 20148 424d1b __invoke_watson 20145->20148 20197 421ddf 20146->20197 20148->20146 20149 424050 20149->20073 20154 427a34 20150->20154 20151 427a38 20152 4240c4 20151->20152 20153 422daa __filwbuf 67 API calls 20151->20153 20152->20080 20152->20089 20155 427a54 20153->20155 20154->20151 20154->20152 20157 427a7e 20154->20157 20156 424d46 __filwbuf 6 API calls 20155->20156 20156->20152 20157->20152 20158 422daa __filwbuf 67 API calls 20157->20158 20158->20155 20160 4279c6 20159->20160 20163 4279bf 20159->20163 20161 422daa __filwbuf 67 API calls 20160->20161 20162 4279cb 20161->20162 20164 424d46 __filwbuf 6 API calls 20162->20164 20163->20160 20166 4279fa 20163->20166 20165 4240ea 20164->20165 20165->20085 20165->20087 20166->20165 20167 422daa __filwbuf 67 API calls 20166->20167 20167->20162 20206 424251 20168->20206 20171 427868 LoadLibraryA 20172 42787d GetProcAddress 20171->20172 20184 427992 20171->20184 20174 427893 20172->20174 20172->20184 20173 4278f0 20176 42425a __decode_pointer 6 API calls 20173->20176 20192 42791a 20173->20192 20209 4241df TlsGetValue 20174->20209 20175 42425a __decode_pointer 6 API calls 20185 42795d 20175->20185 20179 42790d 20176->20179 20178 42425a __decode_pointer 6 API calls 20178->20184 20181 42425a __decode_pointer 6 API calls 20179->20181 20181->20192 20182 4241df __encode_pointer 6 API calls 20183 4278ae GetProcAddress 20182->20183 20186 4241df __encode_pointer 6 API calls 20183->20186 20184->20094 20189 42425a __decode_pointer 6 API calls 20185->20189 20191 427945 20185->20191 20187 4278c3 GetProcAddress 20186->20187 20188 4241df __encode_pointer 6 API calls 20187->20188 20190 4278d8 20188->20190 20189->20191 20190->20173 20193 4278e2 GetProcAddress 20190->20193 20191->20178 20192->20175 20192->20191 20194 4241df __encode_pointer 6 API calls 20193->20194 20194->20173 20196 4287cc __VEC_memzero 20195->20196 20196->20145 20198 421de7 20197->20198 20199 421de9 IsDebuggerPresent 20197->20199 20198->20149 20205 427437 20199->20205 20202 422d2f SetUnhandledExceptionFilter UnhandledExceptionFilter 20203 422d54 GetCurrentProcess TerminateProcess 20202->20203 20204 422d4c __invoke_watson 20202->20204 20203->20149 20204->20203 20205->20202 20207 4241df __encode_pointer 6 API calls 20206->20207 20208 424258 20207->20208 20208->20171 20208->20173 20210 4241f7 20209->20210 20211 424218 GetModuleHandleW 20209->20211 20210->20211 20214 424201 TlsGetValue 20210->20214 20212 424233 GetProcAddress 20211->20212 20213 424228 20211->20213 20217 424210 GetProcAddress 20212->20217 20215 423c8c __crt_waiting_on_module_handle 2 API calls 20213->20215 20218 42420c 20214->20218 20216 42422e 20215->20216 20216->20212 20216->20217 20217->20182 20218->20211 20218->20217 20220 423cf9 GetProcAddress 20219->20220 20221 423d0e ExitProcess 20219->20221 20220->20221 20222 423d09 20220->20222 20222->20221 20224 421f7e 20223->20224 20234 421edd 20223->20234 20225 4241b7 _malloc 6 API calls 20224->20225 20226 421f84 20225->20226 20228 422daa __filwbuf 66 API calls 20226->20228 20227 42416f __FF_MSGBANNER 66 API calls 20232 421eee 20227->20232 20240 421f76 20228->20240 20230 423fc4 __NMSG_WRITE 66 API calls 20230->20232 20231 421f3a RtlAllocateHeap 20231->20234 20232->20227 20232->20230 20233 423d10 _fast_error_exit 3 API calls 20232->20233 20232->20234 20233->20232 20234->20231 20234->20232 20235 421f6a 20234->20235 20238 421f6f 20234->20238 20234->20240 20241 421e7c 20234->20241 20249 4241b7 20234->20249 20236 422daa __filwbuf 66 API calls 20235->20236 20236->20238 20239 422daa __filwbuf 66 API calls 20238->20239 20239->20240 20240->20100 20242 421e88 ___FrameUnwindToState 20241->20242 20243 422f9f __lock 67 API calls 20242->20243 20245 421eb9 ___FrameUnwindToState 20242->20245 20244 421e9e 20243->20244 20252 4237b1 20244->20252 20245->20234 20250 42425a __decode_pointer 6 API calls 20249->20250 20251 4241c7 20250->20251 20251->20234 20253 4237df 20252->20253 20254 423878 20253->20254 20257 421ea9 20253->20257 20261 423318 20253->20261 20254->20257 20268 4233c8 20254->20268 20258 421ec2 20257->20258 20272 422ec5 LeaveCriticalSection 20258->20272 20260 421ec9 20260->20245 20262 42332b HeapReAlloc 20261->20262 20263 42335f HeapAlloc 20261->20263 20264 423349 20262->20264 20265 42334d 20262->20265 20263->20264 20266 423382 VirtualAlloc 20263->20266 20264->20254 20265->20263 20266->20264 20267 42339c HeapFree 20266->20267 20267->20264 20269 4233df VirtualAlloc 20268->20269 20271 423426 20269->20271 20271->20257 20272->20260 20273->20106 20274->20110 20276 4221b8 20275->20276 20277 4221e7 20276->20277 20278 4221df __VEC_memcpy 20276->20278 20277->20012 20278->20277 20279->20015 20295 4242f5 TlsGetValue 20280->20295 20282 4244d7 SetLastError 20282->20018 20286 42449d 20287 42425a __decode_pointer 6 API calls 20286->20287 20288 4244af 20287->20288 20289 4244b6 20288->20289 20290 4244ce 20288->20290 20306 424383 20289->20306 20292 421dee __getptd_noexit 64 API calls 20290->20292 20294 4244d4 20292->20294 20293 4244be GetCurrentThreadId 20293->20282 20294->20282 20296 424325 20295->20296 20297 42430a 20295->20297 20296->20282 20300 424b23 20296->20300 20298 42425a __decode_pointer 6 API calls 20297->20298 20299 424315 TlsSetValue 20298->20299 20299->20296 20301 424b2c 20300->20301 20303 424495 20301->20303 20304 424b4a Sleep 20301->20304 20325 428626 20301->20325 20303->20282 20303->20286 20305 424b5f 20304->20305 20305->20301 20305->20303 20342 423a98 20306->20342 20308 42438f GetModuleHandleW 20309 4243a6 20308->20309 20310 42439f 20308->20310 20312 4243e1 20309->20312 20313 4243bd GetProcAddress GetProcAddress 20309->20313 20311 423c8c __crt_waiting_on_module_handle 2 API calls 20310->20311 20315 4243a5 20311->20315 20314 422f9f __lock 63 API calls 20312->20314 20313->20312 20316 424400 InterlockedIncrement 20314->20316 20315->20309 20343 424458 20316->20343 20319 422f9f __lock 63 API calls 20320 424421 20319->20320 20346 427d67 InterlockedIncrement 20320->20346 20322 42443f 20358 424461 20322->20358 20324 42444c ___FrameUnwindToState 20324->20293 20326 428632 ___FrameUnwindToState 20325->20326 20327 42864a 20326->20327 20337 428669 _memset 20326->20337 20328 422daa __filwbuf 66 API calls 20327->20328 20329 42864f 20328->20329 20330 424d46 __filwbuf 6 API calls 20329->20330 20332 42865f ___FrameUnwindToState 20330->20332 20331 4286db RtlAllocateHeap 20331->20337 20332->20301 20333 4241b7 _malloc 6 API calls 20333->20337 20334 422f9f __lock 66 API calls 20334->20337 20335 4237b1 ___sbh_alloc_block 5 API calls 20335->20337 20337->20331 20337->20332 20337->20333 20337->20334 20337->20335 20338 428722 20337->20338 20341 422ec5 LeaveCriticalSection 20338->20341 20340 428729 20340->20337 20341->20340 20342->20308 20361 422ec5 LeaveCriticalSection 20343->20361 20345 42441a 20345->20319 20347 427d85 InterlockedIncrement 20346->20347 20348 427d88 20346->20348 20347->20348 20349 427d92 InterlockedIncrement 20348->20349 20350 427d95 20348->20350 20349->20350 20351 427da2 20350->20351 20352 427d9f InterlockedIncrement 20350->20352 20353 427daf 20351->20353 20354 427dac InterlockedIncrement 20351->20354 20352->20351 20355 427dc8 InterlockedIncrement 20353->20355 20356 427de3 InterlockedIncrement 20353->20356 20357 427dd8 InterlockedIncrement 20353->20357 20354->20353 20355->20353 20356->20322 20357->20353 20362 422ec5 LeaveCriticalSection 20358->20362 20360 424468 20360->20324 20361->20345 20362->20360 20363 41e040 20366 41df90 20363->20366 20365 41e04a 20371 41dd70 20366->20371 20369 41dfea PostMessageW 20369->20365 20370 41e00f 20370->20365 20372 41ddb0 20371->20372 20373 41ddaa 20371->20373 20378 41df74 WaitForSingleObject 20372->20378 20431 41b1d0 20372->20431 20391 41db40 20373->20391 20378->20369 20378->20370 20379 41df27 20380 421dee __getptd_noexit 67 API calls 20379->20380 20380->20378 20381 41ddda 20381->20379 20383 421dee 67 API calls __getptd_noexit 20381->20383 20384 404b30 68 API calls 20381->20384 20386 41df29 20381->20386 20439 406230 20381->20439 20450 404920 20381->20450 20454 408890 20381->20454 20383->20381 20384->20381 20388 404920 67 API calls 20386->20388 20389 41df38 20388->20389 20390 408890 VariantClear 20389->20390 20390->20379 20458 404e70 20391->20458 20396 41dbc5 20474 41abf0 20396->20474 20397 41db9f 20470 404bf0 20397->20470 20401 421dee __getptd_noexit 67 API calls 20402 41dd50 20401->20402 20402->20372 20403 421dee __getptd_noexit 67 API calls 20404 41dc34 20403->20404 20405 41dc5b 20404->20405 20406 41dc3c 20404->20406 20535 404b90 20405->20535 20408 404bf0 68 API calls 20406->20408 20410 41dbac 20408->20410 20410->20401 20414 41dc7e 20415 41dc82 20414->20415 20416 41dcde 20414->20416 20592 41b320 20415->20592 20599 404b30 20416->20599 21459 4089e0 20431->21459 20434 405140 20435 405150 20434->20435 20436 405171 CharUpperW CharUpperW 20435->20436 20437 40518f 20435->20437 20436->20435 20438 405198 20436->20438 20437->20381 20438->20381 20440 40626a 20439->20440 20441 404e70 68 API calls 20440->20441 20445 406281 20441->20445 20442 40628c 20444 421dee __getptd_noexit 67 API calls 20442->20444 20443 4062e2 20446 4049b0 68 API calls 20443->20446 20447 406300 20444->20447 20445->20442 20445->20443 20448 4049b0 68 API calls 20445->20448 20449 404c40 68 API calls 20445->20449 20446->20442 20447->20381 20448->20445 20449->20445 20451 40495f 20450->20451 20452 421dee __getptd_noexit 67 API calls 20451->20452 20453 404983 20452->20453 20453->20381 20455 4088b5 VariantClear 20454->20455 20456 40889b 20454->20456 20455->20381 20456->20455 20457 4088a9 20456->20457 20457->20381 20459 421ecb _malloc 67 API calls 20458->20459 20460 404e8e 20459->20460 20463 404eac 20460->20463 20658 42d9e5 20460->20658 20462 404ed8 20465 407f40 20462->20465 20463->20462 20463->20463 20464 421dee __getptd_noexit 67 API calls 20463->20464 20464->20462 20661 407e20 20465->20661 20468 407f94 20468->20396 20468->20397 20469 407f8d FindClose 20469->20468 20471 404bf7 20470->20471 20472 404c14 20470->20472 20471->20472 20473 404e70 68 API calls 20471->20473 20472->20410 20473->20472 20475 421ecb _malloc 67 API calls 20474->20475 20476 41ac2d 20475->20476 20477 41ac47 20476->20477 20478 42d9e5 __CxxThrowException@8 RaiseException 20476->20478 20736 4197d0 20477->20736 20478->20477 20481 404e70 68 API calls 20482 41ac95 20481->20482 20483 404e70 68 API calls 20482->20483 20484 41acb1 20483->20484 20485 404e70 68 API calls 20484->20485 20486 41accd 20485->20486 20743 4077c0 20486->20743 20488 41ace7 20489 41aceb GetLastError 20488->20489 20490 41ad3d 20488->20490 20492 421dee __getptd_noexit 67 API calls 20489->20492 20758 404df0 20490->20758 20494 41ad02 20492->20494 20496 421dee __getptd_noexit 67 API calls 20494->20496 20495 404bf0 68 API calls 20497 41ad5e 20495->20497 20498 41ad14 20496->20498 20499 421dee __getptd_noexit 67 API calls 20497->20499 20500 421dee __getptd_noexit 67 API calls 20498->20500 20501 41ad6d 20499->20501 20533 41ad26 20500->20533 20761 404cb0 20501->20761 20504 404bf0 68 API calls 20505 41ad91 20504->20505 20506 421dee __getptd_noexit 67 API calls 20505->20506 20507 41ada0 20506->20507 20764 4198b0 20507->20764 20533->20403 20536 404bb5 20535->20536 20537 404baf 20535->20537 20539 408700 20536->20539 20538 404e70 68 API calls 20537->20538 20538->20536 20540 408738 20539->20540 20541 408708 20539->20541 20543 406c90 20540->20543 20541->20540 20542 404c40 68 API calls 20541->20542 20542->20540 20544 404b30 68 API calls 20543->20544 20550 406cc2 20544->20550 20545 406d40 20546 404b90 68 API calls 20545->20546 20547 406d56 20546->20547 21426 406bc0 CreateDirectoryW 20547->21426 20549 406d66 20552 406d70 GetLastError 20549->20552 20573 404df0 68 API calls 20549->20573 20584 406f44 20549->20584 20586 421dee __getptd_noexit 67 API calls 20549->20586 20587 404e70 68 API calls 20549->20587 20590 406bc0 72 API calls 20549->20590 20591 406ef8 20549->20591 20550->20545 20551 4221a0 ___sbh_free_block __VEC_memcpy 20550->20551 20585 406ead 20550->20585 20551->20545 20552->20549 20555 406e55 20552->20555 20553 404bf0 68 API calls 20568 406f54 20553->20568 20554 421dee __getptd_noexit 67 API calls 20556 406ec1 20554->20556 20556->20414 20562 421dee __getptd_noexit 67 API calls 20566 406f0d 20562->20566 20573->20549 20584->20553 20585->20554 20586->20549 20587->20549 20590->20549 20591->20562 20593 41b1d0 69 API calls 20592->20593 20594 41b359 20593->20594 21439 41b280 20594->21439 20600 404b4f 20599->20600 20601 404e70 68 API calls 20600->20601 20602 404b65 20600->20602 20601->20602 20659 42da1a RaiseException 20658->20659 20660 42da0e 20658->20660 20659->20463 20660->20659 20662 407e84 FindFirstFileW 20661->20662 20663 407e6f FindClose 20661->20663 20665 407e97 20662->20665 20666 407ef7 20662->20666 20664 407e7e 20663->20664 20668 407f0c 20663->20668 20664->20662 20669 404e70 68 API calls 20665->20669 20666->20668 20706 407dc0 20666->20706 20670 421ddf __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 20668->20670 20671 407eb0 20669->20671 20673 407f2d 20670->20673 20678 4081c0 20671->20678 20673->20468 20673->20469 20675 407ee6 20677 421dee __getptd_noexit 67 API calls 20675->20677 20676 407ed8 FindFirstFileW 20676->20675 20677->20666 20679 408206 20678->20679 20680 404e70 68 API calls 20679->20680 20691 407ec4 20679->20691 20682 408259 20680->20682 20681 4082a9 GetCurrentDirectoryW 20683 4082c4 20681->20683 20682->20681 20684 404e70 68 API calls 20682->20684 20685 4082f1 20682->20685 20686 408391 20683->20686 20689 4082d8 20683->20689 20684->20681 20687 404b30 68 API calls 20685->20687 20688 421dee __getptd_noexit 67 API calls 20686->20688 20690 4082ff 20687->20690 20688->20691 20689->20685 20710 404c40 20689->20710 20714 407ca0 20690->20714 20691->20675 20691->20676 20697 404bf0 68 API calls 20698 408338 20697->20698 20699 421dee __getptd_noexit 67 API calls 20698->20699 20700 408346 20699->20700 20701 421dee __getptd_noexit 67 API calls 20700->20701 20702 408355 20701->20702 20703 421dee __getptd_noexit 67 API calls 20702->20703 20704 408364 20703->20704 20705 421dee __getptd_noexit 67 API calls 20704->20705 20705->20691 20707 407df9 __winput_l 20706->20707 20732 4067a0 20707->20732 20709 407e15 20709->20668 20711 404c8c 20710->20711 20712 404c52 20710->20712 20711->20685 20712->20711 20713 404e70 68 API calls 20712->20713 20713->20711 20715 404b90 68 API calls 20714->20715 20716 407cdd 20715->20716 20724 406370 20716->20724 20719 408600 20720 404b90 68 API calls 20719->20720 20721 40863d 20720->20721 20728 408670 20721->20728 20725 4063c0 20724->20725 20726 40638a 20724->20726 20725->20719 20726->20725 20727 404e70 68 API calls 20726->20727 20727->20725 20730 408682 20728->20730 20729 408328 20729->20697 20730->20729 20731 404e70 68 API calls 20730->20731 20731->20729 20733 4067b9 20732->20733 20734 404e70 68 API calls 20733->20734 20735 4067d5 20733->20735 20734->20735 20735->20709 20735->20735 20737 404e70 68 API calls 20736->20737 20738 41983e 20737->20738 20739 404e70 68 API calls 20738->20739 20740 419854 20739->20740 20741 404e70 68 API calls 20740->20741 20742 41986b 20741->20742 20742->20481 20744 4077e1 20743->20744 20745 4077f2 GetFullPathNameW 20743->20745 20744->20745 20747 404e70 68 API calls 20744->20747 20746 407815 20745->20746 20748 40782e 20746->20748 20751 407856 GetFullPathNameW 20746->20751 20754 407871 20746->20754 20757 404e70 68 API calls 20746->20757 20747->20745 20748->20488 20749 4078b9 20753 407620 70 API calls 20749->20753 20750 40789a lstrlenW 20830 407620 20750->20830 20751->20754 20756 4078cb 20753->20756 20754->20748 20754->20749 20754->20750 20756->20488 20757->20751 20852 404cd0 20758->20852 20762 404cd0 68 API calls 20761->20762 20763 404cc6 20762->20763 20763->20504 20765 404bf0 68 API calls 20764->20765 20766 4198e1 20765->20766 20767 407ca0 68 API calls 20766->20767 20768 4198f2 20767->20768 20769 407f40 73 API calls 20768->20769 20770 419905 20769->20770 20771 421dee __getptd_noexit 67 API calls 20770->20771 20832 407655 20830->20832 20831 40779b 20831->20488 20832->20831 20848 407580 20832->20848 20834 407697 20835 407580 68 API calls 20834->20835 20836 4076a6 20835->20836 20837 4076d7 20836->20837 20838 404df0 68 API calls 20836->20838 20841 421dee __getptd_noexit 67 API calls 20837->20841 20844 4076f6 20837->20844 20839 4076c2 20838->20839 20840 405140 2 API calls 20839->20840 20840->20837 20841->20844 20842 407700 20843 421dee __getptd_noexit 67 API calls 20842->20843 20845 407789 20843->20845 20844->20842 20847 404e70 68 API calls 20844->20847 20846 421dee __getptd_noexit 67 API calls 20845->20846 20846->20831 20847->20844 20849 407593 20848->20849 20850 404e70 68 API calls 20849->20850 20851 4075fa 20849->20851 20850->20851 20851->20834 20851->20851 20853 404d11 20852->20853 20854 404d2f 20853->20854 20855 404d1d 20853->20855 20856 404e70 68 API calls 20854->20856 20857 404b90 68 API calls 20855->20857 20858 404d46 20856->20858 20859 404d2a 20857->20859 20860 404d59 20858->20860 20861 404e70 68 API calls 20858->20861 20859->20495 20862 404da8 20860->20862 20863 404e70 68 API calls 20860->20863 20861->20860 20864 421dee __getptd_noexit 67 API calls 20862->20864 20863->20862 20864->20859 21427 406bfb 21426->21427 21428 406bff GetLastError 21426->21428 21427->20549 21428->21427 21429 406c0c 21428->21429 21430 404e70 68 API calls 21429->21430 21431 406c23 21430->21431 21432 4081c0 69 API calls 21431->21432 21462 408910 21459->21462 21463 404e70 68 API calls 21462->21463 21465 408958 21463->21465 21464 408989 LoadStringW 21464->21465 21467 40899e 21464->21467 21465->21464 21466 404e70 68 API calls 21465->21466 21466->21464 21467->20434 21468 416680 21473 4166d0 21468->21473 21471 416695 21472 421dee __getptd_noexit 67 API calls 21472->21471 21474 416738 21473->21474 21475 421dee __getptd_noexit 67 API calls 21474->21475 21476 416688 21475->21476 21476->21471 21476->21472 21477 413d40 21478 413d50 WriteFile 21477->21478 21479 413d4b 21477->21479 21480 413d8d 21478->21480 21479->21478 21481 413d93 21480->21481 21482 413d98 GetLastError 21480->21482 21483 413da2 21482->21483 21484 4166c4 21485 421dee __getptd_noexit 67 API calls 21484->21485 21486 4166ca 21485->21486 21487 422b09 21488 422b1a 21487->21488 21524 422df3 HeapCreate 21488->21524 21491 422b59 21526 42469a GetModuleHandleW 21491->21526 21495 422b6a __RTC_Initialize 21560 427101 21495->21560 21496 422ab1 _fast_error_exit 67 API calls 21496->21495 21498 422b78 21499 422b84 GetCommandLineA 21498->21499 21501 423cbc __amsg_exit 67 API calls 21498->21501 21575 426fca 21499->21575 21503 422b83 21501->21503 21503->21499 21506 422ba9 21611 426c97 21506->21611 21507 423cbc __amsg_exit 67 API calls 21507->21506 21510 422bba 21626 423d7b 21510->21626 21511 423cbc __amsg_exit 67 API calls 21511->21510 21513 422bc1 21514 422bcc 21513->21514 21515 423cbc __amsg_exit 67 API calls 21513->21515 21632 426c38 21514->21632 21515->21514 21519 422bed 21520 422bfb 21519->21520 22380 423f2c 21519->22380 22391 423f58 21520->22391 21525 422b4d 21524->21525 21525->21491 22383 422ab1 21525->22383 21527 4246b5 21526->21527 21528 4246ae 21526->21528 21530 4246bf GetProcAddress GetProcAddress GetProcAddress GetProcAddress 21527->21530 21531 42481d 21527->21531 21529 423c8c __crt_waiting_on_module_handle 2 API calls 21528->21529 21533 4246b4 21529->21533 21534 424708 TlsAlloc 21530->21534 22405 424346 21531->22405 21533->21527 21536 422b5f 21534->21536 21537 424756 TlsSetValue 21534->21537 21536->21495 21536->21496 21537->21536 21538 424767 21537->21538 22394 423f76 21538->22394 21541 4241df __encode_pointer 6 API calls 21542 424777 21541->21542 21543 4241df __encode_pointer 6 API calls 21542->21543 21544 424787 21543->21544 21545 4241df __encode_pointer 6 API calls 21544->21545 21546 424797 21545->21546 21547 4241df __encode_pointer 6 API calls 21546->21547 21548 4247a7 21547->21548 22401 422e23 21548->22401 21551 42425a __decode_pointer 6 API calls 21552 4247c8 21551->21552 21552->21531 21553 424b23 __calloc_crt 67 API calls 21552->21553 21554 4247e1 21553->21554 21554->21531 21555 42425a __decode_pointer 6 API calls 21554->21555 21556 4247fb 21555->21556 21556->21531 21557 424802 21556->21557 21558 424383 __initptd 67 API calls 21557->21558 21559 42480a GetCurrentThreadId 21558->21559 21559->21536 22414 423a98 21560->22414 21562 42710d GetStartupInfoA 21563 424b23 __calloc_crt 67 API calls 21562->21563 21570 42712e 21563->21570 21564 42734c ___FrameUnwindToState 21564->21498 21565 4272c9 GetStdHandle 21569 427293 21565->21569 21566 42732e SetHandleCount 21566->21564 21567 424b23 __calloc_crt 67 API calls 21567->21570 21568 4272db GetFileType 21568->21569 21569->21564 21569->21565 21569->21566 21569->21568 21571 42744e __ioinit InitializeCriticalSectionAndSpinCount 21569->21571 21570->21564 21570->21567 21570->21569 21572 427216 21570->21572 21571->21569 21572->21564 21572->21569 21573 42723f GetFileType 21572->21573 21574 42744e __ioinit InitializeCriticalSectionAndSpinCount 21572->21574 21573->21572 21574->21572 21576 427007 21575->21576 21577 426fe8 GetEnvironmentStringsW 21575->21577 21578 426ff0 21576->21578 21580 4270a0 21576->21580 21577->21578 21579 426ffc GetLastError 21577->21579 21582 427032 WideCharToMultiByte 21578->21582 21583 427023 GetEnvironmentStringsW 21578->21583 21579->21576 21581 4270a9 GetEnvironmentStrings 21580->21581 21584 422b94 21580->21584 21581->21584 21589 4270b9 21581->21589 21586 427066 21582->21586 21587 427095 FreeEnvironmentStringsW 21582->21587 21583->21582 21583->21584 21600 426f0f 21584->21600 21588 424ade __malloc_crt 67 API calls 21586->21588 21587->21584 21592 42706c 21588->21592 21590 424ade __malloc_crt 67 API calls 21589->21590 21591 4270d3 21590->21591 21593 4270e6 ___crtGetEnvironmentStringsA 21591->21593 21594 4270da FreeEnvironmentStringsA 21591->21594 21592->21587 21595 427074 WideCharToMultiByte 21592->21595 21598 4270f0 FreeEnvironmentStringsA 21593->21598 21594->21584 21596 42708e 21595->21596 21597 427086 21595->21597 21596->21587 21599 421dee __getptd_noexit 67 API calls 21597->21599 21598->21584 21599->21596 21601 426f24 21600->21601 21602 426f29 GetModuleFileNameA 21600->21602 22421 428608 21601->22421 21604 426f50 21602->21604 22415 426d75 21604->22415 21606 422b9e 21606->21506 21606->21507 21608 424ade __malloc_crt 67 API calls 21609 426f92 21608->21609 21609->21606 21610 426d75 _parse_cmdline 77 API calls 21609->21610 21610->21606 21612 426ca0 21611->21612 21613 426ca5 _strlen 21611->21613 21614 428608 ___initmbctable 111 API calls 21612->21614 21615 422baf 21613->21615 21616 424b23 __calloc_crt 67 API calls 21613->21616 21614->21613 21615->21510 21615->21511 21623 426cda _strlen 21616->21623 21617 426d38 21618 421dee __getptd_noexit 67 API calls 21617->21618 21618->21615 21619 424b23 __calloc_crt 67 API calls 21619->21623 21620 426d5e 21621 421dee __getptd_noexit 67 API calls 21620->21621 21621->21615 21622 427b6b _strcpy_s 67 API calls 21622->21623 21623->21615 21623->21617 21623->21619 21623->21620 21623->21622 21624 426d1f 21623->21624 21624->21623 21625 424c1e __invoke_watson 10 API calls 21624->21625 21625->21624 21627 423d89 __IsNonwritableInCurrentImage 21626->21627 22832 427603 21627->22832 21629 423da7 __initterm_e 21631 423dc6 __IsNonwritableInCurrentImage __initterm 21629->21631 22836 42262c 21629->22836 21631->21513 21633 426c46 21632->21633 21636 426c4b 21632->21636 21634 428608 ___initmbctable 111 API calls 21633->21634 21634->21636 21635 422bd2 21638 41ff60 LoadLibraryW 21635->21638 21636->21635 21637 42af37 _parse_cmdline 77 API calls 21636->21637 21637->21636 21639 41ffe2 21638->21639 21640 41ff9b GetProcAddress 21638->21640 22936 41ea10 GetVersionExW 21639->22936 21642 41ffcb GetProcAddress 21640->21642 21643 41ffad 21640->21643 21645 41ffd7 21642->21645 21646 41ffdb FreeLibrary 21642->21646 21643->21642 21650 41ffb8 GetProcAddress 21643->21650 21644 41fff1 21647 41fff5 21644->21647 21648 420044 CoInitialize 21644->21648 21645->21646 21646->21639 21649 41b1d0 69 API calls 21647->21649 21651 42005e _memset 21648->21651 21652 420009 MessageBoxW 21649->21652 21650->21642 21653 41ffc4 21650->21653 22944 41f320 GetVersion 21651->22944 21654 421dee __getptd_noexit 67 API calls 21652->21654 21653->21642 21656 420025 21654->21656 21660 421ddf __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 21656->21660 21658 420090 21659 4200aa 21658->21659 21661 420099 21658->21661 21662 4200b4 21659->21662 22947 41f6e0 21659->22947 21663 42003e 21660->21663 23209 41f630 21661->23209 21666 404e70 68 API calls 21662->21666 21663->21519 21668 4200e0 21666->21668 21669 404e70 68 API calls 21668->21669 21670 4200f7 21669->21670 21671 404e70 68 API calls 21670->21671 24319 423e00 22380->24319 22384 422ac4 22383->22384 22385 422abf 22383->22385 22387 423fc4 __NMSG_WRITE 67 API calls 22384->22387 22386 42416f __FF_MSGBANNER 67 API calls 22385->22386 22386->22384 22388 422acc 22387->22388 22389 423d10 _fast_error_exit 3 API calls 22388->22389 22390 422ad6 22389->22390 22390->21491 22392 423e00 _doexit 67 API calls 22391->22392 22395 424251 ___crtMessageBoxW 6 API calls 22394->22395 22396 423f7e __init_pointers __initp_misc_winsig 22395->22396 22411 424df0 22396->22411 22399 4241df __encode_pointer 6 API calls 22400 423fba 22399->22400 22400->21541 22402 422e2e 22401->22402 22403 42744e __ioinit InitializeCriticalSectionAndSpinCount 22402->22403 22404 422e5c 22402->22404 22403->22402 22404->21531 22404->21551 22406 424350 22405->22406 22410 42435c 22405->22410 22407 42425a __decode_pointer 6 API calls 22406->22407 22407->22410 22408 424370 TlsFree 22409 42437e 22408->22409 22409->22409 22410->22408 22410->22409 22412 4241df __encode_pointer 6 API calls 22411->22412 22413 423fb0 22412->22413 22413->22399 22414->21562 22417 426d94 22415->22417 22419 426e01 22417->22419 22425 42af37 22417->22425 22418 426eff 22418->21606 22418->21608 22419->22418 22420 42af37 77 API calls _parse_cmdline 22419->22420 22420->22419 22422 428618 22421->22422 22423 428611 22421->22423 22422->21602 22647 42846e 22423->22647 22428 42aee4 22425->22428 22431 4257e9 22428->22431 22432 4257fc 22431->22432 22436 425849 22431->22436 22439 4244e3 22432->22439 22435 425829 22435->22436 22459 428169 22435->22459 22436->22417 22440 42446a __getptd_noexit 67 API calls 22439->22440 22441 4244eb 22440->22441 22442 4244f8 22441->22442 22443 423cbc __amsg_exit 67 API calls 22441->22443 22442->22435 22444 427ecd 22442->22444 22443->22442 22445 427ed9 ___FrameUnwindToState 22444->22445 22446 4244e3 __getptd 67 API calls 22445->22446 22447 427ede 22446->22447 22448 427f0c 22447->22448 22449 427ef0 22447->22449 22450 422f9f __lock 67 API calls 22448->22450 22451 4244e3 __getptd 67 API calls 22449->22451 22452 427f13 22450->22452 22453 427ef5 22451->22453 22475 427e8f 22452->22475 22457 427f03 ___FrameUnwindToState 22453->22457 22458 423cbc __amsg_exit 67 API calls 22453->22458 22457->22435 22458->22457 22460 428175 ___FrameUnwindToState 22459->22460 22461 4244e3 __getptd 67 API calls 22460->22461 22462 42817a 22461->22462 22463 42818c 22462->22463 22464 422f9f __lock 67 API calls 22462->22464 22466 42819a ___FrameUnwindToState 22463->22466 22468 423cbc __amsg_exit 67 API calls 22463->22468 22465 4281aa 22464->22465 22467 4281f3 22465->22467 22470 4281c1 InterlockedDecrement 22465->22470 22471 4281db InterlockedIncrement 22465->22471 22466->22436 22643 428204 22467->22643 22468->22466 22470->22471 22472 4281cc 22470->22472 22471->22467 22472->22471 22473 421dee __getptd_noexit 67 API calls 22472->22473 22474 4281da 22473->22474 22474->22471 22476 427e93 22475->22476 22477 427ec5 22475->22477 22476->22477 22478 427d67 ___addlocaleref 8 API calls 22476->22478 22483 427f37 22477->22483 22479 427ea6 22478->22479 22479->22477 22486 427df6 22479->22486 22642 422ec5 LeaveCriticalSection 22483->22642 22485 427f3e 22485->22453 22487 427e07 InterlockedDecrement 22486->22487 22488 427e8a 22486->22488 22489 427e1f 22487->22489 22490 427e1c InterlockedDecrement 22487->22490 22488->22477 22500 427c1e 22488->22500 22491 427e29 InterlockedDecrement 22489->22491 22492 427e2c 22489->22492 22490->22489 22491->22492 22493 427e36 InterlockedDecrement 22492->22493 22494 427e39 22492->22494 22493->22494 22495 427e43 InterlockedDecrement 22494->22495 22496 427e46 22494->22496 22495->22496 22497 427e5f InterlockedDecrement 22496->22497 22498 427e7a InterlockedDecrement 22496->22498 22499 427e6f InterlockedDecrement 22496->22499 22497->22496 22498->22488 22499->22496 22501 427ca2 22500->22501 22502 427c35 22500->22502 22503 427cef 22501->22503 22504 421dee __getptd_noexit 67 API calls 22501->22504 22502->22501 22512 421dee __getptd_noexit 67 API calls 22502->22512 22528 427c69 22502->22528 22519 427d16 22503->22519 22554 42b090 22503->22554 22506 427cc3 22504->22506 22507 421dee __getptd_noexit 67 API calls 22506->22507 22509 427cd6 22507->22509 22515 421dee __getptd_noexit 67 API calls 22509->22515 22510 421dee __getptd_noexit 67 API calls 22516 427c97 22510->22516 22511 427d5b 22517 421dee __getptd_noexit 67 API calls 22511->22517 22518 427c5e 22512->22518 22513 421dee __getptd_noexit 67 API calls 22513->22519 22514 421dee __getptd_noexit 67 API calls 22520 427c7f 22514->22520 22521 427ce4 22515->22521 22523 421dee __getptd_noexit 67 API calls 22516->22523 22524 427d61 22517->22524 22530 42b26a 22518->22530 22519->22511 22522 421dee 67 API calls __getptd_noexit 22519->22522 22546 42b225 22520->22546 22527 421dee __getptd_noexit 67 API calls 22521->22527 22522->22519 22523->22501 22524->22477 22527->22503 22528->22514 22529 427c8a 22528->22529 22529->22510 22531 42b277 22530->22531 22545 42b2f4 22530->22545 22532 42b288 22531->22532 22533 421dee __getptd_noexit 67 API calls 22531->22533 22534 42b29a 22532->22534 22535 421dee __getptd_noexit 67 API calls 22532->22535 22533->22532 22536 42b2ac 22534->22536 22537 421dee __getptd_noexit 67 API calls 22534->22537 22535->22534 22538 42b2be 22536->22538 22539 421dee __getptd_noexit 67 API calls 22536->22539 22537->22536 22540 421dee __getptd_noexit 67 API calls 22538->22540 22542 42b2d0 22538->22542 22539->22538 22540->22542 22541 42b2e2 22544 421dee __getptd_noexit 67 API calls 22541->22544 22541->22545 22542->22541 22543 421dee __getptd_noexit 67 API calls 22542->22543 22543->22541 22544->22545 22545->22528 22547 42b232 22546->22547 22548 42b266 22546->22548 22549 42b242 22547->22549 22550 421dee __getptd_noexit 67 API calls 22547->22550 22548->22529 22551 42b254 22549->22551 22552 421dee __getptd_noexit 67 API calls 22549->22552 22550->22549 22551->22548 22553 421dee __getptd_noexit 67 API calls 22551->22553 22552->22551 22553->22548 22555 42b0a1 22554->22555 22641 427d0f 22554->22641 22556 421dee __getptd_noexit 67 API calls 22555->22556 22557 42b0a9 22556->22557 22558 421dee __getptd_noexit 67 API calls 22557->22558 22559 42b0b1 22558->22559 22560 421dee __getptd_noexit 67 API calls 22559->22560 22561 42b0b9 22560->22561 22562 421dee __getptd_noexit 67 API calls 22561->22562 22563 42b0c1 22562->22563 22564 421dee __getptd_noexit 67 API calls 22563->22564 22565 42b0c9 22564->22565 22566 421dee __getptd_noexit 67 API calls 22565->22566 22567 42b0d1 22566->22567 22641->22513 22642->22485 22646 422ec5 LeaveCriticalSection 22643->22646 22645 42820b 22645->22463 22646->22645 22648 42847a ___FrameUnwindToState 22647->22648 22649 4244e3 __getptd 67 API calls 22648->22649 22650 428483 22649->22650 22651 428169 _LocaleUpdate::_LocaleUpdate 69 API calls 22650->22651 22652 42848d 22651->22652 22678 42820d 22652->22678 22655 424ade __malloc_crt 67 API calls 22656 4284ae 22655->22656 22670 4285cd ___FrameUnwindToState 22656->22670 22685 428289 22656->22685 22659 4285da 22664 4285ed 22659->22664 22665 421dee __getptd_noexit 67 API calls 22659->22665 22659->22670 22660 4284de InterlockedDecrement 22661 4284ee 22660->22661 22662 4284ff InterlockedIncrement 22660->22662 22661->22662 22667 421dee __getptd_noexit 67 API calls 22661->22667 22663 428515 22662->22663 22662->22670 22669 422f9f __lock 67 API calls 22663->22669 22663->22670 22666 422daa __filwbuf 67 API calls 22664->22666 22665->22664 22666->22670 22668 4284fe 22667->22668 22668->22662 22672 428529 InterlockedDecrement 22669->22672 22670->22422 22673 4285a5 22672->22673 22674 4285b8 InterlockedIncrement 22672->22674 22673->22674 22676 421dee __getptd_noexit 67 API calls 22673->22676 22695 4285cf 22674->22695 22677 4285b7 22676->22677 22677->22674 22679 4257e9 _LocaleUpdate::_LocaleUpdate 77 API calls 22678->22679 22680 428221 22679->22680 22681 42824a 22680->22681 22682 42822c GetOEMCP 22680->22682 22683 42824f GetACP 22681->22683 22684 42823c 22681->22684 22682->22684 22683->22684 22684->22655 22684->22670 22686 42820d getSystemCP 79 API calls 22685->22686 22687 4282a9 22686->22687 22688 4282b4 setSBCS 22687->22688 22691 4282f8 IsValidCodePage 22687->22691 22694 42831d _memset __setmbcp_nolock 22687->22694 22689 421ddf __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 22688->22689 22690 42846c 22689->22690 22690->22659 22690->22660 22691->22688 22692 42830a GetCPInfo 22691->22692 22692->22688 22692->22694 22698 427fd6 GetCPInfo 22694->22698 22831 422ec5 LeaveCriticalSection 22695->22831 22697 4285d6 22697->22670 22700 42800a _memset 22698->22700 22707 4280bc 22698->22707 22708 42b500 22700->22708 22703 421ddf __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 22705 428167 22703->22705 22705->22694 22706 42b935 ___crtLCMapStringA 102 API calls 22706->22707 22707->22703 22709 4257e9 _LocaleUpdate::_LocaleUpdate 77 API calls 22708->22709 22710 42b513 22709->22710 22718 42b346 22710->22718 22713 42b935 22714 4257e9 _LocaleUpdate::_LocaleUpdate 77 API calls 22713->22714 22715 42b948 22714->22715 22784 42b590 22715->22784 22719 42b367 GetStringTypeW 22718->22719 22721 42b392 22718->22721 22720 42b387 GetLastError 22719->22720 22722 42b37f 22719->22722 22720->22721 22721->22722 22724 42b479 22721->22724 22723 42b3cb MultiByteToWideChar 22722->22723 22741 42b473 22722->22741 22730 42b3f8 22723->22730 22723->22741 22746 42c5c6 GetLocaleInfoA 22724->22746 22726 421ddf __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 22728 428077 22726->22728 22728->22713 22729 42b4ca GetStringTypeA 22733 42b4e5 22729->22733 22729->22741 22734 42b40d _memset __crtLCMapStringA_stat 22730->22734 22735 421ecb _malloc 67 API calls 22730->22735 22732 42b446 MultiByteToWideChar 22737 42b45c GetStringTypeW 22732->22737 22738 42b46d 22732->22738 22739 421dee __getptd_noexit 67 API calls 22733->22739 22734->22732 22734->22741 22735->22734 22737->22738 22742 42893f 22738->22742 22739->22741 22741->22726 22743 42894b 22742->22743 22744 42895c 22742->22744 22743->22744 22745 421dee __getptd_noexit 67 API calls 22743->22745 22744->22741 22745->22744 22747 42c5f4 22746->22747 22748 42c5f9 22746->22748 22750 421ddf __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 22747->22750 22777 42ba60 22748->22777 22751 42b49d 22750->22751 22751->22729 22751->22741 22752 42c60f 22751->22752 22753 42c6d9 22752->22753 22754 42c64f GetCPInfo 22752->22754 22757 421ddf __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 22753->22757 22755 42c666 22754->22755 22756 42c6c4 MultiByteToWideChar 22754->22756 22755->22756 22758 42c66c GetCPInfo 22755->22758 22756->22753 22761 42c67f _strlen 22756->22761 22759 42b4be 22757->22759 22758->22756 22760 42c679 22758->22760 22759->22729 22759->22741 22760->22756 22760->22761 22762 421ecb _malloc 67 API calls 22761->22762 22764 42c6b1 _memset __crtLCMapStringA_stat 22761->22764 22762->22764 22763 42c70e MultiByteToWideChar 22765 42c726 22763->22765 22766 42c745 22763->22766 22764->22753 22764->22763 22768 42c74a 22765->22768 22769 42c72d WideCharToMultiByte 22765->22769 22767 42893f __freea 67 API calls 22766->22767 22767->22753 22770 42c755 WideCharToMultiByte 22768->22770 22771 42c769 22768->22771 22769->22766 22770->22766 22770->22771 22772 424b23 __calloc_crt 67 API calls 22771->22772 22780 42c9f2 22777->22780 22781 42ca0b 22780->22781 22782 42c7c3 strtoxl 91 API calls 22781->22782 22783 42ba71 22782->22783 22783->22747 22785 42b5b1 LCMapStringW 22784->22785 22786 42b5cc 22784->22786 22785->22786 22787 42b5d4 GetLastError 22785->22787 22788 42b7ca 22786->22788 22789 42b626 22786->22789 22787->22786 22791 42c5c6 ___ansicp 91 API calls 22788->22791 22790 42b63f MultiByteToWideChar 22789->22790 22792 42b7c1 22789->22792 22790->22792 22799 42b66c 22790->22799 22794 42b7f2 22791->22794 22793 421ddf __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 22792->22793 22795 428097 22793->22795 22794->22792 22796 42b8e6 LCMapStringA 22794->22796 22797 42b80b 22794->22797 22795->22706 22800 42b842 22796->22800 22801 42c60f ___convertcp 74 API calls 22797->22801 22798 42b6bd MultiByteToWideChar 22802 42b6d6 LCMapStringW 22798->22802 22803 42b7b8 22798->22803 22805 421ecb _malloc 67 API calls 22799->22805 22812 42b685 __crtLCMapStringA_stat 22799->22812 22804 42b90d 22800->22804 22809 421dee __getptd_noexit 67 API calls 22800->22809 22806 42b81d 22801->22806 22802->22803 22804->22792 22805->22812 22806->22792 22809->22804 22812->22792 22812->22798 22831->22697 22833 427609 22832->22833 22834 4241df __encode_pointer 6 API calls 22833->22834 22835 427621 22833->22835 22834->22833 22835->21629 22839 4225f0 22836->22839 22838 422639 22838->21631 22840 4225fc ___FrameUnwindToState 22839->22840 22847 423d28 22840->22847 22846 42261d ___FrameUnwindToState 22846->22838 22848 422f9f __lock 67 API calls 22847->22848 22849 422601 22848->22849 22850 422505 22849->22850 22851 42425a __decode_pointer 6 API calls 22850->22851 22852 422519 22851->22852 22853 42425a __decode_pointer 6 API calls 22852->22853 22854 422529 22853->22854 22862 4225ac 22854->22862 22870 425131 22854->22870 22856 422547 22858 42256b 22856->22858 22866 422593 22856->22866 22883 424b6f 22856->22883 22857 4241df __encode_pointer 6 API calls 22859 4225a1 22857->22859 22858->22862 22863 424b6f __realloc_crt 73 API calls 22858->22863 22864 422581 22858->22864 22861 4241df __encode_pointer 6 API calls 22859->22861 22861->22862 22867 422626 22862->22867 22863->22864 22864->22862 22865 4241df __encode_pointer 6 API calls 22864->22865 22865->22866 22866->22857 22932 423d31 22867->22932 22871 42513d ___FrameUnwindToState 22870->22871 22872 42516a 22871->22872 22873 42514d 22871->22873 22875 4251ab HeapSize 22872->22875 22877 422f9f __lock 67 API calls 22872->22877 22874 422daa __filwbuf 67 API calls 22873->22874 22876 425152 22874->22876 22879 425162 ___FrameUnwindToState 22875->22879 22878 424d46 __filwbuf 6 API calls 22876->22878 22880 42517a ___sbh_find_block 22877->22880 22878->22879 22879->22856 22888 4251cb 22880->22888 22887 424b78 22883->22887 22885 424bb7 22885->22858 22886 424b98 Sleep 22886->22887 22887->22885 22887->22886 22892 42266d 22887->22892 22891 422ec5 LeaveCriticalSection 22888->22891 22890 4251a6 22890->22875 22890->22879 22891->22890 22893 422679 ___FrameUnwindToState 22892->22893 22894 422680 22893->22894 22895 42268e 22893->22895 22898 421ecb _malloc 67 API calls 22894->22898 22896 4226a1 22895->22896 22897 422695 22895->22897 22905 422813 22896->22905 22926 4226ae ___sbh_resize_block ___sbh_find_block ___crtGetEnvironmentStringsA 22896->22926 22899 421dee __getptd_noexit 67 API calls 22897->22899 22900 422688 ___FrameUnwindToState _realloc 22898->22900 22899->22900 22900->22887 22926->22900 22935 422ec5 LeaveCriticalSection 22932->22935 22934 42262b 22934->22846 22935->22934 22937 41ea5b 22936->22937 22938 41ea3a 22936->22938 22940 421ddf __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 22937->22940 22938->22937 22939 41ea41 22938->22939 22941 421ddf __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 22939->22941 22942 41ea6b 22940->22942 22943 41ea54 22941->22943 22942->21644 22943->21644 22945 41f330 CoCreateInstance 22944->22945 22946 41f357 GetVersionExW 22944->22946 22945->22946 22946->21658 22946->21659 22948 4287c0 _memset 22947->22948 22949 41f711 GetModuleFileNameW 22948->22949 22950 41f740 _memset 22949->22950 22951 422938 67 API calls 22950->22951 22952 41f754 _wcsrchr 22951->22952 23210 41f63a _memset __write_nolock 23209->23210 23211 41f659 GetModuleFileNameW RegCreateKeyExW RegSetValueExW RegCloseKey 23210->23211 23212 421ddf __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 23211->23212 23213 41f6d4 23212->23213 23213->21659 24320 423e0c ___FrameUnwindToState 24319->24320 24344 40ba4d 24360 40b530 24344->24360 24345 40b558 24517 40a9c0 24345->24517 24346 40b5c7 24531 40bb00 24346->24531 24348 421ecb _malloc 67 API calls 24348->24360 24352 42d9e5 __CxxThrowException@8 RaiseException 24352->24360 24354 40bb70 67 API calls 24365 40b5a8 24354->24365 24359 40b6f5 24361 40bb00 67 API calls 24359->24361 24360->24345 24360->24346 24360->24348 24360->24352 24360->24359 24366 40c4b0 73 API calls 24360->24366 24367 40b823 24360->24367 24368 40b8c6 24360->24368 24376 414f60 24360->24376 24381 40c030 24360->24381 24386 40c2c0 24360->24386 24390 409180 24360->24390 24363 40b724 24361->24363 24364 40bb70 67 API calls 24363->24364 24364->24365 24366->24360 24370 40bb00 67 API calls 24367->24370 24369 40bb00 67 API calls 24368->24369 24371 40b901 24369->24371 24372 40b85e 24370->24372 24373 40bb70 67 API calls 24371->24373 24374 40bb70 67 API calls 24372->24374 24373->24365 24374->24365 24377 414f90 24376->24377 24378 415011 24377->24378 24536 41c450 EnterCriticalSection 24377->24536 24378->24360 24379 41500a 24379->24360 24382 421ecb _malloc 67 API calls 24381->24382 24383 40c087 24382->24383 24384 42d9e5 __CxxThrowException@8 RaiseException 24383->24384 24385 40c0a3 24383->24385 24384->24385 24385->24360 24387 40c36e 24386->24387 24389 40c2d1 24386->24389 24387->24360 24389->24387 24539 40c0f0 24389->24539 24543 40dc00 24390->24543 24393 4099b6 24393->24360 24395 40933f 24570 408d70 24395->24570 24397 4094a3 24398 42d9e5 __CxxThrowException@8 RaiseException 24397->24398 24399 4094b8 24398->24399 24401 42d9e5 __CxxThrowException@8 RaiseException 24399->24401 24400 421ecb 67 API calls _malloc 24413 4091fd 24400->24413 24407 4094cd 24401->24407 24402 409427 24403 421ecb _malloc 67 API calls 24402->24403 24402->24407 24498 40973a 24402->24498 24404 409487 24403->24404 24404->24407 24410 42d9e5 __CxxThrowException@8 RaiseException 24404->24410 24405 40a179 24408 42d9e5 __CxxThrowException@8 RaiseException 24405->24408 24412 40a1c7 24405->24412 24406 40951d 24411 409100 67 API calls 24406->24411 24407->24406 24467 40958a 24407->24467 24408->24412 24409 409709 24585 40a530 24409->24585 24410->24397 24414 409532 DeleteCriticalSection 24411->24414 24419 40a247 24412->24419 24420 40a1da 24412->24420 24413->24395 24413->24397 24413->24399 24413->24400 24563 4130b0 24413->24563 24417 409553 24414->24417 24578 40a640 24417->24578 24427 4051f0 68 API calls 24419->24427 24425 409100 67 API calls 24420->24425 24421 409eb8 24431 409100 67 API calls 24421->24431 24429 40a1ef DeleteCriticalSection 24425->24429 24426 4098ae 24438 409100 67 API calls 24426->24438 24441 40a27d 24427->24441 24433 40a210 24429->24433 24430 40a2df 24463 421dee __getptd_noexit 67 API calls 24430->24463 24437 409edd DeleteCriticalSection 24431->24437 24432 4099d3 24443 409100 67 API calls 24432->24443 24439 40a640 67 API calls 24433->24439 24434 409f38 24440 409100 67 API calls 24434->24440 24435 409f86 24455 409100 67 API calls 24435->24455 24436 40994b 24448 409100 67 API calls 24436->24448 24444 409efe 24437->24444 24445 4098f3 DeleteCriticalSection 24438->24445 24446 40a22d 24439->24446 24447 409f65 DeleteCriticalSection 24440->24447 24441->24430 24454 4051f0 68 API calls 24441->24454 24442 4051f0 68 API calls 24442->24498 24449 409a00 DeleteCriticalSection 24443->24449 24450 40a640 67 API calls 24444->24450 24451 409914 24445->24451 24446->24360 24447->24435 24453 409978 DeleteCriticalSection 24448->24453 24457 409a21 24449->24457 24458 409f1b 24450->24458 24459 40a640 67 API calls 24451->24459 24452 4130b0 68 API calls 24452->24467 24460 409999 24453->24460 24454->24441 24461 409fc8 DeleteCriticalSection 24455->24461 24456 40a023 SysFreeString 24465 40a03e 24456->24465 24466 40a640 67 API calls 24457->24466 24458->24360 24468 409931 24459->24468 24469 40a640 67 API calls 24460->24469 24470 409fe9 24461->24470 24462 404b30 68 API calls 24462->24498 24471 40a33f 24463->24471 24464 412a70 77 API calls 24464->24467 24472 409100 67 API calls 24465->24472 24473 409a3e 24466->24473 24467->24409 24467->24426 24467->24432 24467->24436 24467->24452 24467->24464 24582 4139d0 24467->24582 24468->24360 24469->24393 24474 40a640 67 API calls 24470->24474 24479 421dee __getptd_noexit 67 API calls 24471->24479 24475 40a05b DeleteCriticalSection 24472->24475 24473->24360 24476 40a006 24474->24476 24477 40a07c 24475->24477 24476->24360 24480 40a640 67 API calls 24477->24480 24478 421ecb _malloc 67 API calls 24478->24498 24482 40a380 24479->24482 24483 40a099 24480->24483 24481 409c40 24488 421dee __getptd_noexit 67 API calls 24481->24488 24485 408bd0 67 API calls 24482->24485 24483->24360 24484 40a0b3 24490 42d9e5 __CxxThrowException@8 RaiseException 24484->24490 24489 40a3ad DeleteCriticalSection 24485->24489 24486 40a0c8 24491 421dee __getptd_noexit 67 API calls 24486->24491 24487 421dee 67 API calls __getptd_noexit 24487->24498 24492 409c6b 24488->24492 24493 40a3ce 24489->24493 24490->24486 24494 40a0d5 24491->24494 24503 421dee __getptd_noexit 67 API calls 24492->24503 24497 40a640 67 API calls 24493->24497 24495 421dee __getptd_noexit 67 API calls 24494->24495 24499 40a0e6 SysFreeString 24495->24499 24496 421dee __getptd_noexit 67 API calls 24500 409ae1 SysFreeString 24496->24500 24501 40a3eb 24497->24501 24498->24405 24498->24421 24498->24434 24498->24435 24498->24442 24498->24456 24498->24462 24498->24478 24498->24481 24498->24484 24498->24486 24498->24487 24498->24496 24502 40a104 24499->24502 24500->24498 24501->24360 24504 409100 67 API calls 24502->24504 24505 409ca0 24503->24505 24506 40a121 DeleteCriticalSection 24504->24506 24509 421dee __getptd_noexit 67 API calls 24505->24509 24507 40a142 24506->24507 24508 40a640 67 API calls 24507->24508 24510 40a15f 24508->24510 24511 409ce1 24509->24511 24510->24360 24600 408bd0 24511->24600 24514 409d2f 24515 40a640 67 API calls 24514->24515 24516 409d4c 24515->24516 24516->24360 24518 40a9ff 24517->24518 24519 421dee __getptd_noexit 67 API calls 24518->24519 24520 40aa23 24519->24520 24521 409100 24520->24521 24522 409143 24521->24522 24523 421dee __getptd_noexit 67 API calls 24522->24523 24524 40914c 24523->24524 24525 408bd0 67 API calls 24524->24525 24526 409166 24525->24526 24527 40bb70 24526->24527 24528 40bbaf 24527->24528 24529 421dee __getptd_noexit 67 API calls 24528->24529 24530 40bbd3 24529->24530 24530->24365 24532 40a9c0 67 API calls 24531->24532 24533 40bb36 24532->24533 24534 409100 67 API calls 24533->24534 24535 40b5ea 24534->24535 24535->24354 24537 41c4f8 LeaveCriticalSection 24536->24537 24538 41c4a2 24536->24538 24537->24379 24538->24537 24540 40c128 24539->24540 24542 407f40 73 API calls 24540->24542 24541 40c15f 24541->24389 24542->24541 24544 40dc40 24543->24544 24551 4091bd 24543->24551 24544->24551 24610 40db90 24544->24610 24546 40de9f 24549 421dee __getptd_noexit 67 API calls 24546->24549 24547 40db90 68 API calls 24552 40dcf8 24547->24552 24549->24551 24550 40dd2d 24553 421dee __getptd_noexit 67 API calls 24550->24553 24551->24393 24560 40a410 24551->24560 24552->24546 24552->24550 24558 40dd5a 24553->24558 24554 40df93 24555 421dee __getptd_noexit 67 API calls 24554->24555 24556 40dff7 24555->24556 24559 421dee __getptd_noexit 67 API calls 24556->24559 24557 4051f0 68 API calls 24557->24558 24558->24554 24558->24557 24559->24551 24616 4047c0 InitializeCriticalSection 24560->24616 24562 40a44c 24562->24413 24564 421ecb _malloc 67 API calls 24563->24564 24565 4130dd 24564->24565 24566 42d9e5 __CxxThrowException@8 RaiseException 24565->24566 24568 4130fb 24565->24568 24566->24568 24567 41314e 24567->24413 24568->24567 24569 4051f0 68 API calls 24568->24569 24569->24567 24573 408d82 24570->24573 24571 408f97 24571->24402 24572 408f3f 24572->24571 24576 4051f0 68 API calls 24572->24576 24574 4051f0 68 API calls 24573->24574 24575 408dee 24573->24575 24574->24573 24575->24572 24577 4051f0 68 API calls 24575->24577 24576->24572 24577->24575 24579 40a67f 24578->24579 24580 421dee __getptd_noexit 67 API calls 24579->24580 24581 409570 24580->24581 24581->24360 24617 413850 24582->24617 24586 40a544 24585->24586 24587 40af00 68 API calls 24586->24587 24588 40a54c 24587->24588 24589 40af00 68 API calls 24588->24589 24590 40a56a 24589->24590 24629 413690 24590->24629 24593 413690 68 API calls 24594 409718 24593->24594 24595 40af00 24594->24595 24596 4051f0 68 API calls 24595->24596 24598 40af1e 24596->24598 24597 40af7c 24597->24498 24598->24597 24599 4051f0 68 API calls 24598->24599 24599->24598 24601 408c17 24600->24601 24602 421dee __getptd_noexit 67 API calls 24601->24602 24603 408c20 24602->24603 24604 421dee __getptd_noexit 67 API calls 24603->24604 24605 408c50 24604->24605 24606 421dee __getptd_noexit 67 API calls 24605->24606 24607 408c7f 24606->24607 24608 421dee __getptd_noexit 67 API calls 24607->24608 24609 408caf DeleteCriticalSection 24608->24609 24609->24514 24611 40dba5 24610->24611 24612 4051f0 68 API calls 24611->24612 24614 40dbaa 24612->24614 24613 40dbee 24613->24546 24613->24547 24614->24613 24615 4051f0 68 API calls 24614->24615 24615->24614 24616->24562 24621 413886 24617->24621 24618 421ecb _malloc 67 API calls 24619 413937 24618->24619 24620 413953 24619->24620 24623 42d9e5 __CxxThrowException@8 RaiseException 24619->24623 24625 414150 VirtualAlloc 24620->24625 24621->24618 24624 413965 24621->24624 24623->24620 24624->24467 24626 414216 24625->24626 24627 41422d 24625->24627 24628 42d9e5 __CxxThrowException@8 RaiseException 24626->24628 24627->24624 24628->24627 24630 4051f0 68 API calls 24629->24630 24632 4136ac 24630->24632 24631 40a588 24631->24593 24632->24631 24633 4051f0 68 API calls 24632->24633 24633->24632 24634 40b1d0 24647 40b21b 24634->24647 24635 40b409 24681 41c380 EnterCriticalSection 24635->24681 24636 40b419 24638 40b43f 24636->24638 24639 40b41f 24636->24639 24643 421ecb _malloc 67 API calls 24638->24643 24640 40bb70 67 API calls 24639->24640 24642 40b246 24640->24642 24641 40bc00 68 API calls 24641->24647 24644 40b488 24643->24644 24646 42d9e5 __CxxThrowException@8 RaiseException 24644->24646 24650 40b4a4 24644->24650 24645 421dee 67 API calls __getptd_noexit 24645->24647 24646->24650 24647->24635 24647->24641 24647->24642 24647->24645 24648 4051f0 68 API calls 24647->24648 24684 40b120 24647->24684 24690 40b000 24647->24690 24648->24647 24651 40b558 24650->24651 24652 40b5c7 24650->24652 24654 421ecb _malloc 67 API calls 24650->24654 24658 42d9e5 __CxxThrowException@8 RaiseException 24650->24658 24659 40c030 68 API calls 24650->24659 24664 40c2c0 73 API calls 24650->24664 24665 40b6f5 24650->24665 24667 409180 94 API calls 24650->24667 24670 40c4b0 73 API calls 24650->24670 24671 40b8c6 24650->24671 24672 40b823 24650->24672 24679 414f60 2 API calls 24650->24679 24653 40a9c0 67 API calls 24651->24653 24655 40bb00 67 API calls 24652->24655 24656 40b578 24653->24656 24654->24650 24657 40b5ea 24655->24657 24661 409100 67 API calls 24656->24661 24660 40bb70 67 API calls 24657->24660 24658->24650 24659->24650 24660->24642 24662 40b59b 24661->24662 24663 40bb70 67 API calls 24662->24663 24663->24642 24664->24650 24666 40bb00 67 API calls 24665->24666 24668 40b724 24666->24668 24667->24650 24669 40bb70 67 API calls 24668->24669 24669->24642 24670->24650 24673 40bb00 67 API calls 24671->24673 24674 40bb00 67 API calls 24672->24674 24675 40b901 24673->24675 24676 40b85e 24674->24676 24677 40bb70 67 API calls 24675->24677 24678 40bb70 67 API calls 24676->24678 24677->24642 24678->24642 24679->24650 24682 41c426 LeaveCriticalSection 24681->24682 24683 41c3d6 24681->24683 24682->24636 24683->24682 24685 40b1ab 24684->24685 24686 40b17b 24684->24686 24685->24647 24687 4051f0 68 API calls 24686->24687 24688 40b183 24687->24688 24688->24685 24689 4051f0 68 API calls 24688->24689 24689->24685 24691 40b008 24690->24691 24695 40b00c 24690->24695 24691->24647 24692 42d9e5 __CxxThrowException@8 RaiseException 24694 40b05c 24692->24694 24693 40b02f 24693->24647 24694->24647 24695->24692 24695->24693 24696 41be50 24697 41be60 KillTimer 24696->24697 24698 41be7b 24696->24698 24697->24698 24699 41be96 KiUserCallbackDispatcher 24697->24699 24702 4064e0 24698->24702 24701 41be91 24703 40657f 24702->24703 24704 4064f2 24702->24704 24705 406680 SetEvent 24703->24705 24708 4064fe 24703->24708 24706 40654e 24704->24706 24707 406520 24704->24707 24704->24708 24705->24701 24706->24701 24712 406546 24707->24712 24713 406526 GetDesktopWindow SetForegroundWindow 24707->24713 24710 4065fc 24708->24710 24711 4065ae ShowWindow 24708->24711 24714 406507 24708->24714 24716 406601 ShowWindow 24710->24716 24717 406645 24710->24717 24715 4065c0 PeekMessageW 24711->24715 24712->24701 24713->24701 24714->24701 24715->24715 24719 4065d2 DialogBoxParamW SetEvent 24715->24719 24718 406610 PeekMessageW 24716->24718 24717->24701 24718->24718 24720 406622 MessageBoxW SetEvent 24718->24720 24719->24710 24720->24717 24721 41c010 GetDlgItem SendMessageW 24722 417090 24723 4170ad 24722->24723 24724 4170b9 24723->24724 24727 417040 24723->24727 24728 417047 24727->24728 24729 421dee __getptd_noexit 67 API calls 24728->24729 24732 41706e 24728->24732 24730 41705b 24729->24730 24731 421ecb _malloc 67 API calls 24730->24731 24730->24732 24731->24732 24733 41c950 EnterCriticalSection LeaveCriticalSection 24734 41c990 24733->24734 24735 41c99e 24733->24735 24736 41cb0b 24735->24736 24737 404e70 68 API calls 24735->24737 24738 408890 VariantClear 24736->24738 24739 41c9f7 24737->24739 24740 41cb17 24738->24740 24741 41ca01 24739->24741 24742 41ca0d 24739->24742 24743 404bf0 68 API calls 24741->24743 24744 41cb9a 24742->24744 24745 4067a0 68 API calls 24742->24745 24746 41ca0b 24743->24746 24747 421dee __getptd_noexit 67 API calls 24744->24747 24745->24746 24748 404bf0 68 API calls 24746->24748 24749 41cba4 24747->24749 24762 41ca33 24748->24762 24750 408890 VariantClear 24749->24750 24751 41cbb0 24750->24751 24752 421dee __getptd_noexit 67 API calls 24754 41cece 24752->24754 24753 41caf8 24755 408890 VariantClear 24753->24755 24756 408890 VariantClear 24754->24756 24757 41cab0 24755->24757 24760 41ceda 24756->24760 24761 421dee __getptd_noexit 67 API calls 24757->24761 24758 41cc0f 24759 408890 VariantClear 24758->24759 24759->24744 24761->24736 24762->24753 24762->24758 24763 41cab7 24762->24763 24764 41caa7 24762->24764 24830 41cccb 24762->24830 24766 41cb22 24763->24766 24767 41caef 24763->24767 24765 408890 VariantClear 24764->24765 24765->24757 24769 408890 VariantClear 24766->24769 24768 408890 VariantClear 24767->24768 24768->24753 24770 41cb3e 24769->24770 24771 41cb83 24770->24771 24772 41cb59 24770->24772 24774 41cbbe 24771->24774 24775 41cb91 24771->24775 24773 408890 VariantClear 24772->24773 24776 41cb62 24773->24776 24779 406230 68 API calls 24774->24779 24777 408890 VariantClear 24775->24777 24778 421dee __getptd_noexit 67 API calls 24776->24778 24777->24744 24780 41cb6c 24778->24780 24781 41cc00 24779->24781 24782 408890 VariantClear 24780->24782 24783 41cc07 24781->24783 24784 41cc1f 24781->24784 24786 41cb78 24782->24786 24787 404920 67 API calls 24783->24787 24785 404b90 68 API calls 24784->24785 24789 41cc2c 24785->24789 24787->24758 24788 41cc61 24790 407ca0 68 API calls 24788->24790 24789->24788 24859 41c840 24789->24859 24792 41cc73 24790->24792 24793 41ccd5 24792->24793 24794 41cc79 24792->24794 24868 407040 24793->24868 24796 404bf0 68 API calls 24794->24796 24797 41cc87 24796->24797 24799 41cc90 24797->24799 24800 41cc98 24797->24800 24802 406b00 71 API calls 24799->24802 24847 406920 CreateFileW 24800->24847 24801 407f40 73 API calls 24803 41ccea 24801->24803 24805 41cc96 24802->24805 24806 41cd9c 24803->24806 24807 4070d0 80 API calls 24803->24807 24808 421dee __getptd_noexit 67 API calls 24805->24808 24812 405350 68 API calls 24806->24812 24829 41ce30 24806->24829 24809 41ccfc 24807->24809 24810 41cca8 24808->24810 24809->24806 24813 41cd04 24809->24813 24814 421dee __getptd_noexit 67 API calls 24810->24814 24811 404bf0 68 API calls 24815 41ce7c 24811->24815 24816 41cdb1 24812->24816 24819 404bf0 68 API calls 24813->24819 24842 41cd1c 24813->24842 24817 41ccb5 24814->24817 24818 421dee __getptd_noexit 67 API calls 24815->24818 24822 4083b0 72 API calls 24816->24822 24820 404920 67 API calls 24817->24820 24821 41ce89 24818->24821 24819->24842 24823 41ccc2 24820->24823 24824 421dee __getptd_noexit 67 API calls 24821->24824 24825 41cdfc 24822->24825 24826 408890 VariantClear 24823->24826 24827 41ce96 24824->24827 24825->24829 24833 41ce0b 24825->24833 24826->24830 24831 421dee __getptd_noexit 67 API calls 24827->24831 24828 421dee __getptd_noexit 67 API calls 24832 41cd62 24828->24832 24829->24811 24830->24752 24834 41cea3 24831->24834 24836 421dee __getptd_noexit 67 API calls 24832->24836 24837 404bf0 68 API calls 24833->24837 24835 404920 67 API calls 24834->24835 24838 41ceb0 24835->24838 24839 41cd6f 24836->24839 24837->24842 24840 408890 VariantClear 24838->24840 24841 421dee __getptd_noexit 67 API calls 24839->24841 24840->24830 24843 41cd7c 24841->24843 24842->24828 24844 404920 67 API calls 24843->24844 24845 41cd89 24844->24845 24846 408890 VariantClear 24845->24846 24846->24744 24848 40696b 24847->24848 24858 4069cc 24847->24858 24851 404e70 68 API calls 24848->24851 24849 4069f4 24849->24805 24850 4069d8 SetFileTime CloseHandle 24850->24849 24852 406982 24851->24852 24853 4081c0 69 API calls 24852->24853 24854 406993 24853->24854 24855 4069be 24854->24855 24856 4069a7 CreateFileW 24854->24856 24857 421dee __getptd_noexit 67 API calls 24855->24857 24856->24855 24857->24858 24858->24849 24858->24850 24860 404b90 68 API calls 24859->24860 24866 41c875 24860->24866 24861 41c920 24863 421dee __getptd_noexit 67 API calls 24861->24863 24862 406370 68 API calls 24862->24866 24864 41c934 24863->24864 24864->24788 24865 406bc0 72 API calls 24865->24866 24866->24861 24866->24862 24866->24865 24867 404e70 68 API calls 24866->24867 24867->24866 24869 404e70 68 API calls 24868->24869 24870 407055 24869->24870 24870->24801 24871 41cf10 24872 41d013 24871->24872 24877 41cf22 24871->24877 24873 41d020 SetFileTime 24872->24873 24874 41d04e 24872->24874 24873->24874 24875 41d043 FindCloseChangeNotification 24873->24875 24878 41d0a1 24874->24878 24883 406a10 71 API calls 24874->24883 24875->24874 24876 41d056 GetLastError 24875->24876 24876->24874 24880 41d060 24876->24880 24881 41cf44 24877->24881 24882 41cf79 24877->24882 24879 404bf0 68 API calls 24885 41cf89 24879->24885 24881->24879 24881->24885 24884 404bf0 68 API calls 24882->24884 24883->24878 24884->24885 24886 416790 24887 416797 24886->24887 24888 41679f 24886->24888 24893 4024a0 24888->24893 24890 4167b4 24891 421ecb _malloc 67 API calls 24890->24891 24892 4167c0 24890->24892 24891->24892 24894 40251a 24893->24894 24897 4024b9 24893->24897 24895 421ddf __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 24894->24895 24896 40252b 24895->24896 24896->24890 24898 421ddf __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 24897->24898 24899 402514 24898->24899 24899->24890 24909 412659 24910 412660 24909->24910 24911 4126ce 24910->24911 24914 4051f0 68 API calls 24910->24914 24912 412702 24911->24912 24913 4126dd 24911->24913 24932 415fc0 24912->24932 24919 413ba0 24913->24919 24926 414c40 EnterCriticalSection 24913->24926 24914->24910 24915 412700 24920 413bb0 ReadFile 24919->24920 24921 413bab 24919->24921 24922 413be0 24920->24922 24921->24920 24923 413bea 24922->24923 24924 413bef GetLastError 24922->24924 24923->24915 24925 413bf9 24924->24925 24925->24915 24931 413c10 3 API calls 24926->24931 24927 414c94 24928 414cb8 LeaveCriticalSection 24927->24928 24929 414c9a LeaveCriticalSection 24927->24929 24928->24915 24929->24915 24931->24927 24935 415a80 24932->24935 24934 41600f 24934->24915 24936 415ab6 24935->24936 24937 415f9d 24935->24937 24936->24937 24968 414ac0 24936->24968 24937->24934 24939 415ad1 24940 415ad5 24939->24940 24941 414ac0 2 API calls 24939->24941 24940->24934 24942 415afd 24941->24942 24942->24940 24943 414ac0 2 API calls 24942->24943 24944 415b0f 24943->24944 24944->24940 24945 414ac0 2 API calls 24944->24945 24946 415b21 24945->24946 24946->24940 24975 414d50 24946->24975 24949 415b38 24949->24940 24982 415740 24949->24982 24950 414b50 RaiseException 24957 415c21 24950->24957 24954 415edf 24955 415efa 24954->24955 25002 414df0 24954->25002 24955->24934 24956 415ebb 24956->24934 24957->24950 24957->24954 24957->24956 24958 414df0 __VEC_memcpy 24957->24958 24959 415f51 24957->24959 24961 415f64 24957->24961 24962 415f77 24957->24962 24963 415f8a 24957->24963 24967 414f60 2 API calls 24957->24967 24986 414e80 24957->24986 24995 416080 24957->24995 24958->24957 24960 42d9e5 __CxxThrowException@8 RaiseException 24959->24960 24960->24961 24964 42d9e5 __CxxThrowException@8 RaiseException 24961->24964 24965 42d9e5 __CxxThrowException@8 RaiseException 24962->24965 24966 42d9e5 __CxxThrowException@8 RaiseException 24963->24966 24964->24962 24965->24963 24966->24937 24967->24957 24969 414ac8 24968->24969 24970 414aef 24969->24970 24971 414ad9 24969->24971 24974 414ae1 VirtualFree 24969->24974 24972 414b0d VirtualAlloc 24970->24972 24973 414afd 24970->24973 24971->24939 24972->24939 24973->24939 24974->24970 24978 414d58 24975->24978 24976 414d7e 24979 414d8b 24976->24979 24980 414d9a VirtualAlloc 24976->24980 24977 414d68 24977->24949 24978->24976 24978->24977 24981 414d70 VirtualFree 24978->24981 24979->24949 24980->24949 24981->24976 24983 415765 24982->24983 24985 41579a 24983->24985 25006 414b50 24983->25006 24985->24957 24987 414ea1 24986->24987 24989 414e8c 24986->24989 24987->24957 24988 414df0 __VEC_memcpy 24988->24989 24989->24987 24989->24988 24990 414ea4 24989->24990 24991 42d9e5 __CxxThrowException@8 RaiseException 24990->24991 24992 414eb7 24991->24992 24993 421dee __getptd_noexit 67 API calls 24992->24993 24994 414eda 24992->24994 24993->24994 24994->24957 24996 416095 24995->24996 24997 4160eb 24995->24997 24999 414b50 RaiseException 24996->24999 25000 4160bd 24996->25000 24998 414b50 RaiseException 24997->24998 25001 416115 24997->25001 24998->25001 24999->25000 25000->24957 25001->24957 25003 414dfe 25002->25003 25004 4221a0 ___sbh_free_block __VEC_memcpy 25003->25004 25005 414e1b 25003->25005 25004->25005 25005->24954 25007 414b59 25006->25007 25008 414b5f 25006->25008 25007->24983 25009 414b9b 25008->25009 25010 42d9e5 __CxxThrowException@8 RaiseException 25008->25010 25009->24983 25010->25009 25011 419e5e 25013 419e60 25011->25013 25012 405140 2 API calls 25012->25013 25013->25012 25014 419f00 25013->25014 25015 4051f0 68 API calls 25013->25015 25016 4052a0 68 API calls 25013->25016 25018 419f1a 25014->25018 25032 419f79 25014->25032 25015->25013 25016->25013 25017 41a092 25020 421dee __getptd_noexit 67 API calls 25017->25020 25019 421dee __getptd_noexit 67 API calls 25018->25019 25023 419f3c 25019->25023 25021 41a0b8 25020->25021 25024 421dee __getptd_noexit 67 API calls 25021->25024 25022 41a109 25029 421dee __getptd_noexit 67 API calls 25022->25029 25025 421dee __getptd_noexit 67 API calls 25023->25025 25026 41a0d6 25024->25026 25027 419f5a 25025->25027 25028 421dee __getptd_noexit 67 API calls 25026->25028 25030 421dee __getptd_noexit 67 API calls 25027->25030 25082 419f6f 25028->25082 25031 41a130 25029->25031 25030->25082 25034 421dee __getptd_noexit 67 API calls 25031->25034 25032->25017 25032->25022 25033 41a167 25032->25033 25035 41a1d8 25032->25035 25083 40d1d0 97 API calls 25032->25083 25084 40d1b0 97 API calls 25032->25084 25085 413c10 3 API calls 25032->25085 25039 421dee __getptd_noexit 67 API calls 25033->25039 25036 41a14e 25034->25036 25037 41a1dc 25035->25037 25043 41a24a 25035->25043 25038 421dee __getptd_noexit 67 API calls 25036->25038 25045 421dee __getptd_noexit 67 API calls 25037->25045 25038->25082 25042 41a19b 25039->25042 25040 41a297 25041 408890 VariantClear 25040->25041 25044 41a2a7 25041->25044 25046 421dee __getptd_noexit 67 API calls 25042->25046 25043->25040 25047 4067a0 68 API calls 25043->25047 25054 41a36b 25044->25054 25055 41a2df 25044->25055 25048 41a210 25045->25048 25049 41a1b9 25046->25049 25047->25040 25050 421dee __getptd_noexit 67 API calls 25048->25050 25051 421dee __getptd_noexit 67 API calls 25049->25051 25052 41a22e 25050->25052 25051->25082 25053 421dee __getptd_noexit 67 API calls 25052->25053 25053->25082 25056 419a00 2 API calls 25054->25056 25057 404b30 68 API calls 25055->25057 25058 41a374 25056->25058 25059 41a2ed 25057->25059 25061 418e00 70 API calls 25058->25061 25060 404b30 68 API calls 25059->25060 25062 41a2fb 25060->25062 25063 41a395 25061->25063 25064 418e00 70 API calls 25062->25064 25065 404bf0 68 API calls 25063->25065 25066 41a31c 25064->25066 25067 41a3ab 25065->25067 25068 404bf0 68 API calls 25066->25068 25069 421dee __getptd_noexit 67 API calls 25067->25069 25070 41a332 25068->25070 25076 41a364 25069->25076 25071 421dee __getptd_noexit 67 API calls 25070->25071 25072 41a340 25071->25072 25073 421dee __getptd_noexit 67 API calls 25072->25073 25074 41a352 25073->25074 25075 421dee __getptd_noexit 67 API calls 25074->25075 25075->25076 25077 421dee __getptd_noexit 67 API calls 25076->25077 25078 41a3f1 25077->25078 25079 421dee __getptd_noexit 67 API calls 25078->25079 25080 41a40e 25079->25080 25081 421dee __getptd_noexit 67 API calls 25080->25081 25081->25082 25083->25032 25084->25032 25085->25032 25086 40bce1 25087 40bcf9 25086->25087 25088 40bd66 25087->25088 25091 421dee 67 API calls __getptd_noexit 25087->25091 25089 40bd9a 25088->25089 25090 4221a0 ___sbh_free_block __VEC_memcpy 25088->25090 25090->25089 25091->25087 25092 4166a0 25093 4166a8 25092->25093 25094 4166ab 25092->25094 25095 421ecb _malloc 67 API calls 25094->25095 25096 4166b1 25095->25096 25097 4158a0 25098 4158ba 25097->25098 25099 4158ae 25097->25099 25103 4158d0 25099->25103 25102 421dee __getptd_noexit 67 API calls 25102->25098 25114 4156c0 25103->25114 25108 415640 VirtualFree 25109 415925 25108->25109 25110 415640 VirtualFree 25109->25110 25111 415933 25110->25111 25112 415640 VirtualFree 25111->25112 25113 4158b4 25112->25113 25113->25102 25115 4156f3 VirtualFree 25114->25115 25116 415701 25114->25116 25115->25116 25117 415640 25116->25117 25118 415682 25117->25118 25119 415674 VirtualFree 25117->25119 25118->25108 25119->25118 25129 41daf0 25134 41d9c0 25129->25134 25132 41db05 25133 421dee __getptd_noexit 67 API calls 25133->25132 25135 41da15 DestroyWindow 25134->25135 25136 41da21 25134->25136 25135->25136 25137 41da32 DestroyWindow 25136->25137 25138 41da3e 25136->25138 25137->25138 25139 421dee __getptd_noexit 67 API calls 25138->25139 25140 41da51 25139->25140 25141 421dee __getptd_noexit 67 API calls 25140->25141 25142 41da5d 25141->25142 25153 41d5e0 DeleteCriticalSection 25142->25153 25145 421dee __getptd_noexit 67 API calls 25146 41da81 25145->25146 25147 421dee __getptd_noexit 67 API calls 25146->25147 25148 41daa6 25147->25148 25149 421dee __getptd_noexit 67 API calls 25148->25149 25150 41dab4 25149->25150 25151 421dee __getptd_noexit 67 API calls 25150->25151 25152 41dac2 25151->25152 25152->25132 25152->25133 25154 41d61e CloseHandle 25153->25154 25156 41d631 25153->25156 25155 41d629 GetLastError 25154->25155 25154->25156 25155->25156 25157 421dee __getptd_noexit 67 API calls 25156->25157 25158 41d646 25157->25158 25158->25145 25159 4154b0 25160 4154bd CreateEventW 25159->25160 25161 4154df 25159->25161 25160->25161 25162 4154ce GetLastError 25160->25162 25163 4154e5 CreateEventW 25161->25163 25164 4154f6 ResetEvent 25161->25164 25165 4154d8 25162->25165 25163->25162 25163->25164 25166 41550d GetLastError 25164->25166 25167 41550f ResetEvent 25164->25167 25166->25167 25168 415519 GetLastError 25167->25168 25169 41551b 25167->25169 25168->25169 25170 415529 25169->25170 25172 415410 25169->25172 25173 422096 86 API calls 25172->25173 25174 415422 25173->25174 25175 415435 GetLastError 25174->25175 25176 41542f 25174->25176 25177 41543f 25175->25177 25176->25165 25177->25165 25178 41bd70 EnterCriticalSection LeaveCriticalSection 25179 41bda0 25178->25179 25187 41be0a __aulldiv __winput_l 25178->25187 25180 41bda5 PostMessageW 25179->25180 25181 41bdbb EnterCriticalSection LeaveCriticalSection 25179->25181 25180->25181 25182 41bdf2 25181->25182 25183 41bded 25181->25183 25192 41bca0 25182->25192 25183->25182 25184 41bdf9 25183->25184 25188 41bcf0 25184->25188 25191 41bd05 25188->25191 25189 41bd45 SendMessageW 25190 41bd5b 25189->25190 25190->25187 25191->25189 25191->25190 25193 41bcc6 25192->25193 25194 41bcd2 SendMessageW 25193->25194 25194->25184 25195 41b9b0 GetDlgItem 25196 41ba07 LoadIconW SendMessageW 25195->25196 25197 41ba2e SetTimer SetWindowTextW 25195->25197 25196->25197 25198 41ba53 PostMessageW 25197->25198 25199 41ba67 25197->25199 25198->25199 25200 404e70 68 API calls 25199->25200 25201 41ba7e 25200->25201 25202 41b1d0 69 API calls 25201->25202 25203 41ba90 25202->25203 25204 404bf0 68 API calls 25203->25204 25205 41ba9e 25204->25205 25206 421dee __getptd_noexit 67 API calls 25205->25206 25207 41baac SetDlgItemTextW 25206->25207 25208 404e70 68 API calls 25207->25208 25209 41bada 25208->25209 25210 41b1d0 69 API calls 25209->25210 25211 41baed 25210->25211 25212 404bf0 68 API calls 25211->25212 25213 41bafb 25212->25213 25214 421dee __getptd_noexit 67 API calls 25213->25214 25215 41bb0a SetDlgItemTextW SendMessageW SetEvent 25214->25215 25216 41bb45 GetLastError 25215->25216 25217 41bb4b 25215->25217 25216->25217 25218 41bb56 GetWindowRect GetWindowRect SystemParametersInfoW 25217->25218 25219 41bc3e 25217->25219 25221 41bc0a MoveWindow 25218->25221 25220 421dee __getptd_noexit 67 API calls 25219->25220 25222 41bc4c 25220->25222 25221->25219 25224 421dee __getptd_noexit 67 API calls 25222->25224 25225 41bc5e 25224->25225 25226 410137 25245 40ffa6 25226->25245 25227 410194 25229 40a9c0 67 API calls 25227->25229 25230 4101ab 25229->25230 25231 409100 67 API calls 25230->25231 25233 4101db 25231->25233 25232 40b000 RaiseException 25232->25245 25237 421dee __getptd_noexit 67 API calls 25233->25237 25234 4103b2 25235 40e0c0 RaiseException 25234->25235 25236 4103b7 25235->25236 25238 42d9e5 __CxxThrowException@8 RaiseException 25236->25238 25239 410206 25237->25239 25240 4103cc 25238->25240 25246 421dee __getptd_noexit 67 API calls 25239->25246 25242 42d9e5 __CxxThrowException@8 RaiseException 25240->25242 25241 421ecb 67 API calls _malloc 25241->25245 25244 4103e1 25242->25244 25243 421dee 67 API calls __getptd_noexit 25243->25245 25250 40bb00 67 API calls 25244->25250 25245->25227 25245->25232 25245->25234 25245->25236 25245->25240 25245->25241 25245->25243 25245->25244 25248 409180 94 API calls 25245->25248 25249 4221a0 ___sbh_free_block __VEC_memcpy 25245->25249 25279 411e60 25245->25279 25247 41023b 25246->25247 25252 421dee __getptd_noexit 67 API calls 25247->25252 25248->25245 25249->25245 25251 410406 25250->25251 25254 421dee __getptd_noexit 67 API calls 25251->25254 25253 410270 25252->25253 25255 421dee __getptd_noexit 67 API calls 25253->25255 25256 410433 25254->25256 25257 4102b1 25255->25257 25259 421dee __getptd_noexit 67 API calls 25256->25259 25292 40d610 25257->25292 25261 410468 25259->25261 25263 421dee __getptd_noexit 67 API calls 25261->25263 25262 421dee __getptd_noexit 67 API calls 25264 410310 25262->25264 25265 41049d 25263->25265 25266 421dee __getptd_noexit 67 API calls 25264->25266 25267 421dee __getptd_noexit 67 API calls 25265->25267 25268 41034d 25266->25268 25269 4104de 25267->25269 25271 421dee __getptd_noexit 67 API calls 25268->25271 25270 40d610 67 API calls 25269->25270 25272 41050b 25270->25272 25278 410391 25271->25278 25273 421dee __getptd_noexit 67 API calls 25272->25273 25274 41053d 25273->25274 25275 421dee __getptd_noexit 67 API calls 25274->25275 25276 41057b 25275->25276 25277 421dee __getptd_noexit 67 API calls 25276->25277 25277->25278 25280 421ecb _malloc 67 API calls 25279->25280 25281 411e8b 25280->25281 25282 411eab 25281->25282 25283 42d9e5 __CxxThrowException@8 RaiseException 25281->25283 25284 421dee __getptd_noexit 67 API calls 25282->25284 25283->25282 25285 411ec6 25284->25285 25287 40a5d0 68 API calls 25285->25287 25289 411ef6 25285->25289 25286 411f2e 25286->25245 25288 411ee1 25287->25288 25290 4221a0 ___sbh_free_block __VEC_memcpy 25288->25290 25289->25286 25291 4051f0 68 API calls 25289->25291 25290->25289 25291->25286 25293 40d64f 25292->25293 25294 421dee __getptd_noexit 67 API calls 25293->25294 25295 40d673 25294->25295 25295->25262

                                                                          Executed Functions

                                                                          Function 0041FF60 Relevance: 117.4, APIs: 35, Strings: 31, Instructions: 1866libraryloaderwindowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryW.KERNEL32(kernel32.dll), ref: 0041FF8F
                                                                          • GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0041FFA7
                                                                          • GetProcAddress.KERNEL32(00000000,SetDllDirectory), ref: 0041FFBE
                                                                            • Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
                                                                            • Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7
                                                                          • GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 0041FFD1
                                                                          • FreeLibrary.KERNEL32(00000000), ref: 0041FFDC
                                                                          • MessageBoxW.USER32(00000000,022F1528,?,00012010), ref: 00420015
                                                                          • CoInitialize.OLE32(00000000), ref: 00420045
                                                                          • _memset.LIBCMT ref: 00420059
                                                                          • GetVersionExW.KERNEL32 ref: 0042007E
                                                                          • GetCommandLineW.KERNEL32(00000004,00000004,00000004,00000004), ref: 0042013D
                                                                          • _malloc.LIBCMT ref: 004202E1
                                                                          • __CxxThrowException@8.LIBCMT ref: 00420301
                                                                          • MessageBoxW.USER32(00000000,?,?,00000024), ref: 00420916
                                                                            • Part of subcall function 0041EA80: MessageBoxW.USER32(00000000,?,00000000,00012010), ref: 0041EAA0
                                                                            • Part of subcall function 00421DEE: __lock.LIBCMT ref: 00421E0C
                                                                            • Part of subcall function 00421DEE: ___sbh_find_block.LIBCMT ref: 00421E17
                                                                            • Part of subcall function 00421DEE: ___sbh_free_block.LIBCMT ref: 00421E26
                                                                            • Part of subcall function 00421DEE: RtlFreeHeap.NTDLL(00000000,?,00437B30,0000000C,004244D4,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C), ref: 00421E56
                                                                            • Part of subcall function 00421DEE: GetLastError.KERNEL32(?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA,?,?,?,0042458E,0000000D), ref: 00421E67
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AddressMessageProc$Exception@8FreeLibraryThrow_malloc$CommandErrorHeapInitializeLastLineLoadVersion___sbh_find_block___sbh_free_block__lock_memset
                                                                          • String ID: $ $ $ /m="$"$" /k="$"-k=$"/k=$%%T$%%T\$-k=$/k=$<$<$@E$BeginPrompt$D$Directory$ExecuteFile$ExecuteParameters$Progress$RunProgram$SetDefaultDllDirectories$SetDllDirectory$SetSearchPathMode$Title$`A$kernel32.dll$mia.lib$runas$setup.exe
                                                                          • API String ID: 2774692769-3493990677
                                                                          • Opcode ID: daaa674b2ad1d50fc3211e2271210bce0b7d211d1a0899aaaade4bedbd3bb0f7
                                                                          • Instruction ID: 441557ecdbd4f95e2da424cce832fc79fed486ae06a920805007eef883770e54
                                                                          • Opcode Fuzzy Hash: daaa674b2ad1d50fc3211e2271210bce0b7d211d1a0899aaaade4bedbd3bb0f7
                                                                          • Instruction Fuzzy Hash: 23E2A7B16143509BD220EB75EC82B9FB3E4AFD4308F50492EF58997252DA39F508C79B
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041F0E0 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 181librarythreadloaderCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 843 41f0e0-41f120 call 41b1d0 846 41f122 843->846 847 41f125-41f136 call 405140 843->847 846->847 850 41f143-41f154 call 405140 847->850 851 41f138-41f13e GetSystemDefaultUILanguage 847->851 858 41f15a-41f15c 850->858 859 41f26e-41f27f call 405140 850->859 852 41f2cd-41f2d2 851->852 854 41f2d4-41f2db SetThreadUILanguage 852->854 855 41f2dd-41f2e1 SetThreadLocale 852->855 857 41f2e7-41f30f call 421dee 854->857 855->857 862 41f169-41f18a LoadLibraryW 858->862 863 41f15e-41f164 GetSystemDefaultUILanguage 858->863 870 41f281-41f287 GetUserDefaultUILanguage 859->870 871 41f289-41f2a1 859->871 866 41f190-41f19e GetProcAddress 862->866 867 41f253-41f25a 862->867 863->852 872 41f1b1-41f1ba FreeLibrary 866->872 873 41f1a0-41f1af 866->873 868 41f262-41f26c SetThreadUILanguage 867->868 869 41f25c GetSystemDefaultUILanguage 867->869 868->857 869->868 870->852 875 41f2a3-41f2a4 call 404e70 871->875 876 41f2a9-41f2af 871->876 872->867 874 41f1c0-41f1e1 call 421ecb 872->874 873->872 883 41f1e3-41f1f3 call 42d9e5 874->883 884 41f1f8-41f209 LoadLibraryW 874->884 875->876 879 41f2b0-41f2bf 876->879 879->879 882 41f2c1-41f2c8 call 41eaf0 879->882 882->852 883->884 887 41f20b-41f219 GetProcAddress 884->887 888 41f24a-41f250 call 421dee 884->888 889 41f21b-41f22a 887->889 890 41f22c-41f235 FreeLibrary 887->890 888->867 889->890 890->888 893 41f237-41f247 call 422916 890->893 893->888
                                                                          APIs
                                                                          • GetSystemDefaultUILanguage.KERNEL32(?,INSTALL), ref: 0041F138
                                                                          • SetThreadUILanguage.KERNELBASE(?,?,?,00000000,?,00000000,0042FDF8,000000FF,0042017D,?,?), ref: 0041F2D5
                                                                            • Part of subcall function 00405140: CharUpperW.USER32(?,?,?,?,00000000,0041DDDA,?,TRUE,4A67CDA7), ref: 00405175
                                                                            • Part of subcall function 00405140: CharUpperW.USER32(?,?,?,?,00000000,0041DDDA,?,TRUE,4A67CDA7), ref: 0040517E
                                                                          • GetSystemDefaultUILanguage.KERNEL32(?,SYSTEM,?,INSTALL), ref: 0041F15E
                                                                          • LoadLibraryW.KERNEL32(Kernel32.dll,?,SYSTEM,?,INSTALL), ref: 0041F180
                                                                          • GetProcAddress.KERNEL32(00000000,GetSystemPreferredUILanguages), ref: 0041F196
                                                                          • FreeLibrary.KERNEL32(00000000), ref: 0041F1B2
                                                                          • _malloc.LIBCMT ref: 0041F1D5
                                                                          • __CxxThrowException@8.LIBCMT ref: 0041F1F3
                                                                          • LoadLibraryW.KERNEL32(Kernel32.dll,00000000,?,00000000,0042FDF8,000000FF,0042017D,?,?), ref: 0041F1FF
                                                                          • GetProcAddress.KERNEL32(00000000,GetSystemPreferredUILanguages), ref: 0041F211
                                                                          • FreeLibrary.KERNEL32(00000000,?,00000000,0042FDF8,000000FF,0042017D,?,?), ref: 0041F22D
                                                                          • _swscanf.LIBCMT ref: 0041F242
                                                                          • GetSystemDefaultUILanguage.KERNEL32(?,?,?,00000000,0042FDF8,000000FF,0042017D,?,?), ref: 0041F25C
                                                                          • SetThreadUILanguage.KERNEL32(?), ref: 0041F266
                                                                          • GetUserDefaultUILanguage.KERNEL32(?,USER,?,SYSTEM,?,INSTALL), ref: 0041F281
                                                                          • SetThreadLocale.KERNEL32(?,?,?,00000000,?,00000000,0042FDF8,000000FF,0042017D,?,?), ref: 0041F2E1
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Language$DefaultLibrary$SystemThread$AddressCharFreeLoadProcUpper$Exception@8LocaleThrowUser_malloc_swscanf
                                                                          • String ID: GetSystemPreferredUILanguages$INSTALL$Kernel32.dll$SYSTEM$USER
                                                                          • API String ID: 2081102591-4030941638
                                                                          • Opcode ID: d6552d0fb4520b339bd37c9dc8b8512f68942760f5bed1399b449c860eeb6083
                                                                          • Instruction ID: 298e183df9084cad5458aef8e4b5078e0dc32087b97a83fc7525aa864e930c3c
                                                                          • Opcode Fuzzy Hash: d6552d0fb4520b339bd37c9dc8b8512f68942760f5bed1399b449c860eeb6083
                                                                          • Instruction Fuzzy Hash: 4051F3725043409BC3149FA4DC85AABB3F5BB88314F50093EFA9697280D77DE94ACB5A
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040B1D0 Relevance: 6.7, APIs: 4, Instructions: 722COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1325 40b1d0-40b219 1326 40b223-40b237 1325->1326 1327 40b21b-40b220 1325->1327 1328 40b242-40b244 1326->1328 1329 40b239-40b23f 1326->1329 1327->1326 1330 40b246-40b24c 1328->1330 1331 40b25d-40b27d 1328->1331 1329->1328 1332 40b256-40b258 1330->1332 1333 40b24e-40b253 1330->1333 1334 40b280-40b282 1331->1334 1337 40baa2-40bab6 1332->1337 1333->1332 1335 40b288-40b28a 1334->1335 1336 40b409-40b41d call 41c380 1334->1336 1338 40b292-40b2a4 1335->1338 1339 40b28c-40b28f 1335->1339 1344 40b43f-40b48f call 409090 call 421ecb 1336->1344 1345 40b41f-40b43a call 40bb70 1336->1345 1340 40b2a6-40b2e3 call 40b120 call 40bc00 call 421dee 1338->1340 1341 40b2fa-40b2fe 1338->1341 1339->1338 1360 40b2e6-40b2f8 1340->1360 1346 40b310-40b38e call 40bc00 call 421dee call 40b000 1341->1346 1347 40b300-40b30a 1341->1347 1371 40b491-40b49f call 42d9e5 1344->1371 1372 40b4a4-40b4e6 1344->1372 1345->1337 1352 40b391-40b3ad 1346->1352 1347->1346 1347->1352 1356 40b3b0-40b3ba 1352->1356 1359 40b3c0-40b3cc 1356->1359 1356->1360 1364 40b3f1-40b407 1359->1364 1365 40b3ce-40b3d6 1359->1365 1360->1334 1364->1356 1369 40b3d8-40b3dd 1365->1369 1370 40b3df-40b3e2 1365->1370 1376 40b3e9-40b3ec call 4051f0 1369->1376 1370->1376 1377 40b3e4 1370->1377 1371->1372 1382 40b4f2-40b502 1372->1382 1383 40b4e8-40b4f0 1372->1383 1376->1364 1377->1376 1387 40b504-40b509 1382->1387 1388 40b50c-40b528 1382->1388 1383->1382 1387->1388 1390 40b530-40b556 call 414f60 1388->1390 1392 40b5c2-40b5c5 1390->1392 1393 40b558-40b561 1390->1393 1394 40b611-40b637 call 421ecb 1392->1394 1395 40b5c7-40b5d0 1392->1395 1396 40b563-40b568 1393->1396 1397 40b56b-40b581 call 40a9c0 1393->1397 1405 40b639-40b647 call 42d9e5 1394->1405 1406 40b64c-40b667 call 40c030 1394->1406 1398 40b5d2-40b5d7 1395->1398 1399 40b5da-40b600 call 40bb00 call 40bb70 1395->1399 1396->1397 1408 40b583-40b588 1397->1408 1409 40b58b-40b5b1 call 409100 call 40bb70 1397->1409 1398->1399 1419 40b602-40b605 1399->1419 1420 40b60a-40b60c 1399->1420 1405->1406 1417 40b671-40b680 1406->1417 1418 40b669-40b66e 1406->1418 1408->1409 1427 40b5b3-40b5b6 1409->1427 1428 40b5bb-40b5bd 1409->1428 1422 40b682-40b68b 1417->1422 1423 40b68e-40b6b0 1417->1423 1418->1417 1419->1420 1420->1337 1422->1423 1425 40b6b2-40b6b8 1423->1425 1426 40b6bd-40b6c2 1423->1426 1425->1426 1429 40b6c4-40b6c9 1426->1429 1430 40b6cc-40b6f3 call 40c2c0 1426->1430 1427->1428 1428->1337 1429->1430 1433 40b6f5-40b70a 1430->1433 1434 40b74c-40b74f 1430->1434 1441 40b714-40b73a call 40bb00 call 40bb70 1433->1441 1442 40b70c-40b70f 1433->1442 1435 40b751-40b75d 1434->1435 1436 40b762-40b7ba call 40b060 1434->1436 1443 40ba6f-40ba92 1435->1443 1444 40b7bc-40b7cc 1436->1444 1445 40b7cf-40b7ff call 409180 1436->1445 1457 40b744-40b747 1441->1457 1458 40b73c-40b741 1441->1458 1442->1441 1443->1390 1444->1445 1449 40b804-40b809 1445->1449 1451 40b8a6-40b8ac 1449->1451 1452 40b80f-40b821 call 40c4b0 1449->1452 1454 40b8b2-40b8c4 call 40c4b0 1451->1454 1455 40b949-40b94b 1451->1455 1467 40b823-40b825 1452->1467 1468 40b885-40b887 1452->1468 1463 40b8c6-40b8c8 1454->1463 1474 40b928-40b92a 1454->1474 1459 40b959-40b962 1455->1459 1460 40b94d-40b954 1455->1460 1457->1337 1458->1457 1464 40b964-40b976 call 40c4b0 1459->1464 1465 40b99d-40b9a9 1459->1465 1460->1463 1475 40b8d2-40b8e7 1463->1475 1476 40b8ca-40b8cd 1463->1476 1464->1463 1485 40b97c-40b97e 1464->1485 1477 40b9b3-40ba6a 1465->1477 1478 40b9ab-40b9ae 1465->1478 1469 40b827-40b82c 1467->1469 1470 40b82f-40b844 1467->1470 1471 40b891-40b8a1 1468->1471 1472 40b889-40b88e 1468->1472 1469->1470 1487 40b846-40b849 1470->1487 1488 40b84e-40b874 call 40bb00 call 40bb70 1470->1488 1471->1443 1472->1471 1480 40b934-40b944 1474->1480 1481 40b92c-40b931 1474->1481 1492 40b8f1-40b917 call 40bb00 call 40bb70 1475->1492 1493 40b8e9-40b8ee 1475->1493 1476->1475 1477->1443 1478->1477 1480->1443 1481->1480 1489 40b980-40b985 1485->1489 1490 40b988-40b998 1485->1490 1487->1488 1505 40b876-40b87b 1488->1505 1506 40b87e-40b880 1488->1506 1489->1490 1490->1443 1503 40b921-40b923 1492->1503 1504 40b919-40b91c 1492->1504 1493->1492 1503->1337 1504->1503 1505->1506 1506->1337
                                                                          APIs
                                                                            • Part of subcall function 004051F0: __CxxThrowException@8.LIBCMT ref: 00405214
                                                                            • Part of subcall function 004051F0: __CxxThrowException@8.LIBCMT ref: 0040523E
                                                                            • Part of subcall function 004051F0: __CxxThrowException@8.LIBCMT ref: 00405268
                                                                          • _malloc.LIBCMT ref: 0040B483
                                                                          • __CxxThrowException@8.LIBCMT ref: 0040B49F
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw$_malloc
                                                                          • String ID:
                                                                          • API String ID: 175252994-0
                                                                          • Opcode ID: 27ae718cb246680f5c5d6bf1bb6c97d8e5902cdf4d9c3899dc96b8d455768ad1
                                                                          • Instruction ID: 2e6abc30ca2aa20ae5f3f6fc0f68f379590f98e29c4b42247bfa53aa02dcf44d
                                                                          • Opcode Fuzzy Hash: 27ae718cb246680f5c5d6bf1bb6c97d8e5902cdf4d9c3899dc96b8d455768ad1
                                                                          • Instruction Fuzzy Hash: 3C627D71A00248DFCB10DF69C880B9EBBF5EF88304F14819AE849AB391D779ED45CB95
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00407E20 Relevance: 4.6, APIs: 3, Instructions: 83fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FindClose.KERNEL32(?,4A67CDA7,?,?), ref: 00407E70
                                                                          • FindFirstFileW.KERNELBASE(?,?,4A67CDA7,?,?), ref: 00407E8A
                                                                          • FindFirstFileW.KERNELBASE(?,?), ref: 00407EDE
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Find$FileFirst$Close
                                                                          • String ID:
                                                                          • API String ID: 2810966245-0
                                                                          • Opcode ID: 2262d13d9cd29b8ef9dcfccac33bfb97fc72ec8c8361f932944a4d878434cc8b
                                                                          • Instruction ID: 6d9093d44a4d32a4fee55667aa604e93bb106650d9471b23b0a41932ce3bcc02
                                                                          • Opcode Fuzzy Hash: 2262d13d9cd29b8ef9dcfccac33bfb97fc72ec8c8361f932944a4d878434cc8b
                                                                          • Instruction Fuzzy Hash: C0316D71908742DFD710DF28D845B5BB7E4EF59320F100B2AE4A5972D0DB38A909CB9A
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041F320 Relevance: 3.0, APIs: 2, Instructions: 45comCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetVersion.KERNEL32(?,?,00420066), ref: 0041F323
                                                                          • CoCreateInstance.OLE32 ref: 0041F34A
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CreateInstanceVersion
                                                                          • String ID:
                                                                          • API String ID: 1462612201-0
                                                                          • Opcode ID: 2178591d72f77ed9f68f1ba43183410802dbbc52281cb795d0c4d4a87dbbd7d5
                                                                          • Instruction ID: 4119b896e90871d56b1c7fc6a18c68987ceef037eb140d8bc2a0f6e2bd03ebc3
                                                                          • Opcode Fuzzy Hash: 2178591d72f77ed9f68f1ba43183410802dbbc52281cb795d0c4d4a87dbbd7d5
                                                                          • Instruction Fuzzy Hash: F8010C70304205AFD700DF69CD85F5B77E8AF88B04F109829F458D72A0D7B8E949CB56
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00419D20 Relevance: 1.8, Strings: 1, Instructions: 518COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CharUpper
                                                                          • String ID: Unknown error
                                                                          • API String ID: 9403516-83687255
                                                                          • Opcode ID: ad7bf46e3de6b7f21405f684f1ccac249f2d2889590892a53ac2a03263f299c4
                                                                          • Instruction ID: 207171b60f41956f4efded5058e7d1de725f9a258d7fd4d3ab9f449e565e6028
                                                                          • Opcode Fuzzy Hash: ad7bf46e3de6b7f21405f684f1ccac249f2d2889590892a53ac2a03263f299c4
                                                                          • Instruction Fuzzy Hash: 052258756083808FC324DF69C884A9BBBE5BF89304F64891EF69587351CB39E845CF96
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041B9B0 Relevance: 22.7, APIs: 15, Instructions: 227windowtimeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • GetDlgItem.USER32(?,000003E8), ref: 0041B9F4
                                                                          • LoadIconW.USER32(00400000,?), ref: 0041BA16
                                                                          • SendMessageW.USER32(?,00000080,00000001,00000000), ref: 0041BA28
                                                                          • SetTimer.USER32(?,00000003,00000064,00000000), ref: 0041BA37
                                                                          • SetWindowTextW.USER32(?,?), ref: 0041BA48
                                                                          • PostMessageW.USER32(?,00008000,00000000,00000000), ref: 0041BA5E
                                                                          • SetDlgItemTextW.USER32(?,000003E7,?), ref: 0041BABD
                                                                          • SetDlgItemTextW.USER32(?,00000002,?), ref: 0041BB18
                                                                          • SendMessageW.USER32(?,00000080,00000001,00000000), ref: 0041BB2D
                                                                          • SetEvent.KERNEL32 ref: 0041BB3B
                                                                          • GetLastError.KERNEL32 ref: 0041BB45
                                                                          • GetWindowRect.USER32(?,?), ref: 0041BB74
                                                                          • GetWindowRect.USER32(?,?), ref: 0041BB91
                                                                          • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0041BBC6
                                                                          • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 0041BC38
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Window$ItemMessageText$RectSend$ErrorEventIconInfoLastLoadMoveParametersPostSystemTimer
                                                                          • String ID:
                                                                          • API String ID: 4208242464-0
                                                                          • Opcode ID: 213527b756d3c871117873a44ecb0c9c645d7508d353441342c7c43678ba1636
                                                                          • Instruction ID: d4708a701f4d74b9302c6a0546dacd2ca318cb66cb684dddc2989582ad0f470f
                                                                          • Opcode Fuzzy Hash: 213527b756d3c871117873a44ecb0c9c645d7508d353441342c7c43678ba1636
                                                                          • Instruction Fuzzy Hash: 589157B1608344AFD710DF69D984A5BBBE8EF88704F404A2EF988D7390D7B4D940CB96
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00422B09 Relevance: 22.6, APIs: 15, Instructions: 86COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 930 422b09-422b18 931 422b41 930->931 932 422b1a-422b26 930->932 934 422b44-422b50 call 422df3 931->934 932->931 933 422b28-422b2f 932->933 933->931 935 422b31-422b3f 933->935 938 422b52-422b59 call 422ab1 934->938 939 422b5a-422b61 call 42469a 934->939 935->934 938->939 944 422b63-422b6a call 422ab1 939->944 945 422b6b-422b7a call 427355 call 427101 939->945 944->945 952 422b84-422ba0 GetCommandLineA call 426fca call 426f0f 945->952 953 422b7c-422b83 call 423cbc 945->953 960 422ba2-422ba9 call 423cbc 952->960 961 422baa-422bb1 call 426c97 952->961 953->952 960->961 966 422bb3-422bba call 423cbc 961->966 967 422bbb-422bc4 call 423d7b 961->967 966->967 972 422bc6-422bcc call 423cbc 967->972 973 422bcd-422bd5 call 426c38 967->973 972->973 978 422bd7-422bdb 973->978 979 422bdd-422bdf 973->979 980 422be0-422bf3 call 41ff60 978->980 979->980 983 422bf5-422bf6 call 423f2c 980->983 984 422bfb-422c57 call 423f58 call 423add 980->984 983->984
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp__wincmdln
                                                                          • String ID:
                                                                          • API String ID: 3545360858-0
                                                                          • Opcode ID: 1bbe4d6a2c1f83ef58cbfe54f8c5cc5bedf82d33bd6d22c311cede4537bf217c
                                                                          • Instruction ID: 59fed90c4ca1eede3bb5b7934065d88dc15ceb01ae7c2db383fc00aafbe58fe6
                                                                          • Opcode Fuzzy Hash: 1bbe4d6a2c1f83ef58cbfe54f8c5cc5bedf82d33bd6d22c311cede4537bf217c
                                                                          • Instruction Fuzzy Hash: C421A270B00335A9DB147F72BA52B6E2674AF00709FD0442FF805AA292EAFCD942961C
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041F6E0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72registryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • _memset.LIBCMT ref: 0041F70C
                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0041F723
                                                                          • _memset.LIBCMT ref: 0041F73B
                                                                          • _wcsrchr.LIBCMT ref: 0041F75E
                                                                          • RegCreateKeyExW.KERNELBASE ref: 0041F79F
                                                                          • RegSetValueExW.KERNELBASE(00000000,IsHostApp,00000000,00000001,00000000,00000002), ref: 0041F7BF
                                                                          • RegCloseKey.ADVAPI32 ref: 0041F7C9
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: _memset$CloseCreateFileModuleNameValue_wcsrchr
                                                                          • String ID: Applications\$IsHostApp
                                                                          • API String ID: 1474337858-1667566961
                                                                          • Opcode ID: cff6f790a36eb52c656df31ff0c4e9f8bf1fe657cd444f3676a6b9194cf5c507
                                                                          • Instruction ID: b4fefd4a986ce641184e98d9e04d4cd0ee7292d218086c9f430e2e44724af58e
                                                                          • Opcode Fuzzy Hash: cff6f790a36eb52c656df31ff0c4e9f8bf1fe657cd444f3676a6b9194cf5c507
                                                                          • Instruction Fuzzy Hash: 2E2165B1654300BAE224EB60DD47FEB73A8AF98B04F40491DB3459A1C1DAB4A544C79A
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041D740 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 86synchronizationCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1005 41d740-41d76c CreateDialogParamW 1006 41d771-41d791 call 408600 call 41c040 1005->1006 1007 41d76e 1005->1007 1012 41d793-41d79a 1006->1012 1013 41d7ab-41d7b9 1006->1013 1007->1006 1012->1013 1016 41d79c-41d7a5 ShowWindow 1012->1016 1014 41d7c3 1013->1014 1015 41d7bb-41d7c1 1013->1015 1017 41d7c5-41d846 call 404bf0 DialogBoxParamW WaitForSingleObject call 41b1d0 SetWindowTextW call 421dee ShowWindow WaitForSingleObject 1014->1017 1015->1017 1016->1013
                                                                          APIs
                                                                          • CreateDialogParamW.USER32(00400000,000001F6,00000000,Function_000063F0,?), ref: 0041D764
                                                                          • ShowWindow.USER32(?,00000001,?,setup.bmp), ref: 0041D7A5
                                                                          • DialogBoxParamW.USER32(00400000,000001F4,00000000,Function_000063F0,?), ref: 0041D7EB
                                                                          • WaitForSingleObject.KERNEL32(?,000000FF,?,setup.bmp), ref: 0041D800
                                                                          • SetWindowTextW.USER32(?,?), ref: 0041D817
                                                                          • ShowWindow.USER32(?,00000001), ref: 0041D830
                                                                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041D83B
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Window$DialogObjectParamShowSingleWait$CreateText
                                                                          • String ID: setup.bmp
                                                                          • API String ID: 2497262453-2262724209
                                                                          • Opcode ID: d8c619cd4cecbc0b145774af9c6c06f338f744dbb22830f04e4e83a9de6a6ac1
                                                                          • Instruction ID: 0faa20cbb3d567336509cef9e5aebf815778aaddbabd9f03ba19637f0d8d8adc
                                                                          • Opcode Fuzzy Hash: d8c619cd4cecbc0b145774af9c6c06f338f744dbb22830f04e4e83a9de6a6ac1
                                                                          • Instruction Fuzzy Hash: EF313172640305AFC720EF24DD81FDB37A4EB49310F20062AFA54672D1CB74E805CBA9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041C040 Relevance: 12.1, APIs: 8, Instructions: 125windowCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00008010), ref: 0041C058
                                                                          • GetObjectW.GDI32(00000000,00000018,?), ref: 0041C085
                                                                          • SendMessageW.USER32(?,00000172,00000000,?), ref: 0041C09A
                                                                          • MoveWindow.USER32(?,00000000,00000000,?,?,00000001), ref: 0041C0BA
                                                                          • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0041C0D7
                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 0041C13D
                                                                          • AdjustWindowRect.USER32(?,00000000), ref: 0041C149
                                                                          • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 0041C16D
                                                                            • Part of subcall function 00421DEE: __lock.LIBCMT ref: 00421E0C
                                                                            • Part of subcall function 00421DEE: ___sbh_find_block.LIBCMT ref: 00421E17
                                                                            • Part of subcall function 00421DEE: ___sbh_free_block.LIBCMT ref: 00421E26
                                                                            • Part of subcall function 00421DEE: RtlFreeHeap.NTDLL(00000000,?,00437B30,0000000C,004244D4,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C), ref: 00421E56
                                                                            • Part of subcall function 00421DEE: GetLastError.KERNEL32(?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA,?,?,?,0042458E,0000000D), ref: 00421E67
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Window$Move$AdjustErrorFreeHeapImageInfoLastLoadLongMessageObjectParametersRectSendSystem___sbh_find_block___sbh_free_block__lock
                                                                          • String ID:
                                                                          • API String ID: 3689589546-0
                                                                          • Opcode ID: 7bfc0ae8c63c3b13bb5f29ca599eb26561b13572ec439ebf92d2744aaab055c0
                                                                          • Instruction ID: 10272e37aad25a8ad928242f2c0e3e8038a1b118f2e72c0a5f5bbb975411cee3
                                                                          • Opcode Fuzzy Hash: 7bfc0ae8c63c3b13bb5f29ca599eb26561b13572ec439ebf92d2744aaab055c0
                                                                          • Instruction Fuzzy Hash: E7412AB1604300AFD354CF38DD85F6BBBE9EBC8710F545A2DB989C7290D671E9088B66
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00422013 Relevance: 12.0, APIs: 8, Instructions: 42threadCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1031 422013-42202b call 4242f5 call 4242ef call 4242d5 1038 422057-42206d call 4244fd 1031->1038 1039 42202d-42203e call 4242ef call 424329 1031->1039 1042 422072-422079 1038->1042 1051 422040-422047 GetLastError ExitThread 1039->1051 1052 42204d-422055 GetCurrentThreadId 1039->1052 1044 422090-422095 call 421fd2 1042->1044 1045 42207b-422088 call 4248c0 1042->1045 1045->1044 1054 42208a 1045->1054 1052->1042 1054->1044
                                                                          APIs
                                                                          • ___set_flsgetvalue.LIBCMT ref: 00422019
                                                                            • Part of subcall function 004242F5: TlsGetValue.KERNEL32(?,0042201E), ref: 004242FE
                                                                            • Part of subcall function 004242F5: __decode_pointer.LIBCMT ref: 00424310
                                                                            • Part of subcall function 004242F5: TlsSetValue.KERNEL32(00000000,0042201E), ref: 0042431F
                                                                          • ___fls_getvalue@4.LIBCMT ref: 00422024
                                                                            • Part of subcall function 004242D5: TlsGetValue.KERNEL32(?,?,00422029,00000000), ref: 004242E3
                                                                          • ___fls_setvalue@8.LIBCMT ref: 00422037
                                                                            • Part of subcall function 00424329: __decode_pointer.LIBCMT ref: 0042433A
                                                                          • GetLastError.KERNEL32(00000000,?,00000000), ref: 00422040
                                                                          • ExitThread.KERNEL32 ref: 00422047
                                                                          • GetCurrentThreadId.KERNEL32 ref: 0042204D
                                                                          • __freefls@4.LIBCMT ref: 0042206D
                                                                          • __IsNonwritableInCurrentImage.LIBCMT ref: 00422080
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                                                          • String ID:
                                                                          • API String ID: 1925773019-0
                                                                          • Opcode ID: 72ddbad82ef0f2b195670e724972f924a497b3df3b9b3875832c963032e7b329
                                                                          • Instruction ID: cba3c34129614957de2666b5bd55052eb0b4080e267b2a8cfe39401b396168e4
                                                                          • Opcode Fuzzy Hash: 72ddbad82ef0f2b195670e724972f924a497b3df3b9b3875832c963032e7b329
                                                                          • Instruction Fuzzy Hash: 8001A074300221FBD714BF73FA4990A3769EF45344791405AF50587622CBBCD846C66D
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041E050 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 329COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1055 41e050-41e1aa call 41e510 call 41b1d0 call 404bf0 call 421dee call 41b1d0 call 404bf0 call 421dee call 41b1d0 call 404bf0 call 421dee call 41b1d0 call 404bf0 call 421dee call 404bf0 * 2 call 421ecb 1088 41e1ac-41e1ba call 42d9e5 1055->1088 1089 41e1bf-41e1e0 call 41d850 1055->1089 1088->1089 1093 41e1e2-41e1e7 1089->1093 1094 41e1ea-41e1f0 1089->1094 1093->1094 1095 41e1f2-41e1f7 1094->1095 1096 41e1fa-41e236 call 404bf0 1094->1096 1095->1096 1099 41e44c-41e451 call 41dd70 1096->1099 1100 41e23c-41e24d call 41db40 1096->1100 1104 41e456-41e466 1099->1104 1100->1104 1107 41e253-41e27c 1100->1107 1105 41e468-41e47d 1104->1105 1106 41e4ab-41e4ae 1104->1106 1108 41e485-41e48e 1105->1108 1109 41e47f-41e480 call 404e70 1105->1109 1110 41e4c1-41e4df 1106->1110 1111 41e4b0-41e4bc call 404bf0 1106->1111 1117 41e360-41e367 1107->1117 1118 41e282-41e2a6 call 408740 1107->1118 1113 41e490-41e49f 1108->1113 1109->1108 1115 41e4e0-41e50b call 41e5d0 1110->1115 1111->1110 1113->1113 1119 41e4a1-41e4a8 1113->1119 1117->1104 1121 41e36d-41e39b call 422096 1117->1121 1123 41e2a8-41e2ca call 404b30 1118->1123 1119->1106 1128 41e3b8-41e418 call 404e70 call 41b1d0 call 404bf0 call 421dee call 41d740 1121->1128 1129 41e39d-41e3a7 GetLastError 1121->1129 1131 41e2e7-41e2ea 1123->1131 1132 41e2cc 1123->1132 1159 41e41d-41e442 call 421dee CloseHandle 1128->1159 1133 41e3a9 1129->1133 1134 41e3ae-41e3b3 1129->1134 1137 41e2f5-41e309 call 421dee 1131->1137 1136 41e2cf 1132->1136 1133->1134 1134->1115 1139 41e2d1-41e2d4 1136->1139 1140 41e2ec-41e2f1 1136->1140 1147 41e330-41e359 call 408890 1137->1147 1148 41e30b-41e328 call 408890 1137->1148 1143 41e2f3 1139->1143 1144 41e2d6-41e2e5 1139->1144 1140->1137 1143->1137 1144->1131 1144->1136 1157 41e35e 1147->1157 1148->1118 1154 41e32e 1148->1154 1154->1157 1157->1117 1159->1104 1162 41e444-41e44a GetLastError 1159->1162 1162->1104
                                                                          APIs
                                                                            • Part of subcall function 00421DEE: __lock.LIBCMT ref: 00421E0C
                                                                            • Part of subcall function 00421DEE: ___sbh_find_block.LIBCMT ref: 00421E17
                                                                            • Part of subcall function 00421DEE: ___sbh_free_block.LIBCMT ref: 00421E26
                                                                            • Part of subcall function 00421DEE: RtlFreeHeap.NTDLL(00000000,?,00437B30,0000000C,004244D4,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C), ref: 00421E56
                                                                            • Part of subcall function 00421DEE: GetLastError.KERNEL32(?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA,?,?,?,0042458E,0000000D), ref: 00421E67
                                                                          • _malloc.LIBCMT ref: 0041E1A0
                                                                            • Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
                                                                            • Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
                                                                            • Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42
                                                                          • __CxxThrowException@8.LIBCMT ref: 0041E1BA
                                                                            • Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27
                                                                          • CloseHandle.KERNEL32(00000000,?,00000004,?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 0041E43A
                                                                          • GetLastError.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 0041E444
                                                                          • GetLastError.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 0041E39D
                                                                            • Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
                                                                            • Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7
                                                                            • Part of subcall function 0041D740: CreateDialogParamW.USER32(00400000,000001F6,00000000,Function_000063F0,?), ref: 0041D764
                                                                            • Part of subcall function 0041D740: ShowWindow.USER32(?,00000001,?,setup.bmp), ref: 0041D7A5
                                                                            • Part of subcall function 0041D740: DialogBoxParamW.USER32(00400000,000001F4,00000000,Function_000063F0,?), ref: 0041D7EB
                                                                            • Part of subcall function 0041D740: WaitForSingleObject.KERNEL32(?,000000FF,?,setup.bmp), ref: 0041D800
                                                                            • Part of subcall function 0041D740: SetWindowTextW.USER32(?,?), ref: 0041D817
                                                                            • Part of subcall function 0041D740: ShowWindow.USER32(?,00000001), ref: 0041D830
                                                                            • Part of subcall function 0041D740: WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041D83B
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLastWindow$DialogException@8HeapObjectParamShowSingleThrowWait_malloc$AllocateCloseCreateExceptionFreeHandleRaiseText___sbh_find_block___sbh_free_block__lock
                                                                          • String ID: etup.bmp
                                                                          • API String ID: 108091135-3436927654
                                                                          • Opcode ID: 9d215bae1c5d9e1a63466686c8b5942799d0021b491904e95ddcade9e571659f
                                                                          • Instruction ID: 5d8bd30ac3cac1c9bf74f9187621e21ec3f781addd92d798ee7c0fa51436409c
                                                                          • Opcode Fuzzy Hash: 9d215bae1c5d9e1a63466686c8b5942799d0021b491904e95ddcade9e571659f
                                                                          • Instruction Fuzzy Hash: 2FD1A2755083808FC320EF69C880B9BB7E5AF98304F14892EF99987351D738E949CB5B
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041F7F0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 227COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1164 41f7f0-41f867 call 42bdf0 call 4083b0 1169 41f886-41f890 1164->1169 1170 41f869-41f876 1164->1170 1173 41f892-41f89a 1169->1173 1174 41f89c-41f8a8 1169->1174 1171 41f878-41f879 CloseHandle 1170->1171 1172 41f87f-41f881 1170->1172 1171->1172 1175 41fabe-41fae5 call 421ddf 1172->1175 1173->1173 1173->1174 1176 41f8aa 1174->1176 1177 41f8be-41f8cb 1174->1177 1178 41f8b0-41f8b8 1176->1178 1179 41f8d3-41f8ef call 408520 1177->1179 1178->1178 1181 41f8ba 1178->1181 1179->1170 1185 41f8f5-41f8fb 1179->1185 1181->1177 1186 41f901-41f90d 1185->1186 1187 41fa6f-41fa7c 1185->1187 1188 41f910-41f91b 1186->1188 1189 41fab3 1187->1189 1190 41f921-41f929 1188->1190 1191 41f9ab-41f9af 1188->1191 1192 41fab5-41fab6 FindCloseChangeNotification 1189->1192 1193 41fabc 1189->1193 1195 41fa0d-41fa35 call 4221a0 1190->1195 1196 41f92f-41f939 1190->1196 1194 41f9b1-41f9bd 1191->1194 1191->1195 1192->1193 1193->1175 1197 41f9d4-41f9d6 1194->1197 1198 41f9bf 1194->1198 1209 41fa45-41fa62 1195->1209 1210 41fa37-41fa3f 1195->1210 1199 41f954-41f956 1196->1199 1200 41f93b 1196->1200 1204 41f9d8-41f9dc 1197->1204 1205 41f9ff-41fa08 1197->1205 1202 41f9c0-41f9c4 1198->1202 1206 41faa1-41fab0 1199->1206 1207 41f95c-41f960 1199->1207 1203 41f940-41f944 1200->1203 1211 41f9c6-41f9d2 1202->1211 1212 41f9f8-41f9fa 1202->1212 1213 41f946-41f952 1203->1213 1214 41f988-41f990 1203->1214 1204->1212 1215 41f9de-41f9e1 1204->1215 1205->1188 1206->1189 1207->1214 1216 41f962-41f965 1207->1216 1218 41fa64-41fa65 CloseHandle 1209->1218 1219 41fa6b-41fa6d 1209->1219 1210->1209 1217 41f8d0 1210->1217 1211->1197 1211->1202 1212->1188 1213->1199 1213->1203 1222 41f996-41f9a6 call 406070 1214->1222 1223 41fa7e-41fa90 1214->1223 1215->1205 1220 41f9e3-41f9e9 1215->1220 1216->1206 1221 41f96b-41f971 1216->1221 1217->1179 1218->1219 1219->1175 1220->1212 1225 41f9eb-41f9ee 1220->1225 1221->1214 1226 41f973-41f976 1221->1226 1222->1188 1223->1172 1224 41fa96-41fa9f CloseHandle 1223->1224 1224->1175 1225->1205 1228 41f9f0-41f9f6 1225->1228 1226->1206 1229 41f97c-41f982 1226->1229 1228->1205 1228->1212 1229->1206 1229->1214
                                                                          APIs
                                                                            • Part of subcall function 004083B0: CloseHandle.KERNEL32(?,4A67CDA7,00000000,?,80000000,00000001,00000000), ref: 004083DD
                                                                            • Part of subcall function 004083B0: CreateFileW.KERNELBASE(?,?,?,00000000,00000003,00000080,00000000,4A67CDA7,00000000,?,80000000,00000001,00000000), ref: 00408410
                                                                            • Part of subcall function 004083B0: CreateFileW.KERNEL32(?,?,?,00000000,00000003,00000080,00000000), ref: 0040846E
                                                                          • CloseHandle.KERNEL32(?,?,00001000,?,80000000,00000001,4A67CDA7,?,?,?,00000004,00000000,0043092B,000000FF,004205FF,?), ref: 0041F879
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CloseCreateFileHandle
                                                                          • String ID: ;!@Install@!UTF-8!$;!@InstallEnd@!
                                                                          • API String ID: 3498533004-372238525
                                                                          • Opcode ID: 91f2affea4869e83765d2e1f74f89e94a0244e6f1a37536b6162920d4a1ac00b
                                                                          • Instruction ID: 1b5d8e8219d8dbe746f9698ee4f6a7a213231ea35f70ff9d4cceb37c5f899a79
                                                                          • Opcode Fuzzy Hash: 91f2affea4869e83765d2e1f74f89e94a0244e6f1a37536b6162920d4a1ac00b
                                                                          • Instruction Fuzzy Hash: E781D4B15083809BD325DF2485807EBBBE1AF95354F244A3EE5D987281D73AD88FCB49
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00422096 Relevance: 10.6, APIs: 7, Instructions: 71threadCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1231 422096-4220a8 1232 4220c6-4220de call 4242f5 call 424b23 1231->1232 1233 4220aa-4220c4 call 422daa call 424d46 1231->1233 1243 4220e0-422102 call 4244e3 call 424383 1232->1243 1244 42212a-422134 call 421dee 1232->1244 1242 422142-422145 1233->1242 1256 422107-42211f CreateThread 1243->1256 1257 422104 1243->1257 1249 422136-42213e call 422dd0 1244->1249 1250 42213f 1244->1250 1249->1250 1253 422141 1250->1253 1253->1242 1256->1253 1258 422121-422127 GetLastError 1256->1258 1257->1256 1258->1244
                                                                          APIs
                                                                          • ___set_flsgetvalue.LIBCMT ref: 004220C7
                                                                          • __calloc_crt.LIBCMT ref: 004220D3
                                                                          • __getptd.LIBCMT ref: 004220E0
                                                                          • __initptd.LIBCMT ref: 004220E9
                                                                          • CreateThread.KERNELBASE(?,?,00422013,00000000,?,?), ref: 00422117
                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00422121
                                                                          • __dosmaperr.LIBCMT ref: 00422139
                                                                            • Part of subcall function 00422DAA: __getptd_noexit.LIBCMT ref: 00422DAA
                                                                            • Part of subcall function 00424D46: __decode_pointer.LIBCMT ref: 00424D51
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit__initptd
                                                                          • String ID:
                                                                          • API String ID: 3358092440-0
                                                                          • Opcode ID: 602223caef30ac8905e2114ad2e2831423af8eb0fd15534cf41766eaa13dc9e9
                                                                          • Instruction ID: fb74a56c9f60d37d37198afcb2bea95722bf172271e528f26766c8b543eded33
                                                                          • Opcode Fuzzy Hash: 602223caef30ac8905e2114ad2e2831423af8eb0fd15534cf41766eaa13dc9e9
                                                                          • Instruction Fuzzy Hash: 80110872700225BFCB10BFA5FD829AF77A5EF44324B90002FF60493151DBF99950D6A8
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004070D0 Relevance: 7.6, APIs: 5, Instructions: 109fileCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1259 4070d0-407106 DeleteFileW 1260 407181-407183 1259->1260 1261 407108-407112 call 407070 1259->1261 1263 4071fa-40720d 1260->1263 1265 407114-40711f call 406a10 1261->1265 1266 407125-40712a DeleteFileW 1261->1266 1265->1266 1271 4071f8 1265->1271 1266->1260 1267 40712c-407154 call 404e70 call 4081c0 1266->1267 1275 4071e3-4071ef 1267->1275 1276 40715a-407163 1267->1276 1271->1263 1278 4071f0-4071f5 call 421dee 1275->1278 1276->1275 1277 407165-40716e DeleteFileW 1276->1277 1279 407170-40717e call 421dee 1277->1279 1280 407185-40718f call 407070 1277->1280 1278->1271 1279->1260 1287 407191-40719c call 406a10 1280->1287 1288 4071ab-4071b1 DeleteFileW 1280->1288 1295 4071a9 1287->1295 1296 40719e-4071a7 1287->1296 1290 4071b3-4071c5 call 421dee 1288->1290 1291 4071c7-4071e1 DeleteFileW call 421dee 1288->1291 1290->1263 1291->1263 1295->1288 1296->1278
                                                                          APIs
                                                                          • DeleteFileW.KERNELBASE(?,4A67CDA7,?,?,?,00000000,4A67CDA7,?,00000000), ref: 00407102
                                                                            • Part of subcall function 00407070: CreateFileW.KERNEL32(?,00000000,00000007,00000000,00000003,00000080,00000000), ref: 00407084
                                                                            • Part of subcall function 00407070: _memset.LIBCMT ref: 0040709A
                                                                            • Part of subcall function 00407070: GetFileInformationByHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0040710F), ref: 004070A8
                                                                            • Part of subcall function 00407070: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,0040710F), ref: 004070B3
                                                                          • DeleteFileW.KERNEL32(?,?,?,00000000,4A67CDA7,?,00000000), ref: 00407126
                                                                          • DeleteFileW.KERNEL32(?,?,?,00000004,?,?,00000000,4A67CDA7,?,00000000), ref: 0040716A
                                                                            • Part of subcall function 00406A10: SetFileAttributesW.KERNELBASE(?,00000000,4A67CDA7,?,?,00000000,00430508,000000FF,00407419), ref: 00406A40
                                                                          • DeleteFileW.KERNEL32(?,?,?,00000000,4A67CDA7,?,00000000), ref: 004071AC
                                                                          • DeleteFileW.KERNEL32(?,?,?,00000000,4A67CDA7,?,00000000), ref: 004071C7
                                                                            • Part of subcall function 00421DEE: __lock.LIBCMT ref: 00421E0C
                                                                            • Part of subcall function 00421DEE: ___sbh_find_block.LIBCMT ref: 00421E17
                                                                            • Part of subcall function 00421DEE: ___sbh_free_block.LIBCMT ref: 00421E26
                                                                            • Part of subcall function 00421DEE: RtlFreeHeap.NTDLL(00000000,?,00437B30,0000000C,004244D4,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C), ref: 00421E56
                                                                            • Part of subcall function 00421DEE: GetLastError.KERNEL32(?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA,?,?,?,0042458E,0000000D), ref: 00421E67
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: File$Delete$Handle$AttributesCloseCreateErrorFreeHeapInformationLast___sbh_find_block___sbh_free_block__lock_memset
                                                                          • String ID:
                                                                          • API String ID: 3115853615-0
                                                                          • Opcode ID: bfb8be93367b1f7e134295210bed3b2619c59b7c9f56f090842b6278bde08a63
                                                                          • Instruction ID: ca44fddab62255b2f7870df1ed14c1733f6fd0f03786bcee7d5bc91ed6090572
                                                                          • Opcode Fuzzy Hash: bfb8be93367b1f7e134295210bed3b2619c59b7c9f56f090842b6278bde08a63
                                                                          • Instruction Fuzzy Hash: 71310771A083419BC610AB265C40A5B7798AF95324F10073FF865BB3D1DB3CE906CA5B
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00421DEE Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1299 421dee-421dff call 423a98 1302 421e01-421e08 1299->1302 1303 421e76-421e7b call 423add 1299->1303 1304 421e0a-421e22 call 422f9f call 422fd2 1302->1304 1305 421e4d 1302->1305 1317 421e24-421e2c call 423002 1304->1317 1318 421e2d-421e3d call 421e44 1304->1318 1307 421e4e-421e5e RtlFreeHeap 1305->1307 1307->1303 1310 421e60-421e75 call 422daa GetLastError call 422d68 1307->1310 1310->1303 1317->1318 1318->1303 1324 421e3f-421e42 1318->1324 1324->1307
                                                                          APIs
                                                                          • __lock.LIBCMT ref: 00421E0C
                                                                            • Part of subcall function 00422F9F: __mtinitlocknum.LIBCMT ref: 00422FB5
                                                                            • Part of subcall function 00422F9F: __amsg_exit.LIBCMT ref: 00422FC1
                                                                            • Part of subcall function 00422F9F: EnterCriticalSection.KERNEL32(?,?,?,0042458E,0000000D,00437C60,00000008,00422072,?,00000000), ref: 00422FC9
                                                                          • ___sbh_find_block.LIBCMT ref: 00421E17
                                                                          • ___sbh_free_block.LIBCMT ref: 00421E26
                                                                          • RtlFreeHeap.NTDLL(00000000,?,00437B30,0000000C,004244D4,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C), ref: 00421E56
                                                                          • GetLastError.KERNEL32(?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA,?,?,?,0042458E,0000000D), ref: 00421E67
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                          • String ID:
                                                                          • API String ID: 2714421763-0
                                                                          • Opcode ID: c8934a7c4923efb6ac1c1572ab7c9cc304ace5cc8a043a7b62b6768359b908ef
                                                                          • Instruction ID: 36df9ecf480f3c232eb00c3d22aa6e4bf98602e55d40a7a541d3ce7ea1edb9de
                                                                          • Opcode Fuzzy Hash: c8934a7c4923efb6ac1c1572ab7c9cc304ace5cc8a043a7b62b6768359b908ef
                                                                          • Instruction Fuzzy Hash: DD018471B05335AAEB206F71BD0AB5F3674AF21328FD1411FF940A6191CABC99418B9C
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040FD80 Relevance: 6.5, APIs: 4, Instructions: 497COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1509 40fd80-40ff87 call 40fa50 call 409090 1514 410196-4101bc call 40a9c0 1509->1514 1515 40ff8d-40ff9b 1509->1515 1520 4101c6-410394 call 409100 call 421dee * 4 call 40d610 call 421dee * 3 1514->1520 1521 4101be-4101c3 1514->1521 1516 40ffa6-410002 call 411e60 call 421dee call 40b000 1515->1516 1531 4103b2 call 40e0c0 1516->1531 1532 410008-41000a 1516->1532 1608 410396-4103af 1520->1608 1521->1520 1536 4103b7-4103c7 call 42d9e5 1531->1536 1532->1531 1535 410010-410013 1532->1535 1537 410015-410017 1535->1537 1538 41005d-41006d call 421ecb 1535->1538 1544 4103cc-4103dc call 42d9e5 1536->1544 1542 410049 1537->1542 1543 410019-410024 call 421ecb 1537->1543 1538->1544 1551 410073-410082 1538->1551 1545 41004b-41005a call 421dee 1542->1545 1543->1536 1556 41002a-410031 1543->1556 1554 4103e1-4105c9 call 40bb00 call 421dee * 4 call 40d610 call 421dee * 3 1544->1554 1545->1538 1557 41008b-4100e5 call 409180 1551->1557 1554->1608 1556->1545 1559 410033-410035 1556->1559 1568 4100ea-4100f3 1557->1568 1560 410037 1559->1560 1561 410039-410047 call 4221a0 1559->1561 1560->1561 1561->1545 1568->1554 1569 4100f9-410100 1568->1569 1572 410102-410124 1569->1572 1573 41012a-410133 1569->1573 1572->1531 1572->1573 1576 410135 1573->1576 1577 41016e-41018e 1573->1577 1581 410140-410165 1576->1581 1577->1516 1588 410194 1577->1588 1581->1581 1584 410167 1581->1584 1584->1577 1588->1514
                                                                          APIs
                                                                            • Part of subcall function 00411E60: _malloc.LIBCMT ref: 00411E86
                                                                            • Part of subcall function 00411E60: __CxxThrowException@8.LIBCMT ref: 00411EA6
                                                                            • Part of subcall function 00421DEE: __lock.LIBCMT ref: 00421E0C
                                                                            • Part of subcall function 00421DEE: ___sbh_find_block.LIBCMT ref: 00421E17
                                                                            • Part of subcall function 00421DEE: ___sbh_free_block.LIBCMT ref: 00421E26
                                                                            • Part of subcall function 00421DEE: RtlFreeHeap.NTDLL(00000000,?,00437B30,0000000C,004244D4,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C), ref: 00421E56
                                                                            • Part of subcall function 00421DEE: GetLastError.KERNEL32(?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA,?,?,?,0042458E,0000000D), ref: 00421E67
                                                                          • _malloc.LIBCMT ref: 0041001A
                                                                            • Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
                                                                            • Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
                                                                            • Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42
                                                                          • _malloc.LIBCMT ref: 0041005F
                                                                          • __CxxThrowException@8.LIBCMT ref: 004103C7
                                                                          • __CxxThrowException@8.LIBCMT ref: 004103DC
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw_malloc$Heap$AllocateErrorFreeLast___sbh_find_block___sbh_free_block__lock
                                                                          • String ID:
                                                                          • API String ID: 692529005-0
                                                                          • Opcode ID: 30c8d6273c1f0815a2eb9915eecc83b390c54e5ece629dd8823cc2c1d9aba3a5
                                                                          • Instruction ID: 56e3bafea64fc53d2df5d5e03e911840bc184fe3c7d80c36f6e752c328ae0f0a
                                                                          • Opcode Fuzzy Hash: 30c8d6273c1f0815a2eb9915eecc83b390c54e5ece629dd8823cc2c1d9aba3a5
                                                                          • Instruction Fuzzy Hash: DB32D2B5908380DFD320CF6AC880B9BFBE4BFD9304F54892EE58987251DB79A544CB56
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00415A80 Relevance: 6.4, APIs: 4, Instructions: 428COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1619 415a80-415ab0 1620 415ab6-415aba 1619->1620 1621 415f9d-415fb4 1619->1621 1620->1621 1622 415ac0-415ad3 call 414ac0 1620->1622 1625 415ad5-415aec 1622->1625 1626 415aef-415aff call 414ac0 1622->1626 1626->1625 1629 415b01-415b11 call 414ac0 1626->1629 1629->1625 1632 415b13-415b23 call 414ac0 1629->1632 1632->1625 1635 415b25-415b3a call 414d50 1632->1635 1635->1625 1638 415b3c-415b88 call 414b30 * 3 1635->1638 1645 415b92-415b9a 1638->1645 1646 415b8a-415b8f 1638->1646 1647 415ba4-415bb6 1645->1647 1648 415b9c-415ba1 1645->1648 1646->1645 1649 415bc4-415bcc 1647->1649 1650 415bb8-415bc0 1647->1650 1648->1647 1651 415bda-415c4e call 415740 1649->1651 1652 415bce-415bd6 1649->1652 1650->1649 1657 415c56-415c5e 1651->1657 1652->1651 1658 415c60-415c65 1657->1658 1659 415c93 1657->1659 1658->1659 1661 415c67-415c83 call 414dc0 call 414f60 1658->1661 1660 415c95-415c9e 1659->1660 1663 415ca0-415ca9 call 414b50 1660->1663 1664 415cb2-415cd0 1660->1664 1675 415c85-415c89 1661->1675 1677 415edf-415ee5 1663->1677 1678 415caf 1663->1678 1667 415cd2-415cd4 call 414e80 1664->1667 1668 415cdd-415ce5 1664->1668 1679 415cd9 1667->1679 1669 415d05-415d0f 1668->1669 1670 415ce7-415cec 1668->1670 1669->1657 1676 415d15-415d17 1669->1676 1673 415cf8-415d03 1670->1673 1674 415cee-415cf6 1670->1674 1673->1660 1673->1669 1674->1669 1674->1673 1680 415ebb-415edc call 4157a0 1675->1680 1681 415c8f 1675->1681 1682 415d20-415d2d 1676->1682 1683 415d19-415d1e 1676->1683 1684 415ee7-415ee9 call 414df0 1677->1684 1685 415efa 1677->1685 1678->1664 1679->1668 1681->1659 1687 415d2f-415d41 call 416080 1682->1687 1683->1687 1692 415eee-415ef0 1684->1692 1689 415efc-415f20 call 4157a0 1685->1689 1698 415d47-415d4e 1687->1698 1699 415eae-415eb6 1687->1699 1695 415f23-415f25 1692->1695 1696 415ef2-415ef8 1692->1696 1695->1689 1696->1684 1696->1685 1700 415d50-415d53 1698->1700 1701 415d55 1698->1701 1699->1657 1702 415d58 1700->1702 1701->1702 1703 415d60-415d65 1702->1703 1704 415d74-415d8f 1703->1704 1705 415d67-415d6e call 414b50 1703->1705 1704->1703 1707 415d91-415daa 1704->1707 1705->1704 1711 415f27-415f4e call 4157a0 1705->1711 1709 415db3-415dcf 1707->1709 1710 415dac-415db1 1707->1710 1712 415df1-415e07 1709->1712 1713 415dd1-415dd4 1709->1713 1710->1709 1716 415e09-415e0c 1712->1716 1717 415e2b-415e41 1712->1717 1713->1712 1715 415dd6-415dd8 call 414df0 1713->1715 1724 415ddd-415ddf 1715->1724 1716->1717 1722 415e0e 1716->1722 1719 415e63-415e7b 1717->1719 1720 415e43-415e46 1717->1720 1725 415e9d-415ea9 1719->1725 1726 415e7d-415e80 1719->1726 1720->1719 1723 415e48-415e4a call 414df0 1720->1723 1727 415e10-415e12 call 414df0 1722->1727 1735 415e4f-415e51 1723->1735 1730 415f51-415f5f call 42d9e5 1724->1730 1731 415de5-415deb 1724->1731 1725->1657 1726->1725 1732 415e82-415e8b call 414df0 1726->1732 1733 415e17-415e19 1727->1733 1738 415f64-415f72 call 42d9e5 1730->1738 1731->1715 1736 415ded 1731->1736 1743 415e91-415e97 1732->1743 1744 415f8a-415f98 call 42d9e5 1732->1744 1733->1738 1739 415e1f-415e25 1733->1739 1740 415f77-415f85 call 42d9e5 1735->1740 1741 415e57-415e5d 1735->1741 1736->1712 1738->1740 1739->1727 1745 415e27 1739->1745 1740->1744 1741->1723 1748 415e5f 1741->1748 1743->1732 1749 415e99 1743->1749 1744->1621 1745->1717 1748->1719 1749->1725
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: c22077e6261d0ce50dc2a4e52b14bd537c44690fc40115488985def5f82b3dc1
                                                                          • Instruction ID: c83496670c431ab4ea79856a4b507278c9c29364285cad59d9c6f3676edfd229
                                                                          • Opcode Fuzzy Hash: c22077e6261d0ce50dc2a4e52b14bd537c44690fc40115488985def5f82b3dc1
                                                                          • Instruction Fuzzy Hash: 4C026E71604B40CFCB20DF29D480696B7E1FFC9314F148A5EE89A8B346D738E985CB99
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00406920 Relevance: 6.1, APIs: 4, Instructions: 83filetimeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,02000000,00000000,4A67CDA7,00000004,?,?,?), ref: 00406962
                                                                          • CreateFileW.KERNEL32(4A67CDA7,40000000,00000003,00000000,00000003,02000000,00000000,?,00000000,00000004), ref: 004069BA
                                                                          • SetFileTime.KERNELBASE(00000000,00000000,00000000,?,?,40000000,00000003,00000000,00000003,02000000,00000000,4A67CDA7,00000004,?,?,?), ref: 004069E0
                                                                          • CloseHandle.KERNEL32(00000000,?,40000000,00000003,00000000,00000003,02000000,00000000,4A67CDA7,00000004,?,?,?), ref: 004069EC
                                                                            • Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
                                                                            • Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7
                                                                            • Part of subcall function 004081C0: GetCurrentDirectoryW.KERNEL32(00000105,4A67CDA7), ref: 004082B3
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: File$Create$CloseCurrentDirectoryException@8HandleThrowTime_malloc
                                                                          • String ID:
                                                                          • API String ID: 122967144-0
                                                                          • Opcode ID: 4abefc374c4680e747f2d68701bb1e162ba3d43bfcf2598988ba8f17a99620e7
                                                                          • Instruction ID: b3999c9b89675ebd2ae71541746d99067d6c3b718fc365bd41268ac977983332
                                                                          • Opcode Fuzzy Hash: 4abefc374c4680e747f2d68701bb1e162ba3d43bfcf2598988ba8f17a99620e7
                                                                          • Instruction Fuzzy Hash: CE210A71244310BBE2209F25DC45F5B7BDCEB45B70F11062EF555A72D0C7789909CAA9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00421F95 Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __IsNonwritableInCurrentImage.LIBCMT ref: 00421FA8
                                                                            • Part of subcall function 004248C0: __FindPESection.LIBCMT ref: 0042491B
                                                                          • __getptd_noexit.LIBCMT ref: 00421FB8
                                                                          • __freeptd.LIBCMT ref: 00421FC2
                                                                          • ExitThread.KERNEL32 ref: 00421FCB
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
                                                                          • String ID:
                                                                          • API String ID: 3182216644-0
                                                                          • Opcode ID: acf5ac546c9837852431c15dd70e16c76053a486527b636c9cb693f04e975d81
                                                                          • Instruction ID: 75a8cb905a69bf016ed46b0df59a3a75953ea8d07fb7ab818117307767d24168
                                                                          • Opcode Fuzzy Hash: acf5ac546c9837852431c15dd70e16c76053a486527b636c9cb693f04e975d81
                                                                          • Instruction Fuzzy Hash: 70D0EC342206619ADB143B76FE09B1636A99F91755FD50436B914941F1DFEC8880C95C
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041D9C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • DestroyWindow.USER32(?,4A67CDA7,?,?,?,?,0042FE62,000000FF), ref: 0041DA16
                                                                          • DestroyWindow.USER32(?,4A67CDA7,?,?,?,?,0042FE62,000000FF), ref: 0041DA33
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: DestroyWindow
                                                                          • String ID: 0A
                                                                          • API String ID: 3375834691-2007828011
                                                                          • Opcode ID: 161837be4814b510d9902a9e6e63a5e35f8b1e2428d35ecccc6011dd03927949
                                                                          • Instruction ID: 742c35474aecbc2d495c618619e94c506e51131d9200873e0cf2b397f01be0b8
                                                                          • Opcode Fuzzy Hash: 161837be4814b510d9902a9e6e63a5e35f8b1e2428d35ecccc6011dd03927949
                                                                          • Instruction Fuzzy Hash: BA31ABB1604B018BC720DFB9D884B87BBE8AF48704F04891DE595CB351D779F808CBA5
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00408740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SysAllocString.OLEAUT32(?), ref: 00408766
                                                                          • __CxxThrowException@8.LIBCMT ref: 00408789
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AllocException@8StringThrow
                                                                          • String ID: out of memory
                                                                          • API String ID: 1617264723-2599737071
                                                                          • Opcode ID: 1ed9c45135ccbe0afddda232c66c0b4c97afda0b6637c0bc8184c57e8a2482c2
                                                                          • Instruction ID: b06795632af80c0f3b2f60a81ac9b2924824ca72a0d9e76516643deceff84f38
                                                                          • Opcode Fuzzy Hash: 1ed9c45135ccbe0afddda232c66c0b4c97afda0b6637c0bc8184c57e8a2482c2
                                                                          • Instruction Fuzzy Hash: DCF03965210B029AD7589F269E45617B2E4AF98748F24D83FE9DAC3690FF78C944830E
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041CF10 Relevance: 4.6, APIs: 3, Instructions: 130timeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetFileTime.KERNELBASE(?,00000000,00000000,?), ref: 0041D02F
                                                                          • FindCloseChangeNotification.KERNELBASE(?), ref: 0041D044
                                                                          • GetLastError.KERNEL32 ref: 0041D056
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ChangeCloseErrorFileFindLastNotificationTime
                                                                          • String ID:
                                                                          • API String ID: 3673273941-0
                                                                          • Opcode ID: 598afc9bdab16a93d3b10089d4ba35f6cb7ea56aac1ec8cc64db83f033a8fef5
                                                                          • Instruction ID: c12e9f6ba34e0cb75690c4241fdf9b3d4b5867d1a81a83578a9db8fa05c906e5
                                                                          • Opcode Fuzzy Hash: 598afc9bdab16a93d3b10089d4ba35f6cb7ea56aac1ec8cc64db83f033a8fef5
                                                                          • Instruction Fuzzy Hash: EE4160B16407409FE720DB79C884BD3B7E5AB89318F144A1EE19A873A1C779E8C6C758
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004083B0 Relevance: 4.6, APIs: 3, Instructions: 88fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CloseHandle.KERNEL32(?,4A67CDA7,00000000,?,80000000,00000001,00000000), ref: 004083DD
                                                                          • CreateFileW.KERNELBASE(?,?,?,00000000,00000003,00000080,00000000,4A67CDA7,00000000,?,80000000,00000001,00000000), ref: 00408410
                                                                          • CreateFileW.KERNEL32(?,?,?,00000000,00000003,00000080,00000000), ref: 0040846E
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CreateFile$CloseHandle
                                                                          • String ID:
                                                                          • API String ID: 1443461169-0
                                                                          • Opcode ID: a958eb1727f0773fe12240db7343fd6a6dfe216b9791fc289c98b5276d088d7d
                                                                          • Instruction ID: ea8c27ecf3da15231cfb0a4b39e97664de59f0c511d558578ac63eaab3307ad4
                                                                          • Opcode Fuzzy Hash: a958eb1727f0773fe12240db7343fd6a6dfe216b9791fc289c98b5276d088d7d
                                                                          • Instruction Fuzzy Hash: 98315CB1608711AFD210DF24DC45B5BBBE8EB89774F104B2EF5A4A32D0DB74A904CB99
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00406BC0 Relevance: 4.6, APIs: 3, Instructions: 71COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateDirectoryW.KERNELBASE(?,00000000,4A67CDA7,?,?,00000000,4A67CDA7,?,?,?), ref: 00406BF5
                                                                          • GetLastError.KERNEL32(?,?), ref: 00406BFF
                                                                          • CreateDirectoryW.KERNEL32(?,00000000,?,?,00000004,?,?), ref: 00406C45
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CreateDirectory$ErrorLast
                                                                          • String ID:
                                                                          • API String ID: 2485089472-0
                                                                          • Opcode ID: 56a95a43980192e959b2e4b50370b07096a6e7883afc364f6167491118b5c463
                                                                          • Instruction ID: 59b7f8852602325ad3b7576acbac00231ee3a5ddb581369b778845d7921f0455
                                                                          • Opcode Fuzzy Hash: 56a95a43980192e959b2e4b50370b07096a6e7883afc364f6167491118b5c463
                                                                          • Instruction Fuzzy Hash: C01105B15083449FD200EF259C81A5BB7A8FB85364F510A3EF595A32D0C738E909CBAA
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00413C10 Relevance: 4.6, APIs: 3, Instructions: 69COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetFilePointer.KERNELBASE(?,?,?,?), ref: 00413C4C
                                                                          • GetLastError.KERNEL32 ref: 00413C61
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorFileLastPointer
                                                                          • String ID:
                                                                          • API String ID: 2976181284-0
                                                                          • Opcode ID: 6b7253807f8ef255e98dfbf493882eb9d2fc15aa48d8ac2fa26197f0956bf59b
                                                                          • Instruction ID: e59b8c6c9d207f6d54cab4becb255c60ffc16cf7df699e343ca3dfbb7fc882c3
                                                                          • Opcode Fuzzy Hash: 6b7253807f8ef255e98dfbf493882eb9d2fc15aa48d8ac2fa26197f0956bf59b
                                                                          • Instruction Fuzzy Hash: 7011B17761120A4B8710CE6CE8409AB7798AB85321F10822BED18D7350E236D95997E5
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004051F0 Relevance: 4.6, APIs: 3, Instructions: 58COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __CxxThrowException@8.LIBCMT ref: 00405214
                                                                            • Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27
                                                                          • __CxxThrowException@8.LIBCMT ref: 0040523E
                                                                          • __CxxThrowException@8.LIBCMT ref: 00405268
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw$ExceptionRaise
                                                                          • String ID:
                                                                          • API String ID: 3476068407-0
                                                                          • Opcode ID: 93f21f90a24a6d79e60d0ce691905b085430826ee26feee9bb30897c4dfec070
                                                                          • Instruction ID: 2a8572daa85d10c4884425167270a8e47683ed821fa1c2661b0350afdfb93438
                                                                          • Opcode Fuzzy Hash: 93f21f90a24a6d79e60d0ce691905b085430826ee26feee9bb30897c4dfec070
                                                                          • Instruction Fuzzy Hash: 1F1191B1704F005FC318EF66D89192BF3D9AF98304B50C82EF49A92281E778E8448F15
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00414C40 Relevance: 3.8, APIs: 3, Instructions: 67COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • EnterCriticalSection.KERNEL32(?,4A67CDA7,?,?,?,?,?,0042F7E8,000000FF), ref: 00414C6E
                                                                          • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,0042F7E8,000000FF), ref: 00414C9B
                                                                          • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,0042F7E8,000000FF), ref: 00414CD4
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalSection$Leave$Enter
                                                                          • String ID:
                                                                          • API String ID: 2978645861-0
                                                                          • Opcode ID: 188848c371126ab57bf03bd26e69b33c65c7dd8113ad2cd64a699b042e3b5674
                                                                          • Instruction ID: 4acca2b25c34ca54317f79935144ea5dd27772e4ebcf5dfec4b79ca227a1c604
                                                                          • Opcode Fuzzy Hash: 188848c371126ab57bf03bd26e69b33c65c7dd8113ad2cd64a699b042e3b5674
                                                                          • Instruction Fuzzy Hash: 8A11067A204640AFD304CB48D980F6BB7E9FFC8A20F60452AFA15D3350D775A905CBA5
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004079A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetTempFileNameW.KERNELBASE(00000000,mia,00000000,?,00000000,4A67CDA7,00407AD3,4A67CDA7,00000004,4A67CDA7,00000000,?,?,00000000,?), ref: 004079CE
                                                                            • Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
                                                                            • Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8FileNameTempThrow_malloc
                                                                          • String ID: mia
                                                                          • API String ID: 739282062-834928705
                                                                          • Opcode ID: 85ed890860e913ee20a6726b8fb2430cbd5c8761302e1e886de3ef44df40c26c
                                                                          • Instruction ID: e059b37136ce9a7132ddeb773af8d25e1d362e9c040abae9839df66ee31215f0
                                                                          • Opcode Fuzzy Hash: 85ed890860e913ee20a6726b8fb2430cbd5c8761302e1e886de3ef44df40c26c
                                                                          • Instruction Fuzzy Hash: 9FF082B2A046005AE324DB2CD802B57B3F6EF94710F25883BE180E32D4E7B4B8918759
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040E3F0 Relevance: 3.2, APIs: 2, Instructions: 198COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw_malloc
                                                                          • String ID:
                                                                          • API String ID: 3476970888-0
                                                                          • Opcode ID: 00de60611b3a96967887767fc9f4685b619d8754863df02162bc914e3ce1103d
                                                                          • Instruction ID: 2ce8f76c52d71ee6ea90f967cf5ac0dc49b3900ca87f21fdd147f9ed563b7727
                                                                          • Opcode Fuzzy Hash: 00de60611b3a96967887767fc9f4685b619d8754863df02162bc914e3ce1103d
                                                                          • Instruction Fuzzy Hash: AE61A3716083009BC724DF69D88072BB7E5BB89318F540E2EF995A7381E739E855CB4A
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00406A10 Relevance: 3.1, APIs: 2, Instructions: 80COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetFileAttributesW.KERNELBASE(?,00000000,4A67CDA7,?,?,00000000,00430508,000000FF,00407419), ref: 00406A40
                                                                          • SetFileAttributesW.KERNEL32(4A67CDA7,00000000), ref: 00406A9B
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AttributesFile
                                                                          • String ID:
                                                                          • API String ID: 3188754299-0
                                                                          • Opcode ID: 187a544e7858a3dfb482a7e8ec67af794a0d5a5258aeab4042801e34d4edc5c8
                                                                          • Instruction ID: 6e6e9d07e5e1d0b40351bad84d41fbed830de9d4b3b2563167fee72041689f41
                                                                          • Opcode Fuzzy Hash: 187a544e7858a3dfb482a7e8ec67af794a0d5a5258aeab4042801e34d4edc5c8
                                                                          • Instruction Fuzzy Hash: 7721B6B26087419FD710EF64AC41B5BB7D4FB85720F440A2EF955933C0D739A909CBA6
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00406B00 Relevance: 3.1, APIs: 2, Instructions: 66COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • RemoveDirectoryW.KERNELBASE(?,4A67CDA7,00000000,?,?,00000000,000000FF,00407425,00000000), ref: 00406B32
                                                                          • RemoveDirectoryW.KERNELBASE(?,?,?,00000004,?,00000000,000000FF,00407425,00000000), ref: 00406B76
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: DirectoryRemove
                                                                          • String ID:
                                                                          • API String ID: 597925465-0
                                                                          • Opcode ID: ac1f213a70f12f41f1bb15f4098679eba2acecc486c30517d39d7b2e6ffdfcb2
                                                                          • Instruction ID: f8b0e0ce4887a377146ac5a6f91a43faa227c917df174c811a8712e04894c35a
                                                                          • Opcode Fuzzy Hash: ac1f213a70f12f41f1bb15f4098679eba2acecc486c30517d39d7b2e6ffdfcb2
                                                                          • Instruction Fuzzy Hash: B811E7B25043509BC200EF559C41A5BB7A8FB85360F500A3EF591A33C1D73DA909CBAA
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041DF90 Relevance: 3.1, APIs: 2, Instructions: 57synchronizationwindowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • WaitForSingleObject.KERNEL32(?,000000FF,4A67CDA7), ref: 0041DFDF
                                                                          • PostMessageW.USER32(00000001,00008000,00000000,00000000), ref: 0041DFF5
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: MessageObjectPostSingleWait
                                                                          • String ID:
                                                                          • API String ID: 1869837590-0
                                                                          • Opcode ID: 0ae074bdfef50da82f8f66b7cc14cb3ca0f2355ec82bfaede708d9a8856dc369
                                                                          • Instruction ID: 67b44cf236718e77661c825e43d0bc0602f7586151c5710897ab21da0a41314e
                                                                          • Opcode Fuzzy Hash: 0ae074bdfef50da82f8f66b7cc14cb3ca0f2355ec82bfaede708d9a8856dc369
                                                                          • Instruction Fuzzy Hash: 2A11A3B2A08788EFD710CF99D944B9AFBF8EB09764F10426FE91593780C7756904C7A4
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00404E70 Relevance: 3.0, APIs: 2, Instructions: 46COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 00404E89
                                                                            • Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
                                                                            • Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
                                                                            • Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42
                                                                          • __CxxThrowException@8.LIBCMT ref: 00404EA7
                                                                            • Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
                                                                          • String ID:
                                                                          • API String ID: 2732643326-0
                                                                          • Opcode ID: 6bd8fd08a92474bdf1f489356f990fc19856af292f4c7f69916532a116e51352
                                                                          • Instruction ID: a8e9cb405463b2bfb29194c4a7db1ddf7ad65b7b3f345e2b191dc1a639ec63bb
                                                                          • Opcode Fuzzy Hash: 6bd8fd08a92474bdf1f489356f990fc19856af292f4c7f69916532a116e51352
                                                                          • Instruction Fuzzy Hash: 2801BCB06007019AC720DF69D842627F3E4BFD8304F10883EE59AC33A1EB39E465CB46
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00413D40 Relevance: 3.0, APIs: 2, Instructions: 39fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • WriteFile.KERNELBASE(?,?,?,?,?,?,?,?,00000000), ref: 00413D6E
                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 00413D98
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorFileLastWrite
                                                                          • String ID:
                                                                          • API String ID: 442123175-0
                                                                          • Opcode ID: e3304a8171667333fdaac178f79259fccf236578ad01ac04bc50c7c63b81fbe9
                                                                          • Instruction ID: 46ffd835ac929a46f1b1754ee70f3be117443b79a1282e0e598ca55ed5e1d04d
                                                                          • Opcode Fuzzy Hash: e3304a8171667333fdaac178f79259fccf236578ad01ac04bc50c7c63b81fbe9
                                                                          • Instruction Fuzzy Hash: 690162352043029BD350CF18E944BA777E4AF84705F00892EE559D6250D378DD48CB6A
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00413BA0 Relevance: 3.0, APIs: 2, Instructions: 35fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ReadFile.KERNELBASE(?,?,?,?,?,?,?,?,00000000), ref: 00413BCD
                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00413BEF
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorFileLastRead
                                                                          • String ID:
                                                                          • API String ID: 1948546556-0
                                                                          • Opcode ID: 82dd4830fae7e60dd82e4e8a08d870d85d8bd823a9d0dc89f859ae175ffd171e
                                                                          • Instruction ID: 31285fa28142ff3eda2036dbb8780ef0364bf7388d3a88ddde29d243f6d0e8ff
                                                                          • Opcode Fuzzy Hash: 82dd4830fae7e60dd82e4e8a08d870d85d8bd823a9d0dc89f859ae175ffd171e
                                                                          • Instruction Fuzzy Hash: 22F06D792082029BD304CF18C844B6BB7E4BBC4305F00C92EF595DB391E779E948DB69
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041BE50 Relevance: 3.0, APIs: 2, Instructions: 33timeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • KillTimer.USER32(?,?), ref: 0041BE68
                                                                          • KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 0041BE9C
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CallbackDispatcherKillTimerUser
                                                                          • String ID:
                                                                          • API String ID: 45433635-0
                                                                          • Opcode ID: ddf1266d2bd96984e55c2111573cec84cd69dacffde2e565b4b5898f6a62966f
                                                                          • Instruction ID: 00470ecef782a90aa5a81525347fb0470b9370af0cd53691b1602fb172eecf1e
                                                                          • Opcode Fuzzy Hash: ddf1266d2bd96984e55c2111573cec84cd69dacffde2e565b4b5898f6a62966f
                                                                          • Instruction Fuzzy Hash: DDF067722047409BD324DB18E844FABB7E9ABE4714F00491EF98247290C7B9EC85CBA8
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00421FD2 Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __getptd.LIBCMT ref: 00421FDE
                                                                            • Part of subcall function 004244E3: __getptd_noexit.LIBCMT ref: 004244E6
                                                                            • Part of subcall function 004244E3: __amsg_exit.LIBCMT ref: 004244F3
                                                                            • Part of subcall function 00421F95: __IsNonwritableInCurrentImage.LIBCMT ref: 00421FA8
                                                                            • Part of subcall function 00421F95: __getptd_noexit.LIBCMT ref: 00421FB8
                                                                            • Part of subcall function 00421F95: __freeptd.LIBCMT ref: 00421FC2
                                                                            • Part of subcall function 00421F95: ExitThread.KERNEL32 ref: 00421FCB
                                                                          • __XcptFilter.LIBCMT ref: 00421FFF
                                                                            • Part of subcall function 0042497E: __getptd_noexit.LIBCMT ref: 00424986
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: __getptd_noexit$CurrentExitFilterImageNonwritableThreadXcpt__amsg_exit__freeptd__getptd
                                                                          • String ID:
                                                                          • API String ID: 393088965-0
                                                                          • Opcode ID: 8069cb46053e809ece7fc975d9d4d70a304da6873b102c594fd6ad5f9402eec9
                                                                          • Instruction ID: 225cb1a2493a05b67e88bf7f72ea339520824f6e15ce0439916c389049fd7118
                                                                          • Opcode Fuzzy Hash: 8069cb46053e809ece7fc975d9d4d70a304da6873b102c594fd6ad5f9402eec9
                                                                          • Instruction Fuzzy Hash: C9E0BFB56406149FD718BBA1D906E2D7775DF44309F60004EF1015B2B1CA7999409B18
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041C010 Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetDlgItem.USER32(?,000003E8), ref: 0041C01C
                                                                          • SendMessageW.USER32(?,00000080,00000001,00000000), ref: 0041C032
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ItemMessageSend
                                                                          • String ID:
                                                                          • API String ID: 3015471070-0
                                                                          • Opcode ID: 5de501a1ff413fbe9085e3604fd8fb62ba8ef300bea9de6c68d42dc9b065594f
                                                                          • Instruction ID: b39bce7e1dc77a8742afbb46725aac72f2e371372a91e58acbf060f5fe3c6fef
                                                                          • Opcode Fuzzy Hash: 5de501a1ff413fbe9085e3604fd8fb62ba8ef300bea9de6c68d42dc9b065594f
                                                                          • Instruction Fuzzy Hash: 69D0A77168031067DA604B64FD49F8373D86B0CB01F014A5AF64AD71C0C9F0A4408B08
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00405350 Relevance: 3.0, APIs: 2, Instructions: 14COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 00405352
                                                                            • Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
                                                                            • Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
                                                                            • Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42
                                                                          • __CxxThrowException@8.LIBCMT ref: 0040536E
                                                                            • Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
                                                                          • String ID:
                                                                          • API String ID: 2732643326-0
                                                                          • Opcode ID: 9c2fadfb130e266a98ccff6bb26c568532dfe8a0070e7586c49056718d7968ee
                                                                          • Instruction ID: a602915de48d0db7676f328d3f5172f7efee01bdfe68b84f608bad21c35d458a
                                                                          • Opcode Fuzzy Hash: 9c2fadfb130e266a98ccff6bb26c568532dfe8a0070e7586c49056718d7968ee
                                                                          • Instruction Fuzzy Hash: 2EC012C091534035DD185731BC0296752E84CA5348F51486FB84591142E97CD65D921F
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00423D10 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ___crtCorExitProcess.LIBCMT ref: 00423D18
                                                                            • Part of subcall function 00423CE5: GetModuleHandleW.KERNEL32(mscoree.dll,?,00423D1D,?,?,00421F04,000000FF,0000001E,?,00424AEF,?,00000001,?,?,00422F29,00000018), ref: 00423CEF
                                                                            • Part of subcall function 00423CE5: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00423CFF
                                                                          • ExitProcess.KERNEL32 ref: 00423D21
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ExitProcess$AddressHandleModuleProc___crt
                                                                          • String ID:
                                                                          • API String ID: 2427264223-0
                                                                          • Opcode ID: 413c8b1009435b3ffbe48e234a8bb614a3e7ee2aa3c7bc32ca9ee7a0a1530568
                                                                          • Instruction ID: 7c21544d0a3d036927f1def45caf06a8b18b837482dd20d66ee3204eca29a738
                                                                          • Opcode Fuzzy Hash: 413c8b1009435b3ffbe48e234a8bb614a3e7ee2aa3c7bc32ca9ee7a0a1530568
                                                                          • Instruction Fuzzy Hash: A6B09232000118BBCF022F13EE0A8493F3AEB803A1B514025F90909031DFB7EE92DA98
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041C380 Relevance: 2.6, APIs: 2, Instructions: 73COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • EnterCriticalSection.KERNEL32(?,4A67CDA7,?,?,?,?,?,0042F7E8,000000FF,0041C7EE,?,?), ref: 0041C3AC
                                                                          • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,0042F7E8,000000FF,0041C7EE,?,?), ref: 0041C427
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalSection$EnterLeave
                                                                          • String ID:
                                                                          • API String ID: 3168844106-0
                                                                          • Opcode ID: fd4df8d3fcbbb8da80bc25aa3a6ee8a0f33404e5326e133e9b1a93824fd3a48b
                                                                          • Instruction ID: 793c60a82a3897cbea006ef7a6d765e9df0119faf799fe96586615b7e53cdcb1
                                                                          • Opcode Fuzzy Hash: fd4df8d3fcbbb8da80bc25aa3a6ee8a0f33404e5326e133e9b1a93824fd3a48b
                                                                          • Instruction Fuzzy Hash: 4A21F4BA604A00AFC318DF19DA81A6BB3FAFF8C710B50491EF54693B60D774B845CB65
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041C450 Relevance: 2.6, APIs: 2, Instructions: 72COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • EnterCriticalSection.KERNEL32(?,4A67CDA7,?,?,?,?,?,0042F7E8,000000FF,0041C82F,?,?), ref: 0041C47C
                                                                          • LeaveCriticalSection.KERNEL32(?,?,?,?,?,0042F7E8,000000FF,0041C82F,?,?), ref: 0041C4F9
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalSection$EnterLeave
                                                                          • String ID:
                                                                          • API String ID: 3168844106-0
                                                                          • Opcode ID: 804f14f6e22a247da375789de95732f2e138cad818d84c02829c3f8a1e5d6830
                                                                          • Instruction ID: 745e08ec57bfe2d81673155d5771ce654260503d44a53da57d59fe68b26565c1
                                                                          • Opcode Fuzzy Hash: 804f14f6e22a247da375789de95732f2e138cad818d84c02829c3f8a1e5d6830
                                                                          • Instruction Fuzzy Hash: 2321F2BA200A00AFC314DF19DA81A6BB3FAFB8D710F50491DE68293B50D774B805CBA1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00414AC0 Relevance: 2.5, APIs: 2, Instructions: 43memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • VirtualFree.KERNEL32(?,00000000,00008000,?,00415AD1,4A67CDA7), ref: 00414AE9
                                                                          • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,00415AD1,4A67CDA7), ref: 00414B17
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Virtual$AllocFree
                                                                          • String ID:
                                                                          • API String ID: 2087232378-0
                                                                          • Opcode ID: 7819856d66b5851ede3f9bdef5d93ae2c7799b9db804b66b9b6b4ab617a870bd
                                                                          • Instruction ID: 3f647bf7e0689e73f0432b280dd933d7141cac813072c7c94ae20007a4340fe1
                                                                          • Opcode Fuzzy Hash: 7819856d66b5851ede3f9bdef5d93ae2c7799b9db804b66b9b6b4ab617a870bd
                                                                          • Instruction Fuzzy Hash: 8CF0F63168072267DB608E25EC457C777986F447A4F128526F524D73C0C7A4ECD28BD8
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00414D50 Relevance: 2.5, APIs: 2, Instructions: 43memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • VirtualFree.KERNEL32(?,00000000,00008000,?,00415B38,4A67CDA7), ref: 00414D78
                                                                          • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,00415B38,4A67CDA7), ref: 00414DA4
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Virtual$AllocFree
                                                                          • String ID:
                                                                          • API String ID: 2087232378-0
                                                                          • Opcode ID: 37fe2aa6ff23e776cda0949a660b7ad76bdcf7dc678ab92d592f4fa13fe7be67
                                                                          • Instruction ID: 8e2800784cee38b2061e6fe60721290af1e5f1d33f89dcf86bc39648f11f61cb
                                                                          • Opcode Fuzzy Hash: 37fe2aa6ff23e776cda0949a660b7ad76bdcf7dc678ab92d592f4fa13fe7be67
                                                                          • Instruction Fuzzy Hash: EBF0907164072357EF604F38BD057C637A86B45B61F110026F951DB3C0D7A498D28B98
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004080C0 Relevance: 1.6, APIs: 1, Instructions: 78fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FindNextFileW.KERNELBASE(4A67CDA7,?,?,00000000), ref: 004080ED
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: FileFindNext
                                                                          • String ID:
                                                                          • API String ID: 2029273394-0
                                                                          • Opcode ID: 4e98acda21bc520af0750d45f365bcf612b41177028bb51abe9b2f04225e281f
                                                                          • Instruction ID: 0ac86ba7e6036cb0bca20b54e3df52c499b184387ab912897b1ff671fb7c457c
                                                                          • Opcode Fuzzy Hash: 4e98acda21bc520af0750d45f365bcf612b41177028bb51abe9b2f04225e281f
                                                                          • Instruction Fuzzy Hash: EE2161706097419FC724DF25D981A6BB7E1BF88304F40892EE5D987381D739F80ACB56
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041BCF0 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0041BD4F
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend
                                                                          • String ID:
                                                                          • API String ID: 3850602802-0
                                                                          • Opcode ID: 3e934bf6b8fda8c9455b302bff1661e1d9bd3881a9536dc17bef4322b8786aa9
                                                                          • Instruction ID: 2b345634289db81ae9c8ad967e6cfd939ec9b3350c734fd0bd0422c7a7e865b1
                                                                          • Opcode Fuzzy Hash: 3e934bf6b8fda8c9455b302bff1661e1d9bd3881a9536dc17bef4322b8786aa9
                                                                          • Instruction Fuzzy Hash: 3C01B1B1700B166BC71CAE64E6C0D9EF395FB44750B50842AE20183B41C779F891CBDC
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00414E80 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __CxxThrowException@8.LIBCMT ref: 00414EB2
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw
                                                                          • String ID:
                                                                          • API String ID: 2005118841-0
                                                                          • Opcode ID: ab7e41e99244f33ed92de240ba7b8afb81cc21cbac62c036d2481108839cb380
                                                                          • Instruction ID: 7f677e2a0d96dd042953974e68f50ffb109c9cca23682643b4d14ef79ff7504b
                                                                          • Opcode Fuzzy Hash: ab7e41e99244f33ed92de240ba7b8afb81cc21cbac62c036d2481108839cb380
                                                                          • Instruction Fuzzy Hash: 16F090715007105B8720EB69E8418CBB3E5AE80320B20CD1EF4AE83980E738FC818B6D
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00408520 Relevance: 1.5, APIs: 1, Instructions: 40fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ReadFile.KERNELBASE(?,?,?,?,00000000,00000000,?,00000000,0041F8ED,?,00001000,?,80000000,00000001,4A67CDA7,?), ref: 0040855C
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: FileRead
                                                                          • String ID:
                                                                          • API String ID: 2738559852-0
                                                                          • Opcode ID: 2621b06c5321a8c3f0fd18990958dce362ec427473b39e7e457abe834a3f0343
                                                                          • Instruction ID: f39ee7e7f60ea532393ae8b1daf0349f663640ccd44f9b94e31dfc72485cb8ec
                                                                          • Opcode Fuzzy Hash: 2621b06c5321a8c3f0fd18990958dce362ec427473b39e7e457abe834a3f0343
                                                                          • Instruction Fuzzy Hash: 15F06D722043066BC754DE49E980B2BB3E8ABE8310F10443EF284D7280EB75A849C779
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00407510 Relevance: 1.5, APIs: 1, Instructions: 37COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetShortPathNameW.KERNELBASE(?,?,00000105), ref: 0040753C
                                                                            • Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
                                                                            • Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8NamePathShortThrow_malloc
                                                                          • String ID:
                                                                          • API String ID: 2966644318-0
                                                                          • Opcode ID: 572c1ff56df4c723897f1b5f8077861ec5bcd5b1864dcfcf38f0de8c29b59959
                                                                          • Instruction ID: 803da70797d6faa53c3d6321105406aed6117c351dfe0607d1041baaf81b07e9
                                                                          • Opcode Fuzzy Hash: 572c1ff56df4c723897f1b5f8077861ec5bcd5b1864dcfcf38f0de8c29b59959
                                                                          • Instruction Fuzzy Hash: 14F0B471A046005BE324DB3CD815997B3F6EF98710B24843FE186E7AD0F7B4A8D28745
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00416790 Relevance: 1.5, APIs: 1, Instructions: 37COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 09be56aac9fe1bcd87d90f05d3fd35e2e31454c41ff1b78bfbc62eebb49b2b9e
                                                                          • Instruction ID: b0f22ba89bf6f4baeb6bc1cea3b70d90dd13a4c9dd67412f4e94cd6d2aa3cb97
                                                                          • Opcode Fuzzy Hash: 09be56aac9fe1bcd87d90f05d3fd35e2e31454c41ff1b78bfbc62eebb49b2b9e
                                                                          • Instruction Fuzzy Hash: 1BF09672104151DAD760D719A840FDBB3E09BA0324F02882FF5558A2A0C23DDDD5CB99
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00407940 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,?,00000004,00407A91,00000004,4A67CDA7,00000000,?,?,00000000,?,?,00000000), ref: 00407969
                                                                            • Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
                                                                            • Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8FolderPathThrow_malloc
                                                                          • String ID:
                                                                          • API String ID: 2862337592-0
                                                                          • Opcode ID: 34f6f5cb213bffc77dfebc8498b2f279899a3604e67780ddcea719c6106339d9
                                                                          • Instruction ID: 46fce7617049bad6f137b75ed99042ad9b7eccbfa9cfcc549d31155430e20db5
                                                                          • Opcode Fuzzy Hash: 34f6f5cb213bffc77dfebc8498b2f279899a3604e67780ddcea719c6106339d9
                                                                          • Instruction Fuzzy Hash: 03F0A7716042105BF770AF28DC41B5773E1EF08310F24447BE986DF2D0D6B969C18B59
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00407F40 Relevance: 1.5, APIs: 1, Instructions: 31COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00407E20: FindClose.KERNEL32(?,4A67CDA7,?,?), ref: 00407E70
                                                                            • Part of subcall function 00407E20: FindFirstFileW.KERNELBASE(?,?,4A67CDA7,?,?), ref: 00407E8A
                                                                            • Part of subcall function 00407E20: FindFirstFileW.KERNELBASE(?,?), ref: 00407EDE
                                                                          • FindClose.KERNEL32(FFFFFFFF,?,4A67CDA7,00000000,?,?,00430488,000000FF,00418955,?), ref: 00407F8E
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Find$CloseFileFirst
                                                                          • String ID:
                                                                          • API String ID: 2295610775-0
                                                                          • Opcode ID: 2546e1c02685e61960b6156f213b1b43b7edd20205f17317a08b49c00ca059c2
                                                                          • Instruction ID: dddce3a9af92c8c3231f840ac9d95d7011c8770734e059ed718bfb036d1edd7c
                                                                          • Opcode Fuzzy Hash: 2546e1c02685e61960b6156f213b1b43b7edd20205f17317a08b49c00ca059c2
                                                                          • Instruction Fuzzy Hash: 65F06DB5508740AFD304CF18C885B57B7E8E759330F108B2EF869833D0D738A8098A66
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00417040 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: _malloc
                                                                          • String ID:
                                                                          • API String ID: 1579825452-0
                                                                          • Opcode ID: db1c2a274b80fe3cab9964bc48ea42ac3ec852d3d6926aa7facd0bd6a5778cb0
                                                                          • Instruction ID: 7602617d1c0ce983adb61dbcf89cd8959781196aaff58d124a315e77f73bd1bc
                                                                          • Opcode Fuzzy Hash: db1c2a274b80fe3cab9964bc48ea42ac3ec852d3d6926aa7facd0bd6a5778cb0
                                                                          • Instruction Fuzzy Hash: 92E0EDB060470187DB30CB359891B9377EA7F54344F54892EA89EC7614EB39F884C71A
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00422DF3 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00422E08
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CreateHeap
                                                                          • String ID:
                                                                          • API String ID: 10892065-0
                                                                          • Opcode ID: 2366ed851773c368dff311633043479c6c90e4a138c4d4a9eb2632cbacb2a32f
                                                                          • Instruction ID: 86aee0bac0538ae6b76e20c7bf6ff8a860abe30deba9c378a37622715fe1d8de
                                                                          • Opcode Fuzzy Hash: 2366ed851773c368dff311633043479c6c90e4a138c4d4a9eb2632cbacb2a32f
                                                                          • Instruction Fuzzy Hash: E7D05E766603046FDB105F717E097233BEC9394395F40443AB90CC6190E5B4C9509608
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00423F2C Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _doexit.LIBCMT ref: 00423F38
                                                                            • Part of subcall function 00423E00: __lock.LIBCMT ref: 00423E0E
                                                                            • Part of subcall function 00423E00: __decode_pointer.LIBCMT ref: 00423E45
                                                                            • Part of subcall function 00423E00: __decode_pointer.LIBCMT ref: 00423E5A
                                                                            • Part of subcall function 00423E00: __decode_pointer.LIBCMT ref: 00423E84
                                                                            • Part of subcall function 00423E00: __decode_pointer.LIBCMT ref: 00423E9A
                                                                            • Part of subcall function 00423E00: __decode_pointer.LIBCMT ref: 00423EA7
                                                                            • Part of subcall function 00423E00: __initterm.LIBCMT ref: 00423ED6
                                                                            • Part of subcall function 00423E00: __initterm.LIBCMT ref: 00423EE6
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: __decode_pointer$__initterm$__lock_doexit
                                                                          • String ID:
                                                                          • API String ID: 1597249276-0
                                                                          • Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
                                                                          • Instruction ID: fa2e777966923ff6dfc8112d92b190de78b5184cf570968b1206adc42845c334
                                                                          • Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
                                                                          • Instruction Fuzzy Hash: FAB0927268020833DA202A42BC03F063E1A87C0B68E660021BA0C295A2A9A6AA6580C9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004166A0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: _malloc
                                                                          • String ID:
                                                                          • API String ID: 1579825452-0
                                                                          • Opcode ID: 9cafb99de2f3493ce3e7878a8b0fea2fc32f41290bda0b55f0f2156e21cf90c1
                                                                          • Instruction ID: d347abebaf0359f5fa1359167306a0a34dd3417ef1332786ed79c0e5b6877914
                                                                          • Opcode Fuzzy Hash: 9cafb99de2f3493ce3e7878a8b0fea2fc32f41290bda0b55f0f2156e21cf90c1
                                                                          • Instruction Fuzzy Hash: 1FB012BEB0020112D970F921BC41D57B2D83FB0785B85882BB8C8C1120F228E87CC22A
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00415640 Relevance: 1.3, APIs: 1, Instructions: 34COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • VirtualFree.KERNELBASE(?,00000000,00008000,4A67CDA7,?,?,0042EE5B,000000FF), ref: 0041567C
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: FreeVirtual
                                                                          • String ID:
                                                                          • API String ID: 1263568516-0
                                                                          • Opcode ID: eda4174a4717431e7e9f737c7c7dbf923edcdc2d68691a2a456201ebbdb4da49
                                                                          • Instruction ID: 6eac19e29b5bad37f342a6201f77cddbe98d170c480904c3d704713a42110b49
                                                                          • Opcode Fuzzy Hash: eda4174a4717431e7e9f737c7c7dbf923edcdc2d68691a2a456201ebbdb4da49
                                                                          • Instruction Fuzzy Hash: E6F01975604B41DFD320CF19D884B53B7E8FB88B20F508A19E5A9877D0D779E844CB95
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004156C0 Relevance: 1.3, APIs: 1, Instructions: 34COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • VirtualFree.KERNELBASE(?,00000000,00008000,4A67CDA7,?,?,0042EE2B,000000FF), ref: 004156FB
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: FreeVirtual
                                                                          • String ID:
                                                                          • API String ID: 1263568516-0
                                                                          • Opcode ID: c87a56866fa1b47c1608489e454f44b453adb3a14ab80ec470fbf3b0ce0cf926
                                                                          • Instruction ID: 7a31c48fe41f0245d7057249d72feef9ac66eab8aee5c8a5e621aac5e61e55c5
                                                                          • Opcode Fuzzy Hash: c87a56866fa1b47c1608489e454f44b453adb3a14ab80ec470fbf3b0ce0cf926
                                                                          • Instruction Fuzzy Hash: 6CF01475604B81DFD720CF18D881B53B7E8FB88B20F204A29E9A5873D0D779E844CB95
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00415410 Relevance: 1.3, APIs: 1, Instructions: 23COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLast
                                                                          • String ID:
                                                                          • API String ID: 1452528299-0
                                                                          • Opcode ID: d2ddbbd5ed56630edbf359f3a6a23b87cf336805f66c5b382b2410dfdd830d39
                                                                          • Instruction ID: 96464189ef5ab4881843a27eb04bb39dfb4e36e9bcfaf951d4a3f0df901096ff
                                                                          • Opcode Fuzzy Hash: d2ddbbd5ed56630edbf359f3a6a23b87cf336805f66c5b382b2410dfdd830d39
                                                                          • Instruction Fuzzy Hash: FFE0C2B13042016BF3249B749C45FA7339CAB90705F20403EB606D91C0EAA4E890C22D
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Non-executed Functions

                                                                          Function 00409180 Relevance: 45.1, APIs: 24, Strings: 1, Instructions: 1315COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: _malloc$Exception@8Throw$CriticalDeleteSection
                                                                          • String ID: 8@C
                                                                          • API String ID: 4184010672-3398775317
                                                                          • Opcode ID: 4c5b3bca666bce3093585746d5be962a3c73d676d1dd6046193adceac47d38f2
                                                                          • Instruction ID: da0a2bb2dffd0da2cf288ff33df2b5a874d38cbaed28d2defd6f584eaea280d2
                                                                          • Opcode Fuzzy Hash: 4c5b3bca666bce3093585746d5be962a3c73d676d1dd6046193adceac47d38f2
                                                                          • Instruction Fuzzy Hash: 41C26C716083818FC324DF69C480B9BBBE4BFC9304F14892EF58997391DB79A945CB96
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004055E0 Relevance: 24.7, APIs: 16, Instructions: 747COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
                                                                            • Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7
                                                                            • Part of subcall function 00405390: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,?,00000004), ref: 00405410
                                                                            • Part of subcall function 00405390: __CxxThrowException@8.LIBCMT ref: 0040542C
                                                                          • _malloc.LIBCMT ref: 00405787
                                                                          • _malloc.LIBCMT ref: 00405854
                                                                          • _malloc.LIBCMT ref: 004058F3
                                                                          • _malloc.LIBCMT ref: 00405992
                                                                          • _malloc.LIBCMT ref: 00405A31
                                                                          • _malloc.LIBCMT ref: 00405AD0
                                                                          • _malloc.LIBCMT ref: 00405B6D
                                                                          • _malloc.LIBCMT ref: 00405C12
                                                                          • __CxxThrowException@8.LIBCMT ref: 00405DDD
                                                                            • Part of subcall function 00421DEE: __lock.LIBCMT ref: 00421E0C
                                                                            • Part of subcall function 00421DEE: ___sbh_find_block.LIBCMT ref: 00421E17
                                                                            • Part of subcall function 00421DEE: ___sbh_free_block.LIBCMT ref: 00421E26
                                                                            • Part of subcall function 00421DEE: RtlFreeHeap.NTDLL(00000000,?,00437B30,0000000C,004244D4,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C), ref: 00421E56
                                                                            • Part of subcall function 00421DEE: GetLastError.KERNEL32(?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA,?,?,?,0042458E,0000000D), ref: 00421E67
                                                                          • __CxxThrowException@8.LIBCMT ref: 00405E7A
                                                                            • Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27
                                                                          • __CxxThrowException@8.LIBCMT ref: 00405E95
                                                                          • __CxxThrowException@8.LIBCMT ref: 00405EB0
                                                                          • __CxxThrowException@8.LIBCMT ref: 00405ECB
                                                                          • __CxxThrowException@8.LIBCMT ref: 00405EE6
                                                                          • __CxxThrowException@8.LIBCMT ref: 00405F01
                                                                          • __CxxThrowException@8.LIBCMT ref: 00405F1C
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw$_malloc$ByteCharErrorExceptionFreeHeapLastMultiRaiseWide___sbh_find_block___sbh_free_block__lock
                                                                          • String ID:
                                                                          • API String ID: 1646499912-0
                                                                          • Opcode ID: 6575ba569594f88a5ed10eb1e61e9a88485f65cbca5aba06d6520043add3f438
                                                                          • Instruction ID: d3f9713f669ec5f3df7da001e5281389b91580916c26e67ca497a4527f5a7d99
                                                                          • Opcode Fuzzy Hash: 6575ba569594f88a5ed10eb1e61e9a88485f65cbca5aba06d6520043add3f438
                                                                          • Instruction Fuzzy Hash: C3421571608B908BD7209F39888076BBBE5EF95304F544A2EE8D5D7392D67CE805CF86
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00412B50 Relevance: 11.0, APIs: 7, Instructions: 465synchronizationCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __CxxThrowException@8.LIBCMT ref: 00412DF1
                                                                          • __CxxThrowException@8.LIBCMT ref: 00412E08
                                                                            • Part of subcall function 004130B0: _malloc.LIBCMT ref: 004130D8
                                                                            • Part of subcall function 004130B0: __CxxThrowException@8.LIBCMT ref: 004130F6
                                                                          • __CxxThrowException@8.LIBCMT ref: 00412E86
                                                                          • __CxxThrowException@8.LIBCMT ref: 00412EEF
                                                                            • Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27
                                                                          • SetEvent.KERNEL32(?,00000000,?,?,?,?,?,?,?,00437FD4), ref: 00412F8B
                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,00437FD4), ref: 00412F91
                                                                          • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,00437FD4), ref: 00412FD4
                                                                            • Part of subcall function 004154B0: CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,00412F53,?,?,?,?,?,?,?,00437FD4), ref: 004154C5
                                                                            • Part of subcall function 004154B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,00437FD4), ref: 004154CE
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw$ErrorEventLast$CreateExceptionObjectRaiseSingleWait_malloc
                                                                          • String ID:
                                                                          • API String ID: 2637030848-0
                                                                          • Opcode ID: f9fdbc78714b5f468024bd4ccc9f89bcb4f92527db628ae5e64e64e821519191
                                                                          • Instruction ID: 6db37e9d7ad01f81545c4ce0e11e49c4d9759a330240abb6dd05be9c37f6078c
                                                                          • Opcode Fuzzy Hash: f9fdbc78714b5f468024bd4ccc9f89bcb4f92527db628ae5e64e64e821519191
                                                                          • Instruction Fuzzy Hash: C5027D746047029FC724CF28C580AABB3E1FB88304F248A5EE599C7355D775F896CB95
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00421DDF Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • IsDebuggerPresent.KERNEL32 ref: 00422D1D
                                                                          • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00422D32
                                                                          • UnhandledExceptionFilter.KERNEL32(00432388), ref: 00422D3D
                                                                          • GetCurrentProcess.KERNEL32(C0000409), ref: 00422D59
                                                                          • TerminateProcess.KERNEL32(00000000), ref: 00422D60
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                                                                          • String ID:
                                                                          • API String ID: 2579439406-0
                                                                          • Opcode ID: ee80e8d3c8b4e1287dcdca918fd6cd3014df0d1a4d5be41a5f58ca83e8ce57d4
                                                                          • Instruction ID: 6df77d042e21db70d105d2c9e33ae376466ac4bc9509ba677e5ade4139247391
                                                                          • Opcode Fuzzy Hash: ee80e8d3c8b4e1287dcdca918fd6cd3014df0d1a4d5be41a5f58ca83e8ce57d4
                                                                          • Instruction Fuzzy Hash: 5E21F274906201EFD700DF5AFE896447BB4BB2C324F50A53AE509973E1E3B458858F0D
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040E740 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 383COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 0040E941
                                                                          • __CxxThrowException@8.LIBCMT ref: 0040EA84
                                                                            • Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ExceptionException@8RaiseThrow_malloc
                                                                          • String ID:
                                                                          • API String ID: 1621474382-3916222277
                                                                          • Opcode ID: 4127ce21aac610060991a7e4c62f26f7d9d08e8a3ecb5e928be9a0cc2228c74f
                                                                          • Instruction ID: 6bf4d4a0c66dc1ea962e3fac851877465544c5f1d051c7262505d9f3521c3fa1
                                                                          • Opcode Fuzzy Hash: 4127ce21aac610060991a7e4c62f26f7d9d08e8a3ecb5e928be9a0cc2228c74f
                                                                          • Instruction Fuzzy Hash: BEE17E756043018FC714DF2AC580A1BB7E5BF89314F548D3FE9A6A7391C638E865CB8A
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041B110 Relevance: 3.1, APIs: 2, Instructions: 51windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
                                                                            • Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7
                                                                          • FormatMessageW.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000,00000004,4A67CDA7,74DEE010,?,?), ref: 0041B170
                                                                          • LocalFree.KERNEL32(?), ref: 0041B18A
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8FormatFreeLocalMessageThrow_malloc
                                                                          • String ID:
                                                                          • API String ID: 2713084418-0
                                                                          • Opcode ID: ac5f01f677d42775a070dfc2d7d76652363426f171e82a111de39c834594508d
                                                                          • Instruction ID: f5968aaa4db2781cbfa919783bd6b72111f4b5590e0f3694e6d324342bca7b18
                                                                          • Opcode Fuzzy Hash: ac5f01f677d42775a070dfc2d7d76652363426f171e82a111de39c834594508d
                                                                          • Instruction Fuzzy Hash: 1A1106B1204740AFD214DF1AD945F5BFBF8EBD8B54F104A2EF19593250C3B4A904CB65
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004011C0 Relevance: 1.7, APIs: 1, Instructions: 164COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 622117b63befa7973a322741aeb603a8934fb9cc7300e44e43da5c37f40fa5d3
                                                                          • Instruction ID: 3e93a4eee694f26e6faae586ba0078f3ad04e973345864326b6e953aeb32d7b0
                                                                          • Opcode Fuzzy Hash: 622117b63befa7973a322741aeb603a8934fb9cc7300e44e43da5c37f40fa5d3
                                                                          • Instruction Fuzzy Hash: DC51F631B106204AF348CF769C851AA3BD3D7C9386B44C63DE659D66E8DABDC017C798
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004011D8 Relevance: 1.7, APIs: 1, Instructions: 160COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: c9805ec844e61b1c20006ad2471b23da2c5c5d9f86331cec8f43e7bb082fc1db
                                                                          • Instruction ID: a617d443dbee23744503749e53e855a887ddea7c71caec0ae79ad38ee72a4a7a
                                                                          • Opcode Fuzzy Hash: c9805ec844e61b1c20006ad2471b23da2c5c5d9f86331cec8f43e7bb082fc1db
                                                                          • Instruction Fuzzy Hash: D451F731B106204AF348CF368C852AA7BD3D7CA346F44C63DE659D66E8DABDC017C698
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00426C2A Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetUnhandledExceptionFilter.KERNEL32(Function_00026BE8), ref: 00426C2F
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ExceptionFilterUnhandled
                                                                          • String ID:
                                                                          • API String ID: 3192549508-0
                                                                          • Opcode ID: e861745a69044617ac1bea6ecfa3d2f0e8736b247a0f242b783b82f71a65e87b
                                                                          • Instruction ID: 962ed4ba0d295f6b9a0c84e56d2007df0ba939f6c58a15a6d83148043966d6dd
                                                                          • Opcode Fuzzy Hash: e861745a69044617ac1bea6ecfa3d2f0e8736b247a0f242b783b82f71a65e87b
                                                                          • Instruction Fuzzy Hash: 7A9002B0355524464E4017757E0950539A05A88B127D714616101C8054DBD490409519
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004105D0 Relevance: .9, Instructions: 901COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 18309e6ef098ee44329f294808c0462ed8b4c6f897a052627e43a1a5366fdf93
                                                                          • Instruction ID: e4f4b5f0e6080d98b9ee51d6b85e52c5fa7c1b81b31bb3f3eb6839b9fe8b0d70
                                                                          • Opcode Fuzzy Hash: 18309e6ef098ee44329f294808c0462ed8b4c6f897a052627e43a1a5366fdf93
                                                                          • Instruction Fuzzy Hash: E19238B1908381CFC724DF15C480A9BBBE5BF89304F14892EE59A97352D778A885CF96
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040F2F0 Relevance: .5, Instructions: 523COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw
                                                                          • String ID:
                                                                          • API String ID: 2005118841-0
                                                                          • Opcode ID: f0f49e76071627281c60fd3ab089d3b336aad91d20a840542ed0eb56c7fb7762
                                                                          • Instruction ID: 3095d77bb6f78aa45d5fb910dec581cee314f00d86e746a1153facfe542a7aca
                                                                          • Opcode Fuzzy Hash: f0f49e76071627281c60fd3ab089d3b336aad91d20a840542ed0eb56c7fb7762
                                                                          • Instruction Fuzzy Hash: 042238755043419FC734DF15C480A6BB7E1FB88314F14893EE899AB792DB38E84ACB86
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00403760 Relevance: .5, Instructions: 481COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 9803c8db8919b39b22e60e951130245479d9368fb12c4fe1c3f5fb4592283aad
                                                                          • Instruction ID: c2d97246fd2aafeb022947b6bb86a1446f9da4e42c3c7867536164bb694cac53
                                                                          • Opcode Fuzzy Hash: 9803c8db8919b39b22e60e951130245479d9368fb12c4fe1c3f5fb4592283aad
                                                                          • Instruction Fuzzy Hash: 80024C72A042114BD708CE18C580279BFE6FBC5346F114A3FE496A77C4D778DA88CB99
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040DC00 Relevance: .3, Instructions: 332COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 205793e7145c16a5e0c2912e64e9f233fbc1bf0e4f6c3dde8f69b1dc978c8365
                                                                          • Instruction ID: d1afe5bdaaf273eaa513a6fab511294eb2313c4e303bc650a9aebec8748cfb60
                                                                          • Opcode Fuzzy Hash: 205793e7145c16a5e0c2912e64e9f233fbc1bf0e4f6c3dde8f69b1dc978c8365
                                                                          • Instruction Fuzzy Hash: 61E136719083858FD764DF59C480B5BBBE0FF89304F10492EE99A97391D774A809CF86
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004015B0 Relevance: .3, Instructions: 302COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 64d347874e94e17a2217a0dc20e9d9653d82e18ffac58338c6f5489616670a27
                                                                          • Instruction ID: 3ceeb9f01f185fd99b8167d9a09416257b1ad7465954055751da435def19fb93
                                                                          • Opcode Fuzzy Hash: 64d347874e94e17a2217a0dc20e9d9653d82e18ffac58338c6f5489616670a27
                                                                          • Instruction Fuzzy Hash: 65D1D032C156A64FE314EF5DEC812357762ABC8300F6E1279CB58173A2CA34F612DB98
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00401AB0 Relevance: .3, Instructions: 300COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 8b7d9839d863fb000ff702bf221cb0633bd704a472fd011186c38929c58f0f53
                                                                          • Instruction ID: 78e49fb2be52b2f7f58f30e4f95c54c21e56b5d13c11c68cfb1cca23aa70ab33
                                                                          • Opcode Fuzzy Hash: 8b7d9839d863fb000ff702bf221cb0633bd704a472fd011186c38929c58f0f53
                                                                          • Instruction Fuzzy Hash: 3FD1D3378142664FD394DF59DC852397762EBC9300F1E067DCB5917292C634FA22DB98
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004045A0 Relevance: .2, Instructions: 199COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: ed524da47b8aa2ae254806281c4a749b71c931bd55644e6fcbbed78bd4e0280e
                                                                          • Instruction ID: 57494768f0b92b70c1e5fb60671f8c0904b92fa69cceb7a89f96e62002fbccdf
                                                                          • Opcode Fuzzy Hash: ed524da47b8aa2ae254806281c4a749b71c931bd55644e6fcbbed78bd4e0280e
                                                                          • Instruction Fuzzy Hash: 7E61F4112197D29FD311CE3D488026CFFE1EFA71047588B6ED8D287B86C668E56AC7E1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004042D0 Relevance: .2, Instructions: 167COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: c57aee5bc17977aafdc7c97f7c58be596e940ff6eefc37f40ebb5461949aa7fb
                                                                          • Instruction ID: 69ac4843b161a5063ae5296b824130d1e1d4dd1cf33e14d0e2b6e5324ebe5178
                                                                          • Opcode Fuzzy Hash: c57aee5bc17977aafdc7c97f7c58be596e940ff6eefc37f40ebb5461949aa7fb
                                                                          • Instruction Fuzzy Hash: 78614A725087118FC318DF49D48494AF3E1FFC8328F1A8A6DEA885B361D771E959CB86
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004013F0 Relevance: .1, Instructions: 97COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 7edf9d7677cf5a148deedc6415e29e53bd66bb8e929762ed0f0be55657242144
                                                                          • Instruction ID: 22718e2ba8aa9c85a7860933c045bfb99706646b777ed0143ccf77e3315a414a
                                                                          • Opcode Fuzzy Hash: 7edf9d7677cf5a148deedc6415e29e53bd66bb8e929762ed0f0be55657242144
                                                                          • Instruction Fuzzy Hash: 71315871E046B607E320DE1E8C40126BBD3AFD2311F18C27ED5AC8B79EE479955296A4
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00401000 Relevance: .1, Instructions: 80COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: b6af16c8484d87dd613c3a1aa62de61aa8fd9c2e42459e8d3272b73d93abbe76
                                                                          • Instruction ID: db6508d24fc9758a38762259af66184612b3ffe3fafafd84facb5b971e2ac8eb
                                                                          • Opcode Fuzzy Hash: b6af16c8484d87dd613c3a1aa62de61aa8fd9c2e42459e8d3272b73d93abbe76
                                                                          • Instruction Fuzzy Hash: D8110A3E370D0607E71C8769AD33BB921C2E385309B88A53DF68BC96D1EEAD9494C50D
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00401100 Relevance: .1, Instructions: 62COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 9de65a982604af57022305bde5ac8764cd96b40e1cb3bce903844e2d22169a83
                                                                          • Instruction ID: 745e0ab5a1f4135cb869288e75bb92ef0094498d29e0feb23aae1f7a6adb8ed7
                                                                          • Opcode Fuzzy Hash: 9de65a982604af57022305bde5ac8764cd96b40e1cb3bce903844e2d22169a83
                                                                          • Instruction Fuzzy Hash: 0111CE37A54A270BD324A96CDC80B777392EB8A354F1A4271DF449F392D538A94282E8
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00414150 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 58memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • VirtualAlloc.KERNEL32(00000000,00020000,00001000,00000004,4A67CDA7,?,00000000,?,00000000,0042EEE7,000000FF,00413965), ref: 00414209
                                                                          • __CxxThrowException@8.LIBCMT ref: 00414228
                                                                            • Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AllocExceptionException@8RaiseThrowVirtual
                                                                          • String ID: JA$0?A$C&B$C&B$C&B$C&B$C&B$C&B$C&B$PJA
                                                                          • API String ID: 3950171414-2120522429
                                                                          • Opcode ID: 0d5661974bf269f5af8409563256e4c29114449b89244a4f43cb1bf1215309df
                                                                          • Instruction ID: 260438ba03119f7b615b79ac7b2777a53ea5ea2c99cdc2cdac365c488f08df6f
                                                                          • Opcode Fuzzy Hash: 0d5661974bf269f5af8409563256e4c29114449b89244a4f43cb1bf1215309df
                                                                          • Instruction Fuzzy Hash: E721C4B0504B808FC320CF869544A87FBF4FB98758F109E4FE5A697A50C3B8B148CB99
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00415540 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82synchronizationCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetEvent.KERNEL32(?,4A67CDA7,?,?,00000000,00000000,0042FB21,000000FF,0040AD9B,?,?), ref: 00415582
                                                                          • GetLastError.KERNEL32 ref: 0041558C
                                                                          • WaitForSingleObject.KERNEL32(?,000000FF,4A67CDA7,?,?,00000000,00000000,0042FB21,000000FF,0040AD9B,?,?), ref: 0041559C
                                                                          • CloseHandle.KERNEL32(?,4A67CDA7,?,?,00000000,00000000,0042FB21,000000FF,0040AD9B,?,?), ref: 004155B4
                                                                          • GetLastError.KERNEL32 ref: 004155C0
                                                                          • CloseHandle.KERNEL32(?,4A67CDA7,?,?,00000000,00000000,0042FB21,000000FF,0040AD9B,?,?), ref: 004155DE
                                                                          • GetLastError.KERNEL32 ref: 004155E4
                                                                          • CloseHandle.KERNEL32(?,4A67CDA7,?,?,00000000,00000000,0042FB21,000000FF,0040AD9B,?,?), ref: 004155FF
                                                                          • GetLastError.KERNEL32 ref: 00415605
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLast$CloseHandle$EventObjectSingleWait
                                                                          • String ID: C&B
                                                                          • API String ID: 2212007442-3599845651
                                                                          • Opcode ID: c57171be3ed920f45849e8ec44a75f0ffdecc9bc2c30afcfb972f860a568f160
                                                                          • Instruction ID: 665055ef18fc4c7992229bbc331917046034d4750283f4bd9219c4516c9acca3
                                                                          • Opcode Fuzzy Hash: c57171be3ed920f45849e8ec44a75f0ffdecc9bc2c30afcfb972f860a568f160
                                                                          • Instruction Fuzzy Hash: 34219EB1204B42DBD720DF25DC84B97BBE9EB94760F10492EE965C3390D739E848CB69
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004064E0 Relevance: 16.7, APIs: 11, Instructions: 177windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetDesktopWindow.USER32 ref: 00406531
                                                                          • SetForegroundWindow.USER32(00000000), ref: 00406538
                                                                          • ShowWindow.USER32(?,00000005), ref: 004065B4
                                                                          • PeekMessageW.USER32(00000000,?,00000000,00000000,00000000), ref: 004065CC
                                                                          • DialogBoxParamW.USER32(00400000,?,?,Function_000063F0,?), ref: 004065E9
                                                                          • SetEvent.KERNEL32(?), ref: 004065F6
                                                                          • ShowWindow.USER32(?,00000005), ref: 00406607
                                                                          • PeekMessageW.USER32(00000000,?,00000000,00000000,00000000), ref: 0040661C
                                                                          • MessageBoxW.USER32(?,?,?,?), ref: 00406632
                                                                          • SetEvent.KERNEL32(?), ref: 0040663F
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Window$Message$EventPeekShow$DesktopDialogForegroundParam
                                                                          • String ID:
                                                                          • API String ID: 1049595212-0
                                                                          • Opcode ID: 3d40821ce19ca547cea518ffdd8c62fdf5f8a9e0590e93619e838d0074d6cd98
                                                                          • Instruction ID: c328493347b47e5292b43415d999d64e624e09d027fc7698bf52afcf243555f5
                                                                          • Opcode Fuzzy Hash: 3d40821ce19ca547cea518ffdd8c62fdf5f8a9e0590e93619e838d0074d6cd98
                                                                          • Instruction Fuzzy Hash: D6518176300201AFD624CF58ED88F6BB7A9EBD8711F11852EF64687390C671EC55CBA8
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041D850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 98registrywindowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
                                                                            • Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7
                                                                            • Part of subcall function 0041D370: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,4A67CDA7,?,?,?,00000000,?,?,0042FEA9,000000FF,0041D90D,?,00000004), ref: 0041D3B2
                                                                            • Part of subcall function 0041D370: RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MODAL_DLG,?,?,0042FEA9,000000FF,0041D90D,?,00000004,00000004,00000004,00000004,4A67CDA7,?,?,00000000,00000000), ref: 0041D3C2
                                                                            • Part of subcall function 0041D370: RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MESSAGE_BOX,?,?,0042FEA9,000000FF,0041D90D,?,00000004,00000004,00000004,00000004,4A67CDA7,?,?,00000000,00000000), ref: 0041D3CC
                                                                            • Part of subcall function 0041D370: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000004,?,?,0042FEA9,000000FF,0041D90D,?,00000004,00000004,00000004,00000004,4A67CDA7), ref: 0041D44F
                                                                            • Part of subcall function 0041D370: GetLastError.KERNEL32(?,?,0042FEA9,000000FF,0041D90D,?,00000004,00000004,00000004,00000004,4A67CDA7,?,?,00000000,00000000,00430209), ref: 0041D458
                                                                            • Part of subcall function 0041D370: __CxxThrowException@8.LIBCMT ref: 0041D470
                                                                          • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000004,00000004,00000004,00000004,4A67CDA7,?,?,00000000,00000000,00430209,000000FF), ref: 0041D92D
                                                                          • RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MODAL_DLG), ref: 0041D944
                                                                          • RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MESSAGE_BOX), ref: 0041D951
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: MessageRegisterWindow$CreateEvent$Exception@8Throw$ErrorLast_malloc
                                                                          • String ID: 0A$C&B$C&B$CDialog::MSG_CREATE_MESSAGE_BOX$CDialog::MSG_CREATE_MODAL_DLG
                                                                          • API String ID: 1053270758-1754678918
                                                                          • Opcode ID: 6b9a2186c4aacdd9aa879c590d57c6f905f6d015003411dcbe7587b3d416dfd2
                                                                          • Instruction ID: ff79ae979ea3c55558c752116325ba362ad5e0a4aeac68ff67176371f723eebb
                                                                          • Opcode Fuzzy Hash: 6b9a2186c4aacdd9aa879c590d57c6f905f6d015003411dcbe7587b3d416dfd2
                                                                          • Instruction Fuzzy Hash: 5A4116B1904B82AEC314CF26C881782FBE4BB58704F508A2EE6A957651C378B558CBD5
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041D370 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85registrywindowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,4A67CDA7,?,?,?,00000000,?,?,0042FEA9,000000FF,0041D90D,?,00000004), ref: 0041D3B2
                                                                          • RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MODAL_DLG,?,?,0042FEA9,000000FF,0041D90D,?,00000004,00000004,00000004,00000004,4A67CDA7,?,?,00000000,00000000), ref: 0041D3C2
                                                                          • RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MESSAGE_BOX,?,?,0042FEA9,000000FF,0041D90D,?,00000004,00000004,00000004,00000004,4A67CDA7,?,?,00000000,00000000), ref: 0041D3CC
                                                                            • Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
                                                                            • Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7
                                                                            • Part of subcall function 004047C0: InitializeCriticalSection.KERNEL32(?,4A67CDA7), ref: 004047FE
                                                                          • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000004,?,?,0042FEA9,000000FF,0041D90D,?,00000004,00000004,00000004,00000004,4A67CDA7), ref: 0041D44F
                                                                          • GetLastError.KERNEL32(?,?,0042FEA9,000000FF,0041D90D,?,00000004,00000004,00000004,00000004,4A67CDA7,?,?,00000000,00000000,00430209), ref: 0041D458
                                                                          • __CxxThrowException@8.LIBCMT ref: 0041D470
                                                                            • Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27
                                                                          Strings
                                                                          • CDialog::MSG_CREATE_MESSAGE_BOX, xrefs: 0041D3C4
                                                                          • CDialog::MSG_CREATE_MODAL_DLG, xrefs: 0041D3BA
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CreateEventException@8MessageRegisterThrowWindow$CriticalErrorExceptionInitializeLastRaiseSection_malloc
                                                                          • String ID: CDialog::MSG_CREATE_MESSAGE_BOX$CDialog::MSG_CREATE_MODAL_DLG
                                                                          • API String ID: 2475960406-1515309323
                                                                          • Opcode ID: dd1457a73b0a163e9de1fc32d0a7b1367226a52f8b3e557f26fbd9f6b0ed3806
                                                                          • Instruction ID: ce6adb0846dacee929c4b269caab47ed56b5dce5ab6c1ff985edc843b1e8f192
                                                                          • Opcode Fuzzy Hash: dd1457a73b0a163e9de1fc32d0a7b1367226a52f8b3e557f26fbd9f6b0ed3806
                                                                          • Instruction Fuzzy Hash: E6316FB1604B86AFD304CF29C881B86FFE8FB59354F50462FE19893651C778B458CB99
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041D490 Relevance: 13.6, APIs: 9, Instructions: 95synchronizationwindowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • EnterCriticalSection.KERNEL32(?,4A67CDA7,?,?,?,?,?,?,0042F9F0,000000FF), ref: 0041D4C5
                                                                          • LeaveCriticalSection.KERNEL32(?), ref: 0041D4FC
                                                                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041D50E
                                                                          • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0041D518
                                                                          • PostMessageW.USER32(?,?,?,?), ref: 0041D533
                                                                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041D53F
                                                                          • CloseHandle.KERNEL32(?), ref: 0041D545
                                                                          • EnterCriticalSection.KERNEL32(?), ref: 0041D55E
                                                                          • LeaveCriticalSection.KERNEL32(?), ref: 0041D587
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalSection$EnterLeaveObjectSingleWait$CloseCreateEventHandleMessagePost
                                                                          • String ID:
                                                                          • API String ID: 3292403733-0
                                                                          • Opcode ID: 2ab1832f6a7bee7da5fac1aacacfabd99e4207771d9bb24a02fab69fbfaa0d40
                                                                          • Instruction ID: f3d772afd4ee5944f76de5045bb3e40646552dd8c4de7b14b0dca013c747943b
                                                                          • Opcode Fuzzy Hash: 2ab1832f6a7bee7da5fac1aacacfabd99e4207771d9bb24a02fab69fbfaa0d40
                                                                          • Instruction Fuzzy Hash: 793134B1204740AFD324CB29CD84B27B7F9FB89724F104A1DF699933A0C7B4A805CB69
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041E8D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 70memorystringwindowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FormatMessageW.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000,00000000,00420E70), ref: 0041E8F3
                                                                          • lstrlenW.KERNEL32(00000000), ref: 0041E900
                                                                          • LocalAlloc.KERNEL32(00000000,00000040), ref: 0041E937
                                                                          • swprintf.LIBCMT ref: 0041E96E
                                                                          • swprintf.LIBCMT ref: 0041E983
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: swprintf$AllocFormatLocalMessagelstrlen
                                                                          • String ID: IDispatch error #%d$Unknown error 0x%0lX
                                                                          • API String ID: 1134423501-2934499512
                                                                          • Opcode ID: f6e50c7be8be514e84a0b90db71478859d0b6e887827da412b84fe5d130f3157
                                                                          • Instruction ID: dfc2c100d0fa81078b2a730f8d319b60173ab00cae5a86e14b41508050d6b34f
                                                                          • Opcode Fuzzy Hash: f6e50c7be8be514e84a0b90db71478859d0b6e887827da412b84fe5d130f3157
                                                                          • Instruction Fuzzy Hash: 9C21EBB0600210A7E774DB29ED45FE673A5EF50344F208059F584DB2D1D3B9BC46CB98
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041F630 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 47registryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 0041F654
                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00002000,?,?,?), ref: 0041F668
                                                                          • RegCreateKeyExW.ADVAPI32 ref: 0041F694
                                                                          • RegSetValueExW.ADVAPI32(?,00000000,00000000,00000004,00000000,00000004), ref: 0041F6B6
                                                                          • RegCloseKey.ADVAPI32(00000000,?,00000000,00000000,00000004,00000000,00000004), ref: 0041F6C0
                                                                          Strings
                                                                          • , xrefs: 0041F6AE
                                                                          • Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted, xrefs: 0041F682
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CloseCreateFileModuleNameValue_memset
                                                                          • String ID: $Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted
                                                                          • API String ID: 2280741871-2837994659
                                                                          • Opcode ID: 02b76c714ddad47070057f04439b6013b1663233fbc740c1de6452bbb3833300
                                                                          • Instruction ID: 37a7b5702278f112b31955c87cec25a7fde7f3e4c6faff8a8326e10aa8a02003
                                                                          • Opcode Fuzzy Hash: 02b76c714ddad47070057f04439b6013b1663233fbc740c1de6452bbb3833300
                                                                          • Instruction Fuzzy Hash: 1D014071254300BFF214DB50DC8AFAA77A4AB98B04F50841DB7489A1D2DBB46408CB5A
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041B530 Relevance: 10.7, APIs: 7, Instructions: 156windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetDlgItem.USER32(?,000003E9), ref: 0041B562
                                                                          • SetWindowTextW.USER32(00000000,?), ref: 0041B570
                                                                            • Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
                                                                            • Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7
                                                                            • Part of subcall function 00421DEE: __lock.LIBCMT ref: 00421E0C
                                                                            • Part of subcall function 00421DEE: ___sbh_find_block.LIBCMT ref: 00421E17
                                                                            • Part of subcall function 00421DEE: ___sbh_free_block.LIBCMT ref: 00421E26
                                                                            • Part of subcall function 00421DEE: RtlFreeHeap.NTDLL(00000000,?,00437B30,0000000C,004244D4,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C), ref: 00421E56
                                                                            • Part of subcall function 00421DEE: GetLastError.KERNEL32(?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA,?,?,?,0042458E,0000000D), ref: 00421E67
                                                                          • SetWindowTextW.USER32(?,?), ref: 0041B5C7
                                                                          • SetDlgItemTextW.USER32(?,000003E8,?), ref: 0041B623
                                                                          • SetDlgItemTextW.USER32(?,00000001,?), ref: 0041B67C
                                                                          • SetDlgItemTextW.USER32(?,00000002,?), ref: 0041B6D5
                                                                          • SendMessageW.USER32(?,00000080,00000001,00000000), ref: 0041B6E7
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Text$Item$Window$ErrorException@8FreeHeapLastMessageSendThrow___sbh_find_block___sbh_free_block__lock_malloc
                                                                          • String ID:
                                                                          • API String ID: 1891682577-0
                                                                          • Opcode ID: a8893c355988dc046967399e1d6393c2a355a0867427ab7a748b946283110e5f
                                                                          • Instruction ID: b462c79913f27606fce5be96d1d4db49be7a94859ae037c386c9d335dcadd2b5
                                                                          • Opcode Fuzzy Hash: a8893c355988dc046967399e1d6393c2a355a0867427ab7a748b946283110e5f
                                                                          • Instruction Fuzzy Hash: E55164B1508380AFD700EF69DC85B4BBBE4AF98354F50091DF68597292C7B8E544CB67
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004154B0 Relevance: 10.6, APIs: 7, Instructions: 57COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,00412F53,?,?,?,?,?,?,?,00437FD4), ref: 004154C5
                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,00437FD4), ref: 004154CE
                                                                          • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,00412F53,?,?,?,?,?,?,?,00437FD4), ref: 004154ED
                                                                          • ResetEvent.KERNEL32(00000000,?,?,00412F53,?,?,?,?,?,?,?,00437FD4), ref: 00415501
                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,00437FD4), ref: 0041550D
                                                                          • ResetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00437FD4), ref: 00415513
                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,00437FD4), ref: 00415519
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Event$ErrorLast$CreateReset
                                                                          • String ID:
                                                                          • API String ID: 2684445861-0
                                                                          • Opcode ID: 397fea74b750bfb1b0a927181ac41e1428b8659026dfcbaf32b253da1c8ae01f
                                                                          • Instruction ID: 46a4382e4f685cd8f0a90a1e671664aa1b9fbbb21dc1a77a4e7868b3bece67f6
                                                                          • Opcode Fuzzy Hash: 397fea74b750bfb1b0a927181ac41e1428b8659026dfcbaf32b253da1c8ae01f
                                                                          • Instruction Fuzzy Hash: 00118831300B01EAE7709B79EC80B97B3E95FD0715F10842AE215D6694D7B8F8C58628
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041BEB0 Relevance: 9.1, APIs: 6, Instructions: 114windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • EnterCriticalSection.KERNEL32(?,4A67CDA7), ref: 0041BEED
                                                                          • LeaveCriticalSection.KERNEL32(?), ref: 0041BEF7
                                                                          • EnterCriticalSection.KERNEL32(?), ref: 0041BF05
                                                                          • LeaveCriticalSection.KERNEL32(?), ref: 0041BF36
                                                                          • MessageBoxW.USER32(?,?,?,00000024), ref: 0041BF65
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalSection$EnterLeave$Message
                                                                          • String ID:
                                                                          • API String ID: 850481049-0
                                                                          • Opcode ID: 0fc563b75534699d1d46bfe3fa0fa692735b2cfc7cf69dda51ce6e4883b0f232
                                                                          • Instruction ID: d58ba03eace6790549a51d7cf0a140a1ee8029c9543b5873e91039f9fafb8494
                                                                          • Opcode Fuzzy Hash: 0fc563b75534699d1d46bfe3fa0fa692735b2cfc7cf69dda51ce6e4883b0f232
                                                                          • Instruction Fuzzy Hash: B94189B5204345AFC324DF28C984BABBBE4FB89314F100619F55583791C738E94ACF9A
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041BD70 Relevance: 9.1, APIs: 6, Instructions: 79windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • EnterCriticalSection.KERNEL32(?), ref: 0041BD89
                                                                          • LeaveCriticalSection.KERNEL32(?), ref: 0041BD92
                                                                          • PostMessageW.USER32(?,00008000,00000000,00000000), ref: 0041BDB2
                                                                          • EnterCriticalSection.KERNEL32(?), ref: 0041BDBF
                                                                          • LeaveCriticalSection.KERNEL32(?), ref: 0041BDE2
                                                                          • __aulldiv.LIBCMT ref: 0041BE2C
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalSection$EnterLeave$MessagePost__aulldiv
                                                                          • String ID:
                                                                          • API String ID: 3743465594-0
                                                                          • Opcode ID: 8ddcddcfe8e5cc343d9f3872b492c1c617b7ef677ad0fa64153c49aec06e9001
                                                                          • Instruction ID: 0f6cecad49a1d158afd731c11dc079c735cde051cd0f7b3838b3757deac6ee7a
                                                                          • Opcode Fuzzy Hash: 8ddcddcfe8e5cc343d9f3872b492c1c617b7ef677ad0fa64153c49aec06e9001
                                                                          • Instruction Fuzzy Hash: 4621BD72604704ABC324EF759D81FABF7E9EB85B00F04081EFA9647341CB75B84987A9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041C1F0 Relevance: 9.1, APIs: 6, Instructions: 56synchronizationwindowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041C209
                                                                          • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0041C22B
                                                                          • SendMessageW.USER32(00000000,?,00000000,?), ref: 0041C243
                                                                          • CloseHandle.KERNEL32(?), ref: 0041C24D
                                                                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041C259
                                                                          • MessageBoxW.USER32(00000000,?,?,?), ref: 0041C27C
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: MessageObjectSingleWait$CloseCreateEventHandleSend
                                                                          • String ID:
                                                                          • API String ID: 3833482109-0
                                                                          • Opcode ID: 6d17b11e7bcf11a9d7b57836135ff4d9eb2c6b9d4dfdb948564495aa17a6fda9
                                                                          • Instruction ID: a341cd1b27fd06dd4103b1dfc400c87a0f2c7d7423bf8431d21d9bbe00f176ce
                                                                          • Opcode Fuzzy Hash: 6d17b11e7bcf11a9d7b57836135ff4d9eb2c6b9d4dfdb948564495aa17a6fda9
                                                                          • Instruction Fuzzy Hash: 7A110775604301AFD224DF58DD85F5BF7F4EB98B10F108A1EF59593290D6B0E809CBA6
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0042DE28 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __CreateFrameInfo.LIBCMT ref: 0042DE50
                                                                            • Part of subcall function 0042D8E0: __getptd.LIBCMT ref: 0042D8EE
                                                                            • Part of subcall function 0042D8E0: __getptd.LIBCMT ref: 0042D8FC
                                                                          • __getptd.LIBCMT ref: 0042DE5A
                                                                            • Part of subcall function 004244E3: __getptd_noexit.LIBCMT ref: 004244E6
                                                                            • Part of subcall function 004244E3: __amsg_exit.LIBCMT ref: 004244F3
                                                                          • __getptd.LIBCMT ref: 0042DE68
                                                                          • __getptd.LIBCMT ref: 0042DE76
                                                                          • __getptd.LIBCMT ref: 0042DE81
                                                                          • _CallCatchBlock2.LIBCMT ref: 0042DEA7
                                                                            • Part of subcall function 0042D985: __CallSettingFrame@12.LIBCMT ref: 0042D9D1
                                                                            • Part of subcall function 0042DF4E: __getptd.LIBCMT ref: 0042DF5D
                                                                            • Part of subcall function 0042DF4E: __getptd.LIBCMT ref: 0042DF6B
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
                                                                          • String ID:
                                                                          • API String ID: 1602911419-0
                                                                          • Opcode ID: 732a5a4de1712c62318a0ddeb78ca340981344dd2e45324716b5b23d54ed3c5d
                                                                          • Instruction ID: 2feef8606836cd958bd5a2fd3112628b4059505882e4cd18e6819dd8d5e60df7
                                                                          • Opcode Fuzzy Hash: 732a5a4de1712c62318a0ddeb78ca340981344dd2e45324716b5b23d54ed3c5d
                                                                          • Instruction Fuzzy Hash: 6D1107B1E00219DFDB00EFA5E946BAD7BB0FF08318F50806AF814A7251DB789A11DF58
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041A430 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 83COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 0041A470
                                                                            • Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
                                                                            • Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
                                                                            • Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42
                                                                          • __CxxThrowException@8.LIBCMT ref: 0041A48C
                                                                            • Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27
                                                                          • GetLastError.KERNEL32(00434200,80000000,00000001), ref: 0041A4D6
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AllocateErrorExceptionException@8HeapLastRaiseThrow_malloc
                                                                          • String ID: C&B$`:A
                                                                          • API String ID: 1656954132-1488716206
                                                                          • Opcode ID: 2a486e199a1073192d2ab76fdaf9423da61f3946df1b212c46d744dd35da5e3a
                                                                          • Instruction ID: 1cdb7f40dcaf2c5b6f8298736c64605cc2d4e7cc8bd3ecd4195e4897365a2a63
                                                                          • Opcode Fuzzy Hash: 2a486e199a1073192d2ab76fdaf9423da61f3946df1b212c46d744dd35da5e3a
                                                                          • Instruction Fuzzy Hash: 5F319F71104740AFC320DF19C880B8BBBE8EF8D724F204A1EF59997390C779A945CB96
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041D1A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48registrywindowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,4A67CDA7,?,?,?,?,0042F588,000000FF,0041D0DF,?), ref: 0041D1DA
                                                                          • RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MODAL_DLG,?,?,?,?,0042F588,000000FF,0041D0DF,?), ref: 0041D1EE
                                                                          • RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MESSAGE_BOX,?,?,?,?,0042F588,000000FF,0041D0DF,?), ref: 0041D1F8
                                                                            • Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
                                                                            • Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7
                                                                          Strings
                                                                          • CDialog::MSG_CREATE_MESSAGE_BOX, xrefs: 0041D1F0
                                                                          • CDialog::MSG_CREATE_MODAL_DLG, xrefs: 0041D1E6
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: MessageRegisterWindow$CreateEventException@8Throw_malloc
                                                                          • String ID: CDialog::MSG_CREATE_MESSAGE_BOX$CDialog::MSG_CREATE_MODAL_DLG
                                                                          • API String ID: 1188034692-1515309323
                                                                          • Opcode ID: e5df840c374edb4d314b405cf7927deab87bd118bdc003591a6cefdd6186986a
                                                                          • Instruction ID: 8f30331a7d0a82c71c2cf135fcdddbf6783167e00fcd53bb43b2a30073ddcfa9
                                                                          • Opcode Fuzzy Hash: e5df840c374edb4d314b405cf7927deab87bd118bdc003591a6cefdd6186986a
                                                                          • Instruction Fuzzy Hash: 511179B1A00742AFC300CF15D880B56FBE8FB48760F504A3FE55483B50C378A854CB98
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041B940 Relevance: 8.8, APIs: 7, Instructions: 45sleepCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • EnterCriticalSection.KERNEL32(?,?,?,?,?,0041C818), ref: 0041B94E
                                                                          • LeaveCriticalSection.KERNEL32(?,?,?,?,0041C818), ref: 0041B95E
                                                                          • EnterCriticalSection.KERNEL32(?), ref: 0041B968
                                                                          • LeaveCriticalSection.KERNEL32(?), ref: 0041B972
                                                                          • Sleep.KERNEL32(00000064), ref: 0041B97D
                                                                          • EnterCriticalSection.KERNEL32(?), ref: 0041B984
                                                                          • LeaveCriticalSection.KERNEL32(?), ref: 0041B98E
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalSection$EnterLeave$Sleep
                                                                          • String ID:
                                                                          • API String ID: 2348874005-0
                                                                          • Opcode ID: 89fbda83cfde529f4557547a284b07b53fde272b623b93481bab980feee85910
                                                                          • Instruction ID: f1f9374e472945a2e4150c96b9f2f04068727bb37f025097168d847f170bca56
                                                                          • Opcode Fuzzy Hash: 89fbda83cfde529f4557547a284b07b53fde272b623b93481bab980feee85910
                                                                          • Instruction Fuzzy Hash: A6F0F96200E3A57DD71597789C80BDBFFD89F06224F48104AF38442602CB58E45CD3EE
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0042DB77 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __getptd.LIBCMT ref: 0042DB91
                                                                            • Part of subcall function 004244E3: __getptd_noexit.LIBCMT ref: 004244E6
                                                                            • Part of subcall function 004244E3: __amsg_exit.LIBCMT ref: 004244F3
                                                                          • __getptd.LIBCMT ref: 0042DBA2
                                                                          • __getptd.LIBCMT ref: 0042DBB0
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: __getptd$__amsg_exit__getptd_noexit
                                                                          • String ID: MOC$csm
                                                                          • API String ID: 803148776-1389381023
                                                                          • Opcode ID: d1bdbd8c26c8a705d5a7a2af35c4b2a202de102865fc560031df8e0dd3ccf076
                                                                          • Instruction ID: 47a718ef4add73cab02364874fd470c84c685f020952b3a97a078907d01c782d
                                                                          • Opcode Fuzzy Hash: d1bdbd8c26c8a705d5a7a2af35c4b2a202de102865fc560031df8e0dd3ccf076
                                                                          • Instruction Fuzzy Hash: A4E01A35B101248FC720AA66E146B2937A4EF84319F9600A7E408C7322C76DEA41964A
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00412930 Relevance: 7.6, APIs: 5, Instructions: 108COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00413180: _malloc.LIBCMT ref: 00413183
                                                                            • Part of subcall function 00413180: __CxxThrowException@8.LIBCMT ref: 004131A1
                                                                            • Part of subcall function 0040AC20: CloseHandle.KERNEL32(?,4A67CDA7,00000000,?,?,00000000,0042FD93,000000FF,004129BE), ref: 0040AC63
                                                                            • Part of subcall function 0040AC20: GetLastError.KERNEL32(?,00000000,0042FD93,000000FF,004129BE), ref: 0040AC69
                                                                            • Part of subcall function 0040AC20: CloseHandle.KERNEL32(?,4A67CDA7,00000000,?,?,00000000,0042FD93,000000FF,004129BE), ref: 0040AC81
                                                                            • Part of subcall function 0040AC20: GetLastError.KERNEL32(?,00000000,0042FD93,000000FF,004129BE), ref: 0040AC87
                                                                            • Part of subcall function 0040AC20: CloseHandle.KERNEL32(?,4A67CDA7,00000000,?,?,00000000,0042FD93,000000FF,004129BE), ref: 0040ACA1
                                                                            • Part of subcall function 0040AC20: GetLastError.KERNEL32(?,00000000,0042FD93,000000FF,004129BE), ref: 0040ACA7
                                                                          • CreateEventW.KERNEL32(00000000,00000001,00000001,00000000), ref: 004129CE
                                                                          • GetLastError.KERNEL32 ref: 004129DA
                                                                          • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 004129F0
                                                                          • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00412A02
                                                                          • GetLastError.KERNEL32 ref: 00412A0F
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLast$CloseCreateEventHandle$Exception@8Throw_malloc
                                                                          • String ID:
                                                                          • API String ID: 1759989790-0
                                                                          • Opcode ID: 6b857cbb71be1ad28325e6d6b7d75c8c9f3b23fd950410c6b5f2775173ff0025
                                                                          • Instruction ID: d29682d7f2a8e5d8ad5244a4e56567742131bd4529a3a95453868c643860fb60
                                                                          • Opcode Fuzzy Hash: 6b857cbb71be1ad28325e6d6b7d75c8c9f3b23fd950410c6b5f2775173ff0025
                                                                          • Instruction Fuzzy Hash: FF31BA712083009BC720DF19DA84A5BBBF5FBD8720F104A2EF955D7390D7B59884CBAA
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040AC20 Relevance: 7.6, APIs: 6, Instructions: 63COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CloseHandle.KERNEL32(?,4A67CDA7,00000000,?,?,00000000,0042FD93,000000FF,004129BE), ref: 0040AC63
                                                                          • GetLastError.KERNEL32(?,00000000,0042FD93,000000FF,004129BE), ref: 0040AC69
                                                                          • CloseHandle.KERNEL32(?,4A67CDA7,00000000,?,?,00000000,0042FD93,000000FF,004129BE), ref: 0040AC81
                                                                          • GetLastError.KERNEL32(?,00000000,0042FD93,000000FF,004129BE), ref: 0040AC87
                                                                          • CloseHandle.KERNEL32(?,4A67CDA7,00000000,?,?,00000000,0042FD93,000000FF,004129BE), ref: 0040ACA1
                                                                          • GetLastError.KERNEL32(?,00000000,0042FD93,000000FF,004129BE), ref: 0040ACA7
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CloseErrorHandleLast
                                                                          • String ID:
                                                                          • API String ID: 918212764-0
                                                                          • Opcode ID: 01571284487dd8332102ea27bf21fc6b24d93d877b32237917eca0345e84306e
                                                                          • Instruction ID: dcfd2361e2e7680f2d61e14ae5f50a0f0a30a84fdfe528ae2696ca0788a1d8cd
                                                                          • Opcode Fuzzy Hash: 01571284487dd8332102ea27bf21fc6b24d93d877b32237917eca0345e84306e
                                                                          • Instruction Fuzzy Hash: 8D1193B16087418BE320CF25DD44B17B7E8FB40B60F11093EE89193780D73AE518CAAA
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00428169 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __getptd.LIBCMT ref: 00428175
                                                                            • Part of subcall function 004244E3: __getptd_noexit.LIBCMT ref: 004244E6
                                                                            • Part of subcall function 004244E3: __amsg_exit.LIBCMT ref: 004244F3
                                                                          • __amsg_exit.LIBCMT ref: 00428195
                                                                          • __lock.LIBCMT ref: 004281A5
                                                                          • InterlockedDecrement.KERNEL32(?), ref: 004281C2
                                                                          • InterlockedIncrement.KERNEL32(022F1660), ref: 004281ED
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                                                          • String ID:
                                                                          • API String ID: 4271482742-0
                                                                          • Opcode ID: fa3bbf27329c5f55e436b88aabd8abac842491f5a62691615a63079069034a17
                                                                          • Instruction ID: fd241d50e1f8b1b7d4dc77b21c0c83e36747cdc79bc18032ab753e40f4628816
                                                                          • Opcode Fuzzy Hash: fa3bbf27329c5f55e436b88aabd8abac842491f5a62691615a63079069034a17
                                                                          • Instruction Fuzzy Hash: 72018E32B02632ABDA21AB65B94576E7760BF04714F86501FE800B32D0CB6C6952DBDD
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00415240 Relevance: 7.5, APIs: 5, Instructions: 45COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ResetEvent.KERNEL32(?), ref: 00415256
                                                                          • GetLastError.KERNEL32 ref: 00415266
                                                                          • SetEvent.KERNEL32(?), ref: 0041526C
                                                                          • GetLastError.KERNEL32 ref: 00415276
                                                                          • WaitForMultipleObjects.KERNEL32(00000002,00000000,00000000,000000FF), ref: 00415290
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorEventLast$MultipleObjectsResetWait
                                                                          • String ID:
                                                                          • API String ID: 234195192-0
                                                                          • Opcode ID: 09ae9fbb8350569853272b2c8be73804df0dbc38018a1bb2ab0204f4601fc4bc
                                                                          • Instruction ID: 01ba3faf78e38b84e446a84389ce2623cf67465c42dd92f621bab6ccc91c99b8
                                                                          • Opcode Fuzzy Hash: 09ae9fbb8350569853272b2c8be73804df0dbc38018a1bb2ab0204f4601fc4bc
                                                                          • Instruction Fuzzy Hash: B6019E751007019FD320DF64AC80AA7B3F4BBD4710F00892EE969C2740D774E948CF69
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00407070 Relevance: 7.5, APIs: 5, Instructions: 36fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateFileW.KERNEL32(?,00000000,00000007,00000000,00000003,00000080,00000000), ref: 00407084
                                                                          • _memset.LIBCMT ref: 0040709A
                                                                          • GetFileInformationByHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0040710F), ref: 004070A8
                                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,0040710F), ref: 004070B3
                                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,0040710F), ref: 004070C1
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Handle$CloseFile$CreateInformation_memset
                                                                          • String ID:
                                                                          • API String ID: 1323354321-0
                                                                          • Opcode ID: 0132f8f558b8720df98c9a6f2a9f479f48355388beba6bfe8d17b00a70df9ae5
                                                                          • Instruction ID: 6e2f4fad45cc1b478236f34afacde46dc3ac694dbfc79934ddf445b22f007f0c
                                                                          • Opcode Fuzzy Hash: 0132f8f558b8720df98c9a6f2a9f479f48355388beba6bfe8d17b00a70df9ae5
                                                                          • Instruction Fuzzy Hash: B4F02E75945310BBD1246324AD0AF873B645F44B24F504B24FF69A61E0E7B4A50CC5DE
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041C190 Relevance: 7.5, APIs: 5, Instructions: 34synchronizationwindowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041C1A0
                                                                          • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0041C1AA
                                                                          • PostMessageW.USER32(?,?,?,?), ref: 0041C1C5
                                                                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041C1D1
                                                                          • CloseHandle.KERNEL32(?), ref: 0041C1D7
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ObjectSingleWait$CloseCreateEventHandleMessagePost
                                                                          • String ID:
                                                                          • API String ID: 1259710111-0
                                                                          • Opcode ID: da4c244dec537242234236758f76901cdaebeb962d90af1f950e35a4ae204856
                                                                          • Instruction ID: 1c2131afe4bbbcb97152305221c9bc3684589986b6a1f07a80391251fe593e57
                                                                          • Opcode Fuzzy Hash: da4c244dec537242234236758f76901cdaebeb962d90af1f950e35a4ae204856
                                                                          • Instruction Fuzzy Hash: F6F0F975204700ABD224DF58EE44F17B7F9EB88720F108A19B666936D0C6B0E804CB64
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00422007 Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00423F42: _doexit.LIBCMT ref: 00423F4E
                                                                          • ___set_flsgetvalue.LIBCMT ref: 00422019
                                                                            • Part of subcall function 004242F5: TlsGetValue.KERNEL32(?,0042201E), ref: 004242FE
                                                                            • Part of subcall function 004242F5: __decode_pointer.LIBCMT ref: 00424310
                                                                            • Part of subcall function 004242F5: TlsSetValue.KERNEL32(00000000,0042201E), ref: 0042431F
                                                                          • ___fls_getvalue@4.LIBCMT ref: 00422024
                                                                            • Part of subcall function 004242D5: TlsGetValue.KERNEL32(?,?,00422029,00000000), ref: 004242E3
                                                                          • ___fls_setvalue@8.LIBCMT ref: 00422037
                                                                            • Part of subcall function 00424329: __decode_pointer.LIBCMT ref: 0042433A
                                                                          • GetLastError.KERNEL32(00000000,?,00000000), ref: 00422040
                                                                          • ExitThread.KERNEL32 ref: 00422047
                                                                          • GetCurrentThreadId.KERNEL32 ref: 0042204D
                                                                          • __freefls@4.LIBCMT ref: 0042206D
                                                                          • __IsNonwritableInCurrentImage.LIBCMT ref: 00422080
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                                                          • String ID:
                                                                          • API String ID: 132634196-0
                                                                          • Opcode ID: abb640ab18d0b5c1348d4bac514cf4b1efe66e005ced65b3c2dfaf410d7190e0
                                                                          • Instruction ID: fd81764335df7765f2fb6b6443d515abc26e7ee03fb5a8222b8a574a8caa6766
                                                                          • Opcode Fuzzy Hash: abb640ab18d0b5c1348d4bac514cf4b1efe66e005ced65b3c2dfaf410d7190e0
                                                                          • Instruction Fuzzy Hash: 26E04F35B00235B78F107BB3BE0A99F362CDD91389F810056BB1493516DAACA952C6BD
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041FAF0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 266COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
                                                                            • Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7
                                                                            • Part of subcall function 00421DEE: __lock.LIBCMT ref: 00421E0C
                                                                            • Part of subcall function 00421DEE: ___sbh_find_block.LIBCMT ref: 00421E17
                                                                            • Part of subcall function 00421DEE: ___sbh_free_block.LIBCMT ref: 00421E26
                                                                            • Part of subcall function 00421DEE: RtlFreeHeap.NTDLL(00000000,?,00437B30,0000000C,004244D4,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C), ref: 00421E56
                                                                            • Part of subcall function 00421DEE: GetLastError.KERNEL32(?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA,?,?,?,0042458E,0000000D), ref: 00421E67
                                                                            • Part of subcall function 004080C0: FindNextFileW.KERNELBASE(4A67CDA7,?,?,00000000), ref: 004080ED
                                                                          • FindClose.KERNEL32(?,?,mia.lib), ref: 0041FDD6
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Find$CloseErrorException@8FileFreeHeapLastNextThrow___sbh_find_block___sbh_free_block__lock_malloc
                                                                          • String ID: mia.lib
                                                                          • API String ID: 2885634111-3926378727
                                                                          • Opcode ID: 2ae7be12f441ca50a6143c3c0eb0cee28d23eb9b5f221ca52f3f51d27e8a3092
                                                                          • Instruction ID: 8b4ee6a9bcb3ced087b9b546e1ec6741e99afcab16ee143dc5f2577b8edc9a86
                                                                          • Opcode Fuzzy Hash: 2ae7be12f441ca50a6143c3c0eb0cee28d23eb9b5f221ca52f3f51d27e8a3092
                                                                          • Instruction Fuzzy Hash: DDB19F716083808FC720DF28C88079BB7E1BF95318F544A2EE5D997351D739A98AC79B
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00417D80 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 00417D8A
                                                                            • Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
                                                                            • Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
                                                                            • Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42
                                                                          • __CxxThrowException@8.LIBCMT ref: 00417DA8
                                                                            • Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
                                                                          • String ID: C&B$P!@
                                                                          • API String ID: 2732643326-2732990258
                                                                          • Opcode ID: ef0825c52d97dfa396775a1bbff741b6f9787908cb828aca66d1adbd8e82940c
                                                                          • Instruction ID: 6c4891182d0843430d5aa2e3f13a61663bb5cfbeeb03675ddc0dc77422dc16fb
                                                                          • Opcode Fuzzy Hash: ef0825c52d97dfa396775a1bbff741b6f9787908cb828aca66d1adbd8e82940c
                                                                          • Instruction Fuzzy Hash: 860192716017109FC324CF69D845957B7E4FF89750B00C92EE5668B750C778E545CB94
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0042E1D5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ___BuildCatchObject.LIBCMT ref: 0042E1E8
                                                                            • Part of subcall function 0042E143: ___BuildCatchObjectHelper.LIBCMT ref: 0042E179
                                                                          • _UnwindNestedFrames.LIBCMT ref: 0042E1FF
                                                                          • ___FrameUnwindToState.LIBCMT ref: 0042E20D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
                                                                          • String ID: csm
                                                                          • API String ID: 2163707966-1018135373
                                                                          • Opcode ID: a1cdc47254b0d1e876ebf16cdfd679722edd35116a1de451e27b255c7f3a5f87
                                                                          • Instruction ID: 501dba1919913278d24567a8fb0c29bd8aa274bf433fc8a0c0296e56aab0cabf
                                                                          • Opcode Fuzzy Hash: a1cdc47254b0d1e876ebf16cdfd679722edd35116a1de451e27b255c7f3a5f87
                                                                          • Instruction Fuzzy Hash: 86014B3150112ABBCF126F52EC45EEB7F6AEF18344F444016BC1815121DB7A99B1DBA8
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0042973D Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00429771
                                                                          • __isleadbyte_l.LIBCMT ref: 004297A5
                                                                          • MultiByteToWideChar.KERNEL32(00000080,00000009,0042592B,?,00000000,00000000,?,?,?,?,0042592B,00000000,?), ref: 004297D6
                                                                          • MultiByteToWideChar.KERNEL32(00000080,00000009,0042592B,00000001,00000000,00000000,?,?,?,?,0042592B,00000000,?), ref: 00429844
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                          • String ID:
                                                                          • API String ID: 3058430110-0
                                                                          • Opcode ID: b427793e77801bdb7ba370c3e6adb68a2c31af849afecf8bb8cfe1dd9eb1ff06
                                                                          • Instruction ID: 9c24f66b49e3da99480367bb5e631a60a5aacc6aab19caaf07062d906febf1f7
                                                                          • Opcode Fuzzy Hash: b427793e77801bdb7ba370c3e6adb68a2c31af849afecf8bb8cfe1dd9eb1ff06
                                                                          • Instruction Fuzzy Hash: 9D31F331B20366EFDB10EF64E8809AE3BB4FF41310F58456AE0658B291D334DD40DB58
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00414250 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 73COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • VirtualFree.KERNEL32(?,00000000,00008000,4A67CDA7,?,000000FF,0042EA77,000000FF,00414134,?), ref: 004142C3
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: FreeVirtual
                                                                          • String ID: JA$0?A$PJA
                                                                          • API String ID: 1263568516-2687202105
                                                                          • Opcode ID: 2d88bd622d4eed4683b29214fa8f1cad973849dcd576eb5995ac585f71bd9563
                                                                          • Instruction ID: 57a710f7211706a9fe31a66cfd9e96bb7129449c188aa58f507e00ff06fc2ee7
                                                                          • Opcode Fuzzy Hash: 2d88bd622d4eed4683b29214fa8f1cad973849dcd576eb5995ac585f71bd9563
                                                                          • Instruction Fuzzy Hash: 63316D74204B818FC320CF55C844B97B7E8BF88754F148A4DE5969B790C7B9F849CB99
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00415100 Relevance: 6.1, APIs: 4, Instructions: 66COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 00415125
                                                                            • Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
                                                                            • Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
                                                                            • Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42
                                                                          • __CxxThrowException@8.LIBCMT ref: 00415143
                                                                            • Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27
                                                                          • _malloc.LIBCMT ref: 0041516C
                                                                          • __CxxThrowException@8.LIBCMT ref: 00415188
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw_malloc$AllocateExceptionHeapRaise
                                                                          • String ID:
                                                                          • API String ID: 82271797-0
                                                                          • Opcode ID: 628c01bc56a7d7ebefc01971975c629e826112fae3ae03c7ba76f33a046b030a
                                                                          • Instruction ID: def4db18d05b99ab4d6b26ffbfca84adb2a4381ad4f7d30a934532bce5ddbadc
                                                                          • Opcode Fuzzy Hash: 628c01bc56a7d7ebefc01971975c629e826112fae3ae03c7ba76f33a046b030a
                                                                          • Instruction Fuzzy Hash: 0A217CB1A04751AFC320DF1AC881A4AFBE4FF9C714F508A2EF49983350D739A945CB96
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00408A00 Relevance: 6.1, APIs: 4, Instructions: 61COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetWindowTextLengthW.USER32 ref: 00408A15
                                                                          • GetLastError.KERNEL32 ref: 00408A21
                                                                          • GetWindowTextW.USER32(?,?,00000001), ref: 00408A4B
                                                                          • GetLastError.KERNEL32 ref: 00408A77
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLastTextWindow$Length
                                                                          • String ID:
                                                                          • API String ID: 3440162706-0
                                                                          • Opcode ID: e8e012cd79b6b6bd25b8c7b73373170b438c3aa796ec5f42770a3d37ac7ff58f
                                                                          • Instruction ID: b6694d03e0650564e1b12933c6f234b168eb3154b6e7cc2141c97879f5f5d7ed
                                                                          • Opcode Fuzzy Hash: e8e012cd79b6b6bd25b8c7b73373170b438c3aa796ec5f42770a3d37ac7ff58f
                                                                          • Instruction Fuzzy Hash: 9C118B352145128FDB24DF38F94491BB3E5EFD4710714957EE086D3B94EB34E882CA94
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00415450 Relevance: 6.0, APIs: 4, Instructions: 36synchronizationCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00415462
                                                                          • SetEvent.KERNEL32(?), ref: 00415484
                                                                          • GetLastError.KERNEL32 ref: 0041548A
                                                                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00415492
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ObjectSingleWait$ErrorEventLast
                                                                          • String ID:
                                                                          • API String ID: 3117263442-0
                                                                          • Opcode ID: 6a9d534bb34e468436ed8922fd9e4c3005a7b31566cd882573cdaab6cdfd99fd
                                                                          • Instruction ID: d9c54cf6459ccd85d0f03389fa364b2fe510f0e71b5d1dca3e53b888f90a5fab
                                                                          • Opcode Fuzzy Hash: 6a9d534bb34e468436ed8922fd9e4c3005a7b31566cd882573cdaab6cdfd99fd
                                                                          • Instruction Fuzzy Hash: E0F03675104B059FD720DB69DD40A5BB3E86B89630B104B19E265933A0C774F8818758
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00412B00 Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorEventLastReset
                                                                          • String ID:
                                                                          • API String ID: 1621066496-0
                                                                          • Opcode ID: f7a27fea00bfa5551196a168a4661de4bb9f1662255f7ccbc6010f2a403cdef1
                                                                          • Instruction ID: 67aa9b638b15eb6519ceb2daf01db011a7dda1e32d9d81611401a8271e3f4563
                                                                          • Opcode Fuzzy Hash: f7a27fea00bfa5551196a168a4661de4bb9f1662255f7ccbc6010f2a403cdef1
                                                                          • Instruction Fuzzy Hash: 74F0827A600705CF8734AF6AEE80857B7F8EF88251301487ADA55D3211D7B4F895CBA8
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00427ECD Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __getptd.LIBCMT ref: 00427ED9
                                                                            • Part of subcall function 004244E3: __getptd_noexit.LIBCMT ref: 004244E6
                                                                            • Part of subcall function 004244E3: __amsg_exit.LIBCMT ref: 004244F3
                                                                          • __getptd.LIBCMT ref: 00427EF0
                                                                          • __amsg_exit.LIBCMT ref: 00427EFE
                                                                          • __lock.LIBCMT ref: 00427F0E
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                                                          • String ID:
                                                                          • API String ID: 3521780317-0
                                                                          • Opcode ID: 05403a0301a6ba57545f7ca89f60679739f76aad3f481758a75143d10c6437fd
                                                                          • Instruction ID: 33523e4aa4e58cc1d750080c8846bc6e86dc2b4c69a7a1b864837c0295b8a662
                                                                          • Opcode Fuzzy Hash: 05403a0301a6ba57545f7ca89f60679739f76aad3f481758a75143d10c6437fd
                                                                          • Instruction Fuzzy Hash: 66F09632B0C3309AD721BB65B50675D73A0AF40728F92415FE450A73D1CBBC5A01DB9E
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00411BA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 00411BC8
                                                                            • Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
                                                                            • Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
                                                                            • Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42
                                                                          • __CxxThrowException@8.LIBCMT ref: 00411BE4
                                                                            • Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
                                                                          • String ID: AC
                                                                          • API String ID: 2732643326-3250319772
                                                                          • Opcode ID: 934699a12a52b3141aafc0e45caf1c944e9b6928602c3da0ff549bbca788445f
                                                                          • Instruction ID: ab5f602e63adf12e9f9b42bdfad0bbc760dd87d5a89e028d2f0e125979789b22
                                                                          • Opcode Fuzzy Hash: 934699a12a52b3141aafc0e45caf1c944e9b6928602c3da0ff549bbca788445f
                                                                          • Instruction Fuzzy Hash: 9A11E1B12047018FC324DF19D881B57B3E4EB88714F004A2EE596C73A1E738E848CB96
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040C030 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 0040C082
                                                                            • Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
                                                                            • Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
                                                                            • Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42
                                                                          • __CxxThrowException@8.LIBCMT ref: 0040C09E
                                                                            • Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
                                                                          • String ID: C&B
                                                                          • API String ID: 2732643326-3599845651
                                                                          • Opcode ID: 5f8e0597f3182be47e06ce787f4affd8efcdedbadb727185b073082a8d2aa648
                                                                          • Instruction ID: 673f2574accb9efc1f410de1bcad0332c86955ef32305ba439929ca51ee66969
                                                                          • Opcode Fuzzy Hash: 5f8e0597f3182be47e06ce787f4affd8efcdedbadb727185b073082a8d2aa648
                                                                          • Instruction Fuzzy Hash: B62167B1604B42EFC314CF5AD880A46FBF8FB88714F508A2FE15883740D379A959CBA5
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0042DF4E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0042D933: __getptd.LIBCMT ref: 0042D939
                                                                            • Part of subcall function 0042D933: __getptd.LIBCMT ref: 0042D949
                                                                          • __getptd.LIBCMT ref: 0042DF5D
                                                                            • Part of subcall function 004244E3: __getptd_noexit.LIBCMT ref: 004244E6
                                                                            • Part of subcall function 004244E3: __amsg_exit.LIBCMT ref: 004244F3
                                                                          • __getptd.LIBCMT ref: 0042DF6B
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: __getptd$__amsg_exit__getptd_noexit
                                                                          • String ID: csm
                                                                          • API String ID: 803148776-1018135373
                                                                          • Opcode ID: 199eeb7c63e04620263b730f4c137685cbdcdb6679406dd5ea4a7cea4fc582b9
                                                                          • Instruction ID: bf84cde6f23fa0aa79f4f710d2ea78ec4cd8ee9a8d4c5decabd064020991354a
                                                                          • Opcode Fuzzy Hash: 199eeb7c63e04620263b730f4c137685cbdcdb6679406dd5ea4a7cea4fc582b9
                                                                          • Instruction Fuzzy Hash: EB012874E002248ECF34EF21F640AAEB3F5AF50315F96442FE08256691CB788AA1CA5D
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00418220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 00418227
                                                                            • Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
                                                                            • Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
                                                                            • Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42
                                                                          • __CxxThrowException@8.LIBCMT ref: 00418245
                                                                            • Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
                                                                          • String ID: C&B
                                                                          • API String ID: 2732643326-3599845651
                                                                          • Opcode ID: 0018449c9cc5969ef64ad9f66a75052b5252505b41bac9490c8dbc4052e981ae
                                                                          • Instruction ID: 3e576634322811acd3d1ac759d3a191cb1e7305ee3e78df6768dc5e4f091bde8
                                                                          • Opcode Fuzzy Hash: 0018449c9cc5969ef64ad9f66a75052b5252505b41bac9490c8dbc4052e981ae
                                                                          • Instruction Fuzzy Hash: 79E022B09007106AC7215BE098012C7B7D0AB46754F01ED5FF68587201CB7CA408879A
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00416490 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 00416493
                                                                            • Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
                                                                            • Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
                                                                            • Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42
                                                                          • __CxxThrowException@8.LIBCMT ref: 004164B1
                                                                            • Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.2251463851.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 00000000.00000002.2251393061.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251513495.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251597557.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.2251634798.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
                                                                          • String ID: C&B
                                                                          • API String ID: 2732643326-3599845651
                                                                          • Opcode ID: 03b8cf24b1c06656392e758bb381557a573019dbe4851daa8f3d5fbae38c5826
                                                                          • Instruction ID: 11d43d463d30091cd7fc968f8fd7abacb3bf7297c3e1db42a875208d6af1d08c
                                                                          • Opcode Fuzzy Hash: 03b8cf24b1c06656392e758bb381557a573019dbe4851daa8f3d5fbae38c5826
                                                                          • Instruction Fuzzy Hash: 5AE092F05083409ECB088F14E80A887BBE4AB45304F06D4AFF4098B363C778D509CB5E
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Execution Graph

                                                                          Execution Coverage:8.4%
                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                          Signature Coverage:0.5%
                                                                          Total number of Nodes:2000
                                                                          Total number of Limit Nodes:32
                                                                          execution_graph 39183 1000e070 39184 1000e082 39183->39184 39187 1000e08c 39183->39187 39185 10012a20 VirtualAlloc 39184->39185 39185->39187 39186 1000e093 39187->39186 39188 10002f54 101 API calls 39187->39188 39188->39187 36774 10005761 36775 1000577f 36774->36775 36776 1000576e 36774->36776 36776->36775 36780 100057a0 36776->36780 36781 100057aa __EH_prolog 36780->36781 36795 100015ec 36781->36795 36786 100015ec ctype 29 API calls 36787 100057f0 36786->36787 36788 100015a7 ctype 29 API calls 36787->36788 36789 100057fb 36788->36789 36804 100033a2 29 API calls 2 library calls 36789->36804 36791 10005779 36792 1000109b 36791->36792 36839 100189ee 36792->36839 36805 10001601 36795->36805 36798 100015a7 36799 100015ce 36798->36799 36800 100015ec ctype 29 API calls 36799->36800 36801 100015d6 36800->36801 36802 1000109b ctype 29 API calls 36801->36802 36803 100015de 36802->36803 36803->36786 36804->36791 36808 10005905 36805->36808 36806 100015f3 36806->36798 36810 1000591c 36808->36810 36809 10005954 36809->36806 36810->36809 36812 1000109b ctype 29 API calls 36810->36812 36813 100039c8 36810->36813 36812->36810 36814 100039d2 __EH_prolog 36813->36814 36815 100015a7 ctype 29 API calls 36814->36815 36816 100039ed 36815->36816 36817 100015a7 ctype 29 API calls 36816->36817 36818 100039fc 36817->36818 36819 100015ec ctype 29 API calls 36818->36819 36820 10003a16 36819->36820 36821 100015a7 ctype 29 API calls 36820->36821 36822 10003a21 36821->36822 36823 100015ec ctype 29 API calls 36822->36823 36824 10003a38 36823->36824 36825 100015a7 ctype 29 API calls 36824->36825 36826 10003a43 36825->36826 36829 10003600 36826->36829 36830 1000360a __EH_prolog 36829->36830 36831 100015a7 ctype 29 API calls 36830->36831 36832 10003620 36831->36832 36833 100015a7 ctype 29 API calls 36832->36833 36834 1000362c 36833->36834 36835 100015a7 ctype 29 API calls 36834->36835 36836 10003638 36835->36836 36837 100015a7 ctype 29 API calls 36836->36837 36838 10003644 36837->36838 36838->36810 36840 100010a4 36839->36840 36841 10018a1c 36839->36841 36840->36775 36842 10018a61 36841->36842 36843 10018a26 36841->36843 36844 10018a52 36842->36844 36859 1001a13a 29 API calls ctype 36842->36859 36856 1001a13a 29 API calls ctype 36843->36856 36844->36840 36846 10018aba HeapFree 36844->36846 36846->36840 36848 10018a6d ctype 36851 10018a99 36848->36851 36860 1001b2c3 VirtualFree HeapFree VirtualFree ctype 36848->36860 36849 10018a2d ctype 36853 10018a47 36849->36853 36857 1001a53c VirtualFree VirtualFree HeapFree ctype 36849->36857 36861 10018ab0 LeaveCriticalSection ctype 36851->36861 36858 10018a58 LeaveCriticalSection ctype 36853->36858 36856->36849 36857->36853 36858->36844 36859->36848 36860->36851 36861->36844 36862 6cec3c8e 36866 6cec3bd7 36862->36866 36863 6cec3d60 36865 6cec3c62 36866->36863 36867 6ceb82b0 36866->36867 36972 6ceaf940 36867->36972 36869 6ceb8305 36870 6ceb8329 36869->36870 37182 6cec663b RaiseException 36869->37182 36980 6cea4dd0 36870->36980 36875 6ceb8340 36990 6cea3be0 36875->36990 36878 6ceb8395 37005 6cea42e0 36878->37005 36885 6ceb83d0 37069 6ceb6cc0 36885->37069 36889 6ceb846d 37088 6ceb72f0 36889->37088 36892 6ceb8498 36910 6ceb84b7 36892->36910 37187 6cec663b RaiseException 36892->37187 36893 6ceb841b 36893->36889 37186 6cec663b RaiseException 36893->37186 36895 6ceb8834 37093 6ceb09e0 36895->37093 36897 6ceb8c70 37146 6ceb4c00 36897->37146 36899 6ceb883b 37098 6ceb0880 36899->37098 36900 6ceb8819 37200 6cec663b RaiseException 36900->37200 36901 6ceb8d65 37214 6cec663b RaiseException 36901->37214 36903 6ceb8cfe 37212 6cec663b RaiseException 36903->37212 36906 6ceb8ce9 37211 6cec663b RaiseException 36906->37211 36907 6ceb8cb4 36907->36903 36907->36906 36911 6ceb8d19 36907->36911 37210 6cec663b RaiseException 36907->37210 36908 6ceb8d80 37215 6cec663b RaiseException 36908->37215 36910->36895 36910->36897 36910->36900 37188 6cece5ce 68 API calls 6 library calls 36910->37188 36911->36901 36914 6ceb8d4a 36911->36914 36923 6ceb8af7 36911->36923 37213 6cec663b RaiseException 36914->37213 36915 6ceb8d9d 37216 6cec663b RaiseException 36915->37216 36919 6ceb8db8 37217 6cec663b RaiseException 36919->37217 36920 6ceb8531 36930 6ceb854a 36920->36930 37189 6ceb93a0 68 API calls __crtGetStringTypeA_stat 36920->37189 36922 6ceb8dd3 37206 6ceb8de0 67 API calls 36923->37206 36926 6ceb8b71 36926->36865 36928 6ceb89c1 36929 6ceb89eb 36928->36929 37201 6cea5290 68 API calls 2 library calls 36928->37201 37106 6cea8ab0 36929->37106 37190 6ceba7b0 CharUpperW CharUpperW 36930->37190 36934 6ceb866d 36936 6ceb868c 36934->36936 36937 6ceb8671 36934->36937 36935 6ceb8aa3 36938 6ceb8aae 36935->36938 36939 6ceb8c55 36935->36939 37192 6cebb9c0 214 API calls __CxxThrowException@8 36936->37192 37191 6cec663b RaiseException 36937->37191 36947 6ceb8b95 36938->36947 36950 6ceb8ad8 36938->36950 37209 6cec663b RaiseException 36939->37209 36940 6ceb8a88 37204 6cec663b RaiseException 36940->37204 36945 6ceb8a6d 37203 6cec663b RaiseException 36945->37203 36946 6ceb8a3e 36946->36935 36946->36938 36946->36940 36946->36945 37202 6cec663b RaiseException 36946->37202 36966 6ceb8bb4 36947->36966 37207 6cec663b RaiseException 36947->37207 36949 6ceb8728 36955 6ceb87fe 36949->36955 36956 6ceb8733 36949->36956 36950->36923 37205 6cec663b RaiseException 36950->37205 36953 6ceb86b2 36953->36949 36954 6ceb870d 36953->36954 36953->36956 36957 6ceb86f2 36953->36957 37193 6cec663b RaiseException 36953->37193 37195 6cec663b RaiseException 36954->37195 37199 6cec663b RaiseException 36955->37199 36964 6ceb8752 36956->36964 37196 6cec663b RaiseException 36956->37196 37194 6cec663b RaiseException 36957->37194 37197 6ceb8270 EnterCriticalSection LeaveCriticalSection 36964->37197 37208 6ceb8de0 67 API calls 36966->37208 36968 6ceb8c2e 36968->36865 36969 6ceb8796 37198 6ceb8de0 67 API calls 36969->37198 36971 6ceb87da 36971->36865 36973 6ceaf97d 36972->36973 37218 6cea8180 36973->37218 36975 6ceaf9be 37222 6ceb02c0 36975->37222 36978 6ceaf9de 36979 6ceafb0c 36978->36979 37226 6cea4d10 68 API calls 2 library calls 36978->37226 36979->36869 36985 6cea4de9 36980->36985 36981 6cea4e2a 36983 6cea4e60 36981->36983 37230 6cec55f0 __VEC_memcpy 36981->37230 36986 6ceb7df0 36983->36986 36985->36981 37229 6cec5ff4 67 API calls 6 library calls 36985->37229 36987 6ceb7e4b 36986->36987 37231 6ceb7c10 36987->37231 36989 6ceb7ecb 36989->36875 37241 6ceafc80 36990->37241 36992 6cea3c1c 37246 6cec53fe 36992->37246 36996 6cea3c2d 36997 6cec53fe __fileno 67 API calls 36996->36997 36998 6cea3c43 36997->36998 36999 6cec539a __write_nolock 67 API calls 36998->36999 37000 6cea3c49 36999->37000 37001 6cec53fe __fileno 67 API calls 37000->37001 37002 6cea3c5f 37001->37002 37003 6cec539a __write_nolock 67 API calls 37002->37003 37004 6cea3c65 37003->37004 37004->36878 37183 6cec663b RaiseException 37004->37183 37010 6cea431b 37005->37010 37007 6cea3cf0 CharUpperW RaiseException 37007->37010 37008 6cea2d80 99 API calls 37008->37010 37010->37007 37010->37008 37011 6cea2670 RaiseException 37010->37011 37012 6cea4579 37010->37012 37014 6cea4583 37010->37014 37015 6cea474d 37010->37015 37033 6cea4936 CharUpperW 37010->37033 37049 6cea46c7 37010->37049 37268 6cea26e0 37010->37268 37302 6cea2940 87 API calls __CxxThrowException@8 37010->37302 37011->37010 37303 6cea2670 RaiseException __CxxThrowException@8 37012->37303 37016 6cea45c8 37014->37016 37304 6cea2d80 99 API calls 37014->37304 37311 6cea3750 75 API calls 37015->37311 37019 6cea45f1 37016->37019 37305 6cea2d80 99 API calls 37016->37305 37022 6cea460d 37019->37022 37306 6cebe950 70 API calls __CxxThrowException@8 37019->37306 37020 6cea475f 37312 6cea39a0 68 API calls 37020->37312 37272 6cea3250 37022->37272 37027 6cebed50 70 API calls 37029 6cea4a74 37027->37029 37051 6cec5f2a 37029->37051 37031 6cea466f 37280 6cea3e70 37031->37280 37032 6cea4623 37307 6cea4d10 68 API calls 2 library calls 37032->37307 37033->37010 37034 6cea487b 37039 6cea3250 75 API calls 37034->37039 37036 6cea4814 37036->37034 37041 6cea485a 37036->37041 37314 6cec663b RaiseException 37036->37314 37039->37049 37040 6cea476c 37040->37036 37313 6cea4b20 __VEC_memcpy _memmove_s 37040->37313 37041->37034 37315 6cec663b RaiseException 37041->37315 37042 6cea464e 37308 6cea4d10 68 API calls 2 library calls 37042->37308 37047 6cea465b 37047->37049 37309 6cea39a0 68 API calls 37047->37309 37048 6cea469b 37048->37049 37310 6cec663b RaiseException 37048->37310 37049->37027 37052 6cec5fdd 37051->37052 37063 6cec5f3c 37051->37063 37455 6cec9494 6 API calls __decode_pointer 37052->37455 37054 6cec5fe3 37456 6cec7f70 67 API calls __getptd_noexit 37054->37456 37057 6ceb83b6 37057->36885 37184 6cec663b RaiseException 37057->37184 37060 6cec5f99 RtlAllocateHeap 37060->37063 37061 6cec5f4d 37061->37063 37448 6cec6fbb 67 API calls 2 library calls 37061->37448 37449 6cec6e10 67 API calls 7 library calls 37061->37449 37450 6cec7814 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 37061->37450 37063->37057 37063->37060 37063->37061 37064 6cec5fc9 37063->37064 37067 6cec5fce 37063->37067 37451 6cec5edb 67 API calls 4 library calls 37063->37451 37452 6cec9494 6 API calls __decode_pointer 37063->37452 37453 6cec7f70 67 API calls __getptd_noexit 37064->37453 37454 6cec7f70 67 API calls __getptd_noexit 37067->37454 37084 6ceb6d1e 37069->37084 37070 6ceb6fe8 37071 6ceb7001 37070->37071 37072 6ceb6ff5 37070->37072 37476 6ceb5c80 16 API calls 37071->37476 37457 6ceb69e0 37072->37457 37075 6ceb700b 37078 6ceb69e0 79 API calls 37075->37078 37076 6cec51c7 __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 37077 6ceb7139 37076->37077 37077->36893 37185 6cec663b RaiseException 37077->37185 37080 6ceb703f 37078->37080 37087 6ceb6ffc 37080->37087 37477 6ceb6b40 86 API calls 37080->37477 37081 6cec55f0 __VEC_memcpy _memmove_s 37081->37084 37084->37070 37084->37081 37474 6ceb6280 68 API calls 37084->37474 37475 6ceb7860 68 API calls 2 library calls 37084->37475 37085 6ceb7094 37085->37087 37478 6ceb6b40 86 API calls 37085->37478 37087->37076 37091 6ceb7329 37088->37091 37090 6ceb73fa 37090->36892 37091->37090 37092 6ceb0880 RaiseException 37091->37092 37504 6ceb07d0 CharUpperW CharUpperW 37091->37504 37092->37091 37094 6cec5f2a _malloc 67 API calls 37093->37094 37095 6ceb09ed 37094->37095 37096 6ceb0a07 37095->37096 37505 6cec663b RaiseException 37095->37505 37096->36899 37099 6ceb088d 37098->37099 37105 6ceb08fc _realloc 37098->37105 37100 6ceb08aa 37099->37100 37506 6cec663b RaiseException 37099->37506 37102 6ceb08d2 37100->37102 37507 6cec663b RaiseException 37100->37507 37102->37105 37508 6cec663b RaiseException 37102->37508 37105->36928 37115 6cea8b3d 37106->37115 37107 6cea8ca8 37108 6cec5f2a _malloc 67 API calls 37107->37108 37109 6cea8cb5 37108->37109 37110 6cea8cfd 37109->37110 37568 6cec663b RaiseException 37109->37568 37509 6cea8400 37110->37509 37111 6ceb2470 9 API calls 37111->37115 37114 6cea8ccf 37569 6cec663b RaiseException 37114->37569 37115->37107 37115->37111 37115->37114 37116 6cea8bf8 FindClose 37115->37116 37118 6cea8ce6 37115->37118 37119 6ceb0880 RaiseException 37115->37119 37116->37115 37570 6cec663b RaiseException 37118->37570 37119->37115 37121 6ceb2470 9 API calls 37142 6cea8d0f 37121->37142 37122 6cea8e9f FindClose 37122->37142 37123 6cea9969 37577 6cec663b RaiseException 37123->37577 37125 6cea9980 37128 6cea966c 37573 6cea82a0 37128->37573 37130 6cea970e 37131 6cea82a0 97 API calls 37130->37131 37145 6cea8d9f 37131->37145 37132 6cea97ad 37136 6cea82a0 97 API calls 37132->37136 37135 6ceb7240 CharUpperW CharUpperW 37135->37142 37136->37145 37138 6cea9813 37141 6cea82a0 97 API calls 37138->37141 37139 6cea9d00 RaiseException 37139->37142 37140 6cea98be 37143 6cea82a0 97 API calls 37140->37143 37141->37145 37142->37121 37142->37122 37142->37123 37142->37128 37142->37130 37142->37132 37142->37135 37142->37138 37142->37139 37142->37140 37144 6cea82a0 97 API calls 37142->37144 37142->37145 37515 6cea9f10 37142->37515 37520 6ceacae0 37142->37520 37539 6cea8670 37142->37539 37571 6ceb07d0 CharUpperW CharUpperW 37142->37571 37572 6cec55f0 __VEC_memcpy 37142->37572 37143->37145 37144->37142 37145->36946 37147 6ceb52a9 37146->37147 37181 6ceb4c52 37146->37181 37147->36907 37148 6ceb2470 9 API calls 37148->37181 37149 6ceb4cdf FindClose 37149->37181 37150 6ceacae0 169 API calls 37150->37181 37151 6ceb5327 37159 6cea82a0 97 API calls 37151->37159 37152 6ceb5315 38850 6cec663b RaiseException 37152->38850 37153 6ceb52eb 37157 6ceb5303 37153->37157 38848 6cec663b RaiseException 37153->38848 37154 6ceb52c1 37154->37151 37154->37152 37154->37153 38847 6cec663b RaiseException 37154->38847 38849 6cec663b RaiseException 37157->38849 37160 6ceb5349 37159->37160 37160->36907 37163 6ceb5364 37164 6cea82a0 97 API calls 37163->37164 37165 6ceb5386 37164->37165 37165->36907 37166 6cea82a0 97 API calls 37166->37181 37167 6ceaabe0 VariantClear 37167->37181 37168 6ceaab10 VariantClear 37168->37181 37169 6ceb539e 37171 6cea82a0 97 API calls 37169->37171 37170 6cebe6e0 72 API calls 37170->37181 37173 6ceb53cd 37171->37173 37172 6ceb53e5 37174 6cea82a0 97 API calls 37172->37174 37173->36907 37175 6ceb5414 37174->37175 37175->36907 37176 6ceb4a10 VariantClear RaiseException 37176->37181 37178 6ceb4b60 VariantClear 37178->37181 37181->37147 37181->37148 37181->37149 37181->37150 37181->37154 37181->37163 37181->37166 37181->37167 37181->37168 37181->37169 37181->37170 37181->37172 37181->37176 37181->37178 38810 6ceb5440 37181->38810 38822 6ceb4ac0 37181->38822 38830 6cec6308 37181->38830 38840 6ceb5560 37181->38840 37182->36870 37183->36878 37184->36885 37185->36893 37186->36889 37187->36910 37188->36920 37189->36930 37190->36934 37191->36936 37192->36953 37193->36957 37194->36954 37195->36949 37196->36964 37197->36969 37198->36971 37199->36900 37200->36895 37201->36928 37202->36945 37203->36940 37204->36935 37205->36923 37206->36926 37207->36966 37208->36968 37209->36897 37210->36906 37211->36903 37212->36911 37213->36901 37214->36908 37215->36915 37216->36919 37217->36922 37219 6cea8209 37218->37219 37220 6cea8194 37218->37220 37219->36975 37220->37219 37227 6cec55f0 __VEC_memcpy 37220->37227 37223 6ceb02d0 37222->37223 37224 6ceb032a 37223->37224 37228 6cec55f0 __VEC_memcpy 37223->37228 37224->36978 37226->36978 37227->37219 37228->37224 37229->36985 37230->36983 37232 6ceb7c7f 37231->37232 37235 6cec1230 37232->37235 37236 6cec5f2a _malloc 67 API calls 37235->37236 37237 6cec125d 37236->37237 37238 6ceb7d20 37237->37238 37240 6cec663b RaiseException 37237->37240 37238->36989 37240->37238 37242 6ceafc9a 37241->37242 37245 6ceafd05 37241->37245 37242->37245 37261 6ceafd20 70 API calls __CxxThrowException@8 37242->37261 37262 6cea4d10 68 API calls 2 library calls 37242->37262 37245->36992 37247 6cec540d 37246->37247 37248 6cea3c27 37246->37248 37263 6cec7f70 67 API calls __getptd_noexit 37247->37263 37252 6cec539a 37248->37252 37250 6cec5412 37264 6cec5bb2 6 API calls 2 library calls 37250->37264 37253 6cec53b6 37252->37253 37254 6cec53a7 37252->37254 37257 6cec53da 37253->37257 37266 6cec7f70 67 API calls __getptd_noexit 37253->37266 37265 6cec7f70 67 API calls __getptd_noexit 37254->37265 37256 6cec53ac 37256->36996 37257->36996 37259 6cec53ca 37267 6cec5bb2 6 API calls 2 library calls 37259->37267 37261->37242 37262->37242 37263->37250 37265->37256 37266->37259 37269 6cea2720 37268->37269 37270 6cea2745 CharUpperW 37269->37270 37271 6cea276e 37270->37271 37271->37010 37273 6cea3279 37272->37273 37274 6cea3258 37272->37274 37276 6cebed50 37273->37276 37274->37273 37316 6cea3070 37274->37316 37278 6cebed5a 37276->37278 37277 6cea461d 37277->37031 37277->37032 37278->37277 37367 6cebe7f0 70 API calls 37278->37367 37368 6ceb4320 37280->37368 37282 6cea3f6f 37283 6cea41a5 37282->37283 37286 6cea3f83 37282->37286 37387 6cec663b RaiseException 37283->37387 37285 6cea41ba 37287 6cea401c 37286->37287 37382 6cea4d10 68 API calls 2 library calls 37286->37382 37296 6cea4047 37287->37296 37383 6cec663b RaiseException 37287->37383 37289 6cea40cf 37386 6cead620 CharUpperW CharUpperW RaiseException 37289->37386 37292 6cea40f6 37293 6ceb0880 RaiseException 37292->37293 37295 6cea4104 37293->37295 37297 6ceb0880 RaiseException 37295->37297 37296->37289 37384 6ceb1df0 CharUpperW CharUpperW GetFullPathNameW GetFullPathNameW lstrlenW 37296->37384 37385 6cea4d10 68 API calls 2 library calls 37296->37385 37300 6cea410f 37297->37300 37299 6cea4d10 68 API calls 37299->37300 37300->37299 37301 6cea414c 37300->37301 37301->37047 37302->37010 37303->37014 37304->37016 37305->37019 37306->37022 37307->37042 37308->37047 37309->37048 37310->37049 37311->37020 37312->37040 37313->37036 37314->37041 37315->37034 37329 6cea3030 37316->37329 37319 6cea3030 10 API calls 37320 6cea30b3 37319->37320 37321 6cea30d9 37320->37321 37333 6cea2f70 37320->37333 37322 6cea31ce 37321->37322 37326 6ceb0880 RaiseException 37321->37326 37328 6cea5a70 68 API calls 37321->37328 37337 6ceb07d0 CharUpperW CharUpperW 37321->37337 37323 6cea3235 37322->37323 37327 6cea3070 75 API calls 37322->37327 37323->37274 37326->37321 37327->37322 37328->37321 37330 6cea306a 37329->37330 37331 6cea303b 37329->37331 37330->37319 37331->37330 37332 6cea2f70 10 API calls 37331->37332 37332->37331 37334 6cea2fef 37333->37334 37335 6cea2fa2 37333->37335 37334->37320 37335->37334 37338 6ceb25a0 37335->37338 37337->37321 37343 6ceb2470 37338->37343 37341 6ceb25e9 FindClose 37342 6ceb25f0 37341->37342 37342->37334 37344 6ceb24d8 FindFirstFileW 37343->37344 37345 6ceb24c3 FindClose 37343->37345 37347 6ceb24eb 37344->37347 37348 6ceb2542 37344->37348 37346 6ceb24d2 37345->37346 37345->37348 37346->37344 37354 6ceb28a0 37347->37354 37358 6cec51c7 37348->37358 37350 6ceb2589 37350->37341 37350->37342 37352 6ceb251d 37352->37348 37353 6ceb2534 FindFirstFileW 37352->37353 37353->37348 37355 6ceb28e4 37354->37355 37356 6ceb298b GetCurrentDirectoryW 37355->37356 37357 6ceb29a4 37355->37357 37356->37357 37357->37352 37359 6cec51cf 37358->37359 37360 6cec51d1 IsDebuggerPresent 37358->37360 37359->37350 37366 6cec84c5 37360->37366 37363 6cec6ba3 SetUnhandledExceptionFilter UnhandledExceptionFilter 37364 6cec6bc8 GetCurrentProcess TerminateProcess 37363->37364 37365 6cec6bc0 __invoke_watson 37363->37365 37364->37350 37365->37364 37366->37363 37367->37278 37369 6ceb43cb 37368->37369 37370 6ceb437a 37368->37370 37371 6ceb0880 RaiseException 37369->37371 37370->37369 37377 6ceb441d 37370->37377 37388 6ceb35f0 37370->37388 37431 6ceb3460 68 API calls 37370->37431 37373 6ceb43d5 37371->37373 37375 6ceb0880 RaiseException 37373->37375 37376 6ceb43e0 37375->37376 37378 6ceb0880 RaiseException 37376->37378 37377->37282 37379 6ceb43eb 37378->37379 37380 6ceb0880 RaiseException 37379->37380 37381 6ceb43f6 37380->37381 37381->37282 37382->37286 37383->37296 37384->37296 37385->37296 37386->37292 37387->37285 37390 6ceb3628 37388->37390 37389 6ceb4303 37389->37370 37390->37389 37422 6ceb36e8 37390->37422 37430 6ceb3e62 37390->37430 37391 6ceb2470 9 API calls 37391->37422 37393 6ceb2470 9 API calls 37409 6ceb3a79 37393->37409 37394 6ceb37c3 FindClose 37394->37422 37395 6ceb4213 GetLastError 37396 6ceb4225 GetLastError 37395->37396 37404 6ceb426f 37395->37404 37399 6ceb4257 37396->37399 37400 6ceb4234 37396->37400 37397 6ceb37d1 GetLastError 37397->37422 37398 6ceb3b47 FindClose 37398->37409 37446 6cea4d10 68 API calls 2 library calls 37399->37446 37406 6ceb0880 RaiseException 37400->37406 37402 6cea4d10 68 API calls 37402->37422 37403 6ceb3c19 GetLastError 37403->37409 37410 6ceb42ac 37404->37410 37411 6ceb42a5 FindClose 37404->37411 37406->37399 37407 6cea4d10 68 API calls 37407->37409 37409->37393 37409->37398 37409->37403 37409->37407 37413 6ceb0880 RaiseException 37409->37413 37419 6ceb3db4 37409->37419 37436 6ceb34f0 85 API calls 37409->37436 37410->37370 37411->37410 37412 6ceb42c4 37414 6ceb42fa FindClose 37412->37414 37415 6ceb4301 37412->37415 37413->37409 37414->37415 37415->37389 37417 6ceb0880 RaiseException 37417->37430 37419->37370 37420 6cebe790 70 API calls 37420->37430 37422->37391 37422->37394 37422->37397 37422->37402 37422->37409 37424 6ceb0880 RaiseException 37422->37424 37429 6ceb3ba9 37422->37429 37432 6cebe790 70 API calls 37422->37432 37433 6ceb31d0 68 API calls 37422->37433 37434 6cebe370 CharUpperW CharUpperW 37422->37434 37435 6ceb34f0 85 API calls 37422->37435 37424->37422 37427 6cea4d10 68 API calls 37427->37430 37429->37370 37430->37395 37430->37412 37430->37417 37430->37420 37430->37427 37437 6ceb2790 10 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 37430->37437 37438 6ceb31d0 68 API calls 37430->37438 37439 6cebe370 CharUpperW CharUpperW 37430->37439 37440 6cea5bb0 37430->37440 37445 6ceb34f0 85 API calls 37430->37445 37431->37370 37432->37422 37433->37422 37434->37422 37435->37422 37436->37409 37437->37430 37438->37430 37439->37430 37441 6ceb0880 RaiseException 37440->37441 37444 6cea5bc8 37441->37444 37442 6cea5be6 37442->37430 37444->37442 37447 6cea4d10 68 API calls 2 library calls 37444->37447 37445->37430 37446->37404 37447->37444 37448->37061 37449->37061 37451->37063 37452->37063 37453->37067 37454->37057 37455->37054 37456->37057 37458 6ceb6a0f LoadLibraryExW 37457->37458 37459 6ceb6a3e 37457->37459 37460 6ceb6a22 37458->37460 37461 6ceb6a37 FreeLibrary 37458->37461 37479 6ceb7750 37459->37479 37460->37087 37461->37459 37464 6ceb6ae9 37464->37087 37465 6ceb6a83 FreeLibrary 37466 6ceb6a97 GetProcAddress 37465->37466 37467 6ceb6a8e 37465->37467 37466->37464 37468 6ceb6ab5 37466->37468 37467->37466 37486 6ceb5f50 GetProcAddress 37468->37486 37471 6ceb6acc 37494 6ceb6530 73 API calls 2 library calls 37471->37494 37473 6ceb6ad8 37473->37464 37474->37084 37475->37084 37476->37075 37477->37085 37478->37087 37480 6cec5f2a _malloc 67 API calls 37479->37480 37481 6ceb7762 37480->37481 37482 6ceb777e 37481->37482 37495 6cec663b RaiseException 37481->37495 37484 6ceb6a54 37482->37484 37485 6ceb0880 RaiseException 37482->37485 37484->37464 37484->37465 37484->37466 37485->37484 37487 6ceb601a 37486->37487 37488 6ceb5f90 GetProcAddress 37486->37488 37490 6cec51c7 __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 37487->37490 37489 6ceb5fa5 37488->37489 37489->37487 37492 6ceb5e80 VariantClear 37489->37492 37496 6ceb77e0 37489->37496 37491 6ceb6029 37490->37491 37491->37464 37491->37471 37492->37489 37494->37473 37495->37482 37497 6cec5f2a _malloc 67 API calls 37496->37497 37498 6ceb77eb 37497->37498 37501 6ceb7808 37498->37501 37503 6cec663b RaiseException 37498->37503 37499 6ceb7843 37499->37489 37501->37499 37502 6ceb0880 RaiseException 37501->37502 37502->37499 37503->37501 37504->37091 37505->37096 37506->37100 37507->37102 37508->37105 37510 6cea8473 37509->37510 37511 6cec5f2a _malloc 67 API calls 37510->37511 37512 6cea84fb 37511->37512 37514 6cea8515 37512->37514 37578 6cec663b RaiseException 37512->37578 37514->37142 37516 6ceb0880 RaiseException 37515->37516 37518 6cea9f2e 37516->37518 37517 6cea9f81 37517->37142 37518->37517 37519 6ceb0880 RaiseException 37518->37519 37519->37518 37521 6cec5f2a _malloc 67 API calls 37520->37521 37522 6ceacb1d 37521->37522 37524 6ceacb35 37522->37524 37593 6cec663b RaiseException 37522->37593 37537 6ceacc8c 37524->37537 37594 6ceb1df0 CharUpperW CharUpperW GetFullPathNameW GetFullPathNameW lstrlenW 37524->37594 37526 6ceacbcc 37527 6ceacbd3 GetLastError 37526->37527 37534 6ceacc24 37526->37534 37531 6ceacbe4 37527->37531 37529 6ceaccbc 37532 6ceaccc2 37529->37532 37596 6cea4d10 68 API calls 2 library calls 37529->37596 37531->37142 37532->37142 37595 6ceaa910 11 API calls __CxxThrowException@8 37534->37595 37535 6ceacd2e 37538 6ceacd7e 37535->37538 37597 6cea4d10 68 API calls 2 library calls 37535->37597 37579 6ceac430 37537->37579 37538->37142 37540 6cea86cf 37539->37540 37541 6cea87cd 37539->37541 37540->37541 37543 6ceaabe0 VariantClear 37540->37543 37565 6cea86e1 37540->37565 38172 6ceaab10 37540->38172 38184 6cebe6e0 37540->38184 38189 6cea9d00 RaiseException 37540->38189 37547 6cea87d9 37541->37547 38050 6ceaa5c0 37541->38050 37543->37540 37544 6cea88d1 38055 6cea99d0 37544->38055 37547->37142 37548 6cea88e5 37550 6cea8931 37548->37550 38061 6ceb1420 37548->38061 38074 6cea5e10 37550->38074 37553 6cea890f 37553->37550 37555 6cea8916 GetLastError 37553->37555 37554 6cea8967 38078 6cead1b0 37554->38078 38190 6cec663b RaiseException 37555->38190 37559 6cea8974 37560 6cea8a3c 37559->37560 37562 6cea89e1 37559->37562 37559->37565 38088 100061aa 37560->38088 38126 10005aa5 37560->38126 37561 6cea8a26 37563 6ceb2e40 VariantClear 37561->37563 37562->37561 38191 6ceb2f70 RaiseException __CxxThrowException@8 37562->38191 37563->37565 37565->37142 37568->37114 37569->37118 37570->37110 37571->37142 37572->37142 37574 6cea82d4 37573->37574 37575 6cea82e8 37573->37575 37574->37575 38736 10006b2c 37574->38736 37575->37145 37577->37125 37578->37514 37591 6ceac46b 37579->37591 37580 6ceac88a 37583 6ceb2e40 VariantClear 37580->37583 37582 6ceacaa1 37584 6ceb2e40 VariantClear 37582->37584 37585 6ceac893 37583->37585 37592 6ceac860 37584->37592 37585->37529 37586 6ceace60 68 API calls 37586->37591 37591->37529 37591->37580 37591->37582 37591->37586 37591->37592 37598 6ceac2d0 37591->37598 37614 6ceb2e40 37591->37614 37618 6ceaabe0 37591->37618 37640 6ceaae70 37591->37640 37685 6ceaad90 VariantClear 37591->37685 37592->37529 37593->37524 37594->37526 37595->37537 37596->37535 37597->37535 37599 6ceac351 37598->37599 37600 6ceac311 37598->37600 37601 6cec5f2a _malloc 67 API calls 37599->37601 37602 6cec5f2a _malloc 67 API calls 37600->37602 37604 6ceac358 37601->37604 37603 6ceac318 37602->37603 37612 6ceac334 37603->37612 37696 6cec663b RaiseException 37603->37696 37605 6ceac374 37604->37605 37697 6cec663b RaiseException 37604->37697 37686 6ceb2a70 37605->37686 37609 6ceaae70 164 API calls 37613 6ceac3d3 37609->37613 37610 6ceac3b8 37611 6ceac3bc GetLastError 37610->37611 37610->37612 37611->37613 37612->37609 37613->37591 37615 6ceb2e4b 37614->37615 37616 6ceb2e65 VariantClear 37614->37616 37615->37616 37617 6ceb2e59 37615->37617 37616->37591 37617->37591 37619 6ceaac34 37618->37619 37620 6ceaac3a 37619->37620 37624 6ceaac59 37619->37624 37621 6ceb2e40 VariantClear 37620->37621 37623 6ceaac43 37621->37623 37622 6ceaad61 37625 6ceb2e40 VariantClear 37622->37625 37623->37591 37624->37622 37626 6ceb2e40 VariantClear 37624->37626 37627 6ceaad6a 37625->37627 37629 6ceaac9a 37626->37629 37627->37591 37628 6ceaad4b 37628->37591 37629->37628 37630 6ceaacfe 37629->37630 37631 6ceaacdf 37629->37631 37632 6ceaad3d 37630->37632 37637 6ceaad09 37630->37637 37633 6ceb2e40 VariantClear 37631->37633 37632->37622 37635 6ceaad42 37632->37635 37634 6ceaace8 37633->37634 37634->37591 37636 6ceb2e40 VariantClear 37635->37636 37636->37628 37638 6ceb2e40 VariantClear 37637->37638 37639 6ceaad27 37638->37639 37639->37591 37645 6ceaaecd 37640->37645 37641 6ceaafba 37642 6ceb0880 RaiseException 37641->37642 37650 6ceaafca 37642->37650 37643 6ceaafe4 37644 6ceab0e3 37643->37644 37649 6ceb0880 RaiseException 37643->37649 37742 6ceb07d0 CharUpperW CharUpperW 37643->37742 37743 6ceb0930 __VEC_memcpy RaiseException _memmove_s 37643->37743 37652 6ceab734 37644->37652 37654 6ceab1a8 37644->37654 37681 6ceab0fa 37644->37681 37744 6ceb07d0 CharUpperW CharUpperW 37644->37744 37645->37641 37645->37643 37648 6ceab19d 37648->37652 37648->37654 37649->37643 37664 6ceabe65 37650->37664 37650->37681 37698 6cea1ab0 37650->37698 37706 100089ec 37650->37706 37712 1000790d 37650->37712 37653 6ceab6ea 37652->37653 37666 6ceab915 37652->37666 37652->37681 37746 6ceb07d0 CharUpperW CharUpperW 37652->37746 37653->37650 37661 6ceab9e7 37653->37661 37749 6ceb07d0 CharUpperW CharUpperW 37653->37749 37654->37681 37745 6ceace00 __VEC_memcpy _memmove_s 37654->37745 37655 6cec51c7 __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 37656 6ceabd53 37655->37656 37656->37591 37659 6ceab6c4 37663 6cea9f10 RaiseException 37659->37663 37661->37650 37750 6ceb07d0 CharUpperW CharUpperW 37661->37750 37663->37653 37665 6ceabee7 VariantClear 37664->37665 37673 6ceabef4 37664->37673 37664->37681 37665->37673 37747 6ceb0990 __VEC_memcpy _memmove_s 37666->37747 37667 6ceab639 37667->37659 37669 6ceb0880 RaiseException 37667->37669 37669->37667 37670 6ceab923 37748 6ceb0930 __VEC_memcpy RaiseException _memmove_s 37670->37748 37672 6ceab3c7 _memset 37672->37667 37675 6ceb0880 RaiseException 37672->37675 37672->37681 37678 6ceac0f3 37673->37678 37679 6ceabf38 37673->37679 37674 6ceac122 37753 6cea80f0 CharUpperW CharUpperW __VEC_memcpy 37674->37753 37675->37672 37678->37674 37752 6ceb07d0 CharUpperW CharUpperW 37678->37752 37751 6cea80f0 CharUpperW CharUpperW __VEC_memcpy 37679->37751 37681->37655 37685->37591 37687 6ceb2a9e CloseHandle 37686->37687 37688 6ceb2ab3 CreateFileW 37686->37688 37689 6ceb2aad 37687->37689 37690 6ceb2b57 37687->37690 37691 6ceb2ad9 37688->37691 37692 6ceb2b33 37688->37692 37689->37688 37690->37610 37693 6ceb28a0 GetCurrentDirectoryW 37691->37693 37692->37610 37694 6ceb2b00 37693->37694 37694->37692 37695 6ceb2b15 CreateFileW 37694->37695 37695->37692 37696->37612 37697->37605 37699 6cea1ac3 37698->37699 37700 6cea1ad0 SetFilePointer 37698->37700 37699->37650 37701 6cea1b0b 37700->37701 37702 6cea1b01 GetLastError 37700->37702 37703 6cea1b2f GetLastError 37701->37703 37704 6cea1b25 37701->37704 37702->37701 37705 6cea1b35 37703->37705 37704->37650 37705->37650 37707 100089fd 37706->37707 37711 6cea1ab0 3 API calls 37707->37711 37708 10008a11 37709 10008a21 37708->37709 37754 100087ae 37708->37754 37709->37650 37711->37708 37713 10007917 __EH_prolog 37712->37713 37714 100015ec ctype 29 API calls 37713->37714 37715 10007939 37714->37715 37716 100089ec 35 API calls 37715->37716 37717 1000798e 37716->37717 37718 10007995 37717->37718 37719 100079c8 37717->37719 37801 10007ad6 29 API calls 2 library calls 37718->37801 37791 100012b5 37719->37791 37725 10007a40 37803 10009f5e 30 API calls ctype 37725->37803 37726 10007a02 37728 1000109b ctype 29 API calls 37726->37728 37729 10007a0a 37728->37729 37802 10007ad6 29 API calls 2 library calls 37729->37802 37730 10007a47 37804 10009fa0 30 API calls ctype 37730->37804 37733 100079a1 37733->37650 37734 10007a4e 37805 10009ff5 30 API calls ctype 37734->37805 37736 10007a55 37737 1000109b ctype 29 API calls 37736->37737 37738 10007a68 37737->37738 37806 10007ad6 29 API calls 2 library calls 37738->37806 37740 10007a75 37807 1000a8eb 30 API calls 2 library calls 37740->37807 37742->37643 37743->37643 37744->37648 37745->37672 37746->37652 37747->37670 37748->37653 37749->37653 37750->37661 37751->37681 37752->37678 37753->37681 37755 100087b8 __EH_prolog 37754->37755 37762 10002f32 37755->37762 37757 100087d1 37760 100087e4 37757->37760 37765 10002e98 37757->37765 37759 1000109b ctype 29 API calls 37759->37760 37760->37709 37761 1000880a ctype 37761->37759 37771 10002ee6 37762->37771 37766 10002ed9 37765->37766 37767 10002ea5 37765->37767 37766->37761 37768 10002eb0 ctype 37767->37768 37782 10001075 37767->37782 37770 1000109b ctype 29 API calls 37768->37770 37770->37766 37772 10002efa 37771->37772 37773 10002f29 37772->37773 37775 6cea19c0 37772->37775 37773->37757 37776 6cea19cd 37775->37776 37777 6cea19d2 ReadFile 37775->37777 37776->37777 37778 6cea19fd 37777->37778 37779 6cea1a0c GetLastError 37778->37779 37780 6cea1a06 37778->37780 37781 6cea1a16 37779->37781 37780->37772 37781->37772 37787 1001887a 37782->37787 37785 10001099 37785->37768 37788 1001888c ctype 29 API calls 37787->37788 37789 10001080 37788->37789 37789->37785 37790 100189b4 RaiseException 37789->37790 37790->37785 37792 100012c5 37791->37792 37795 100012f5 37791->37795 37793 10001075 30 API calls 37792->37793 37794 100012cf 37793->37794 37794->37795 37796 1000109b ctype 29 API calls 37794->37796 37797 1000a496 37795->37797 37796->37795 37798 1000a4a0 __EH_prolog 37797->37798 37808 1000a0ce 37798->37808 37801->37733 37802->37733 37803->37730 37804->37734 37805->37736 37806->37740 37807->37733 37809 1000a0d8 __EH_prolog 37808->37809 37851 10007b7e 37809->37851 37813 1000a11d 37814 1000a27a 37813->37814 37819 1000a170 37813->37819 37831 1000a1ee 37814->37831 37959 1000856a RaiseException 37814->37959 37816 100079fc 37816->37725 37816->37726 37817 1000a2da 37817->37816 37818 10002e98 30 API calls 37817->37818 37820 1000a2ff 37818->37820 37819->37816 37822 10002f32 2 API calls 37819->37822 37821 10002f32 2 API calls 37820->37821 37824 1000a30c 37821->37824 37822->37831 37823 1000109b ctype 29 API calls 37823->37816 37825 1000a35b 37824->37825 37844 1000a310 37824->37844 37960 1000856a RaiseException 37824->37960 37864 10008505 37825->37864 37830 1000a396 37832 1000a42a 37830->37832 37833 1000a3b1 37830->37833 37961 1000856a RaiseException 37830->37961 37831->37816 37850 6cea1ab0 3 API calls 37831->37850 37873 10009824 37832->37873 37962 1000948e 158 API calls 2 library calls 37833->37962 37837 1000a3d9 37838 100015ec ctype 29 API calls 37837->37838 37839 1000a45b 37838->37839 37842 100015a7 ctype 29 API calls 37839->37842 37840 1000a3d5 37840->37837 37841 1000a3fe 37840->37841 37963 1000856a RaiseException 37840->37963 37845 10008505 30 API calls 37841->37845 37842->37844 37844->37823 37846 1000a414 37845->37846 37847 10008617 RaiseException 37846->37847 37848 1000a41c 37847->37848 37848->37832 37964 1000856a RaiseException 37848->37964 37850->37817 37965 10007bd9 37851->37965 37854 100015ec ctype 29 API calls 37855 10007b91 37854->37855 37856 100015ec ctype 29 API calls 37855->37856 37857 10007b9c 37856->37857 37858 100015ec ctype 29 API calls 37857->37858 37859 10007ba7 37858->37859 37860 100015ec ctype 29 API calls 37859->37860 37861 10007bb2 37860->37861 37862 100015ec ctype 29 API calls 37861->37862 37863 10007bbd 37862->37863 37863->37813 37958 1000856a RaiseException 37863->37958 37996 10008491 37864->37996 37867 10008617 37868 1000862a 37867->37868 37870 1000862f 37867->37870 38000 1000856a RaiseException 37868->38000 37872 1000868a 37870->37872 38001 1000856a RaiseException 37870->38001 37872->37830 37874 1000982e __EH_prolog 37873->37874 37875 10008617 RaiseException 37874->37875 37876 10009841 37875->37876 37879 1000986b 37876->37879 38010 10008a48 RaiseException 37876->38010 37878 10009863 37880 10008617 RaiseException 37878->37880 37886 100098e8 37879->37886 38011 1000948e 158 API calls 2 library calls 37879->38011 37880->37879 37882 100098b6 37883 100098ba 37882->37883 37884 10008617 RaiseException 37882->37884 37885 100015ec ctype 29 API calls 37883->37885 37884->37886 37887 10009a49 37885->37887 37890 10009944 37886->37890 37907 1000999d 37886->37907 37889 100015a7 ctype 29 API calls 37887->37889 37888 10009995 37891 100015ec ctype 29 API calls 37888->37891 37957 10009a55 37889->37957 38002 100092ee 37890->38002 37894 100099fe 37891->37894 37892 100040e5 30 API calls 37892->37907 37897 10009a06 37894->37897 37898 10009a5c 37894->37898 37896 10008617 RaiseException 37896->37888 37900 100015a7 ctype 29 API calls 37897->37900 37901 10009a6c 37898->37901 38015 1000856a RaiseException 37898->38015 37903 10009a15 37900->37903 38016 100086b3 37901->38016 37906 100015a7 ctype 29 API calls 37903->37906 37909 10009a24 37906->37909 37907->37888 37907->37892 38012 10006206 RaiseException 37907->38012 38013 100034b0 30 API calls 37907->38013 38014 10006398 30 API calls 37907->38014 37957->37837 37958->37813 37959->37831 37960->37825 37961->37833 37962->37840 37963->37841 37964->37832 37966 100015ec ctype 29 API calls 37965->37966 37967 10007be2 37966->37967 37968 100015ec ctype 29 API calls 37967->37968 37969 10007bea 37968->37969 37970 100015ec ctype 29 API calls 37969->37970 37971 10007bf2 37970->37971 37972 100015ec ctype 29 API calls 37971->37972 37973 10007bfa 37972->37973 37974 100015ec ctype 29 API calls 37973->37974 37975 10007c02 37974->37975 37976 100015ec ctype 29 API calls 37975->37976 37977 10007c0a 37976->37977 37978 100015ec ctype 29 API calls 37977->37978 37979 10007c14 37978->37979 37980 100015ec ctype 29 API calls 37979->37980 37981 10007c1c 37980->37981 37982 100015ec ctype 29 API calls 37981->37982 37983 10007c29 37982->37983 37984 100015ec ctype 29 API calls 37983->37984 37985 10007c31 37984->37985 37986 100015ec ctype 29 API calls 37985->37986 37987 10007c3e 37986->37987 37988 100015ec ctype 29 API calls 37987->37988 37989 10007c46 37988->37989 37990 100015ec ctype 29 API calls 37989->37990 37991 10007c53 37990->37991 37992 100015ec ctype 29 API calls 37991->37992 37993 10007c5b 37992->37993 37994 100015ec ctype 29 API calls 37993->37994 37995 10007b86 37994->37995 37995->37854 37997 10008499 37996->37997 37998 100084b4 30 API calls 37997->37998 37999 100084ac 37998->37999 37999->37867 38000->37870 38001->37870 38007 100092f5 38002->38007 38003 10008617 RaiseException 38003->38007 38004 10009365 38004->37896 38005 10008d1a 30 API calls 38005->38007 38006 10008ddd 30 API calls 38006->38007 38007->38003 38007->38004 38007->38005 38007->38006 38008 1000856a RaiseException 38007->38008 38009 10009028 30 API calls 38007->38009 38008->38007 38009->38007 38010->37878 38011->37882 38012->37907 38013->37907 38014->37907 38015->37901 38017 10008617 RaiseException 38016->38017 38018 100086b9 38017->38018 38192 6ceaa2f0 38050->38192 38052 6ceaa5fc 38197 6ceaa240 38052->38197 38054 6ceaa60d 38054->37544 38056 6cea99e4 38055->38056 38057 6cea99ed 38055->38057 38056->37548 38058 6cea99fe 38057->38058 38212 6cec55f0 __VEC_memcpy 38057->38212 38213 6cea9e80 __VEC_memcpy _memmove_s 38057->38213 38058->37548 38064 6ceb1454 38061->38064 38062 6ceb14ca 38214 6ceb1340 CreateDirectoryW 38062->38214 38064->38062 38067 6ceb1659 38064->38067 38223 6cec55f0 __VEC_memcpy 38064->38223 38066 6ceb1528 GetLastError 38068 6ceb1520 38066->38068 38069 6ceb1630 38066->38069 38067->37553 38068->38066 38068->38067 38070 6ceb1655 38068->38070 38073 6ceb1340 4 API calls 38068->38073 38071 6ceb25a0 10 API calls 38069->38071 38070->38067 38072 6ceb1340 4 API calls 38070->38072 38071->38070 38072->38070 38073->38068 38075 6cea5e5d 38074->38075 38076 6cea5bb0 68 API calls 38075->38076 38077 6cea5f27 38076->38077 38077->37554 38085 6cead1ec 38078->38085 38086 6cead487 38078->38086 38079 6cead415 38082 6ceb0880 RaiseException 38079->38082 38079->38086 38082->38079 38084 6ceb2e40 VariantClear 38084->38085 38085->38079 38085->38084 38085->38086 38224 6cead100 SysAllocString VariantClear RaiseException 38085->38224 38225 6cea4d10 68 API calls 2 library calls 38085->38225 38226 6ceb2ec0 VariantClear VariantCopy __VEC_memcpy _memmove_s 38085->38226 38227 6cec663b RaiseException 38085->38227 38086->37559 38106 10005ce0 38088->38106 38089 10005d05 38092 10006305 29 API calls 38089->38092 38090 10005d3a 38228 10006305 38090->38228 38091 10001075 30 API calls 38091->38106 38093 10005c59 38092->38093 38096 100015ec ctype 29 API calls 38093->38096 38098 10005c61 38096->38098 38100 100015a7 ctype 29 API calls 38098->38100 38103 10005c6d 38100->38103 38102 10005e06 38104 10006305 29 API calls 38102->38104 38103->37565 38105 10005e37 38104->38105 38107 100015ec ctype 29 API calls 38105->38107 38106->38089 38106->38090 38106->38091 38106->38102 38111 100069d4 99 API calls 38106->38111 38112 10006040 38106->38112 38114 10005f4b 38106->38114 38117 10005fcd 38106->38117 38119 100060b5 38106->38119 38238 100066c2 38106->38238 38242 10004859 38106->38242 38384 1000657a 30 API calls __EH_prolog 38106->38384 38109 10005e4a 38107->38109 38110 100015a7 ctype 29 API calls 38109->38110 38110->38103 38111->38106 38113 10006305 29 API calls 38112->38113 38115 10005f86 38113->38115 38116 10006305 29 API calls 38114->38116 38120 100015ec ctype 29 API calls 38115->38120 38116->38115 38118 10006305 29 API calls 38117->38118 38118->38115 38121 10006305 29 API calls 38119->38121 38122 10005f99 38120->38122 38124 100060f3 38121->38124 38123 100015a7 ctype 29 API calls 38122->38123 38123->38103 38385 100063c7 29 API calls 2 library calls 38124->38385 38136 10005aaf __EH_prolog 38126->38136 38128 10005c4e 38131 100015ec ctype 29 API calls 38128->38131 38129 10005c39 38129->38128 38132 10001075 30 API calls 38129->38132 38130 100063ff 30 API calls 38130->38136 38133 10005c61 38131->38133 38151 10005c9f 38132->38151 38137 100015a7 ctype 29 API calls 38133->38137 38134 100015a7 29 API calls ctype 38134->38136 38136->38129 38136->38130 38136->38134 38156 10005aff 38136->38156 38711 10006293 30 API calls __EH_prolog 38136->38711 38712 10006206 RaiseException 38136->38712 38713 10006398 30 API calls 38136->38713 38137->38156 38139 10005d05 38142 10006305 29 API calls 38139->38142 38140 10005d3a 38143 10006305 29 API calls 38140->38143 38141 10001075 30 API calls 38141->38151 38142->38128 38145 10005d55 38143->38145 38714 100063c7 29 API calls 2 library calls 38145->38714 38147 100066c2 99 API calls 38147->38151 38148 10005e06 38149 10006305 29 API calls 38148->38149 38150 10005e37 38149->38150 38152 100015ec ctype 29 API calls 38150->38152 38151->38139 38151->38140 38151->38141 38151->38147 38151->38148 38153 10004859 158 API calls 38151->38153 38157 100069d4 99 API calls 38151->38157 38158 10005f4b 38151->38158 38159 10006040 38151->38159 38163 10005fcd 38151->38163 38165 100060b5 38151->38165 38715 1000657a 30 API calls __EH_prolog 38151->38715 38154 10005e4a 38152->38154 38153->38151 38155 100015a7 ctype 29 API calls 38154->38155 38155->38156 38156->37565 38157->38151 38162 10006305 29 API calls 38158->38162 38160 10006305 29 API calls 38159->38160 38161 10005f86 38160->38161 38166 100015ec ctype 29 API calls 38161->38166 38162->38161 38164 10006305 29 API calls 38163->38164 38164->38161 38167 10006305 29 API calls 38165->38167 38168 10005f99 38166->38168 38170 100060f3 38167->38170 38169 100015a7 ctype 29 API calls 38168->38169 38169->38156 38716 100063c7 29 API calls 2 library calls 38170->38716 38173 6ceaab66 38172->38173 38174 6ceaab88 38173->38174 38175 6ceaab6c 38173->38175 38176 6ceaab93 38174->38176 38179 6ceaabbf 38174->38179 38177 6ceb2e40 VariantClear 38175->38177 38180 6ceb2e40 VariantClear 38176->38180 38178 6ceaab75 38177->38178 38178->37540 38181 6ceb2e40 VariantClear 38179->38181 38182 6ceaaba7 38180->38182 38183 6ceaabc8 38181->38183 38182->37540 38183->37540 38185 6cebdf80 68 API calls 38184->38185 38186 6cebe72f 38185->38186 38717 6cebe590 38186->38717 38188 6cebe745 38188->37540 38189->37540 38190->37550 38191->37561 38194 6ceaa310 38192->38194 38193 6ceaa338 38193->38052 38194->38193 38207 6cea9ff0 __VEC_memcpy _memmove_s 38194->38207 38196 6ceaa32c 38196->38052 38198 6ceaa250 38197->38198 38199 6ceaa2b7 38198->38199 38203 6ceaa2e1 38198->38203 38208 6ceb07d0 CharUpperW CharUpperW 38198->38208 38209 6ceaa110 __VEC_memcpy 38198->38209 38210 6ceaa1c0 CharUpperW CharUpperW __VEC_memcpy 38199->38210 38202 6ceaa2c5 38202->38203 38211 6ceaa1c0 CharUpperW CharUpperW __VEC_memcpy 38202->38211 38203->38054 38205 6ceaa2d7 38205->38054 38207->38196 38208->38198 38209->38198 38210->38202 38211->38205 38212->38057 38213->38057 38215 6ceb1378 38214->38215 38216 6ceb138c GetLastError 38214->38216 38215->38068 38217 6ceb13ff 38216->38217 38218 6ceb1399 38216->38218 38217->38068 38219 6ceb28a0 GetCurrentDirectoryW 38218->38219 38220 6ceb13bf 38219->38220 38220->38217 38221 6ceb13d1 CreateDirectoryW 38220->38221 38222 6ceb13e5 38221->38222 38222->38068 38223->38062 38224->38085 38225->38085 38226->38085 38227->38085 38229 1000630f __EH_prolog 38228->38229 38230 100015ec ctype 29 API calls 38229->38230 38231 10006333 38230->38231 38232 100015a7 ctype 29 API calls 38231->38232 38233 1000633e 38232->38233 38234 100015a7 ctype 29 API calls 38233->38234 38235 10006364 38234->38235 38386 100033a2 29 API calls 2 library calls 38235->38386 38237 10005d55 38383 100063c7 29 API calls 2 library calls 38237->38383 38239 100066eb 38238->38239 38387 1000688a 38239->38387 38243 10004863 __EH_prolog 38242->38243 38530 100081ef 38243->38530 38245 1000487b 38345 10004f5e 38245->38345 38547 10017690 InitializeCriticalSection 38245->38547 38247 100049a8 38548 100054e2 38247->38548 38249 100049df 38251 100015ec ctype 29 API calls 38249->38251 38360 10004bb4 38249->38360 38250 10001075 30 API calls 38253 100048a7 38250->38253 38252 10004a08 38251->38252 38254 10001075 30 API calls 38252->38254 38272 10004a29 38252->38272 38253->38247 38253->38250 38588 10003f9b 30 API calls __EH_prolog 38253->38588 38254->38272 38257 10004a74 38260 100015a7 ctype 29 API calls 38257->38260 38258 10004ba5 38593 10005815 30 API calls ctype 38258->38593 38261 10004a83 38260->38261 38589 100033a2 29 API calls 2 library calls 38261->38589 38265 100053b3 38276 1000163d 30 API calls 38265->38276 38266 10005357 38269 100015a7 ctype 29 API calls 38266->38269 38267 10004a92 DeleteCriticalSection 38285 10004aa7 38267->38285 38268 10004e20 38278 100015a7 ctype 29 API calls 38268->38278 38271 10005366 38269->38271 38270 1000504d 38274 100015a7 ctype 29 API calls 38270->38274 38605 100033a2 29 API calls 2 library calls 38271->38605 38272->38257 38298 10004abc 38272->38298 38280 1000506a 38274->38280 38275 10004ef8 38283 100015a7 ctype 29 API calls 38275->38283 38282 100053dc 38276->38282 38277 10004e8b 38303 100015a7 ctype 29 API calls 38277->38303 38284 10004e51 38278->38284 38279 10005375 DeleteCriticalSection 38279->38285 38598 100033a2 29 API calls 2 library calls 38280->38598 38281 1000508e 38294 100015a7 ctype 29 API calls 38281->38294 38288 100053fc 38282->38288 38606 100040e5 38282->38606 38290 10004f18 38283->38290 38595 100033a2 29 API calls 2 library calls 38284->38595 38286 100015ec ctype 29 API calls 38285->38286 38292 100053a0 38286->38292 38568 10012a20 38288->38568 38571 10017570 38288->38571 38577 1000367f 38288->38577 38289 10005169 38308 100015a7 ctype 29 API calls 38289->38308 38597 100033a2 29 API calls 2 library calls 38290->38597 38300 100015a7 ctype 29 API calls 38292->38300 38293 10005079 DeleteCriticalSection 38293->38281 38304 100050c1 38294->38304 38296 1000541f 38305 100015a7 ctype 29 API calls 38296->38305 38298->38258 38298->38268 38298->38275 38298->38277 38560 10001c8a 38298->38560 38590 10003a70 30 API calls 38298->38590 38591 10003a95 30 API calls 38298->38591 38592 10005966 30 API calls __EH_prolog 38298->38592 38299 10004e60 DeleteCriticalSection 38370 10004e75 38299->38370 38300->38345 38309 10004ebc 38303->38309 38599 100033a2 29 API calls 2 library calls 38304->38599 38312 10005430 38305->38312 38306 10004f27 DeleteCriticalSection 38314 10004f3c 38306->38314 38315 10005186 38308->38315 38596 100033a2 29 API calls 2 library calls 38309->38596 38310 100050fb 38319 100015a7 ctype 29 API calls 38310->38319 38609 100056b6 29 API calls 2 library calls 38312->38609 38313 100051c2 SysFreeString 38322 100051d6 38313->38322 38326 100015ec ctype 29 API calls 38314->38326 38601 100033a2 29 API calls 2 library calls 38315->38601 38317 100050d0 DeleteCriticalSection 38317->38370 38325 1000511b 38319->38325 38329 100015a7 ctype 29 API calls 38322->38329 38323 10004ecb DeleteCriticalSection 38323->38370 38324 1000543f 38610 100056eb DeleteCriticalSection 38324->38610 38600 100033a2 29 API calls 2 library calls 38325->38600 38333 10004f52 38326->38333 38327 100015ec ctype 29 API calls 38334 10005298 38327->38334 38328 10005195 DeleteCriticalSection 38328->38370 38335 100051eb 38329->38335 38332 10002e98 30 API calls 38332->38360 38340 100015a7 ctype 29 API calls 38333->38340 38341 100015a7 ctype 29 API calls 38334->38341 38602 100033a2 29 API calls 2 library calls 38335->38602 38337 1000163d 30 API calls 38337->38360 38338 1000544a 38611 10003f63 29 API calls 2 library calls 38338->38611 38339 1000512a DeleteCriticalSection 38344 1000513f 38339->38344 38340->38345 38341->38345 38342 100051fa DeleteCriticalSection 38342->38370 38346 100015ec ctype 29 API calls 38344->38346 38345->38106 38347 10005155 38346->38347 38350 100015a7 ctype 29 API calls 38347->38350 38348 1000521f 38349 1000109b ctype 29 API calls 38348->38349 38352 10005224 38349->38352 38350->38345 38351 1000109b ctype 29 API calls 38351->38360 38353 1000109b ctype 29 API calls 38352->38353 38355 10005233 SysFreeString 38353->38355 38354 1000109b ctype 29 API calls 38356 10004d6e SysFreeString 38354->38356 38358 10005249 38355->38358 38356->38360 38357 100040e5 30 API calls 38357->38360 38362 100015a7 ctype 29 API calls 38358->38362 38359 100015a7 29 API calls ctype 38359->38360 38360->38270 38360->38281 38360->38289 38360->38310 38360->38313 38360->38332 38360->38337 38360->38348 38360->38351 38360->38354 38360->38357 38360->38359 38361 100052a9 38360->38361 38363 10005043 38360->38363 38594 1000124b 30 API calls 38360->38594 38365 100015a7 ctype 29 API calls 38361->38365 38364 1000525e 38362->38364 38564 10003db9 38363->38564 38603 100033a2 29 API calls 2 library calls 38364->38603 38367 100052b8 38365->38367 38369 100015a7 ctype 29 API calls 38367->38369 38368 1000526d DeleteCriticalSection 38368->38370 38371 100052c7 38369->38371 38370->38327 38372 100015a7 ctype 29 API calls 38371->38372 38373 100052d6 38372->38373 38604 100033a2 29 API calls 2 library calls 38373->38604 38375 100052e5 DeleteCriticalSection 38376 100052fa 38375->38376 38377 100015ec ctype 29 API calls 38376->38377 38378 10005310 38377->38378 38379 100015a7 ctype 29 API calls 38378->38379 38379->38345 38383->38103 38384->38106 38385->38103 38386->38237 38388 1000688d 38387->38388 38389 10006706 38388->38389 38392 1000670b 38388->38392 38396 1000684d 8 API calls 38388->38396 38389->38106 38393 10006715 __EH_prolog 38392->38393 38397 6cea6460 38393->38397 38394 10006762 38394->38388 38396->38388 38398 6cea64a0 38397->38398 38399 6ceaabe0 VariantClear 38398->38399 38400 6cea6522 38399->38400 38401 6cea6528 38400->38401 38402 6ceaab10 VariantClear 38400->38402 38401->38394 38404 6cea655c 38402->38404 38403 6cea6565 38403->38394 38404->38403 38405 6cea65bd 38404->38405 38406 6cea65e7 38404->38406 38408 6ceb2e40 VariantClear 38405->38408 38407 6cea6623 38406->38407 38409 6cea65f6 38406->38409 38410 6ceb2e40 VariantClear 38407->38410 38411 6cea65c5 38408->38411 38412 6ceb2e40 VariantClear 38409->38412 38413 6cea663f 38410->38413 38411->38394 38482 6cea65fe 38412->38482 38414 6ceaab10 VariantClear 38413->38414 38415 6cea6651 38414->38415 38416 6cea665a 38415->38416 38485 6cea63a0 38415->38485 38416->38394 38418 6cea6683 38419 6cea6689 38418->38419 38420 6cea66c4 38418->38420 38518 6cebe770 72 API calls 38418->38518 38419->38394 38422 6cea673c 38420->38422 38423 6cea66ec 38420->38423 38480 6cea6fdb 38420->38480 38426 6cea6791 38422->38426 38427 6cea6767 38422->38427 38424 6ceb09e0 68 API calls 38423->38424 38431 6cea66f3 38424->38431 38425 6ceb09e0 68 API calls 38443 6cea70cd 38425->38443 38428 6cea679b 38426->38428 38430 6cea716a 38426->38430 38429 6ceb2e40 VariantClear 38427->38429 38433 6ceb2e40 VariantClear 38428->38433 38432 6cea676f 38429->38432 38434 6ceb2e40 VariantClear 38430->38434 38431->38394 38432->38394 38435 6cea67bf 38433->38435 38447 6cea688e 38434->38447 38495 6cea62b0 38435->38495 38437 6cea67d5 38438 6cea67db 38437->38438 38439 6cea62b0 VariantClear 38437->38439 38438->38394 38440 6cea6810 38439->38440 38440->38411 38441 6cea62b0 VariantClear 38440->38441 38442 6cea682d 38441->38442 38442->38403 38444 6ceaab10 VariantClear 38442->38444 38443->38394 38445 6cea6850 38444->38445 38445->38403 38507 6cebdf80 38445->38507 38447->38394 38448 6cea68ad 38449 6cea4dd0 67 API calls 38448->38449 38450 6cea68c0 38449->38450 38513 6ceaa360 38450->38513 38453 6cea6884 38453->38447 38453->38448 38520 6ceb07d0 CharUpperW CharUpperW 38453->38520 38454 6cea68c9 38459 6cea69f7 38454->38459 38519 6cea6250 CreateDirectoryW GetLastError CreateDirectoryW GetCurrentDirectoryW 38454->38519 38456 6cea6a28 38481 6cea6a42 38456->38481 38522 6ceb1140 RemoveDirectoryW RemoveDirectoryW GetCurrentDirectoryW 38456->38522 38457 6cea6a86 38461 6ceb25a0 10 API calls 38457->38461 38462 6cea6c89 38457->38462 38458 6ceb09e0 68 API calls 38478 6cea6e99 38458->38478 38459->38456 38459->38457 38479 6cea6aaa 38461->38479 38462->38458 38462->38480 38462->38482 38463 6ceb2a70 4 API calls 38463->38480 38464 6cea6931 38464->38459 38465 6cea69e1 38464->38465 38521 6ceb0f70 CreateFileW CreateFileW SetFileTime CloseHandle GetCurrentDirectoryW 38465->38521 38466 6cea6c81 38523 6cea10e0 10 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 38466->38523 38467 6cea6d35 38468 6cea6d3e 38467->38468 38469 6cea6ebf 38467->38469 38524 6cea10e0 10 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 38468->38524 38526 6ceb17b0 SetFileAttributesW SetFileAttributesW DeleteFileW DeleteFileW GetCurrentDirectoryW 38469->38526 38473 6cea69f4 38473->38459 38475 6cea6d55 38476 6cea6dc8 38475->38476 38475->38482 38525 6ceb1210 MoveFileW MoveFileW GetCurrentDirectoryW 38476->38525 38478->38463 38479->38462 38479->38466 38479->38467 38479->38478 38479->38481 38480->38425 38480->38443 38481->38394 38482->38394 38483 6cea6ecb 38483->38478 38483->38481 38484 6cea6dd5 38484->38462 38484->38483 38486 6cea63f7 38485->38486 38487 6cea6419 38486->38487 38488 6cea63fd 38486->38488 38489 6cea6435 38487->38489 38527 6ceb2f70 RaiseException __CxxThrowException@8 38487->38527 38490 6ceb2e40 VariantClear 38488->38490 38492 6ceb2e40 VariantClear 38489->38492 38493 6cea6406 38490->38493 38494 6cea644a 38492->38494 38493->38418 38494->38418 38496 6cea6309 38495->38496 38497 6cea630f 38496->38497 38498 6cea632d 38496->38498 38499 6ceb2e40 VariantClear 38497->38499 38500 6cea637b 38498->38500 38502 6cea6338 38498->38502 38501 6cea6318 38499->38501 38504 6ceb2e40 VariantClear 38500->38504 38501->38437 38503 6ceb2e40 VariantClear 38502->38503 38505 6cea6361 38503->38505 38506 6cea6384 38504->38506 38505->38437 38506->38437 38512 6cebdfb7 38507->38512 38508 6cebdfda 38508->38453 38509 6cebe021 38529 6cea4d10 68 API calls 2 library calls 38509->38529 38512->38508 38512->38509 38528 6cea4d10 68 API calls 2 library calls 38512->38528 38514 6ceaa51c 38513->38514 38517 6ceaa399 38513->38517 38514->38454 38515 6ceaa2f0 __VEC_memcpy 38515->38517 38516 6ceaa240 3 API calls 38516->38517 38517->38514 38517->38515 38517->38516 38518->38420 38519->38464 38520->38453 38521->38473 38522->38481 38523->38462 38524->38475 38525->38484 38526->38484 38527->38489 38528->38512 38529->38508 38531 100081f9 __EH_prolog 38530->38531 38546 100083a5 38531->38546 38612 1000841c 30 API calls ctype 38531->38612 38533 10008241 38535 100083ff 38533->38535 38613 1000841c 30 API calls ctype 38533->38613 38536 100015a7 ctype 29 API calls 38535->38536 38536->38546 38537 100082b6 38538 100015a7 ctype 29 API calls 38537->38538 38543 100082c2 38538->38543 38539 10008292 38539->38535 38539->38537 38540 10008358 38541 100015a7 ctype 29 API calls 38540->38541 38544 10008399 38541->38544 38542 100040e5 30 API calls 38542->38543 38543->38540 38543->38542 38545 100015a7 ctype 29 API calls 38544->38545 38545->38546 38546->38245 38547->38253 38614 100055b0 38548->38614 38551 100015ec ctype 29 API calls 38552 10005501 38551->38552 38556 10005524 38552->38556 38623 100034b0 30 API calls 38552->38623 38554 100034b0 30 API calls 38554->38556 38555 100055ab 38555->38249 38556->38554 38557 1000558b 38556->38557 38559 100040e5 30 API calls 38556->38559 38557->38555 38558 100040e5 30 API calls 38557->38558 38558->38557 38559->38556 38561 10001c8f __EH_prolog 38560->38561 38624 10001bb2 38561->38624 38563 10001cb6 38563->38298 38567 10003dca 38564->38567 38566 10003df9 38566->38265 38566->38266 38567->38566 38637 100189b4 RaiseException 38567->38637 38569 10012a24 38568->38569 38570 10012a27 VirtualAlloc 38568->38570 38569->38296 38570->38296 38638 10019cb8 38571->38638 38574 10017593 38574->38296 38575 10017598 GetLastError 38576 100175a2 38575->38576 38576->38296 38578 100015ec ctype 29 API calls 38577->38578 38579 10003691 38578->38579 38580 100015ec ctype 29 API calls 38579->38580 38581 1000369c 38580->38581 38582 100036cf 38581->38582 38584 100040e5 30 API calls 38581->38584 38583 10003706 38582->38583 38585 100040e5 30 API calls 38582->38585 38586 10003731 38583->38586 38666 1000224f 38583->38666 38584->38581 38585->38582 38586->38296 38588->38253 38589->38267 38590->38298 38591->38298 38592->38298 38593->38360 38594->38360 38595->38299 38596->38323 38597->38306 38598->38293 38599->38317 38600->38339 38601->38328 38602->38342 38603->38368 38604->38375 38605->38279 38707 10001615 38606->38707 38609->38324 38610->38338 38611->38345 38612->38533 38613->38539 38615 100015ec ctype 29 API calls 38614->38615 38616 100055b8 38615->38616 38617 100015ec ctype 29 API calls 38616->38617 38618 100055c0 38617->38618 38619 100015ec ctype 29 API calls 38618->38619 38620 100055c8 38619->38620 38621 100015ec ctype 29 API calls 38620->38621 38622 100054f9 38621->38622 38622->38551 38623->38552 38626 10001bb7 __EH_prolog 38624->38626 38625 10001075 30 API calls 38627 10001c48 38625->38627 38626->38625 38628 10001c5a 38626->38628 38627->38628 38630 10001f31 38627->38630 38628->38563 38631 10001f3b __EH_prolog 38630->38631 38632 10012a20 VirtualAlloc 38631->38632 38633 10001fd1 38632->38633 38634 10001fed 38633->38634 38636 100189b4 RaiseException 38633->38636 38634->38628 38636->38634 38637->38566 38648 1001c480 38638->38648 38640 10019d0b 38642 100189ee ctype 29 API calls 38640->38642 38641 10019cc8 38641->38640 38643 10019cd6 CreateThread 38641->38643 38644 10019d11 38642->38644 38645 10019d03 GetLastError 38643->38645 38646 10017589 38643->38646 38644->38646 38659 1001c3fb 35 API calls 38644->38659 38645->38640 38646->38574 38646->38575 38653 1001c4b5 ctype 38648->38653 38649 1001c59b 38649->38641 38651 1001c56d HeapAlloc 38651->38653 38652 1001c52f 38652->38651 38652->38653 38663 1001a13a 29 API calls ctype 38652->38663 38664 1001b308 6 API calls ctype 38652->38664 38665 1001c5a2 LeaveCriticalSection ctype 38652->38665 38653->38649 38653->38651 38653->38652 38660 1001a13a 29 API calls ctype 38653->38660 38661 1001a865 5 API calls ctype 38653->38661 38662 1001c519 LeaveCriticalSection ctype 38653->38662 38659->38646 38660->38653 38661->38653 38662->38653 38663->38652 38664->38652 38665->38652 38667 10002259 38666->38667 38670 10002f54 38667->38670 38671 10002f61 38670->38671 38672 10002288 38671->38672 38675 10006814 38671->38675 38680 100068c9 38671->38680 38672->38586 38676 1000681f 38675->38676 38687 6cea7350 38676->38687 38697 6cea1be0 38676->38697 38677 10006833 38677->38671 38683 100068d5 38680->38683 38681 10006982 38681->38671 38682 1000670b 96 API calls 38682->38683 38683->38681 38683->38682 38685 1000688a 99 API calls 38683->38685 38702 100045ee 38683->38702 38706 1000684d 8 API calls 38683->38706 38685->38683 38688 6cea7516 38687->38688 38693 6cea7389 38687->38693 38688->38677 38689 6cea7462 38689->38688 38690 6cea63a0 VariantClear RaiseException 38689->38690 38691 6cea7491 38689->38691 38690->38691 38692 6cea74eb 38691->38692 38695 6ceb1060 SetFileAttributesW SetFileAttributesW GetCurrentDirectoryW 38691->38695 38692->38677 38693->38688 38693->38689 38694 6cea742b SetFileTime 38693->38694 38696 6cea1be0 FindCloseChangeNotification GetLastError 38694->38696 38695->38692 38696->38689 38698 6cea1bf3 38697->38698 38699 6cea1be8 FindCloseChangeNotification 38697->38699 38698->38677 38699->38698 38700 6cea1bfd GetLastError 38699->38700 38701 6cea1c07 38700->38701 38701->38677 38703 1000460f 38702->38703 38704 100045ff 38702->38704 38703->38683 38705 6cea1c20 WriteFile GetLastError 38704->38705 38705->38703 38706->38683 38708 1000163c 38707->38708 38709 1000161d 38707->38709 38708->38282 38710 1000163d 30 API calls 38709->38710 38710->38708 38711->38136 38712->38136 38713->38136 38714->38156 38715->38151 38716->38156 38721 6cebe5c3 38717->38721 38723 6cebe5e3 38717->38723 38720 6cebe610 38731 6cebe66d 38720->38731 38734 6cebe370 CharUpperW CharUpperW 38720->38734 38722 6cebe697 38721->38722 38721->38723 38732 6cebe280 CharUpperW CharUpperW 38721->38732 38722->38188 38723->38720 38733 6cebe280 CharUpperW CharUpperW 38723->38733 38725 6cebe62c 38725->38731 38735 6cea5b40 68 API calls 38725->38735 38727 6cebe643 38728 6cea4dd0 67 API calls 38727->38728 38729 6cebe656 38728->38729 38730 6cebe590 72 API calls 38729->38730 38730->38731 38731->38188 38732->38721 38733->38723 38734->38725 38735->38727 38737 10006b39 38736->38737 38738 10006b4a 38736->38738 38737->38738 38742 10006b51 38737->38742 38738->37574 38741 1000109b ctype 29 API calls 38741->38738 38743 10006b5b __EH_prolog 38742->38743 38744 100015a7 ctype 29 API calls 38743->38744 38745 10006b74 38744->38745 38750 10006b9e 38745->38750 38748 10006b44 38748->38741 38751 10006ba8 __EH_prolog 38750->38751 38752 100015a7 ctype 29 API calls 38751->38752 38753 10006bc1 38752->38753 38754 100015a7 ctype 29 API calls 38753->38754 38755 10006bd0 38754->38755 38756 100015a7 ctype 29 API calls 38755->38756 38757 10006bdf 38756->38757 38758 100015a7 ctype 29 API calls 38757->38758 38759 10006bee 38758->38759 38760 100015a7 ctype 29 API calls 38759->38760 38761 10006bfd 38760->38761 38768 10006c15 38761->38768 38764 6cea18e0 38765 6cea18f8 38764->38765 38766 6cea18ef 38764->38766 38765->38748 38804 6cea1950 38766->38804 38769 10006c1f __EH_prolog 38768->38769 38770 100015a7 ctype 29 API calls 38769->38770 38771 10006c3a 38770->38771 38772 100015a7 ctype 29 API calls 38771->38772 38773 10006c4f 38772->38773 38774 100015a7 ctype 29 API calls 38773->38774 38775 10006c5a 38774->38775 38776 100015a7 ctype 29 API calls 38775->38776 38777 10006c6f 38776->38777 38778 100015a7 ctype 29 API calls 38777->38778 38779 10006c7a 38778->38779 38780 100015a7 ctype 29 API calls 38779->38780 38781 10006c8f 38780->38781 38782 100015a7 ctype 29 API calls 38781->38782 38783 10006c9a 38782->38783 38784 100015a7 ctype 29 API calls 38783->38784 38785 10006cac 38784->38785 38786 100015a7 ctype 29 API calls 38785->38786 38787 10006cb7 38786->38787 38788 100015ec ctype 29 API calls 38787->38788 38789 10006cce 38788->38789 38790 100015a7 ctype 29 API calls 38789->38790 38791 10006cd9 38790->38791 38792 100015a7 ctype 29 API calls 38791->38792 38793 10006ce5 38792->38793 38794 100015ec ctype 29 API calls 38793->38794 38795 10006cfc 38794->38795 38796 100015a7 ctype 29 API calls 38795->38796 38797 10006d07 38796->38797 38798 100015a7 ctype 29 API calls 38797->38798 38799 10006d13 38798->38799 38800 100015a7 ctype 29 API calls 38799->38800 38801 10006d1f 38800->38801 38802 100015a7 ctype 29 API calls 38801->38802 38803 10006b80 38802->38803 38803->38748 38803->38764 38805 6cea196b FindCloseChangeNotification 38804->38805 38806 6cea1976 38804->38806 38805->38806 38808 6cea1989 38806->38808 38809 6cec5ff4 67 API calls 6 library calls 38806->38809 38808->38765 38809->38808 38811 6ceb5478 38810->38811 38812 6ceb547d 38810->38812 38851 6ceaed10 68 API calls 2 library calls 38811->38851 38814 6ceb5509 38812->38814 38852 6ceb59c0 38812->38852 38814->37181 38817 6ceb54c0 38820 6ceb54cd 38817->38820 38862 6cec5bd8 6 API calls _strcpy_s 38817->38862 38820->38814 38863 6cec5ff4 67 API calls 6 library calls 38820->38863 38823 6ceb4b09 38822->38823 38824 6ceb4b0d 38823->38824 38826 6ceb4b2d 38823->38826 38825 6ceb2e40 VariantClear 38824->38825 38827 6ceb4b15 38825->38827 38828 6ceb2e40 VariantClear 38826->38828 38827->37181 38829 6ceb4b43 38828->38829 38829->37181 38831 6cec6319 _wcslen 38830->38831 38834 6cec6315 38830->38834 38867 6ceca3dd 38831->38867 38834->37181 38836 6cec6341 38836->38834 38837 6cec6348 38836->38837 38875 6cec5a8a 10 API calls 3 library calls 38837->38875 38839 6cec6352 38839->38834 38842 6ceb556f 38840->38842 38841 6ceb55da 38897 6ceb5600 38841->38897 38842->38841 38843 6ceb55a5 38842->38843 38911 6cec5bd8 6 API calls _strcpy_s 38842->38911 38843->37181 38847->37153 38848->37157 38849->37152 38850->37151 38851->38812 38853 6ceb59ca 38852->38853 38854 6ceb59fe 38853->38854 38855 6cec5f2a _malloc 67 API calls 38853->38855 38858 6ceb54a9 38853->38858 38864 6cec663b RaiseException 38853->38864 38865 6cec5c76 67 API calls 3 library calls 38854->38865 38855->38853 38857 6ceb5a11 38866 6cec663b RaiseException 38857->38866 38858->38817 38861 6cec5bd8 6 API calls _strcpy_s 38858->38861 38861->38817 38862->38820 38863->38814 38864->38853 38865->38857 38866->38858 38876 6cecc62a 38867->38876 38869 6ceca3f7 38873 6cec632e 38869->38873 38889 6cec7f70 67 API calls __getptd_noexit 38869->38889 38871 6ceca40a 38871->38873 38890 6cec7f70 67 API calls __getptd_noexit 38871->38890 38873->38834 38874 6ceca36e 67 API calls _strcpy_s 38873->38874 38874->38836 38875->38839 38877 6cecc636 _realloc 38876->38877 38878 6cecc64e 38877->38878 38888 6cecc66d _memset 38877->38888 38891 6cec7f70 67 API calls __getptd_noexit 38878->38891 38880 6cecc653 38892 6cec5bb2 6 API calls 2 library calls 38880->38892 38882 6cecc6df RtlAllocateHeap 38882->38888 38885 6cecc663 _realloc 38885->38869 38888->38882 38888->38885 38893 6cec81d4 67 API calls 2 library calls 38888->38893 38894 6cec90fc 5 API calls 2 library calls 38888->38894 38895 6cecc726 LeaveCriticalSection _doexit 38888->38895 38896 6cec9494 6 API calls __decode_pointer 38888->38896 38889->38871 38890->38873 38891->38880 38893->38888 38894->38888 38895->38888 38896->38888 38898 6ceb5628 38897->38898 38899 6ceb562c 38897->38899 38912 6ceb5700 38898->38912 38900 6ceb5635 38899->38900 38920 6cec5bd8 6 API calls _strcpy_s 38899->38920 38900->38898 38921 6cec5bd8 6 API calls _strcpy_s 38900->38921 38904 6ceb567c 38908 6ceb568d 38904->38908 38923 6cec5bd8 6 API calls _strcpy_s 38904->38923 38905 6ceb566f 38905->38904 38922 6cec5bd8 6 API calls _strcpy_s 38905->38922 38910 6ceb55ed 38908->38910 38924 6cec5bd8 6 API calls _strcpy_s 38908->38924 38910->37181 38911->38841 38913 6ceb5735 38912->38913 38915 6ceb577a 38913->38915 38925 6ceaed10 68 API calls 2 library calls 38913->38925 38916 6ceb59c0 68 API calls 38915->38916 38917 6ceb585e 38915->38917 38918 6ceb57b1 38916->38918 38917->38905 38918->38917 38926 6cec5ff4 67 API calls 6 library calls 38918->38926 38920->38900 38921->38898 38922->38904 38923->38908 38924->38910 38925->38915 38926->38917 39189 10019fd5 39190 10019ff1 39189->39190 39191 10019fe8 39189->39191 39190->39191 39198 1001a019 39190->39198 39199 10019efc 39190->39199 39191->39198 39228 100032c6 GetVersionExA 39191->39228 39194 1001a025 39195 1001a039 39194->39195 39196 10019efc 105 API calls 39194->39196 39194->39198 39197 10019efc 105 API calls 39195->39197 39195->39198 39196->39195 39197->39198 39200 10019f91 39199->39200 39201 10019f09 GetVersion 39199->39201 39202 10019fc3 39200->39202 39203 10019f97 39200->39203 39229 1001a3c4 HeapCreate 39201->39229 39206 10019f5c 39202->39206 39207 1001c098 31 API calls 39202->39207 39203->39206 39208 10019fb2 39203->39208 39297 1001c22d 32 API calls 39203->39297 39205 10019f1b 39205->39206 39241 1001bfac 39205->39241 39206->39191 39207->39206 39298 1001c8f1 30 API calls ctype 39208->39298 39212 10019f53 39214 10019f60 GetCommandLineA 39212->39214 39215 10019f57 39212->39215 39213 10019fb7 39299 1001c000 35 API calls 39213->39299 39251 1001cc4b 39214->39251 39288 1001a421 39215->39288 39219 10019fbc 39221 1001a421 6 API calls 39219->39221 39221->39206 39223 10019f7a 39295 1001c9fe 49 API calls ctype 39223->39295 39225 10019f7f 39296 1001c945 48 API calls ctype 39225->39296 39227 10019f84 39227->39206 39228->39194 39230 1001a3e4 39229->39230 39231 1001a41a 39229->39231 39300 1001a27c 57 API calls 39230->39300 39231->39205 39233 1001a3e9 39234 1001a3f3 39233->39234 39236 1001a400 39233->39236 39301 1001a4c9 HeapAlloc 39234->39301 39237 1001a41d 39236->39237 39302 1001b010 5 API calls ctype 39236->39302 39237->39205 39238 1001a3fd 39238->39237 39240 1001a40e HeapDestroy 39238->39240 39240->39231 39303 1001a0a5 InitializeCriticalSection InitializeCriticalSection InitializeCriticalSection InitializeCriticalSection 39241->39303 39243 1001bfb2 TlsAlloc 39244 1001bfc2 39243->39244 39245 1001bffc 39243->39245 39246 1001c480 30 API calls 39244->39246 39245->39212 39247 1001bfcb 39246->39247 39247->39245 39248 1001bfd3 TlsSetValue 39247->39248 39248->39245 39249 1001bfe4 39248->39249 39250 1001bfea GetCurrentThreadId 39249->39250 39250->39212 39252 1001cc66 GetEnvironmentStringsW 39251->39252 39253 1001cc99 39251->39253 39254 1001cc7a GetEnvironmentStrings 39252->39254 39255 1001cc6e 39252->39255 39253->39255 39256 1001cc8a 39253->39256 39254->39256 39257 10019f70 39254->39257 39258 1001cca6 GetEnvironmentStringsW 39255->39258 39261 1001ccb2 39255->39261 39256->39257 39259 1001cd2c GetEnvironmentStrings 39256->39259 39262 1001cd38 39256->39262 39274 1001c735 39257->39274 39258->39257 39258->39261 39259->39257 39259->39262 39260 1001ccc7 WideCharToMultiByte 39263 1001cce6 39260->39263 39264 1001cd18 FreeEnvironmentStringsW 39260->39264 39261->39260 39261->39261 39265 1001887a ctype 29 API calls 39262->39265 39266 1001887a ctype 29 API calls 39263->39266 39264->39257 39272 1001cd53 39265->39272 39267 1001ccec 39266->39267 39267->39264 39268 1001ccf5 WideCharToMultiByte 39267->39268 39269 1001cd0f 39268->39269 39270 1001cd06 39268->39270 39269->39264 39273 100189ee ctype 29 API calls 39270->39273 39271 1001cd69 FreeEnvironmentStringsA 39271->39257 39272->39271 39273->39269 39275 1001887a ctype 29 API calls 39274->39275 39276 1001c748 39275->39276 39277 1001c756 GetStartupInfoA 39276->39277 39304 1001a072 7 API calls ctype 39276->39304 39282 1001c875 39277->39282 39287 1001c7a4 39277->39287 39280 1001c8a0 GetStdHandle 39280->39282 39283 1001c8ae GetFileType 39280->39283 39281 1001c8e0 SetHandleCount 39281->39223 39282->39280 39282->39281 39283->39282 39284 1001887a ctype 29 API calls 39284->39287 39285 1001c81b 39285->39282 39286 1001c83d GetFileType 39285->39286 39286->39285 39287->39282 39287->39284 39287->39285 39290 1001a42d 39288->39290 39291 1001a493 39288->39291 39289 1001a47f HeapFree 39292 1001a4ba HeapDestroy 39289->39292 39290->39289 39293 1001a44d VirtualFree VirtualFree HeapFree 39290->39293 39291->39292 39294 1001a4a6 VirtualFree 39291->39294 39292->39206 39293->39289 39293->39293 39294->39291 39295->39225 39296->39227 39297->39208 39298->39213 39299->39219 39300->39233 39301->39238 39302->39238 39303->39243 39304->39277 39305 10002175 39306 10002182 39305->39306 39307 10002193 39305->39307 39306->39307 39311 1000219a 39306->39311 39310 1000109b ctype 29 API calls 39310->39307 39312 100021a4 __EH_prolog 39311->39312 39315 10012a40 39312->39315 39316 1000218d 39315->39316 39317 10012a44 VirtualFree 39315->39317 39316->39310 39317->39316 38927 10019d87 38933 1001a072 7 API calls ctype 38927->38933 38929 10019d8e GetCurrentThreadId 38930 10019da0 38929->38930 38934 10019de9 38930->38934 38933->38929 38935 10019df2 38934->38935 38942 1001c031 GetLastError TlsGetValue 38935->38942 38937 10019dfa 38938 10019e07 38937->38938 38975 1001a072 7 API calls ctype 38937->38975 38953 1001c098 38938->38953 38943 1001c04d 38942->38943 38944 1001c08c SetLastError 38942->38944 38945 1001c480 30 API calls 38943->38945 38944->38937 38946 1001c056 38945->38946 38947 1001c084 38946->38947 38948 1001c05e TlsSetValue 38946->38948 38976 1001a072 7 API calls ctype 38947->38976 38948->38947 38950 1001c06f 38948->38950 38952 1001c075 GetCurrentThreadId 38950->38952 38951 1001c08b 38951->38944 38952->38944 38954 10019e0e ExitThread 38953->38954 38955 1001c0a6 38953->38955 38956 1001c0bc 38955->38956 38957 1001c0af TlsGetValue 38955->38957 38959 1001c0c9 38956->38959 38961 100189ee ctype 29 API calls 38956->38961 38957->38956 38958 1001c128 TlsSetValue 38957->38958 38958->38954 38960 1001c0d7 38959->38960 38962 100189ee ctype 29 API calls 38959->38962 38963 100189ee ctype 29 API calls 38960->38963 38965 1001c0e5 38960->38965 38961->38959 38962->38960 38963->38965 38964 1001c0f3 38967 1001c101 38964->38967 38969 100189ee ctype 29 API calls 38964->38969 38965->38964 38966 100189ee ctype 29 API calls 38965->38966 38966->38964 38968 1001c10f 38967->38968 38970 100189ee ctype 29 API calls 38967->38970 38971 1001c120 38968->38971 38972 100189ee ctype 29 API calls 38968->38972 38969->38967 38970->38968 38973 100189ee ctype 29 API calls 38971->38973 38972->38971 38974 1001c127 38973->38974 38974->38958 38975->38938 38976->38951 38977 6cec658b 38978 6cec659b 38977->38978 38979 6cec6596 38977->38979 38983 6cec6495 38978->38983 38991 6ceca8ed GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter 38979->38991 38982 6cec65a9 38984 6cec64a1 _realloc 38983->38984 38985 6cec653e _realloc 38984->38985 38988 6cec64ee ___DllMainCRTStartup 38984->38988 38992 6cec6360 38984->38992 38985->38982 38987 6cec6360 __CRT_INIT@12 156 API calls 38987->38985 38988->38985 38989 6cec6360 __CRT_INIT@12 156 API calls 38988->38989 38990 6cec651e 38988->38990 38989->38990 38990->38985 38990->38987 38991->38978 38993 6cec636f 38992->38993 38994 6cec63eb 38992->38994 39042 6cec93e1 HeapCreate 38993->39042 38996 6cec63f1 38994->38996 38997 6cec6422 38994->38997 39002 6cec640c 38996->39002 39009 6cec637a 38996->39009 39139 6cec7a46 67 API calls _doexit 38996->39139 38998 6cec6427 38997->38998 38999 6cec6480 38997->38999 39143 6cec70ea 8 API calls __decode_pointer 38998->39143 38999->39009 39153 6cec7404 79 API calls 2 library calls 38999->39153 39002->39009 39140 6cec7ee0 68 API calls __crtGetStringTypeA_stat 39002->39140 39003 6cec642c 39144 6cec7653 39003->39144 39009->38988 39010 6cec6386 __RTC_Initialize 39011 6cec638a 39010->39011 39018 6cec6396 GetCommandLineA 39010->39018 39134 6cec9411 VirtualFree HeapFree HeapFree HeapDestroy 39011->39134 39012 6cec6416 39141 6cec711e 70 API calls 2 library calls 39012->39141 39016 6cec6444 39150 6cec706f 6 API calls __crt_waiting_on_module_handle 39016->39150 39017 6cec641b 39142 6cec9411 VirtualFree HeapFree HeapFree HeapDestroy 39017->39142 39078 6ceca76a 39018->39078 39022 6cec6456 39025 6cec645d 39022->39025 39026 6cec6474 39022->39026 39151 6cec715b 67 API calls 5 library calls 39025->39151 39152 6cec5ff4 67 API calls 6 library calls 39026->39152 39027 6cec63b0 39030 6cec63b4 39027->39030 39136 6ceca6af 112 API calls 3 library calls 39027->39136 39135 6cec711e 70 API calls 2 library calls 39030->39135 39031 6cec6464 GetCurrentThreadId 39031->39009 39032 6cec63d9 39032->39009 39035 6cec63c0 39041 6cec63d4 39035->39041 39119 6ceca437 39035->39119 39039 6cec63e9 39039->39030 39041->39032 39138 6cec7ee0 68 API calls __crtGetStringTypeA_stat 39041->39138 39043 6cec6375 39042->39043 39043->39009 39044 6cec7472 GetModuleHandleW 39043->39044 39045 6cec748d 39044->39045 39046 6cec7486 39044->39046 39048 6cec75f5 39045->39048 39049 6cec7497 GetProcAddress GetProcAddress GetProcAddress GetProcAddress 39045->39049 39154 6cec7790 Sleep GetModuleHandleW 39046->39154 39164 6cec711e 70 API calls 2 library calls 39048->39164 39052 6cec74e0 TlsAlloc 39049->39052 39051 6cec748c 39051->39045 39054 6cec75fa 39052->39054 39055 6cec752e TlsSetValue 39052->39055 39054->39010 39055->39054 39056 6cec753f 39055->39056 39155 6cec7a55 6 API calls 4 library calls 39056->39155 39058 6cec7544 39156 6cec6ff4 6 API calls __crt_waiting_on_module_handle 39058->39156 39060 6cec754f 39157 6cec6ff4 6 API calls __crt_waiting_on_module_handle 39060->39157 39062 6cec755f 39158 6cec6ff4 6 API calls __crt_waiting_on_module_handle 39062->39158 39064 6cec756f 39159 6cec6ff4 6 API calls __crt_waiting_on_module_handle 39064->39159 39066 6cec757f 39160 6cec8058 InitializeCriticalSectionAndSpinCount __ioinit 39066->39160 39068 6cec758c 39068->39048 39161 6cec706f 6 API calls __crt_waiting_on_module_handle 39068->39161 39070 6cec75a0 39070->39048 39071 6cec7653 __calloc_crt 67 API calls 39070->39071 39072 6cec75b9 39071->39072 39072->39048 39162 6cec706f 6 API calls __crt_waiting_on_module_handle 39072->39162 39074 6cec75d3 39074->39048 39075 6cec75da 39074->39075 39163 6cec715b 67 API calls 5 library calls 39075->39163 39077 6cec75e2 GetCurrentThreadId 39077->39054 39079 6ceca788 GetEnvironmentStringsW 39078->39079 39080 6ceca7a7 39078->39080 39081 6ceca79c GetLastError 39079->39081 39082 6ceca790 39079->39082 39080->39082 39083 6ceca840 39080->39083 39081->39080 39084 6ceca7c3 GetEnvironmentStringsW 39082->39084 39089 6ceca7d2 WideCharToMultiByte 39082->39089 39085 6ceca849 GetEnvironmentStrings 39083->39085 39086 6cec63a6 39083->39086 39084->39086 39084->39089 39085->39086 39092 6ceca859 39085->39092 39104 6cec7c8c 39086->39104 39090 6ceca835 FreeEnvironmentStringsW 39089->39090 39091 6ceca806 39089->39091 39090->39086 39165 6cec760e 67 API calls _malloc 39091->39165 39167 6cec760e 67 API calls _malloc 39092->39167 39095 6ceca873 39097 6ceca87a FreeEnvironmentStringsA 39095->39097 39098 6ceca886 _realloc 39095->39098 39096 6ceca80c 39096->39090 39099 6ceca814 WideCharToMultiByte 39096->39099 39097->39086 39102 6ceca890 FreeEnvironmentStringsA 39098->39102 39100 6ceca826 39099->39100 39101 6ceca82e 39099->39101 39166 6cec5ff4 67 API calls 6 library calls 39100->39166 39101->39090 39102->39086 39168 6cec7aa4 39104->39168 39106 6cec7c98 GetStartupInfoA 39107 6cec7653 __calloc_crt 67 API calls 39106->39107 39113 6cec7cb9 39107->39113 39108 6cec7ed7 _realloc 39108->39027 39109 6cec7e54 GetStdHandle 39118 6cec7e1e 39109->39118 39110 6cec7653 __calloc_crt 67 API calls 39110->39113 39111 6cec7eb9 SetHandleCount 39111->39108 39112 6cec7e66 GetFileType 39112->39118 39113->39108 39113->39110 39115 6cec7da1 39113->39115 39113->39118 39114 6cec7dca GetFileType 39114->39115 39115->39108 39115->39114 39115->39118 39169 6cecc9a2 InitializeCriticalSectionAndSpinCount _realloc 39115->39169 39118->39108 39118->39109 39118->39111 39118->39112 39170 6cecc9a2 InitializeCriticalSectionAndSpinCount _realloc 39118->39170 39120 6ceca440 39119->39120 39122 6ceca445 _strlen 39119->39122 39171 6cecc5ec 111 API calls __setmbcp 39120->39171 39123 6cec7653 __calloc_crt 67 API calls 39122->39123 39126 6cec63c9 39122->39126 39129 6ceca47a _strlen 39123->39129 39124 6ceca4d8 39174 6cec5ff4 67 API calls 6 library calls 39124->39174 39126->39041 39137 6cec787f 74 API calls 5 library calls 39126->39137 39127 6cec7653 __calloc_crt 67 API calls 39127->39129 39128 6ceca4fe 39175 6cec5ff4 67 API calls 6 library calls 39128->39175 39129->39124 39129->39126 39129->39127 39129->39128 39132 6ceca4bf 39129->39132 39172 6cec88b5 67 API calls _strcpy_s 39129->39172 39132->39129 39173 6cec5a8a 10 API calls 3 library calls 39132->39173 39134->39009 39135->39011 39136->39035 39137->39041 39138->39039 39139->39002 39140->39012 39141->39017 39142->39009 39143->39003 39147 6cec765c 39144->39147 39145 6cecc62a __calloc_impl 66 API calls 39145->39147 39146 6cec6438 39146->39009 39146->39016 39147->39145 39147->39146 39148 6cec767a Sleep 39147->39148 39149 6cec768f 39148->39149 39149->39146 39149->39147 39150->39022 39151->39031 39152->39032 39153->39009 39154->39051 39155->39058 39156->39060 39157->39062 39158->39064 39159->39066 39160->39068 39161->39070 39162->39074 39163->39077 39164->39054 39165->39096 39166->39101 39167->39095 39168->39106 39169->39115 39170->39118 39171->39122 39172->39129 39173->39132 39174->39126 39175->39126 39176 10002828 39177 1000282e 39176->39177 39179 10002837 39176->39179 39181 6cea1ab0 3 API calls 39177->39181 39178 10002856 39179->39178 39180 1000284c LeaveCriticalSection 39179->39180 39182 6cea19c0 2 API calls 39179->39182 39180->39178 39181->39179 39182->39180 39318 6cec3ef0 39320 6cec3f2d 39318->39320 39319 6cec5f2a _malloc 67 API calls 39321 6cec4333 39319->39321 39320->39319 39322 6cec40d3 39320->39322 39323 6cec434d 39321->39323 39336 6cec663b RaiseException 39321->39336 39325 6cec1230 68 API calls 39323->39325 39326 6cec435a 39325->39326 39327 6ceb82b0 266 API calls 39326->39327 39328 6cec437e 39327->39328 39337 6cec1a40 68 API calls 39328->39337 39330 6cec439e 39330->39322 39331 6cec43d5 39330->39331 39338 6cec5bd8 6 API calls _strcpy_s 39330->39338 39333 6cec43e0 39331->39333 39339 6cec5bd8 6 API calls _strcpy_s 39331->39339 39333->39322 39340 6cec5bd8 6 API calls _strcpy_s 39333->39340 39336->39323 39337->39330 39338->39331 39339->39333 39340->39322 39341 6cec28b0 39342 6cec28bd 39341->39342 39346 6cec28f6 39341->39346 39342->39346 39347 6cec2bf0 39342->39347 39348 6cec2bf9 FreeLibrary 39347->39348 39349 6cec2c0a 39347->39349 39348->39349 39350 6cec28f1 39349->39350 39351 6cec2c13 DeleteFileW 39349->39351 39352 6cec2a30 39350->39352 39351->39350 39353 6cec2a94 39352->39353 39354 6cec2b5b 39353->39354 39364 6cec2aac _memset 39353->39364 39381 6cec2c40 70 API calls __crtGetStringTypeA_stat 39354->39381 39356 6cec2b65 39357 6cec2b76 FindResourceW 39356->39357 39359 6cec2bb2 39356->39359 39358 6cec2b88 39357->39358 39357->39359 39371 6cec2980 LoadResource 39358->39371 39361 6cec51c7 __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 39359->39361 39363 6cec2bdd 39361->39363 39362 6cec2b94 39362->39359 39365 6cec2ba6 LoadLibraryW 39362->39365 39363->39346 39366 6cec2b13 FindFirstFileW 39364->39366 39365->39359 39367 6cec2b2d 39366->39367 39368 6cec2b72 39366->39368 39369 6cec2b3b LoadLibraryW FindClose 39367->39369 39368->39357 39370 6cec2b54 39369->39370 39370->39359 39372 6cec299f SizeofResource 39371->39372 39373 6cec2a1b 39371->39373 39372->39373 39374 6cec29ad LockResource 39372->39374 39373->39362 39374->39373 39375 6cec29ba CreateFileW 39374->39375 39375->39373 39376 6cec29dc WriteFile 39375->39376 39377 6cec29ef FindCloseChangeNotification 39376->39377 39379 6cec2a04 DeleteFileW 39377->39379 39380 6cec2a10 39377->39380 39379->39380 39380->39362 39381->39356 39382 1000331c 39383 10003336 39382->39383 39385 10003370 39383->39385 39386 100030fd 39383->39386 39387 10003107 __EH_prolog 39386->39387 39388 10003147 39387->39388 39390 1000ab8d 39387->39390 39388->39385 39391 1000ab97 __EH_prolog 39390->39391 39392 10001075 30 API calls 39391->39392 39393 1000aba2 39392->39393 39394 1000abb6 39393->39394 39396 10006a20 39393->39396 39394->39388 39397 10006a2a __EH_prolog 39396->39397 39400 10001b41 GetSystemInfo 39397->39400 39399 10006a94 39399->39394 39400->39399

                                                                          Executed Functions

                                                                          Function 6CEAAE70 Relevance: 25.9, APIs: 2, Strings: 12, Instructions: 1392COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 6CEB07D0: CharUpperW.USER32(?,00000000,?,6CEAFCF3,?,6CEAFE6C,?,00000000,?,00000010,388BE448,?,00000000,00000000), ref: 6CEB07F7
                                                                            • Part of subcall function 6CEB07D0: CharUpperW.USER32(?,?,6CEAFE6C,?,00000000,?,00000010,388BE448,?,00000000,00000000), ref: 6CEB0804
                                                                          • _memset.LIBCMT ref: 6CEAB3D4
                                                                          • VariantClear.OLEAUT32(?), ref: 6CEABEEE
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CharUpper$ClearVariant_memset
                                                                          • String ID: !$001$R$Unknown error$a$exe$hTl$hTl$iso$r$rar$udf
                                                                          • API String ID: 2702283269-2490787288
                                                                          • Opcode ID: 88d0205e10c567bf7779df0c3d6141bc2d8be5bae5578af4554fb4c930c9759c
                                                                          • Instruction ID: fbc29a2e5136aab3449155426c0d943ca7abe9d0fbd05e03358170d7aa1f2b02
                                                                          • Opcode Fuzzy Hash: 88d0205e10c567bf7779df0c3d6141bc2d8be5bae5578af4554fb4c930c9759c
                                                                          • Instruction Fuzzy Hash: 64C26D71E012288FCB25CF68CD80BDAB7B5AF49308F2441D9D549AB750DB31AE86CF91
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEA8AB0 Relevance: 20.3, APIs: 7, Strings: 4, Instructions: 1018COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1059 6cea8ab0-6cea8b3b 1060 6cea8b3d-6cea8b40 1059->1060 1061 6cea8b42-6cea8b45 1059->1061 1062 6cea8b48-6cea8b52 1060->1062 1061->1062 1063 6cea8cab-6cea8cba call 6cec5f2a 1062->1063 1064 6cea8b58-6cea8baf call 6cec514c 1062->1064 1071 6cea8cbc-6cea8cca call 6cec663b 1063->1071 1072 6cea8cfd-6cea8d25 call 6cea8400 1063->1072 1069 6cea8c1c-6cea8c24 1064->1069 1070 6cea8bb1-6cea8bf6 call 6ceb2470 1064->1070 1075 6cea8c4d-6cea8ca2 call 6cec51d6 1069->1075 1076 6cea8c26-6cea8c2e 1069->1076 1087 6cea8bf8-6cea8bf9 FindClose 1070->1087 1088 6cea8bff-6cea8c03 1070->1088 1080 6cea8ccf-6cea8ce1 call 6cec663b 1071->1080 1084 6cea8d2f-6cea8d80 1072->1084 1085 6cea8d27-6cea8d2c 1072->1085 1075->1064 1094 6cea8ca8 1075->1094 1081 6cea8c30-6cea8c35 1076->1081 1082 6cea8c37-6cea8c3a 1076->1082 1096 6cea8ce6-6cea8cf8 call 6cec663b 1080->1096 1090 6cea8c41-6cea8c48 call 6ceb0880 1081->1090 1082->1090 1091 6cea8c3c 1082->1091 1092 6cea8d82-6cea8d9d 1084->1092 1093 6cea8de4-6cea8dee 1084->1093 1085->1084 1087->1088 1088->1080 1095 6cea8c09-6cea8c16 1088->1095 1090->1075 1091->1090 1092->1093 1105 6cea8d9f-6cea8ddf call 6cec51d6 1092->1105 1099 6cea9562-6cea95fb call 6cec51d6 1093->1099 1100 6cea8df4-6cea8e4e call 6cec514c 1093->1100 1094->1063 1095->1069 1095->1096 1096->1072 1121 6cea95ff-6cea9617 1099->1121 1106 6cea8e50-6cea8e65 1100->1106 1107 6cea8e67-6cea8e9d call 6ceb2470 1100->1107 1105->1121 1108 6cea8ec3-6cea8ede 1106->1108 1114 6cea8e9f-6cea8ea0 FindClose 1107->1114 1115 6cea8ea6-6cea8eaa 1107->1115 1127 6cea9618-6cea966a call 6cec51d6 * 2 1108->1127 1128 6cea8ee4-6cea8f8d call 6cea9f10 1108->1128 1114->1115 1119 6cea9969-6cea9980 call 6cec663b 1115->1119 1120 6cea8eb0-6cea8ebd 1115->1120 1120->1108 1120->1119 1127->1121 1135 6cea90ff-6cea912d call 6ceacae0 1128->1135 1136 6cea8f93-6cea8f98 1128->1136 1147 6cea966c-6cea9709 call 6cec51d6 call 6cea82a0 call 6cec51d6 * 2 1135->1147 1148 6cea9133-6cea9158 1135->1148 1136->1135 1138 6cea8f9e-6cea8faa 1136->1138 1141 6cea8fac 1138->1141 1142 6cea8fc1-6cea8fc9 1138->1142 1145 6cea8fb0-6cea8fb2 1141->1145 1142->1135 1146 6cea8fcf-6cea8ff9 call 6cea1640 call 6ceb7240 1142->1146 1145->1135 1149 6cea8fb8-6cea8fbf 1145->1149 1162 6cea8fff-6cea900f call 6ceb0790 1146->1162 1163 6cea90e6-6cea90fc call 6cec51d6 1146->1163 1147->1121 1159 6cea970e-6cea9761 call 6cec51d6 call 6cea82a0 1148->1159 1160 6cea915e-6cea9160 1148->1160 1149->1142 1149->1145 1205 6cea9762-6cea97a8 call 6cec51d6 * 2 1159->1205 1164 6cea91cb-6cea91d0 1160->1164 1165 6cea9162-6cea91c6 call 6cec51d6 call 6cea82a0 call 6cec51d6 1160->1165 1162->1163 1177 6cea9015-6cea9058 call 6cea1660 call 6cea1460 call 6cec51d6 1162->1177 1163->1135 1172 6cea92a8 1164->1172 1173 6cea91d6-6cea91e3 1164->1173 1225 6cea9549-6cea9559 1165->1225 1176 6cea92af 1172->1176 1175 6cea91e9 1173->1175 1173->1176 1181 6cea91f0-6cea9206 call 6cea9ae0 1175->1181 1183 6cea92ea-6cea931a call 6cec514c 1176->1183 1184 6cea92b1-6cea92e4 1176->1184 1177->1163 1223 6cea905e-6cea906c 1177->1223 1200 6cea920c-6cea9210 1181->1200 1201 6cea9296-6cea92a2 1181->1201 1203 6cea931c-6cea9322 1183->1203 1204 6cea9344-6cea9375 1183->1204 1184->1159 1184->1183 1200->1201 1208 6cea9216-6cea9251 1200->1208 1201->1172 1201->1181 1210 6cea9337-6cea9341 call 6cec51d6 1203->1210 1211 6cea9324-6cea9335 1203->1211 1220 6cea937b-6cea9382 1204->1220 1221 6cea97ad-6cea980e call 6cec51d6 * 2 call 6cea82a0 1204->1221 1205->1121 1242 6cea925b-6cea9284 call 6cec55f0 1208->1242 1243 6cea9253-6cea9259 1208->1243 1210->1204 1211->1210 1211->1211 1226 6cea939c-6cea93ab 1220->1226 1227 6cea9384-6cea9396 1220->1227 1221->1205 1230 6cea906e-6cea9072 1223->1230 1231 6cea907d-6cea9085 1223->1231 1225->1100 1228 6cea955f 1225->1228 1233 6cea93e9-6cea93f9 1226->1233 1234 6cea93ad 1226->1234 1227->1221 1227->1226 1228->1099 1230->1163 1237 6cea9074-6cea907b 1230->1237 1231->1163 1238 6cea9087-6cea90b6 call 6cea1640 call 6ceb7240 call 6cec51d6 1231->1238 1245 6cea940b 1233->1245 1246 6cea93fb-6cea9402 1233->1246 1241 6cea93b0-6cea93bd 1234->1241 1237->1230 1237->1231 1238->1163 1275 6cea90b8-6cea90cc call 6ceb07d0 1238->1275 1249 6cea93bf-6cea93cf 1241->1249 1250 6cea93e0-6cea93e7 1241->1250 1252 6cea9288-6cea9292 1242->1252 1243->1242 1243->1252 1247 6cea940d-6cea9459 call 6cea8670 1245->1247 1246->1245 1255 6cea9404-6cea9409 1246->1255 1261 6cea945e-6cea9465 1247->1261 1249->1221 1268 6cea93d5-6cea93dc 1249->1268 1250->1233 1250->1241 1252->1201 1255->1247 1266 6cea946b-6cea9470 1261->1266 1267 6cea9813-6cea98b9 call 6cec51d6 * 2 call 6cea82a0 call 6cec51d6 * 2 1261->1267 1271 6cea949e-6cea94a5 1266->1271 1272 6cea9472-6cea949c 1266->1272 1267->1121 1268->1250 1276 6cea94ac-6cea94d6 1271->1276 1272->1276 1275->1163 1286 6cea90ce-6cea90e1 call 6cea9d00 * 2 1275->1286 1279 6cea98be-6cea9964 call 6cec51d6 * 2 call 6cea82a0 call 6cec51d6 * 2 1276->1279 1280 6cea94dc-6cea9544 call 6cec51d6 * 2 call 6cea82a0 call 6cec51d6 1276->1280 1279->1121 1280->1225 1286->1163
                                                                          APIs
                                                                          • FindClose.KERNEL32(FFFFFFFF,?), ref: 6CEA8BF9
                                                                          • _malloc.LIBCMT ref: 6CEA8CB0
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEA8CCA
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEA8CE1
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEA8CF8
                                                                          • FindClose.KERNEL32(FFFFFFFF,?), ref: 6CEA8EA0
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEA997B
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw$CloseFind$ExceptionRaise_malloc
                                                                          • String ID: 001$@Sl$rar$Rl
                                                                          • API String ID: 231924613-3129755935
                                                                          • Opcode ID: 10d598491b2381dabda9b4be624ce73d75863b4366182dd22ca59ac286c3edd1
                                                                          • Instruction ID: b155ba5cdbc0d5cbd58997480981151f0d90be5c874b957145c4a58c5a62fac5
                                                                          • Opcode Fuzzy Hash: 10d598491b2381dabda9b4be624ce73d75863b4366182dd22ca59ac286c3edd1
                                                                          • Instruction Fuzzy Hash: 66923BB16093819FC324CF69C980A9BF7F5BF89308F648A1DE5998B751D731E806CB52
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEB4C00 Relevance: 14.6, APIs: 6, Strings: 2, Instructions: 589COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1318 6ceb4c00-6ceb4c4c 1319 6ceb52a9-6ceb52c0 1318->1319 1320 6ceb4c52-6ceb4c66 1318->1320 1321 6ceb4c6c-6ceb4cdd call 6cec514c call 6ceb2470 1320->1321 1322 6ceb4d12-6ceb4db3 call 6cec514c 1320->1322 1335 6ceb4cdf-6ceb4ce0 FindClose 1321->1335 1336 6ceb4ce6-6ceb4cea 1321->1336 1328 6ceb4de0-6ceb4e22 1322->1328 1329 6ceb4db5-6ceb4dbb 1322->1329 1341 6ceb4ec8-6ceb4ef5 call 6ceacae0 1328->1341 1342 6ceb4e28-6ceb4e3d 1328->1342 1331 6ceb4dbd 1329->1331 1332 6ceb4dd3-6ceb4ddd call 6cec51d6 1329->1332 1333 6ceb4dc0-6ceb4dd1 1331->1333 1332->1328 1333->1332 1333->1333 1335->1336 1339 6ceb4fc3-6ceb4fe4 call 6cec51d6 1336->1339 1340 6ceb4cf0-6ceb4cfc 1336->1340 1353 6ceb5296-6ceb52a3 1339->1353 1340->1339 1344 6ceb4d02-6ceb4d0f call 6cec51d6 1340->1344 1355 6ceb4efb-6ceb4efe 1341->1355 1356 6ceb52c1-6ceb52c6 1341->1356 1345 6ceb4e3f-6ceb4e60 call 6cec514c 1342->1345 1346 6ceb4ea5-6ceb4eab 1342->1346 1344->1322 1363 6ceb4e62-6ceb4e68 1345->1363 1364 6ceb4e90-6ceb4ea1 1345->1364 1348 6ceb4eb0-6ceb4ebf 1346->1348 1348->1348 1354 6ceb4ec1-6ceb4ec4 1348->1354 1353->1319 1353->1320 1354->1341 1361 6ceb4f00-6ceb4f0b 1355->1361 1362 6ceb4f66-6ceb4fab call 6ceb5440 1355->1362 1359 6ceb52c8-6ceb52d2 1356->1359 1360 6ceb5327-6ceb5363 call 6cec51d6 call 6cea82a0 1356->1360 1365 6ceb5315-6ceb5322 call 6cec663b 1359->1365 1366 6ceb52d4-6ceb52d7 1359->1366 1361->1362 1367 6ceb4f0d-6ceb4f29 call 6cea9ae0 1361->1367 1395 6ceb4fb1-6ceb4fbb 1362->1395 1396 6ceb5364-6ceb539d call 6cec51d6 call 6cea82a0 1362->1396 1368 6ceb4e6a 1363->1368 1369 6ceb4e83-6ceb4e8d call 6cec51d6 1363->1369 1364->1346 1365->1360 1371 6ceb52eb-6ceb52ef 1366->1371 1372 6ceb52d9-6ceb52e6 call 6cec663b 1366->1372 1390 6ceb4f2b-6ceb4f2f 1367->1390 1391 6ceb4f54-6ceb4f64 1367->1391 1376 6ceb4e70-6ceb4e81 1368->1376 1369->1364 1381 6ceb5303-6ceb5310 call 6cec663b 1371->1381 1382 6ceb52f1-6ceb52fe call 6cec663b 1371->1382 1372->1371 1376->1369 1376->1376 1381->1365 1382->1381 1390->1391 1392 6ceb4f31-6ceb4f50 1390->1392 1391->1362 1391->1367 1392->1391 1398 6ceb5271-6ceb528e call 6cec51d6 call 6cea82a0 1395->1398 1399 6ceb4fc1 1395->1399 1411 6ceb5293 1398->1411 1403 6ceb4ff4-6ceb5041 call 6cec514c call 6ceaabe0 1399->1403 1413 6ceb504f-6ceb5051 1403->1413 1414 6ceb5043-6ceb5049 1403->1414 1411->1353 1416 6ceb539e-6ceb53e4 call 6cec51d6 * 2 call 6cea82a0 1413->1416 1417 6ceb5057-6ceb506f call 6ceaab10 1413->1417 1414->1413 1415 6ceb5262-6ceb526f call 6cec51d6 1414->1415 1415->1398 1425 6ceb53e5-6ceb542b call 6cec51d6 * 2 call 6cea82a0 1417->1425 1426 6ceb5075-6ceb5079 1417->1426 1428 6ceb507b-6ceb508d call 6cec51d6 1426->1428 1429 6ceb5092-6ceb50a9 call 6cebe6e0 1426->1429 1442 6ceb524c-6ceb525a 1428->1442 1440 6ceb50ab-6ceb50b0 1429->1440 1441 6ceb50b2-6ceb50c4 call 6cec51d6 1429->1441 1440->1441 1444 6ceb50c9-6ceb50df call 6ceb4a10 1440->1444 1441->1442 1446 6ceb4ff0 1442->1446 1447 6ceb5260 1442->1447 1452 6ceb50e9-6ceb5103 call 6ceb4a10 1444->1452 1453 6ceb50e1-6ceb50e5 1444->1453 1446->1403 1447->1398 1456 6ceb510f-6ceb51cf call 6ceb4ac0 call 6ceb4b60 * 2 1452->1456 1457 6ceb5105-6ceb510b 1452->1457 1453->1452 1464 6ceb51d1 call 6cea1680 1456->1464 1465 6ceb51d6-6ceb51de 1456->1465 1457->1456 1464->1465 1467 6ceb51e0-6ceb51ef 1465->1467 1467->1467 1468 6ceb51f1-6ceb5235 call 6cec3910 call 6cec6308 call 6cec51d6 call 6ceb5560 1467->1468 1476 6ceb523a-6ceb5248 call 6cec51d6 1468->1476 1476->1442
                                                                          APIs
                                                                            • Part of subcall function 6CEB2470: FindClose.KERNEL32(?,388BE448,6CED0658,00000000), ref: 6CEB24C4
                                                                            • Part of subcall function 6CEB2470: FindFirstFileW.KERNEL32(6CED50B8,?,388BE448,6CED0658,00000000), ref: 6CEB24DE
                                                                            • Part of subcall function 6CEB2470: FindFirstFileW.KERNEL32(?,?), ref: 6CEB253A
                                                                          • FindClose.KERNEL32(FFFFFFFF,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4CE0
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Find$CloseFileFirst
                                                                          • String ID: (_l$Rl
                                                                          • API String ID: 2295610775-3547457512
                                                                          • Opcode ID: ceb25214c8c79f496bdbde01986a19c676be3c7d50c2886f133f0ab1eede033b
                                                                          • Instruction ID: 52632437c9cae21a85a7343fed447c8a25553c7ac4b19124dba9efeaa8e2a20e
                                                                          • Opcode Fuzzy Hash: ceb25214c8c79f496bdbde01986a19c676be3c7d50c2886f133f0ab1eede033b
                                                                          • Instruction Fuzzy Hash: 72325CB16093808FD320CF69C580AABB7F4BFC9318F244A2EE59997750D771A945CB93
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEC2A30 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 122libraryfileCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • _memset.LIBCMT ref: 6CEC2B0E
                                                                          • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 6CEC2B20
                                                                          • LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 6CEC2B3C
                                                                          • FindClose.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 6CEC2B48
                                                                          • FindResourceW.KERNEL32(6CEA0000,00000068,RC_DATA), ref: 6CEC2B7E
                                                                          • LoadLibraryW.KERNEL32(?,?), ref: 6CEC2BA7
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Find$LibraryLoad$CloseFileFirstResource_memset
                                                                          • String ID: 7z.dll$RC_DATA
                                                                          • API String ID: 597928718-3209790242
                                                                          • Opcode ID: 3ba0bc1adcf2b27001074a6eaa28e338223e1c44809ace71f8f46f783bb5e915
                                                                          • Instruction ID: 0408711564aef5e5f8a68e39cea2f8ce59eea1884c565c457eede0ff36513fbf
                                                                          • Opcode Fuzzy Hash: 3ba0bc1adcf2b27001074a6eaa28e338223e1c44809ace71f8f46f783bb5e915
                                                                          • Instruction Fuzzy Hash: 1141E2716093409FC710DF64DA48B9BB7F8AB9A348F240A1DF4A597780DB35E509CBA3
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEB35F0 Relevance: 13.0, APIs: 8, Instructions: 979COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FindClose.KERNEL32(FFFFFFFF,?), ref: 6CEB37C4
                                                                          • GetLastError.KERNEL32(?), ref: 6CEB37D1
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CloseErrorFindLast
                                                                          • String ID:
                                                                          • API String ID: 754982922-0
                                                                          • Opcode ID: 284441ceed714034729ace253cdd0155c1e2bc960005a77d162857415455e6c0
                                                                          • Instruction ID: ef979698f3b75b5fa6cbdda60eeaaeeea5b15a695a24e5cf0b952dac6266ed4f
                                                                          • Opcode Fuzzy Hash: 284441ceed714034729ace253cdd0155c1e2bc960005a77d162857415455e6c0
                                                                          • Instruction Fuzzy Hash: 1982BFB16083419FD724CF58C581BABB7F5AF89308F244A1DF999A7750DB30E849CB92
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEC2980 Relevance: 10.6, APIs: 7, Instructions: 74fileCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 2210 6cec2980-6cec299d LoadResource 2211 6cec299f-6cec29ab SizeofResource 2210->2211 2212 6cec2a1b-6cec2a24 2210->2212 2211->2212 2213 6cec29ad-6cec29b8 LockResource 2211->2213 2213->2212 2214 6cec29ba-6cec29da CreateFileW 2213->2214 2214->2212 2215 6cec29dc-6cec29ed WriteFile 2214->2215 2216 6cec29ef-6cec29f4 2215->2216 2217 6cec29f6 2215->2217 2216->2217 2218 6cec29f9-6cec2a02 FindCloseChangeNotification 2216->2218 2217->2218 2219 6cec2a04-6cec2a0a DeleteFileW 2218->2219 2220 6cec2a10-6cec2a18 2218->2220 2219->2220
                                                                          APIs
                                                                          • LoadResource.KERNEL32(6CEA0000,00000000,6CEA0000,?,?,6CEC2B94,?), ref: 6CEC2993
                                                                          • SizeofResource.KERNEL32(6CEA0000,00000000), ref: 6CEC29A1
                                                                          • LockResource.KERNEL32(00000000), ref: 6CEC29AE
                                                                          • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 6CEC29CF
                                                                          • WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 6CEC29E5
                                                                          • FindCloseChangeNotification.KERNEL32(00000000), ref: 6CEC29FA
                                                                          • DeleteFileW.KERNEL32(00000000), ref: 6CEC2A0A
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: FileResource$ChangeCloseCreateDeleteFindLoadLockNotificationSizeofWrite
                                                                          • String ID:
                                                                          • API String ID: 290882627-0
                                                                          • Opcode ID: 03c5476d5cc04c53b11e6a0782f6fdeba06c37bc786717572e2d7e49df36f98b
                                                                          • Instruction ID: 8c1bb6308ceb176a00b4b0ace5990f6878f305176d356a38f17ec989b4b3f606
                                                                          • Opcode Fuzzy Hash: 03c5476d5cc04c53b11e6a0782f6fdeba06c37bc786717572e2d7e49df36f98b
                                                                          • Instruction Fuzzy Hash: 71113831741604BBD7208AA99C4CF9BBB7CDB9A625F204665FE60E7380D671E801C2B1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEB2470 Relevance: 4.6, APIs: 3, Instructions: 86fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FindClose.KERNEL32(?,388BE448,6CED0658,00000000), ref: 6CEB24C4
                                                                          • FindFirstFileW.KERNEL32(6CED50B8,?,388BE448,6CED0658,00000000), ref: 6CEB24DE
                                                                          • FindFirstFileW.KERNEL32(?,?), ref: 6CEB253A
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Find$FileFirst$Close
                                                                          • String ID:
                                                                          • API String ID: 2810966245-0
                                                                          • Opcode ID: 7e89ff490da2a99c381623007dc96613a09065404d043440a5466a707c7fdd09
                                                                          • Instruction ID: 7620e215ce06ca30eb623ee6e70332cb641baca657e2a5e69dabc98925d65a64
                                                                          • Opcode Fuzzy Hash: 7e89ff490da2a99c381623007dc96613a09065404d043440a5466a707c7fdd09
                                                                          • Instruction Fuzzy Hash: 3B3172715097418FC710DF24DA487AAB7F4FF59328F204B2DE4A597780E730A909CB92
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 10001B41 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetSystemInfo.KERNEL32(?), ref: 10001B4B
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: InfoSystem
                                                                          • String ID:
                                                                          • API String ID: 31276548-0
                                                                          • Opcode ID: 62b61814a3264c2a0f4f706347acbeacecd619b648c4921b8ba18a43bc66cf00
                                                                          • Instruction ID: d3e97598432a4a316c69c7b199a975740681d618dafaa63f0622d860b7c48d59
                                                                          • Opcode Fuzzy Hash: 62b61814a3264c2a0f4f706347acbeacecd619b648c4921b8ba18a43bc66cf00
                                                                          • Instruction Fuzzy Hash: A9C09B7490431D97DB00E7E5D9C9D8EB7FCB608204F500451E555F3141E670F94587A1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEB82B0 Relevance: 53.3, APIs: 28, Strings: 2, Instructions: 779COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 0 6ceb82b0-6ceb830c call 6ceaf940 3 6ceb8329-6ceb8378 call 6cea4dd0 call 6ceb7df0 call 6ceafb40 call 6cea3be0 0->3 4 6ceb830e-6ceb8324 call 6cec663b 0->4 14 6ceb837a-6ceb8390 call 6cec663b 3->14 15 6ceb8395-6ceb83bb call 6cea42e0 call 6cec5f2a 3->15 4->3 14->15 21 6ceb83bd-6ceb83cb call 6cec663b 15->21 22 6ceb83d0-6ceb83e2 call 6ceb8eb0 15->22 21->22 26 6ceb83ec-6ceb83fe call 6ceb6cc0 22->26 27 6ceb83e4-6ceb83e9 22->27 30 6ceb841b-6ceb8424 26->30 31 6ceb8400-6ceb8416 call 6cec663b 26->31 27->26 33 6ceb842f 30->33 34 6ceb8426-6ceb842d 30->34 31->30 35 6ceb8433-6ceb8436 33->35 34->33 34->35 36 6ceb8438-6ceb843c 35->36 37 6ceb846d-6ceb849a call 6ceb72f0 35->37 38 6ceb843e-6ceb8441 36->38 39 6ceb8452-6ceb8468 call 6cec663b 36->39 45 6ceb849c-6ceb84b2 call 6cec663b 37->45 46 6ceb84b7-6ceb84bb 37->46 38->39 41 6ceb8443-6ceb8450 call 6cea26c0 38->41 39->37 41->37 41->39 45->46 49 6ceb84c1-6ceb84c8 46->49 50 6ceb8834-6ceb8847 call 6ceb09e0 46->50 52 6ceb84ce-6ceb84db call 6cea26c0 49->52 53 6ceb8c70-6ceb8caf call 6ceb4c00 49->53 58 6ceb8849-6ceb8851 call 6ceb8110 50->58 59 6ceb8853 50->59 61 6ceb8819-6ceb882f call 6cec663b 52->61 62 6ceb84e1-6ceb84e8 52->62 57 6ceb8cb4-6ceb8cbc 53->57 64 6ceb8d19-6ceb8d1e 57->64 65 6ceb8cbe 57->65 63 6ceb8855-6ceb885e 58->63 59->63 61->50 67 6ceb84ea-6ceb84f0 62->67 68 6ceb8502-6ceb8538 call 6ceb49e0 call 6cece5ce 62->68 69 6ceb8868-6ceb892e call 6cea1460 call 6ceb49e0 call 6cea1460 call 6ceb7bc0 63->69 70 6ceb8860-6ceb8865 63->70 71 6ceb8d20-6ceb8d23 64->71 72 6ceb8d65-6ceb8dd3 call 6cec663b * 4 64->72 74 6ceb8cfe-6ceb8d14 call 6cec663b 65->74 75 6ceb8cc0-6ceb8cc5 65->75 67->68 78 6ceb84f2-6ceb84fd call 6cea7e60 67->78 113 6ceb853a-6ceb854d call 6ceb93a0 68->113 114 6ceb8553-6ceb855a 68->114 146 6ceb893f 69->146 147 6ceb8930-6ceb893d 69->147 70->69 81 6ceb8d2a-6ceb8d3c call 6cea9990 71->81 82 6ceb8d25-6ceb8d28 71->82 74->64 83 6ceb8ce9-6ceb8cf9 call 6cec663b 75->83 84 6ceb8cc7-6ceb8ccc 75->84 78->68 91 6ceb8d42-6ceb8d44 81->91 82->81 82->91 83->74 84->71 85 6ceb8cce-6ceb8ce4 call 6cec663b 84->85 85->83 96 6ceb8d4a-6ceb8d60 call 6cec663b 91->96 97 6ceb8b32-6ceb8b47 call 6cea9990 91->97 96->72 107 6ceb8b49-6ceb8b4e 97->107 108 6ceb8b51-6ceb8b94 call 6ceafc00 call 6ceb8de0 call 6cea4c80 97->108 107->108 113->114 119 6ceb8569 114->119 120 6ceb855c-6ceb8567 114->120 121 6ceb856d-6ceb85ac call 6cea1460 call 6ceb81d0 119->121 120->119 120->121 139 6ceb85bb 121->139 140 6ceb85ae-6ceb85b9 121->140 142 6ceb85bf-6ceb85c1 139->142 140->139 140->142 144 6ceb85c3-6ceb85ce 142->144 145 6ceb85d0 142->145 144->145 148 6ceb85d4-6ceb866f call 6cea1460 call 6ceb7d70 call 6ceba7b0 144->148 145->148 149 6ceb8949-6ceb89c6 call 6cea1460 call 6ceb0880 146->149 147->146 147->149 175 6ceb868c-6ceb86bf call 6cebb9c0 148->175 176 6ceb8671-6ceb8687 call 6cec663b 148->176 159 6ceb89eb-6ceb8a39 call 6cea1400 call 6cea8ab0 149->159 160 6ceb89c8 149->160 171 6ceb8a3e-6ceb8a46 159->171 162 6ceb89d0-6ceb89e9 call 6cea5290 160->162 162->159 173 6ceb8a48 171->173 174 6ceb8aa3-6ceb8aa8 171->174 179 6ceb8a4a-6ceb8a4f 173->179 180 6ceb8a88-6ceb8a9e call 6cec663b 173->180 177 6ceb8aae-6ceb8ab5 174->177 178 6ceb8c55-6ceb8c6b call 6cec663b 174->178 195 6ceb86c1 175->195 196 6ceb86c6-6ceb86cb 175->196 176->175 184 6ceb8ac0-6ceb8ac6 177->184 185 6ceb8ab7-6ceb8ab9 177->185 178->53 187 6ceb8a6d-6ceb8a83 call 6cec663b 179->187 188 6ceb8a51-6ceb8a56 179->188 180->174 191 6ceb8acc-6ceb8ad2 184->191 192 6ceb8b95-6ceb8b97 184->192 185->184 190 6ceb8abb 185->190 187->180 188->177 193 6ceb8a58-6ceb8a68 call 6cec663b 188->193 190->184 191->192 201 6ceb8ad8-6ceb8ada 191->201 197 6ceb8b99-6ceb8baf call 6cec663b 192->197 198 6ceb8bb4-6ceb8be5 call 6cec51d6 call 6ceb8f00 call 6cec51d6 192->198 193->187 195->196 199 6ceb8728-6ceb872d 196->199 200 6ceb86cd 196->200 197->198 239 6ceb8bef-6ceb8c04 call 6cea9990 198->239 240 6ceb8be7-6ceb8bec 198->240 209 6ceb87fe-6ceb8814 call 6cec663b 199->209 210 6ceb8733-6ceb8735 199->210 204 6ceb86cf-6ceb86d4 200->204 205 6ceb870d-6ceb8723 call 6cec663b 200->205 207 6ceb8adc-6ceb8af2 call 6cec663b 201->207 208 6ceb8af7-6ceb8b28 call 6cec51d6 call 6ceb8f00 call 6cec51d6 201->208 211 6ceb86f2-6ceb8708 call 6cec663b 204->211 212 6ceb86d6-6ceb86db 204->212 205->199 207->208 208->97 241 6ceb8b2a-6ceb8b2f 208->241 209->61 218 6ceb8752-6ceb8759 210->218 219 6ceb8737-6ceb874d call 6cec663b 210->219 211->205 212->210 220 6ceb86dd-6ceb86ed call 6cec663b 212->220 225 6ceb875b-6ceb875d 218->225 226 6ceb875f 218->226 219->218 220->211 225->226 227 6ceb8764-6ceb87fd call 6cec51d6 * 3 call 6ceb8270 call 6cec51d6 call 6cea9990 call 6ceafc00 call 6ceb8de0 call 6cea4c80 225->227 226->227 247 6ceb8c0e-6ceb8c54 call 6ceafc00 call 6ceb8de0 call 6cea4c80 239->247 248 6ceb8c06-6ceb8c09 239->248 240->239 241->97 248->247
                                                                          APIs
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB84B2
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB8687
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB86ED
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB8708
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB8723
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB874D
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB882F
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB8A68
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB8A83
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB8A9E
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB8AF2
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB8324
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB8390
                                                                          • _malloc.LIBCMT ref: 6CEB83B1
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB83CB
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB8416
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB8468
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB8CE4
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB8CF9
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB8D14
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw$ExceptionRaise_malloc
                                                                          • String ID: (_l$7zCon.sfx
                                                                          • API String ID: 1305767944-3678846600
                                                                          • Opcode ID: e32dce7ef1ae9df6657cf3772a5b6a212fad4b88f0b9dfc49ec406c067d347ff
                                                                          • Instruction ID: a44dd055e10b7913ba79be1523cb69a84e994f455f49d355211d98ba92ee9005
                                                                          • Opcode Fuzzy Hash: e32dce7ef1ae9df6657cf3772a5b6a212fad4b88f0b9dfc49ec406c067d347ff
                                                                          • Instruction Fuzzy Hash: 63629F71900259DFDB21CBA4CA80BEEB7B8AF58308F2485DAD148B7741D7745B89CFA1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 10004859 Relevance: 30.7, APIs: 16, Strings: 1, Instructions: 904COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __EH_prolog.LIBCMT ref: 1000485E
                                                                            • Part of subcall function 100081EF: __EH_prolog.LIBCMT ref: 100081F4
                                                                            • Part of subcall function 10017690: InitializeCriticalSection.KERNEL32 ref: 100176BE
                                                                          • DeleteCriticalSection.KERNEL32(?), ref: 10004A99
                                                                          • SysFreeString.OLEAUT32(?), ref: 10004D73
                                                                          • DeleteCriticalSection.KERNEL32(?,00000000,?,00000000), ref: 10004E67
                                                                          • DeleteCriticalSection.KERNEL32(?,00000000,?,00000000), ref: 10004ED2
                                                                          • DeleteCriticalSection.KERNEL32(?,00000000,?,00000000), ref: 10004F2E
                                                                          • DeleteCriticalSection.KERNEL32(?), ref: 10005080
                                                                          • DeleteCriticalSection.KERNEL32(?), ref: 100050D7
                                                                          • DeleteCriticalSection.KERNEL32(?), ref: 10005131
                                                                          • DeleteCriticalSection.KERNEL32(?), ref: 1000519C
                                                                          • SysFreeString.OLEAUT32(?), ref: 100051C5
                                                                          • DeleteCriticalSection.KERNEL32(?), ref: 10005201
                                                                          • SysFreeString.OLEAUT32(?), ref: 10005238
                                                                          • DeleteCriticalSection.KERNEL32(?), ref: 10005274
                                                                          • DeleteCriticalSection.KERNEL32(?), ref: 100052EC
                                                                          • DeleteCriticalSection.KERNEL32(?), ref: 1000537C
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalSection$Delete$FreeString$H_prolog$Initialize
                                                                          • String ID: *
                                                                          • API String ID: 3004459923-163128923
                                                                          • Opcode ID: 8d515e06e490fc0e037fbab827e854e363c9577b9e0b0373954554861fc9b88c
                                                                          • Instruction ID: ecb8a8915c69c7c96d6c908040f4422d87eeaffb21051c4ea884642e96cadca4
                                                                          • Opcode Fuzzy Hash: 8d515e06e490fc0e037fbab827e854e363c9577b9e0b0373954554861fc9b88c
                                                                          • Instruction Fuzzy Hash: C3926B74900289DFEF04CFA4C884ADDBBB5FF19344F21849CE446AB256CB71AA89CF51
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEA42E0 Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 538COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1479 6cea42e0-6cea4319 1480 6cea431b-6cea4320 call 6cea2670 1479->1480 1481 6cea4325-6cea433c call 6cea26e0 1479->1481 1480->1481 1485 6cea4348-6cea436a 1481->1485 1486 6cea433e-6cea4343 call 6cea2670 1481->1486 1488 6cea437e-6cea4387 1485->1488 1489 6cea436c-6cea4378 1485->1489 1486->1485 1490 6cea4389-6cea4392 1488->1490 1491 6cea43a4 1488->1491 1489->1488 1492 6cea439d-6cea43a2 1490->1492 1493 6cea4394-6cea4397 1490->1493 1494 6cea43a9-6cea43e1 call 6cea3cf0 * 2 1491->1494 1492->1494 1493->1491 1495 6cea4399-6cea439b 1493->1495 1500 6cea4402-6cea440c 1494->1500 1501 6cea43e3-6cea43ff call 6cea2d80 1494->1501 1495->1494 1503 6cea4428-6cea443b 1500->1503 1504 6cea440e-6cea4425 call 6cea2d80 1500->1504 1501->1500 1507 6cea444e 1503->1507 1508 6cea443d-6cea4443 1503->1508 1504->1503 1511 6cea4453-6cea445c 1507->1511 1508->1507 1510 6cea4445-6cea444c 1508->1510 1510->1507 1510->1511 1512 6cea452b-6cea4533 1511->1512 1513 6cea4462 1511->1513 1514 6cea4466-6cea446e 1512->1514 1515 6cea4539 1512->1515 1513->1514 1516 6cea453e-6cea4543 1514->1516 1517 6cea4474 1514->1517 1515->1516 1518 6cea4479-6cea44ba call 6cea2940 1516->1518 1519 6cea4549-6cea454d 1516->1519 1517->1518 1526 6cea44bc-6cea44cf call 6cea1460 1518->1526 1527 6cea44d3-6cea44e9 1518->1527 1521 6cea4559-6cea4573 call 6cea1460 1519->1521 1522 6cea454f-6cea4554 call 6cea2670 1519->1522 1521->1518 1532 6cea4579-6cea457e call 6cea2670 1521->1532 1522->1521 1526->1527 1530 6cea44eb-6cea4500 call 6cea1460 1527->1530 1531 6cea4504-6cea4509 1527->1531 1530->1531 1536 6cea4738-6cea473d 1531->1536 1537 6cea450f-6cea4513 1531->1537 1539 6cea4583-6cea45ad 1532->1539 1540 6cea473f-6cea4742 1536->1540 1541 6cea474d-6cea4779 call 6cea3750 call 6cea39a0 1536->1541 1542 6cea4521-6cea4526 call 6cea2670 1537->1542 1543 6cea4515-6cea451f 1537->1543 1544 6cea45cb-6cea45d5 1539->1544 1545 6cea45af-6cea45c8 call 6cea2d80 1539->1545 1540->1541 1546 6cea4744-6cea4747 1540->1546 1568 6cea477b 1541->1568 1569 6cea4782-6cea4794 1541->1569 1542->1512 1543->1539 1543->1542 1551 6cea45d7-6cea45f1 call 6cea2d80 1544->1551 1552 6cea45f4-6cea45f9 1544->1552 1545->1544 1546->1541 1550 6cea48a6-6cea48a9 1546->1550 1555 6cea48af-6cea48dd 1550->1555 1556 6cea4a62-6cea4a65 1550->1556 1551->1552 1557 6cea45fb-6cea4608 call 6cebe950 1552->1557 1558 6cea460d-6cea4621 call 6cea3250 call 6cebed50 1552->1558 1563 6cea48df-6cea48f7 call 6cea3e30 1555->1563 1564 6cea4903-6cea4915 1555->1564 1556->1480 1567 6cea4a6b-6cea4a86 call 6cebed50 1556->1567 1557->1558 1591 6cea466f-6cea467b call 6cea3e70 1558->1591 1592 6cea4623-6cea466d call 6cea1420 call 6cea4d10 * 2 call 6cec51d6 1558->1592 1563->1564 1582 6cea48f9-6cea48fe call 6cea2670 1563->1582 1564->1567 1572 6cea491b 1564->1572 1568->1569 1574 6cea4796-6cea479b 1569->1574 1575 6cea47b4-6cea47c5 1569->1575 1578 6cea4920-6cea494e call 6cea1420 CharUpperW 1572->1578 1580 6cea479d-6cea47a1 1574->1580 1581 6cea47a7-6cea47ab 1574->1581 1584 6cea4819 1575->1584 1585 6cea47c7-6cea47e9 call 6cea1460 1575->1585 1578->1480 1600 6cea4954-6cea495b 1578->1600 1588 6cea47ad 1580->1588 1589 6cea47a3-6cea47a5 1580->1589 1581->1575 1581->1588 1582->1564 1587 6cea481d-6cea4838 1584->1587 1585->1584 1607 6cea47eb-6cea47fd 1585->1607 1595 6cea483a-6cea4841 1587->1595 1596 6cea487b-6cea487d 1587->1596 1588->1575 1589->1575 1589->1581 1603 6cea4680-6cea4683 1591->1603 1611 6cea4686-6cea468b 1592->1611 1601 6cea485a-6cea485c 1595->1601 1602 6cea4843-6cea4855 call 6cec663b 1595->1602 1604 6cea4898-6cea48a1 call 6cea3250 1596->1604 1605 6cea487f-6cea4893 call 6cea1460 1596->1605 1608 6cea495d-6cea4967 1600->1608 1609 6cea49a6-6cea49aa 1600->1609 1601->1596 1613 6cea485e-6cea4862 1601->1613 1602->1601 1603->1611 1604->1567 1605->1604 1607->1587 1617 6cea47ff-6cea4817 call 6cea4b20 1607->1617 1618 6cea4969 1608->1618 1619 6cea496e-6cea4981 call 6cea3e30 1608->1619 1609->1480 1612 6cea49b0-6cea49b8 1609->1612 1621 6cea4721-6cea4733 call 6cea5110 1611->1621 1622 6cea4691-6cea46a2 call 6cea39a0 1611->1622 1623 6cea49ba-6cea49c4 1612->1623 1624 6cea49ed-6cea49f1 1612->1624 1613->1596 1625 6cea4864-6cea4876 call 6cec663b 1613->1625 1617->1587 1618->1619 1619->1480 1638 6cea4987-6cea498e 1619->1638 1621->1567 1649 6cea46c7-6cea46d1 1622->1649 1650 6cea46a4-6cea46a8 1622->1650 1632 6cea49cb-6cea49d3 1623->1632 1633 6cea49c6 1623->1633 1624->1480 1636 6cea49f7-6cea49fc 1624->1636 1625->1596 1640 6cea4a34-6cea4a5a call 6cec51d6 1632->1640 1641 6cea49d5-6cea49e5 call 6cea3e30 1632->1641 1633->1632 1636->1640 1643 6cea49fe-6cea4a31 call 6cea1640 call 6cea1460 call 6cec51d6 1636->1643 1638->1480 1647 6cea4994-6cea49a1 1638->1647 1640->1578 1662 6cea4a60 1640->1662 1641->1480 1664 6cea49eb 1641->1664 1643->1640 1647->1640 1657 6cea46ef-6cea4700 1649->1657 1658 6cea46d3-6cea46ec call 6cea1460 call 6ceb2cb0 1649->1658 1650->1649 1655 6cea46aa-6cea46ae 1650->1655 1655->1649 1663 6cea46b0-6cea46c2 call 6cec663b 1655->1663 1660 6cea4702-6cea4712 1657->1660 1661 6cea4714-6cea4718 1657->1661 1658->1657 1660->1621 1661->1621 1668 6cea471a 1661->1668 1662->1567 1663->1649 1664->1640 1668->1621
                                                                          APIs
                                                                            • Part of subcall function 6CEA2670: __CxxThrowException@8.LIBCMT ref: 6CEA2688
                                                                            • Part of subcall function 6CEA4D10: _malloc.LIBCMT ref: 6CEA4D3A
                                                                            • Part of subcall function 6CEA4D10: __CxxThrowException@8.LIBCMT ref: 6CEA4D54
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEA46C2
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEA4855
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEA4876
                                                                          • CharUpperW.USER32(?), ref: 6CEA4943
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw$CharExceptionRaiseUpper_malloc
                                                                          • String ID: (_l$Cannot use absolute pathnames for this command$Incorrect command line$lPl
                                                                          • API String ID: 2609558216-2375522249
                                                                          • Opcode ID: 799285793003d8cae8bb2d1ae73b5ab78923b0119595e628c1a26a9e29e72226
                                                                          • Instruction ID: 21cce0306c0f5f06fe8e71b3eae1f34c832d1e0177577b93eb7ad3c21bb38bff
                                                                          • Opcode Fuzzy Hash: 799285793003d8cae8bb2d1ae73b5ab78923b0119595e628c1a26a9e29e72226
                                                                          • Instruction Fuzzy Hash: 1D22C8715043809FD701CF94C480B96BBF5AF8530CF28999EE4994FB92D774E94ACBA2
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEC3EF0 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 431COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 2005 6cec3ef0-6cec3fb6 call 6cec4b70 call 6cea4a90 call 6cea5bf0 call 6cec51d6 * 2 call 6cec4c50 call 6cea7630 call 6cea15c0 call 6cec51d6 * 2 2026 6cec3fb8-6cec3fbd 2005->2026 2027 6cec3fc3-6cec3fc8 2005->2027 2026->2027 2028 6cec4072-6cec4076 2026->2028 2029 6cec3fce-6cec3fd3 2027->2029 2030 6cec4185-6cec418a 2027->2030 2035 6cec4078-6cec407c 2028->2035 2036 6cec40d3-6cec40e1 call 6cec51d6 2028->2036 2031 6cec3fd9-6cec4065 call 6cec4b70 call 6cec4c50 call 6cea7630 call 6cea7ee0 call 6cea5bf0 call 6cea15c0 call 6cec51d6 * 4 2029->2031 2032 6cec40e6-6cec40eb 2029->2032 2033 6cec42cb-6cec42d0 2030->2033 2034 6cec4190-6cec4195 2030->2034 2175 6cec417d-6cec4182 call 6cec51d6 2031->2175 2032->2030 2037 6cec40f1-6cec417c call 6cec4b70 call 6cec4c50 call 6cea7630 call 6cea7ee0 call 6cea5bf0 call 6cea15c0 call 6cec51d6 * 4 2032->2037 2040 6cec432c-6cec4338 call 6cec5f2a 2033->2040 2041 6cec42d2-6cec42d4 2033->2041 2042 6cec422c-6cec4231 2034->2042 2043 6cec419b-6cec4227 call 6cec4b70 call 6cec4c50 call 6cea7630 call 6cea7ee0 call 6cea5bf0 call 6cea15c0 call 6cec51d6 * 4 2034->2043 2035->2036 2038 6cec407e-6cec40cc call 6cec4b70 call 6cea7630 call 6cea15c0 call 6cec51d6 * 2 2035->2038 2060 6cec4400-6cec4414 2036->2060 2037->2175 2128 6cec40ce 2038->2128 2129 6cec4070 2038->2129 2064 6cec434d-6cec4379 call 6cec1230 call 6ceb82b0 2040->2064 2065 6cec433a-6cec4348 call 6cec663b 2040->2065 2050 6cec42d7-6cec42e0 2041->2050 2042->2033 2045 6cec4237-6cec42c2 call 6cec4b70 call 6cec4c50 call 6cea7630 call 6cea7ee0 call 6cea5bf0 call 6cea15c0 call 6cec51d6 * 4 2042->2045 2179 6cec42c3-6cec42c8 call 6cec51d6 2043->2179 2045->2179 2050->2050 2058 6cec42e2-6cec42e6 2050->2058 2058->2040 2067 6cec42e8-6cec4329 call 6cec4b70 call 6cea7630 call 6cea15c0 call 6cec51d6 * 2 2058->2067 2091 6cec437e-6cec43c9 call 6cec1a40 2064->2091 2065->2064 2067->2040 2112 6cec43cb-6cec43ce 2091->2112 2113 6cec43f4-6cec43fd call 6cec51d6 2091->2113 2121 6cec43d5-6cec43d9 2112->2121 2122 6cec43d0 call 6cec5bd8 2112->2122 2113->2060 2135 6cec43db call 6cec5bd8 2121->2135 2136 6cec4417-6cec4419 2121->2136 2122->2121 2128->2027 2129->2028 2139 6cec43e0-6cec43e3 2135->2139 2136->2139 2148 6cec43ea-6cec43f2 2139->2148 2149 6cec43e5 call 6cec5bd8 2139->2149 2148->2113 2149->2148 2175->2030 2179->2033
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: -i$ -p$ -x$!$7za L
                                                                          • API String ID: 0-2873427068
                                                                          • Opcode ID: 8e83e6c8214e146afedcdeb7eea33f0d4ba5669341e7f3779e3245ae5c8da366
                                                                          • Instruction ID: 67929d4deb9df2b1530fac5533edd97ecbc2fc705d4b27a9cc76e442ca081e34
                                                                          • Opcode Fuzzy Hash: 8e83e6c8214e146afedcdeb7eea33f0d4ba5669341e7f3779e3245ae5c8da366
                                                                          • Instruction Fuzzy Hash: C7F1B972A01248EFCB05DFE4CA44BDE7BB8AF55308F30454DE5116B741D770AA09DBA2
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEAC2D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 121COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 2183 6ceac2d0-6ceac30f 2184 6ceac351-6ceac35f call 6cec5f2a 2183->2184 2185 6ceac311-6ceac31f call 6cec5f2a 2183->2185 2190 6ceac361-6ceac36f call 6cec663b 2184->2190 2191 6ceac374-6ceac3b3 call 6ceb2a70 2184->2191 2192 6ceac321-6ceac32f call 6cec663b 2185->2192 2193 6ceac334-6ceac34c 2185->2193 2190->2191 2201 6ceac3b8-6ceac3ba 2191->2201 2192->2193 2198 6ceac3d7-6ceac3eb call 6ceaae70 2193->2198 2202 6ceac3f0-6ceac3f8 2198->2202 2203 6ceac3bc-6ceac3d3 GetLastError 2201->2203 2204 6ceac3d5 2201->2204 2205 6ceac3fa-6ceac3ff 2202->2205 2206 6ceac402-6ceac40b 2202->2206 2208 6ceac415-6ceac428 2203->2208 2204->2198 2205->2206 2207 6ceac40d-6ceac412 2206->2207 2206->2208 2207->2208
                                                                          APIs
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEAC32F
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          • _malloc.LIBCMT ref: 6CEAC313
                                                                            • Part of subcall function 6CEC5F2A: __FF_MSGBANNER.LIBCMT ref: 6CEC5F4D
                                                                            • Part of subcall function 6CEC5F2A: __NMSG_WRITE.LIBCMT ref: 6CEC5F54
                                                                            • Part of subcall function 6CEC5F2A: RtlAllocateHeap.NTDLL(00000000,6CEAFA6F,?,00000000,?,?,6CEA4D3F,0000000C,388BE448,?,?,00000000,?,?,6CECEF9B,000000FF), ref: 6CEC5FA1
                                                                          • _malloc.LIBCMT ref: 6CEAC353
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEAC36F
                                                                          • GetLastError.KERNEL32(6CED4C28,80000000,00000001,00000003), ref: 6CEAC3BC
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw_malloc$AllocateErrorExceptionHeapLastRaise
                                                                          • String ID: (Ll$(Ll
                                                                          • API String ID: 2571202727-1044384729
                                                                          • Opcode ID: 5ad4e6055d2c13dbbec5a0f220c44e40f6622d94a5e5eb63c4ca2c66a06fc893
                                                                          • Instruction ID: 2a7811de40a36bf80516105ede7712645d380db869ad262c8a2b4a3c20be1f2c
                                                                          • Opcode Fuzzy Hash: 5ad4e6055d2c13dbbec5a0f220c44e40f6622d94a5e5eb63c4ca2c66a06fc893
                                                                          • Instruction Fuzzy Hash: DD41F3B2601204AFCB10DFA8C980B9AB7B8FF49314F21866DE9549B790C771E907CB90
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1001A421 Relevance: 9.1, APIs: 6, Instructions: 56memoryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 2221 1001a421-1001a42b 2222 1001a493-1001a496 2221->2222 2223 1001a42d-1001a43d 2221->2223 2226 1001a498-1001a49d 2222->2226 2227 1001a4ba-1001a4c8 HeapDestroy 2222->2227 2224 1001a47f-1001a491 HeapFree 2223->2224 2225 1001a43f-1001a44a 2223->2225 2224->2227 2228 1001a44d-1001a47d VirtualFree * 2 HeapFree 2225->2228 2229 1001a49f-1001a4a4 2226->2229 2228->2224 2228->2228 2230 1001a4b4-1001a4b8 2229->2230 2231 1001a4a6-1001a4ae VirtualFree 2229->2231 2230->2227 2230->2229 2231->2230
                                                                          APIs
                                                                          • VirtualFree.KERNEL32(?,00100000,00004000,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A459
                                                                          • VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A464
                                                                          • HeapFree.KERNEL32(00000000,?,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A471
                                                                          • HeapFree.KERNEL32(00000000,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A48D
                                                                          • VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000,?,?,10019FC1,1001A015,?,?,?), ref: 1001A4AE
                                                                          • HeapDestroy.KERNELBASE(?,?,10019FC1,1001A015,?,?,?), ref: 1001A4C0
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Free$HeapVirtual$Destroy
                                                                          • String ID:
                                                                          • API String ID: 716807051-0
                                                                          • Opcode ID: a134391120f2aacd7473546f5f7e68fbc99744a2b02380d7265d2bcfbbc009a3
                                                                          • Instruction ID: 1c740d521b0f7e213dbb02f6402200852ca7cbed31c7f2444751ff5461a08e8a
                                                                          • Opcode Fuzzy Hash: a134391120f2aacd7473546f5f7e68fbc99744a2b02380d7265d2bcfbbc009a3
                                                                          • Instruction Fuzzy Hash: 5A110035240365BBE661EB10DCCAF05B7A6E785750F314026FA456A571C7B2BCA2CB14
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEB69E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113libraryloaderCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 2232 6ceb69e0-6ceb6a0d 2233 6ceb6a0f-6ceb6a20 LoadLibraryExW 2232->2233 2234 6ceb6a3e-6ceb6a78 call 6ceb7750 2232->2234 2235 6ceb6a22-6ceb6a34 2233->2235 2236 6ceb6a37-6ceb6a38 FreeLibrary 2233->2236 2239 6ceb6a7a-6ceb6a81 2234->2239 2240 6ceb6af6-6ceb6b02 2234->2240 2236->2234 2241 6ceb6a83-6ceb6a8c FreeLibrary 2239->2241 2242 6ceb6a97-6ceb6ab3 GetProcAddress 2239->2242 2246 6ceb6b06-6ceb6b19 2240->2246 2241->2242 2243 6ceb6a8e-6ceb6a91 2241->2243 2244 6ceb6ae9-6ceb6af4 2242->2244 2245 6ceb6ab5-6ceb6aba call 6ceb5f50 2242->2245 2243->2242 2244->2240 2244->2246 2248 6ceb6abf-6ceb6aca 2245->2248 2248->2244 2249 6ceb6acc-6ceb6add call 6ceb6530 2248->2249 2252 6ceb6adf-6ceb6ae5 2249->2252 2253 6ceb6ae7 2249->2253 2252->2244 2252->2253 2253->2244
                                                                          APIs
                                                                          • LoadLibraryExW.KERNEL32(?,00000000,00000002,388BE448,6CEDFCC8,00000000), ref: 6CEB6A18
                                                                          • FreeLibrary.KERNEL32(00000000), ref: 6CEB6A38
                                                                          • FreeLibrary.KERNEL32(00000000,388BE448,6CEDFCC8,00000000), ref: 6CEB6A84
                                                                          • GetProcAddress.KERNEL32(?,CreateObject), ref: 6CEB6AA5
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Library$Free$AddressLoadProc
                                                                          • String ID: CreateObject
                                                                          • API String ID: 1386263645-166191583
                                                                          • Opcode ID: f635a39abadeabd8f348f8485abb9c30796781f86cfb8890598dae783329324a
                                                                          • Instruction ID: 664aad2c0111ec4ae4c2097e6305e5ed236d40b4e152d8dfd7531a72bdb90015
                                                                          • Opcode Fuzzy Hash: f635a39abadeabd8f348f8485abb9c30796781f86cfb8890598dae783329324a
                                                                          • Instruction Fuzzy Hash: 57416E75A40605EFDB14CF65D680BAABBF9FF49314F20861AE825D7780D734E900CB50
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEB59C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 2254 6ceb59c0-6ceb59c8 2255 6ceb59ca 2254->2255 2256 6ceb59f2-6ceb59fc 2254->2256 2257 6ceb59cc-6ceb59d3 call 6cec5f2a 2255->2257 2256->2257 2258 6ceb59fe-6ceb5a21 call 6cec5c76 call 6cec663b 2256->2258 2261 6ceb59d8-6ceb59dd 2257->2261 2264 6ceb5a26-6ceb5a29 2258->2264 2263 6ceb59df-6ceb59ed call 6cec663b 2261->2263 2261->2264 2263->2256
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 6CEB59D3
                                                                            • Part of subcall function 6CEC5F2A: __FF_MSGBANNER.LIBCMT ref: 6CEC5F4D
                                                                            • Part of subcall function 6CEC5F2A: __NMSG_WRITE.LIBCMT ref: 6CEC5F54
                                                                            • Part of subcall function 6CEC5F2A: RtlAllocateHeap.NTDLL(00000000,6CEAFA6F,?,00000000,?,?,6CEA4D3F,0000000C,388BE448,?,?,00000000,?,?,6CECEF9B,000000FF), ref: 6CEC5FA1
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB59ED
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          • std::exception::exception.LIBCMT ref: 6CEB5A0C
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB5A21
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw$AllocateExceptionHeapRaise_mallocstd::exception::exception
                                                                          • String ID: d2l
                                                                          • API String ID: 1974103008-2889290444
                                                                          • Opcode ID: c756624e74a5309ef39bb8d6d727663ac7125628ca8e0501520f3fd64b05ed4b
                                                                          • Instruction ID: a5fa7aa208ae10d7ea3324f82bb2492568bc42d6215af2dbc516c094bf316372
                                                                          • Opcode Fuzzy Hash: c756624e74a5309ef39bb8d6d727663ac7125628ca8e0501520f3fd64b05ed4b
                                                                          • Instruction Fuzzy Hash: B4F0F6B191520965DB08DBF48B41BFFB73C5B40318F30076ED422B2A80EB70A61E82A3
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEA3E70 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 250COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEA4042
                                                                            • Part of subcall function 6CEA4D10: _malloc.LIBCMT ref: 6CEA4D3A
                                                                            • Part of subcall function 6CEA4D10: __CxxThrowException@8.LIBCMT ref: 6CEA4D54
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEA41B5
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw$_malloc
                                                                          • String ID: Pl$Pl
                                                                          • API String ID: 175252994-816631033
                                                                          • Opcode ID: a8df7c876eccfa7469a2a5edd5eac1210e491f4d0bd4fa9c76994c65a1660bf0
                                                                          • Instruction ID: d3cd370525f4348a35ee558edd377cad87b96aac53608782e058cddfb629c00f
                                                                          • Opcode Fuzzy Hash: a8df7c876eccfa7469a2a5edd5eac1210e491f4d0bd4fa9c76994c65a1660bf0
                                                                          • Instruction Fuzzy Hash: E5B1D4B1D01258DFDB10CF99D981ADEFBB4BB08304F6481AEE519A7740DB346A4ACF91
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEB5F50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84libraryloaderCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 2529 6ceb5f50-6ceb5f8a GetProcAddress 2530 6ceb601a 2529->2530 2531 6ceb5f90-6ceb5fa3 GetProcAddress 2529->2531 2532 6ceb601c-6ceb602c call 6cec51c7 2530->2532 2533 6ceb5faf-6ceb5fb4 2531->2533 2534 6ceb5fa5-6ceb5fad 2531->2534 2533->2530 2536 6ceb5fb6 2533->2536 2534->2532 2534->2533 2539 6ceb5fc0-6ceb5fc3 2536->2539 2540 6ceb5fc6-6ceb5fe7 call 6ceb5e80 2536->2540 2539->2540 2540->2532 2543 6ceb5fe9-6ceb6003 call 6ceb5e80 2540->2543 2543->2532 2546 6ceb6005-6ceb600f call 6ceb77e0 2543->2546 2548 6ceb6014-6ceb6018 2546->2548 2548->2530 2548->2539
                                                                          APIs
                                                                          • GetProcAddress.KERNEL32(00000000,GetMethodProperty), ref: 6CEB5F83
                                                                          • GetProcAddress.KERNEL32(00000000,GetNumberOfMethods), ref: 6CEB5F9F
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AddressProc
                                                                          • String ID: GetMethodProperty$GetNumberOfMethods
                                                                          • API String ID: 190572456-2134343882
                                                                          • Opcode ID: f3ef9238fb4f176cd19f5f20f5161d8da122106747547898ccdc8021485dc2d5
                                                                          • Instruction ID: 24bd9f9938b3f80a6531b258b46cac8eaa90cd187dac7cfdaa62dd5f5209efc3
                                                                          • Opcode Fuzzy Hash: f3ef9238fb4f176cd19f5f20f5161d8da122106747547898ccdc8021485dc2d5
                                                                          • Instruction Fuzzy Hash: CE212175A02219ABCB04DF95DA809EEB7B9FF48348B244069F814B7701E731E906CBA0
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEA8670 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 373COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetLastError.KERNEL32(?,?,00000000,?,00000000), ref: 6CEA8916
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEA892C
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorException@8LastThrow
                                                                          • String ID: <H
                                                                          • API String ID: 1006195485-4022674625
                                                                          • Opcode ID: bbf5c705f0d4312372f82fc56ac7f055c6accf0a68399c667e5620f0a71c50cf
                                                                          • Instruction ID: ef0b180057e27158340efa035577b2ca4c28cc972e59cfa405101bbc1a13dc81
                                                                          • Opcode Fuzzy Hash: bbf5c705f0d4312372f82fc56ac7f055c6accf0a68399c667e5620f0a71c50cf
                                                                          • Instruction Fuzzy Hash: 29E194B2D01248AFCB14DFE8C980ADEBBB5FF49314F24815DE515AB740D735AA06CBA1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEACAE0 Relevance: 4.8, APIs: 3, Instructions: 266COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 6CEACB18
                                                                            • Part of subcall function 6CEC5F2A: __FF_MSGBANNER.LIBCMT ref: 6CEC5F4D
                                                                            • Part of subcall function 6CEC5F2A: __NMSG_WRITE.LIBCMT ref: 6CEC5F54
                                                                            • Part of subcall function 6CEC5F2A: RtlAllocateHeap.NTDLL(00000000,6CEAFA6F,?,00000000,?,?,6CEA4D3F,0000000C,388BE448,?,?,00000000,?,?,6CECEF9B,000000FF), ref: 6CEC5FA1
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEACB30
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                            • Part of subcall function 6CEAA910: __CxxThrowException@8.LIBCMT ref: 6CEAA992
                                                                          • GetLastError.KERNEL32(?,00000000,00000000), ref: 6CEACBD3
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw$AllocateErrorExceptionHeapLastRaise_malloc
                                                                          • String ID:
                                                                          • API String ID: 214124409-0
                                                                          • Opcode ID: 815d88b98614a64607115ed0d87f8ecc7d2113d2af168d83994b21c9d2e00b94
                                                                          • Instruction ID: 628ccd411d10f7d5a4574698cb24b3a3431e260bc1c7753de42f6de229599709
                                                                          • Opcode Fuzzy Hash: 815d88b98614a64607115ed0d87f8ecc7d2113d2af168d83994b21c9d2e00b94
                                                                          • Instruction Fuzzy Hash: 99A161B1E00148EFCB05DFE8D980ADEB7B4BF48318F20466DE915A7740D735AA19CBA1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEB2A70 Relevance: 4.6, APIs: 3, Instructions: 93fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CloseHandle.KERNEL32(?,388BE448,?,00000000,?,?,00000000,?,?,?,00000000,6CED0C38,000000FF), ref: 6CEB2A9F
                                                                          • CreateFileW.KERNEL32(?,?,00000000,00000000,?,00000080,00000000,388BE448,?,00000000,?,?,00000000), ref: 6CEB2ACC
                                                                          • CreateFileW.KERNEL32(?,?,?,00000000,00000000,00000080,00000000), ref: 6CEB2B2B
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CreateFile$CloseHandle
                                                                          • String ID:
                                                                          • API String ID: 1443461169-0
                                                                          • Opcode ID: b7acf66fa3f04a909a1be0f2c6687bd0737c966a7f0f6f79a1ac01af26eb30b9
                                                                          • Instruction ID: 44b33ab1a4685da0f1361de2c3e5d22375354a2ad58297c9020a16a410e84da2
                                                                          • Opcode Fuzzy Hash: b7acf66fa3f04a909a1be0f2c6687bd0737c966a7f0f6f79a1ac01af26eb30b9
                                                                          • Instruction Fuzzy Hash: F6318171A0060AAFDB10CF54D945BABBBB8FF05764F208719F825A77C0D731AA15CBA1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEB1340 Relevance: 4.6, APIs: 3, Instructions: 86COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateDirectoryW.KERNEL32(?,00000000,388BE448,?,?,?,?,?,00000000), ref: 6CEB136E
                                                                          • GetLastError.KERNEL32 ref: 6CEB138C
                                                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 6CEB13D7
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CreateDirectory$ErrorLast
                                                                          • String ID:
                                                                          • API String ID: 2485089472-0
                                                                          • Opcode ID: c8f232f16a17ea798334297c0c352f531850f2a4a593d0dc29b34715c7d0a524
                                                                          • Instruction ID: a57fdde6f04a78dc592f604dbfe34baddd584b20181d79a11830d75c06673f34
                                                                          • Opcode Fuzzy Hash: c8f232f16a17ea798334297c0c352f531850f2a4a593d0dc29b34715c7d0a524
                                                                          • Instruction Fuzzy Hash: F621F173E042049BDB009F94E9057EEBBB8EB45628F20012AE904A3B40DB36A905C7D1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEA1AB0 Relevance: 4.6, APIs: 3, Instructions: 69COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetFilePointer.KERNEL32(?,?,?,?), ref: 6CEA1AEC
                                                                          • GetLastError.KERNEL32 ref: 6CEA1B01
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorFileLastPointer
                                                                          • String ID:
                                                                          • API String ID: 2976181284-0
                                                                          • Opcode ID: 0fbfd584e6257619bbf2be47be9523474a29212f8c65faf43bf5f9cd27738652
                                                                          • Instruction ID: 84cc610cb141342db2069ddff9ef37990bc8ea293d2aff0a419f41354596dde9
                                                                          • Opcode Fuzzy Hash: 0fbfd584e6257619bbf2be47be9523474a29212f8c65faf43bf5f9cd27738652
                                                                          • Instruction Fuzzy Hash: 31119676705109CF8700DEEDE8419AA77F8EB85365F20822EFD14CB760E632D41697E2
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 10008A65 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __EH_prolog.LIBCMT ref: 10008A6A
                                                                            • Part of subcall function 1000A4D5: __EH_prolog.LIBCMT ref: 1000A4DA
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: H_prolog
                                                                          • String ID:
                                                                          • API String ID: 3519838083-3916222277
                                                                          • Opcode ID: e5ab11678a7af806c47a763770102e730e2bdbd4d0fd60aadb5155847553715b
                                                                          • Instruction ID: 5679c1a6151dc724afce86c3166b852d76cd262a1264ab291975f652ea8321e5
                                                                          • Opcode Fuzzy Hash: e5ab11678a7af806c47a763770102e730e2bdbd4d0fd60aadb5155847553715b
                                                                          • Instruction Fuzzy Hash: E3717F74E00609DFEB04DFA4C981AADB7F1FF44390F104519E495AB39ADB34AB81CBA0
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 100087AE Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 156COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: H_prolog
                                                                          • String ID:
                                                                          • API String ID: 3519838083-3916222277
                                                                          • Opcode ID: 87f4fbd9ed9835f185afa277318771e429ef2e1cba041ba48d785ab7c3d46741
                                                                          • Instruction ID: dc996c4eb68a87c8f199726ed84f9ce0c47e74a02a5fa25993d790b30f922306
                                                                          • Opcode Fuzzy Hash: 87f4fbd9ed9835f185afa277318771e429ef2e1cba041ba48d785ab7c3d46741
                                                                          • Instruction Fuzzy Hash: B4515275E002069FEB14DFA8C881ABEB7F5FF88380F548529E545E7245DB70AE41CB61
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEA1950 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FindCloseChangeNotification.KERNEL32(?), ref: 6CEA196C
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ChangeCloseFindNotification
                                                                          • String ID: (Ll
                                                                          • API String ID: 2591292051-2454685301
                                                                          • Opcode ID: 588b22e173755ada5e30b8f74ff0c5c0fc262cf8c2860b5dca038e30ce7c8bed
                                                                          • Instruction ID: ed34cb1936702a52578c98e15e007b43f881f3e2c34f84bcafb8d57a8ebf5258
                                                                          • Opcode Fuzzy Hash: 588b22e173755ada5e30b8f74ff0c5c0fc262cf8c2860b5dca038e30ce7c8bed
                                                                          • Instruction Fuzzy Hash: 03E0D8722017005BD2105FE8A806B4ABBF85F01378B30C719E4B9CBBD0D370E402C798
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEB1060 Relevance: 3.1, APIs: 2, Instructions: 85COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetFileAttributesW.KERNEL32(00000000,00000000,388BE448,?,00000000,?,?,00000000,?,388BE448,00000000), ref: 6CEB108F
                                                                          • SetFileAttributesW.KERNEL32(?,00000000), ref: 6CEB10ED
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AttributesFile
                                                                          • String ID:
                                                                          • API String ID: 3188754299-0
                                                                          • Opcode ID: e0a78526d9875d35c4c31c4768266d4609f2d7533dd5e6a53f0fa4648d28b334
                                                                          • Instruction ID: d0d5776bf7b9ccd15c3692b2cb798cfaf448af754190655628e75f076dc15d27
                                                                          • Opcode Fuzzy Hash: e0a78526d9875d35c4c31c4768266d4609f2d7533dd5e6a53f0fa4648d28b334
                                                                          • Instruction Fuzzy Hash: CA219577E046089FDF00CF94E905BDEBBB8EB45664F20056AE91893740EB35AA05C791
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 10019EFC Relevance: 3.1, APIs: 2, Instructions: 57COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetVersion.KERNEL32(1001A015,?,?,?), ref: 10019F09
                                                                            • Part of subcall function 1001A3C4: HeapCreate.KERNEL32(00000000,00001000,00000000,10019F1B,00000001), ref: 1001A3D5
                                                                            • Part of subcall function 1001A3C4: HeapDestroy.KERNEL32 ref: 1001A414
                                                                            • Part of subcall function 1001BFAC: TlsAlloc.KERNEL32(?,10019F53), ref: 1001BFB2
                                                                            • Part of subcall function 1001BFAC: TlsSetValue.KERNEL32(00000000), ref: 1001BFDA
                                                                            • Part of subcall function 1001BFAC: GetCurrentThreadId.KERNEL32 ref: 1001BFEB
                                                                          • GetCommandLineA.KERNEL32 ref: 10019F60
                                                                            • Part of subcall function 1001A421: VirtualFree.KERNEL32(?,00100000,00004000,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A459
                                                                            • Part of subcall function 1001A421: VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A464
                                                                            • Part of subcall function 1001A421: HeapFree.KERNEL32(00000000,?,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A471
                                                                            • Part of subcall function 1001A421: HeapFree.KERNEL32(00000000,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A48D
                                                                            • Part of subcall function 1001A421: HeapDestroy.KERNELBASE(?,?,10019FC1,1001A015,?,?,?), ref: 1001A4C0
                                                                            • Part of subcall function 1001C098: TlsGetValue.KERNEL32(FFFFFFFF,?,10019FCE,00000000,1001A015,?,?,?), ref: 1001C0B0
                                                                            • Part of subcall function 1001C098: TlsSetValue.KERNEL32(00000000,?,10019FCE,00000000,1001A015,?,?,?), ref: 1001C130
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Heap$Free$Value$DestroyVirtual$AllocCommandCreateCurrentLineThreadVersion
                                                                          • String ID:
                                                                          • API String ID: 1348591257-0
                                                                          • Opcode ID: 34f96abe632768e47baa2bffe8d2b045542454c29b03e75bf19a9a8238ef7ead
                                                                          • Instruction ID: 8c1f116477d2608024c7700a61e60c165b33ed3b7c53a85e67fa66fca4a9002f
                                                                          • Opcode Fuzzy Hash: 34f96abe632768e47baa2bffe8d2b045542454c29b03e75bf19a9a8238ef7ead
                                                                          • Instruction Fuzzy Hash: 7A111878904769ABF709DBB08986A0937A6EB06341B21443EF405CE563DF74E4C3DB56
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEB77E0 Relevance: 3.0, APIs: 2, Instructions: 48COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 6CEB77E6
                                                                            • Part of subcall function 6CEC5F2A: __FF_MSGBANNER.LIBCMT ref: 6CEC5F4D
                                                                            • Part of subcall function 6CEC5F2A: __NMSG_WRITE.LIBCMT ref: 6CEC5F54
                                                                            • Part of subcall function 6CEC5F2A: RtlAllocateHeap.NTDLL(00000000,6CEAFA6F,?,00000000,?,?,6CEA4D3F,0000000C,388BE448,?,?,00000000,?,?,6CECEF9B,000000FF), ref: 6CEC5FA1
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB7803
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
                                                                          • String ID:
                                                                          • API String ID: 2732643326-0
                                                                          • Opcode ID: 1b2d0c8d7c3f2229015024f72a5815b3230de01b3e38e52680686a1615595a17
                                                                          • Instruction ID: e19b7bb3f7c6dd92318a4df7139c5eabe82ab57fbb45252be87d49e87fe79810
                                                                          • Opcode Fuzzy Hash: 1b2d0c8d7c3f2229015024f72a5815b3230de01b3e38e52680686a1615595a17
                                                                          • Instruction Fuzzy Hash: 95019271600215DBDB04CE58C590AA6B3B9EF45318F2481AEEC05AFB01D775EE45C7E1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 10019CB8 Relevance: 3.0, APIs: 2, Instructions: 45threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 1001C480: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,10019E24,10021318,000000FF,?,1001C056,00000001,00000074), ref: 1001C576
                                                                          • CreateThread.KERNEL32(00000000,00000000,10019D23,00000000,?,?), ref: 10019CF9
                                                                          • GetLastError.KERNEL32(?,10017589,00000000,00000000,10002FF6,00000000,00000000,00000000,?,10002FF2,?,?,?,?,10003E76,?), ref: 10019D03
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AllocCreateErrorHeapLastThread
                                                                          • String ID:
                                                                          • API String ID: 3580101977-0
                                                                          • Opcode ID: 53b11fc37b3e5cb832321f1eb73cf4aff9b5aac8ba68efd3095b3517519951be
                                                                          • Instruction ID: 578384fe474d0b562f95e97df9c8fae57dcf2a9e42d60c7228f8a9f52e2ea293
                                                                          • Opcode Fuzzy Hash: 53b11fc37b3e5cb832321f1eb73cf4aff9b5aac8ba68efd3095b3517519951be
                                                                          • Instruction Fuzzy Hash: 77F028372043156BDB21DF65EC05DAF3BA5DF446B0B104029FA18CA190CB31D8918B91
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEA1C20 Relevance: 3.0, APIs: 2, Instructions: 44fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 6CEA1C4C
                                                                          • GetLastError.KERNEL32 ref: 6CEA1C75
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorFileLastWrite
                                                                          • String ID:
                                                                          • API String ID: 442123175-0
                                                                          • Opcode ID: 2d66825f96a4884760817eba13fea5d5e78b82e07e0bb92ea8e380ca99e55dda
                                                                          • Instruction ID: af495561cf65adc2bb1423941a202b7e147af76a3e112f1275f4659870d7273b
                                                                          • Opcode Fuzzy Hash: 2d66825f96a4884760817eba13fea5d5e78b82e07e0bb92ea8e380ca99e55dda
                                                                          • Instruction Fuzzy Hash: 4501623230070AAFD714CED8D840BA737F8BB44719F10492AF916DBA80D375E8558BA0
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEA19C0 Relevance: 3.0, APIs: 2, Instructions: 40fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ReadFile.KERNEL32(?,?,?,?,00000000), ref: 6CEA19EB
                                                                          • GetLastError.KERNEL32 ref: 6CEA1A0C
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorFileLastRead
                                                                          • String ID:
                                                                          • API String ID: 1948546556-0
                                                                          • Opcode ID: c216d75669eb7c2ae8340a0155455e8a0d78d178a92da0430f8866a97bf03c7b
                                                                          • Instruction ID: c6a37e09efa88aabb3f133a35bb29c07f94bb78608ce0dd6a9df4b625ee43980
                                                                          • Opcode Fuzzy Hash: c216d75669eb7c2ae8340a0155455e8a0d78d178a92da0430f8866a97bf03c7b
                                                                          • Instruction Fuzzy Hash: DFF03C7235020A9FDB04CE94E854B6B33BDAB84318F20852AF95ACF680D775E8219B64
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1001A3C4 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • HeapCreate.KERNEL32(00000000,00001000,00000000,10019F1B,00000001), ref: 1001A3D5
                                                                            • Part of subcall function 1001A27C: GetVersionExA.KERNEL32 ref: 1001A29B
                                                                          • HeapDestroy.KERNEL32 ref: 1001A414
                                                                            • Part of subcall function 1001A4C9: HeapAlloc.KERNEL32(00000000,00000140,1001A3FD,000003F8), ref: 1001A4D6
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Heap$AllocCreateDestroyVersion
                                                                          • String ID:
                                                                          • API String ID: 2507506473-0
                                                                          • Opcode ID: bc4e9ed2508816d106b6c68f37e2140fc1a3498347a5ba50f7c2e7f5e8612b28
                                                                          • Instruction ID: f49a4552e00520ddd5bd994c2c6f56530b3037705a70c7491d35245aff95e9ec
                                                                          • Opcode Fuzzy Hash: bc4e9ed2508816d106b6c68f37e2140fc1a3498347a5ba50f7c2e7f5e8612b28
                                                                          • Instruction Fuzzy Hash: 80F09274611302ABFF14EB309D8AB5935D1DB86791F308436F905CD0A6EBF0D8D2A611
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEA1BE0 Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FindCloseChangeNotification.KERNEL32(00000002,6CEBB356,?,?,?,?,?,?,6CED5380,?), ref: 6CEA1BE9
                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,6CED5380,?), ref: 6CEA1BFD
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ChangeCloseErrorFindLastNotification
                                                                          • String ID:
                                                                          • API String ID: 1687624791-0
                                                                          • Opcode ID: 6fa101591aa79147b7120fbf1785b3670156e3ebad0d770aa77cd9d1bdc7a6ff
                                                                          • Instruction ID: 729c74c36a742e69450ffbb46956ead4d727d51d9406294cd340a34f84d06bef
                                                                          • Opcode Fuzzy Hash: 6fa101591aa79147b7120fbf1785b3670156e3ebad0d770aa77cd9d1bdc7a6ff
                                                                          • Instruction Fuzzy Hash: C3E01274351A03EEDB104AB5CC4432675F46B0173EBB08B28E076DAAE0E72CD0428A04
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEB09E0 Relevance: 3.0, APIs: 2, Instructions: 18COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 6CEB09E8
                                                                            • Part of subcall function 6CEC5F2A: __FF_MSGBANNER.LIBCMT ref: 6CEC5F4D
                                                                            • Part of subcall function 6CEC5F2A: __NMSG_WRITE.LIBCMT ref: 6CEC5F54
                                                                            • Part of subcall function 6CEC5F2A: RtlAllocateHeap.NTDLL(00000000,6CEAFA6F,?,00000000,?,?,6CEA4D3F,0000000C,388BE448,?,?,00000000,?,?,6CECEF9B,000000FF), ref: 6CEC5FA1
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB0A02
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
                                                                          • String ID:
                                                                          • API String ID: 2732643326-0
                                                                          • Opcode ID: 80a786d4a69c5cbc1b1f4820ebc7086fb16d0632fbc07a73b199b3f0f5b6f0be
                                                                          • Instruction ID: bf2a39e055e7cfb8059d234c108d6f195171dff121e0e283bf87c78bcaef68c2
                                                                          • Opcode Fuzzy Hash: 80a786d4a69c5cbc1b1f4820ebc7086fb16d0632fbc07a73b199b3f0f5b6f0be
                                                                          • Instruction Fuzzy Hash: BED05EA0919248728A08C7A5AE01AAA77BC8A15208F500699FC1892B01FA22A61E42A6
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 10005AA5 Relevance: 2.1, APIs: 1, Instructions: 563COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: H_prolog
                                                                          • String ID:
                                                                          • API String ID: 3519838083-0
                                                                          • Opcode ID: 418329258124bf81065b2b4d57c61a1207f38c192b65861c8e98dbda376bc648
                                                                          • Instruction ID: 24b6dd137383e7686c229cdd86bb12439a3ed7e02ed9f8727553bb3e51178dae
                                                                          • Opcode Fuzzy Hash: 418329258124bf81065b2b4d57c61a1207f38c192b65861c8e98dbda376bc648
                                                                          • Instruction Fuzzy Hash: 37427F74904249DFEB00CFA4C984BDDBBF5EF09384F244099E849AB386DB75AE45CB61
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 10009824 Relevance: 2.0, APIs: 1, Instructions: 502COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __EH_prolog.LIBCMT ref: 10009829
                                                                            • Part of subcall function 1000940A: __EH_prolog.LIBCMT ref: 1000940F
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: H_prolog
                                                                          • String ID:
                                                                          • API String ID: 3519838083-0
                                                                          • Opcode ID: 20f936d777ea9103e340114ca1ee5d19f73f9782134bda5456cca3b6a12e0127
                                                                          • Instruction ID: 7486e4567ea8ddc6047f59b84a49b8006f4fb568e8041e622ffbf8bfe16b7337
                                                                          • Opcode Fuzzy Hash: 20f936d777ea9103e340114ca1ee5d19f73f9782134bda5456cca3b6a12e0127
                                                                          • Instruction Fuzzy Hash: FE326A74904249DFEB14CFA4C880BDEBBB5FF45384F50806EE44AA7296DB70AA85CF51
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1000A0CE Relevance: 1.8, APIs: 1, Instructions: 315COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: H_prolog
                                                                          • String ID:
                                                                          • API String ID: 3519838083-0
                                                                          • Opcode ID: dc746a499187cff85fc7484ade5f2022362ea269692349762d9b171528c868e0
                                                                          • Instruction ID: 16904ee073535d8266284e3ab4d1ee50d97a619b8a40ccf019ff2181d9a9fe66
                                                                          • Opcode Fuzzy Hash: dc746a499187cff85fc7484ade5f2022362ea269692349762d9b171528c868e0
                                                                          • Instruction Fuzzy Hash: 4DC17F74A0024ADFEB14CFA8C884BDEBBF1FF49380F204629E445A7245DB75AE81CB51
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEA7350 Relevance: 1.7, APIs: 1, Instructions: 158timeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetFileTime.KERNEL32(?,00000000,00000000,00000000,388BE448,?,?,?,?,?,6CED0300,000000FF), ref: 6CEA7438
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: FileTime
                                                                          • String ID:
                                                                          • API String ID: 1425588814-0
                                                                          • Opcode ID: d079689e48865faa7b79f2a887d4fc6f9a33f3eeeaede2d8516f32b01cea8887
                                                                          • Instruction ID: 511f4b0ecc0d24c16330a64a63dcee2927cefcb78cc7fda0afb6f3a1e26001ce
                                                                          • Opcode Fuzzy Hash: d079689e48865faa7b79f2a887d4fc6f9a33f3eeeaede2d8516f32b01cea8887
                                                                          • Instruction Fuzzy Hash: C7516F71A05A82AFD708CFB4C490B95FBB0FF49318F24865DD4698BB05D731B856DB90
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 10008DDD Relevance: 1.7, APIs: 1, Instructions: 154COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __EH_prolog.LIBCMT ref: 10008DE2
                                                                            • Part of subcall function 1000A51C: __EH_prolog.LIBCMT ref: 1000A521
                                                                            • Part of subcall function 1000809D: __EH_prolog.LIBCMT ref: 100080A2
                                                                            • Part of subcall function 10008A65: __EH_prolog.LIBCMT ref: 10008A6A
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: H_prolog
                                                                          • String ID:
                                                                          • API String ID: 3519838083-0
                                                                          • Opcode ID: 0f2ef54e4d54980d6866c9ca524e59761326e1e766cc54546d6848b3260f56d2
                                                                          • Instruction ID: 0609df34ebabf0a4a76e2918ca157b4269ad3ae51d55b8a1eb59a52bcf34417c
                                                                          • Opcode Fuzzy Hash: 0f2ef54e4d54980d6866c9ca524e59761326e1e766cc54546d6848b3260f56d2
                                                                          • Instruction Fuzzy Hash: DF51B274D00159DBEF14DFA4C885AEEBBB2FF44390F108159E8556B286CB71AF41CB90
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1000790D Relevance: 1.6, APIs: 1, Instructions: 145COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __EH_prolog.LIBCMT ref: 10007912
                                                                            • Part of subcall function 1000A496: __EH_prolog.LIBCMT ref: 1000A49B
                                                                            • Part of subcall function 10007AD6: __EH_prolog.LIBCMT ref: 10007ADB
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: H_prolog
                                                                          • String ID:
                                                                          • API String ID: 3519838083-0
                                                                          • Opcode ID: 6bb2def5445f3f3c03a7c343a9c0ad1c6318bdf414d74d1a9ec3108368a0102b
                                                                          • Instruction ID: b40d17a970ea470072cc094887da7a6dca03317504114bf01e9f4a1a4d97d151
                                                                          • Opcode Fuzzy Hash: 6bb2def5445f3f3c03a7c343a9c0ad1c6318bdf414d74d1a9ec3108368a0102b
                                                                          • Instruction Fuzzy Hash: 71516D34900249DFEB11CFA4C954AEDBBB4FF95344F244099E845A7246DB74AF01DB62
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1000670B Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: H_prolog
                                                                          • String ID:
                                                                          • API String ID: 3519838083-0
                                                                          • Opcode ID: ef6ed3350f196110724b134d7ae58aa8eb2fad54a812ca61983dfb10647da9bd
                                                                          • Instruction ID: 1deedfb3ed3693e114189d5c8674f5dba158b51214873baba276ba9a2bcc193c
                                                                          • Opcode Fuzzy Hash: ef6ed3350f196110724b134d7ae58aa8eb2fad54a812ca61983dfb10647da9bd
                                                                          • Instruction Fuzzy Hash: 73419F74900246CFDB24CF58C88496ABBF2FF48358B2546ADD0999B351C731ED46CF50
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 10001BB7 Relevance: 1.6, APIs: 1, Instructions: 82COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: H_prolog
                                                                          • String ID:
                                                                          • API String ID: 3519838083-0
                                                                          • Opcode ID: 02f82e7474b5bf284dc11ca32c5ed9bea93bcca5a0ad974320cd45ec439b4ff6
                                                                          • Instruction ID: 59f6696383dde50044605197c7a13ccbc641f9314ce92faebeca66c50bce22a2
                                                                          • Opcode Fuzzy Hash: 02f82e7474b5bf284dc11ca32c5ed9bea93bcca5a0ad974320cd45ec439b4ff6
                                                                          • Instruction Fuzzy Hash: 47219F7198468ADBFB24CF60D9808EEB7B6EB412D0B21852DE49267648D730FE41CB91
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 100188B8 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • RtlAllocateHeap.NTDLL(00000000,?,?,?,?,?,?), ref: 1001899F
                                                                            • Part of subcall function 1001A13A: InitializeCriticalSection.KERNEL32(00000000,?,?,?,10018A6D,00000009,?,?,?), ref: 1001A177
                                                                            • Part of subcall function 1001A13A: EnterCriticalSection.KERNEL32(?,?,?,10018A6D,00000009,?,?,?), ref: 1001A192
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalSection$AllocateEnterHeapInitialize
                                                                          • String ID:
                                                                          • API String ID: 1616793339-0
                                                                          • Opcode ID: 64ac742c6e18b1ebf1a9d12a1be87a2e2d80d958cc1a171f76a8005aa0769b83
                                                                          • Instruction ID: bde266228d008e092059639ff97bb6b14f601e90ad82446575358dbeed7d10ff
                                                                          • Opcode Fuzzy Hash: 64ac742c6e18b1ebf1a9d12a1be87a2e2d80d958cc1a171f76a8005aa0769b83
                                                                          • Instruction Fuzzy Hash: C5219032A00255BAEB10DB68DC42BADB7A4FB01764F284215F924EF1C0C774EBC18B52
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 10001BB2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: H_prolog
                                                                          • String ID:
                                                                          • API String ID: 3519838083-0
                                                                          • Opcode ID: ebc697b0815d610cf069836f75e5a55b253691f45cf9441c62c129786d474608
                                                                          • Instruction ID: c4781e215bb38ec63fc671d50aeec44c86b20336711f2647e792547350c1aef8
                                                                          • Opcode Fuzzy Hash: ebc697b0815d610cf069836f75e5a55b253691f45cf9441c62c129786d474608
                                                                          • Instruction Fuzzy Hash: 3911E232A4124A9FFB14CF64C9808EEB3F2EB403D0B21813DE052A7648D730FE428B90
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEB1420 Relevance: 1.6, APIs: 1, Instructions: 310COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetLastError.KERNEL32(6CEA890F,388BE448,?,?,00000000), ref: 6CEB1528
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLast
                                                                          • String ID:
                                                                          • API String ID: 1452528299-0
                                                                          • Opcode ID: 937b0efc6834ecf1b05502628eb198c5e49c6a2dabd8b60803212dbd62ee66f6
                                                                          • Instruction ID: 3080b5ec36aa0f63c7e3d10adba461b3f56379211aa35c5ef875377e7e03a149
                                                                          • Opcode Fuzzy Hash: 937b0efc6834ecf1b05502628eb198c5e49c6a2dabd8b60803212dbd62ee66f6
                                                                          • Instruction Fuzzy Hash: 5AB19272E012099BCB05CFD8DA81AEEB7B4EF45318F38416DD816B7B54E731E9098B91
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 100030FD Relevance: 1.6, APIs: 1, Instructions: 59COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: H_prolog
                                                                          • String ID:
                                                                          • API String ID: 3519838083-0
                                                                          • Opcode ID: b051d9f97361328a0859d23c7aef542bc19b666e6010b629010daeab35dc1547
                                                                          • Instruction ID: 1a273919c2d2e3c34155be655625f51d11ef425e7a56d82b9c8decfb09a307f8
                                                                          • Opcode Fuzzy Hash: b051d9f97361328a0859d23c7aef542bc19b666e6010b629010daeab35dc1547
                                                                          • Instruction Fuzzy Hash: 4011CE71A44155ABE722CF29CC05B9F37A9EF0A7E4F008119F805DB265DB31DD01C790
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 100039C8 Relevance: 1.5, APIs: 1, Instructions: 48COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __EH_prolog.LIBCMT ref: 100039CD
                                                                            • Part of subcall function 10003600: __EH_prolog.LIBCMT ref: 10003605
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: H_prolog
                                                                          • String ID:
                                                                          • API String ID: 3519838083-0
                                                                          • Opcode ID: 257c9c1ad85ce65f22fa997ad81c770c6af4072d1a7d7a18d6b680d099e47f4b
                                                                          • Instruction ID: a8771e25a5af01616f041783a1a562797f3037f43c5b4569f99eca130688d05b
                                                                          • Opcode Fuzzy Hash: 257c9c1ad85ce65f22fa997ad81c770c6af4072d1a7d7a18d6b680d099e47f4b
                                                                          • Instruction Fuzzy Hash: 44118274E01795DAEB09DBA8C9153EEFBEADF95300F54414D9057A7282CBF42B04C7A2
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEB25A0 Relevance: 1.5, APIs: 1, Instructions: 35COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 6CEB2470: FindClose.KERNEL32(?,388BE448,6CED0658,00000000), ref: 6CEB24C4
                                                                            • Part of subcall function 6CEB2470: FindFirstFileW.KERNEL32(6CED50B8,?,388BE448,6CED0658,00000000), ref: 6CEB24DE
                                                                            • Part of subcall function 6CEB2470: FindFirstFileW.KERNEL32(?,?), ref: 6CEB253A
                                                                          • FindClose.KERNEL32(FFFFFFFF,?,388BE448,?,00000000,6CED50B8,?,6CED0438,000000FF,?,6CEB265E), ref: 6CEB25EA
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Find$CloseFileFirst
                                                                          • String ID:
                                                                          • API String ID: 2295610775-0
                                                                          • Opcode ID: aa4d030117b8c28d132fc8b57b6055825eacc6e45ee0e9faba44928c19e7f00e
                                                                          • Instruction ID: 807ae6f4ac10cb437e6375fd0376ac74539098b781e8eb7e1fa42423d7cb8a28
                                                                          • Opcode Fuzzy Hash: aa4d030117b8c28d132fc8b57b6055825eacc6e45ee0e9faba44928c19e7f00e
                                                                          • Instruction Fuzzy Hash: 54F01DB6A44648AFCB00CF98D944BAAF7B8FB16624F60471AF831A37D0D73569058A64
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 10006A20 Relevance: 1.5, APIs: 1, Instructions: 35COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __EH_prolog.LIBCMT ref: 10006A25
                                                                            • Part of subcall function 10001B41: GetSystemInfo.KERNEL32(?), ref: 10001B4B
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: H_prologInfoSystem
                                                                          • String ID:
                                                                          • API String ID: 3096475795-0
                                                                          • Opcode ID: 52262b521e3cf9d1fda4bec855af299aea3512d706ab6bf0f58a7f0b292b1210
                                                                          • Instruction ID: 655e083bcbb9f064a1fc17e82f19a2947c3b56c2b4f5fa8eba001858af0e0911
                                                                          • Opcode Fuzzy Hash: 52262b521e3cf9d1fda4bec855af299aea3512d706ab6bf0f58a7f0b292b1210
                                                                          • Instruction Fuzzy Hash: 8701A2B0901B949FD320CF59D48469AFBE5FB09300F90886EE4AA9B612C7B8A6448F50
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 10001C8A Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __EH_prolog.LIBCMT ref: 10001C8F
                                                                            • Part of subcall function 10001BB2: __EH_prolog.LIBCMT ref: 10001BB7
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: H_prolog
                                                                          • String ID:
                                                                          • API String ID: 3519838083-0
                                                                          • Opcode ID: 45d6ff788914fcc1d4c4362c08418d30e3fc6f4cbe7bfcd3fb78a9b9f7420235
                                                                          • Instruction ID: 5875ca03f24213d4aa71392faa60c1249694dc7a06dd944ad61b31c616a183da
                                                                          • Opcode Fuzzy Hash: 45d6ff788914fcc1d4c4362c08418d30e3fc6f4cbe7bfcd3fb78a9b9f7420235
                                                                          • Instruction Fuzzy Hash: 3AF03432A00219ABEB05CF98CC01BEEB7B9EB44365F108659B821E7290C775EE00CB50
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 10001C8F Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __EH_prolog.LIBCMT ref: 10001C8F
                                                                            • Part of subcall function 10001BB2: __EH_prolog.LIBCMT ref: 10001BB7
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: H_prolog
                                                                          • String ID:
                                                                          • API String ID: 3519838083-0
                                                                          • Opcode ID: a6999b822fc1317c87866c67a3b2559ab8b1b0de13d547d74b0740a9a50685af
                                                                          • Instruction ID: a1ce7e251bf4dddfe6d8e665bceb41a424ebb3d89783d3dba666d18c8877da87
                                                                          • Opcode Fuzzy Hash: a6999b822fc1317c87866c67a3b2559ab8b1b0de13d547d74b0740a9a50685af
                                                                          • Instruction Fuzzy Hash: 43F0F876A00219EBEB15CF94CC05BEEB7B9FB44365F108659B825E7290C775AA10CB50
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1000A4D5 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: H_prolog
                                                                          • String ID:
                                                                          • API String ID: 3519838083-0
                                                                          • Opcode ID: d45ba929464739024bbb0bc480a2fcd073bcf0d86694c4e008176eea22f9a2a0
                                                                          • Instruction ID: 00a3cd71fa0aca0c29c4385373171d1cf368eeee970badd092b8d780c186b9fa
                                                                          • Opcode Fuzzy Hash: d45ba929464739024bbb0bc480a2fcd073bcf0d86694c4e008176eea22f9a2a0
                                                                          • Instruction Fuzzy Hash: ECE09275E00510ABDB08DFA88C066AE7AE5EB04360F10462EA016E72C1DFB06B408654
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1000A51C Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __EH_prolog.LIBCMT ref: 1000A521
                                                                            • Part of subcall function 1000A6CF: __EH_prolog.LIBCMT ref: 1000A6D4
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: H_prolog
                                                                          • String ID:
                                                                          • API String ID: 3519838083-0
                                                                          • Opcode ID: 1d350eab279bd1dbb4d5681b811c8a6e671b98ab2be674e428506e08396ece6a
                                                                          • Instruction ID: aa797ba4b590ef7c1940b9b2a0b5883bf8ddeea9a52a955fbfb363e5e3090a9b
                                                                          • Opcode Fuzzy Hash: 1d350eab279bd1dbb4d5681b811c8a6e671b98ab2be674e428506e08396ece6a
                                                                          • Instruction Fuzzy Hash: 72E09275A00514AFEB08DBA88C066AE76E5EB48250F00862EA012E62D0DFB06A808754
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 10006B51 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __EH_prolog.LIBCMT ref: 10006B56
                                                                            • Part of subcall function 10006B9E: __EH_prolog.LIBCMT ref: 10006BA3
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: H_prolog
                                                                          • String ID:
                                                                          • API String ID: 3519838083-0
                                                                          • Opcode ID: c2b4014cf6554101de5823dbb260c55468e89f1724bea5b528826ce213b76a0a
                                                                          • Instruction ID: 8d9a37c6723f40ac26746b696ab844ca15524eaf609cb6dee056dacbd79d311a
                                                                          • Opcode Fuzzy Hash: c2b4014cf6554101de5823dbb260c55468e89f1724bea5b528826ce213b76a0a
                                                                          • Instruction Fuzzy Hash: 8BF08C71C01A60DBD724CF54C8057DEB7B4EF08310F10464EA8A6A7281CBB0BA40CB90
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEC93E1 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • HeapCreate.KERNEL32(00000000,00001000,00000000,?,6CEC6375,00000001,?,?,?,6CEC64EE,?,?,?,6CED7F18,0000000C,6CEC65A9), ref: 6CEC93F6
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CreateHeap
                                                                          • String ID:
                                                                          • API String ID: 10892065-0
                                                                          • Opcode ID: 159bfa737ae24360f42466b518c197ea59e08c19f118bd9a3b16b07da1aba168
                                                                          • Instruction ID: d41102316554f3be0e7e8f1955da382aad0cd4f54c2bc3ccbbca09ae201c4f2c
                                                                          • Opcode Fuzzy Hash: 159bfa737ae24360f42466b518c197ea59e08c19f118bd9a3b16b07da1aba168
                                                                          • Instruction Fuzzy Hash: A6D05E767543895EDB009EB5AC08B223BFCA786799F148835B81CC6140E678E5408601
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1000A496 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __EH_prolog.LIBCMT ref: 1000A49B
                                                                            • Part of subcall function 1000A0CE: __EH_prolog.LIBCMT ref: 1000A0D3
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: H_prolog
                                                                          • String ID:
                                                                          • API String ID: 3519838083-0
                                                                          • Opcode ID: 49073b19b42d1aece4de8f7d12bddb7de673f44c594ea106af3184a1002e2511
                                                                          • Instruction ID: 889d54ac72d292b4943fb779c3a4a2c7d1dd2e9b7142568b78a9c6437da24382
                                                                          • Opcode Fuzzy Hash: 49073b19b42d1aece4de8f7d12bddb7de673f44c594ea106af3184a1002e2511
                                                                          • Instruction Fuzzy Hash: 12E08C36900148FBDF02CF84C805FEF7B75EB452A0F00851AF40415051C3BAAA50DBA0
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 10019DDE Relevance: 1.5, APIs: 1, Instructions: 20threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ExitThread
                                                                          • String ID:
                                                                          • API String ID: 2158977761-0
                                                                          • Opcode ID: 0fe3482dfa25c527acbd858d9d887206c278c7a8d427f86923067702572674c7
                                                                          • Instruction ID: 587474e3f6e270900c506b7264c4806e64e6eaefbf2122b89b9aa41b5ebd9e7a
                                                                          • Opcode Fuzzy Hash: 0fe3482dfa25c527acbd858d9d887206c278c7a8d427f86923067702572674c7
                                                                          • Instruction Fuzzy Hash: D6E08C3694052AABEB12E7A0CC46A9E37A0EF08380F040010F8005E062DB70FED24692
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1000AB8D Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __EH_prolog.LIBCMT ref: 1000AB92
                                                                            • Part of subcall function 10006A20: __EH_prolog.LIBCMT ref: 10006A25
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: H_prolog
                                                                          • String ID:
                                                                          • API String ID: 3519838083-0
                                                                          • Opcode ID: 50b908e3d647e52a03bcd4fae9ea66269edd5c88d27c4c7adeab43c7193a34f8
                                                                          • Instruction ID: f583651af7419ed68212601d7f78bfec3ebd47bcdcb2918c529af6d70d782719
                                                                          • Opcode Fuzzy Hash: 50b908e3d647e52a03bcd4fae9ea66269edd5c88d27c4c7adeab43c7193a34f8
                                                                          • Instruction Fuzzy Hash: 1AD05E75F14141AFEB08DBB4981636D76E2EB48280F10856DA012E66C1DFB0BA80C625
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 10019DE9 Relevance: 1.5, APIs: 1, Instructions: 17threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ExitThread
                                                                          • String ID:
                                                                          • API String ID: 2158977761-0
                                                                          • Opcode ID: e83cf6b22c983a4ed28e69ad6d1585a06803cfa532badbaccde98c5e56e59925
                                                                          • Instruction ID: 55bdce0fba70f3b5ff24939f3ea0e7f6c7887ef7bde984f872fb15fca6cc6046
                                                                          • Opcode Fuzzy Hash: e83cf6b22c983a4ed28e69ad6d1585a06803cfa532badbaccde98c5e56e59925
                                                                          • Instruction Fuzzy Hash: 4FD05E31540626ABE213E770DC86A5E2394DF05790B110115F8408D062DF70FEC24192
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 10002828 Relevance: 1.3, APIs: 1, Instructions: 30COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LeaveCriticalSection.KERNEL32(?,?,?,?), ref: 1000284F
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalLeaveSection
                                                                          • String ID:
                                                                          • API String ID: 3988221542-0
                                                                          • Opcode ID: 56af7d4527998fa58668fa72375b4fbb66d6daa40091eae34442c31c73413363
                                                                          • Instruction ID: 11d10b3ae5732a811c03e9ac0d646ffa47e7b15fd82cf01c80c2bb2696228c6f
                                                                          • Opcode Fuzzy Hash: 56af7d4527998fa58668fa72375b4fbb66d6daa40091eae34442c31c73413363
                                                                          • Instruction Fuzzy Hash: 18F03036A01155DFDB12DFA4C808A89BBA5FF84794B16845AF955D7220D734CC12DF60
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 10017570 Relevance: 1.3, APIs: 1, Instructions: 23COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 10019CB8: CreateThread.KERNEL32(00000000,00000000,10019D23,00000000,?,?), ref: 10019CF9
                                                                            • Part of subcall function 10019CB8: GetLastError.KERNEL32(?,10017589,00000000,00000000,10002FF6,00000000,00000000,00000000,?,10002FF2,?,?,?,?,10003E76,?), ref: 10019D03
                                                                          • GetLastError.KERNEL32 ref: 10017598
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLast$CreateThread
                                                                          • String ID:
                                                                          • API String ID: 665435222-0
                                                                          • Opcode ID: 6a6f0967b860a04a4a08b52caf4fd14ddb262ad7e1e0691d2c85b8c655ef118e
                                                                          • Instruction ID: 5da84cd6a30c0b06f2c1d8553272c344b363e72c39abfbd7409f2c23709d4e44
                                                                          • Opcode Fuzzy Hash: 6a6f0967b860a04a4a08b52caf4fd14ddb262ad7e1e0691d2c85b8c655ef118e
                                                                          • Instruction Fuzzy Hash: 2EE0ECB2254252AEF304DB648C46FA776E9EB94B81F50442DBA49CA180E6B0D944C7B5
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 10012A20 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,10001E62,?,?,1000B459,?), ref: 10012A31
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AllocVirtual
                                                                          • String ID:
                                                                          • API String ID: 4275171209-0
                                                                          • Opcode ID: 0101ec0f5aa2d88080453061d33e9d0ea43cdee5597a4dbf4051f6854f2c80fe
                                                                          • Instruction ID: 499c3da3a26d341c9e988975342de67c6826636d0b386d7712dafe969d9ecfde
                                                                          • Opcode Fuzzy Hash: 0101ec0f5aa2d88080453061d33e9d0ea43cdee5597a4dbf4051f6854f2c80fe
                                                                          • Instruction Fuzzy Hash: 18B012F07B238176FE6E87204C5BF662451A740BC7F601098F301DC0C4E7E094409015
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 10012A40 Relevance: 1.3, APIs: 1, Instructions: 7COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • VirtualFree.KERNELBASE(00000000,00000000,00008000,10001E7E,?,10001E58,?,?,1000B459,?), ref: 10012A4C
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: FreeVirtual
                                                                          • String ID:
                                                                          • API String ID: 1263568516-0
                                                                          • Opcode ID: 66144b5ccae04c28c88a4e760bc3cd1d0957039cec557337da64c84822766760
                                                                          • Instruction ID: 32e2f69f7c2909d2d391187de9ef312e1eea697864ad2fb4147c7fa98b3e1f25
                                                                          • Opcode Fuzzy Hash: 66144b5ccae04c28c88a4e760bc3cd1d0957039cec557337da64c84822766760
                                                                          • Instruction Fuzzy Hash: 96B012B034230023FD78C3110D45B1611506B00741E60405C73016C4C08570E4018504
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0045D344 Relevance: .1, Instructions: 59COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2242182018.000000000045D000.00000020.00000001.01000000.00000004.sdmp, Offset: 0045D000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_45d000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 0e7b173bbb215450c8b4f74675491754b7c61381db732ae293535029b8f08084
                                                                          • Instruction ID: d99f86c8ffeddc58f6e936e0a3f2476e49bd5441f60632e001b21c3972d2faf1
                                                                          • Opcode Fuzzy Hash: 0e7b173bbb215450c8b4f74675491754b7c61381db732ae293535029b8f08084
                                                                          • Instruction Fuzzy Hash: 5F0165B16002046FCB10EB98DC81FAB37A9FB08315F048216FD14D7296DBBDD884876D
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0045D3F8 Relevance: .0, Instructions: 16COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2242182018.000000000045D000.00000020.00000001.01000000.00000004.sdmp, Offset: 0045D000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_45d000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 49f8392043f557017d62716db24232c23fbed2275b2329eef47e5a4435b534a6
                                                                          • Instruction ID: 198944c7f122d1c37403e03e802124c787ccbd8fdaa22fabfa5f4f4463f0d47f
                                                                          • Opcode Fuzzy Hash: 49f8392043f557017d62716db24232c23fbed2275b2329eef47e5a4435b534a6
                                                                          • Instruction Fuzzy Hash: 1EC0122160663826162032A92CC18EA00488C472AA32803BBFC20962A3DA8C9DC602AE
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Non-executed Functions

                                                                          Function 6CEBE950 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 311COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEBE9AF
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ExceptionException@8RaiseThrow
                                                                          • String ID: (l$ (l$Empty file path$xSl
                                                                          • API String ID: 3976011213-1672942623
                                                                          • Opcode ID: 61ae3734bf0621ae4f129730fbcfd74719d7ed18a4912a79dc7e139a168338e6
                                                                          • Instruction ID: ea15b8bf3580de7df5a490b7ba72577c2893034ee1faf164433efa550d740280
                                                                          • Opcode Fuzzy Hash: 61ae3734bf0621ae4f129730fbcfd74719d7ed18a4912a79dc7e139a168338e6
                                                                          • Instruction Fuzzy Hash: 0BC19372E016589FDB14CFA8CA81AEEB7B5BF49308F24419DE805B7740D770AA09CBD1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEC51C7 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • IsDebuggerPresent.KERNEL32 ref: 6CEC6B91
                                                                          • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CEC6BA6
                                                                          • UnhandledExceptionFilter.KERNEL32(6CED3328), ref: 6CEC6BB1
                                                                          • GetCurrentProcess.KERNEL32(C0000409), ref: 6CEC6BCD
                                                                          • TerminateProcess.KERNEL32(00000000), ref: 6CEC6BD4
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                                                                          • String ID:
                                                                          • API String ID: 2579439406-0
                                                                          • Opcode ID: 77d8a4f52b3e53eb19afc1507fe9cf5e033e8fe439fa185131c450e51254c2e4
                                                                          • Instruction ID: 011f8eb1070573408fc75fb6058aac5cffedc203f8081fed4c9720a0d34fef53
                                                                          • Opcode Fuzzy Hash: 77d8a4f52b3e53eb19afc1507fe9cf5e033e8fe439fa185131c450e51254c2e4
                                                                          • Instruction Fuzzy Hash: DB21C2BAB00215DFCF00DF19E6446487BF4BB1A318F64911AE81987342E77976858F11
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEAD1B0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 336COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEAD3E1
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw
                                                                          • String ID: @]l$pTl
                                                                          • API String ID: 2005118841-1296102816
                                                                          • Opcode ID: 3584a522008efc79a06465291f03d0f17e5090a1bfc059bf9e243327d9d44033
                                                                          • Instruction ID: c2a84ae4a3cb755eac413caf0f1589ba9248453f745601cbb6429c099d8ec43f
                                                                          • Opcode Fuzzy Hash: 3584a522008efc79a06465291f03d0f17e5090a1bfc059bf9e243327d9d44033
                                                                          • Instruction Fuzzy Hash: 5CD15AB5D012499FCB14CFE8C9806EEB7B4FF49318F248269D815EB750D770AA4ACB91
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 056A068D Relevance: .0, Instructions: 10COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000003.2064693512.00000000055AA000.00000004.00000020.00020000.00000000.sdmp, Offset: 055AA000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_3_55aa000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 7f7710bd19dd5557c7938fded3f521943d475760a5534bd00408d7b1e04da340
                                                                          • Instruction ID: e0c8b03df474f82e46c53a302e9f570ed9881ea6d865719da1c154a8adff0896
                                                                          • Opcode Fuzzy Hash: 7f7710bd19dd5557c7938fded3f521943d475760a5534bd00408d7b1e04da340
                                                                          • Instruction Fuzzy Hash: C0B0123301C15D5CBE8C2A5D740AE65336CD5C1E38F606C5ADC9D085C23E063046E12C
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEA2AD0 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 202fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • OpenFileMappingW.KERNEL32(00000004,00000000,?,00000002), ref: 6CEA2BB4
                                                                          • GetLastError.KERNEL32 ref: 6CEA2BC3
                                                                          • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 6CEA2BDF
                                                                          • UnmapViewOfFile.KERNEL32(00000000), ref: 6CEA2C88
                                                                          • CloseHandle.KERNEL32(?), ref: 6CEA2C96
                                                                          • OpenEventW.KERNEL32(00000002,00000000,?), ref: 6CEA2CA8
                                                                          • GetLastError.KERNEL32 ref: 6CEA2CBD
                                                                          • SetEvent.KERNEL32(00000000), ref: 6CEA2CC4
                                                                          • GetLastError.KERNEL32 ref: 6CEA2CCE
                                                                          • CloseHandle.KERNEL32(00000000), ref: 6CEA2CD5
                                                                          • GetLastError.KERNEL32 ref: 6CEA2CDF
                                                                            • Part of subcall function 6CEA2670: __CxxThrowException@8.LIBCMT ref: 6CEA2688
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLast$File$CloseEventHandleOpenView$Exception@8MappingThrowUnmap
                                                                          • String ID: Can not open mapping$Incorrect command line$Incorrect mapping data$MapViewOfFile error$data error
                                                                          • API String ID: 682782048-464465891
                                                                          • Opcode ID: 06360124b2370043f8ebf8eb91ff685e26b4261dd3d31b768f0c7d687a62d22e
                                                                          • Instruction ID: 7de455c6bfbb39329c923af616806231469e18dea147dc4e6fea4ee31f459ef3
                                                                          • Opcode Fuzzy Hash: 06360124b2370043f8ebf8eb91ff685e26b4261dd3d31b768f0c7d687a62d22e
                                                                          • Instruction Fuzzy Hash: FF61E371A006099FDB01DFEAD848BDEB7B4AF55358F344129E909BFB40D770E90687A2
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEC715B Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 57libraryloaderCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetModuleHandleW.KERNEL32(KERNEL32.DLL,6CED7F58,0000000C,6CEC7296,00000000,00000000,?,6CEA4D3F,0000000C,388BE448,?,?,00000000,?,?,6CECEF9B), ref: 6CEC716D
                                                                          • __crt_waiting_on_module_handle.LIBCMT ref: 6CEC7178
                                                                            • Part of subcall function 6CEC7790: Sleep.KERNEL32(000003E8,?,?,6CEC70BE,KERNEL32.DLL,?,6CEC94A4,?,6CEC5FE3,6CEAFA7E,?,?,6CEA4D3F,0000000C,388BE448,?), ref: 6CEC779C
                                                                            • Part of subcall function 6CEC7790: GetModuleHandleW.KERNEL32(6CEAFA7E,?,6CEC70BE,KERNEL32.DLL,?,6CEC94A4,?,6CEC5FE3,6CEAFA7E,?,?,6CEA4D3F,0000000C,388BE448,?,?), ref: 6CEC77A5
                                                                          • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 6CEC71A1
                                                                          • GetProcAddress.KERNEL32(?,DecodePointer), ref: 6CEC71B1
                                                                          • __lock.LIBCMT ref: 6CEC71D3
                                                                          • InterlockedIncrement.KERNEL32(02C08302), ref: 6CEC71E0
                                                                          • __lock.LIBCMT ref: 6CEC71F4
                                                                          • ___addlocaleref.LIBCMT ref: 6CEC7212
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
                                                                          • String ID: DecodePointer$EncodePointer$KERNEL32.DLL$9l
                                                                          • API String ID: 1028249917-1601969708
                                                                          • Opcode ID: f1042360f3bb67166bb8e2df122d069bebae18029be3b02295cdbabb7f36f7c4
                                                                          • Instruction ID: c7ac954c9acc495cd08ae1af09256e007c4f2e0575ce25a13934bf79ef12ce9d
                                                                          • Opcode Fuzzy Hash: f1042360f3bb67166bb8e2df122d069bebae18029be3b02295cdbabb7f36f7c4
                                                                          • Instruction Fuzzy Hash: E011B4B2600B059ED720DF79DA01B8ABBF0AF00318F30451EE4B993B90CB34A645CF66
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEB6530 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 323libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetProcAddress.KERNEL32(6CEB6AD8,GetHandlerProperty2), ref: 6CEB6584
                                                                          • GetProcAddress.KERNEL32(?,GetHandlerProperty), ref: 6CEB6595
                                                                          • GetProcAddress.KERNEL32(?,GetNumberOfFormats), ref: 6CEB65B1
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AddressProc
                                                                          • String ID: GetHandlerProperty$GetHandlerProperty2$GetNumberOfFormats$hTl
                                                                          • API String ID: 190572456-3227123446
                                                                          • Opcode ID: 1a4cc24e43b37f3bbdcc05f7ebf0f188955cdb818a282e8a92fb39bdc641caf3
                                                                          • Instruction ID: 5f8cc2f14ee74f5046ddf612a51d6496ca6288ff4a3dfb4b7f2e1a8b67e65788
                                                                          • Opcode Fuzzy Hash: 1a4cc24e43b37f3bbdcc05f7ebf0f188955cdb818a282e8a92fb39bdc641caf3
                                                                          • Instruction Fuzzy Hash: C5D15AB1D012189BDB24DFA9CA80BEEB7B8BF48304F2041ADE559E7750DB309A45CF61
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEC0680 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 295COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 6CEC1230: _malloc.LIBCMT ref: 6CEC1258
                                                                            • Part of subcall function 6CEC1230: __CxxThrowException@8.LIBCMT ref: 6CEC1272
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEC0704
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                            • Part of subcall function 6CEB82B0: __CxxThrowException@8.LIBCMT ref: 6CEB8324
                                                                            • Part of subcall function 6CEB82B0: __CxxThrowException@8.LIBCMT ref: 6CEB8390
                                                                            • Part of subcall function 6CEB82B0: _malloc.LIBCMT ref: 6CEB83B1
                                                                            • Part of subcall function 6CEB82B0: __CxxThrowException@8.LIBCMT ref: 6CEB83CB
                                                                            • Part of subcall function 6CEB82B0: __CxxThrowException@8.LIBCMT ref: 6CEB8416
                                                                            • Part of subcall function 6CEC5FF4: __lock.LIBCMT ref: 6CEC6012
                                                                            • Part of subcall function 6CEC5FF4: ___sbh_find_block.LIBCMT ref: 6CEC601D
                                                                            • Part of subcall function 6CEC5FF4: ___sbh_free_block.LIBCMT ref: 6CEC602C
                                                                            • Part of subcall function 6CEC5FF4: HeapFree.KERNEL32(00000000,6CEAFA7E,6CED7EB0,0000000C,6CEC81B5,00000000,6CED8028,0000000C,6CEC81EF,6CEAFA7E,?,?,6CECC6AB,00000004,6CED82E8,0000000C), ref: 6CEC605C
                                                                            • Part of subcall function 6CEC5FF4: GetLastError.KERNEL32(?,6CECC6AB,00000004,6CED82E8,0000000C,6CEC7669,6CEAFA7E,?,00000000,00000000,00000000,?,6CEC726D,00000001,00000214), ref: 6CEC606D
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEC0A37
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw$_malloc$ErrorExceptionFreeHeapLastRaise___sbh_find_block___sbh_free_block__lock
                                                                          • String ID: -mhe$ -sfx$ -ssw$ -w$7za
                                                                          • API String ID: 1499254937-429077366
                                                                          • Opcode ID: 91eb53f6ad5d0f04fde0e2e2cb7662b1667282fd2428a4d2d5de7261bac668a6
                                                                          • Instruction ID: 165e47588f02da7e96309fafdf5f3254bc44859a8cda07263519ede90d5b311a
                                                                          • Opcode Fuzzy Hash: 91eb53f6ad5d0f04fde0e2e2cb7662b1667282fd2428a4d2d5de7261bac668a6
                                                                          • Instruction Fuzzy Hash: 7CC182B6901248DFDB05DBE4CA84BDEBBB8AF04308F24455DD8157B741D7B4AA0DCBA2
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1001D844 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,1001CEDA,?,Microsoft Visual C++ Runtime Library,00012010,?,10021594,?,100215E4,?,?,?,Runtime Error!Program: ), ref: 1001D856
                                                                          • GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 1001D86E
                                                                          • GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 1001D87F
                                                                          • GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 1001D88C
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AddressProc$LibraryLoad
                                                                          • String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
                                                                          • API String ID: 2238633743-4044615076
                                                                          • Opcode ID: fdf4bd263d9911628fa84a0538cd68ee630e044ef978d7ae2b799142876d2cfd
                                                                          • Instruction ID: 0f002242f215f962b8815e3b350398d74b100aa23eb915cf8c40db05b23b1dbb
                                                                          • Opcode Fuzzy Hash: fdf4bd263d9911628fa84a0538cd68ee630e044ef978d7ae2b799142876d2cfd
                                                                          • Instruction Fuzzy Hash: A9014431604221AFE750FFF59CC4AAA7BE9EB59194721043BF604C6121DF35C8829B70
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1001DD3D Relevance: 13.7, APIs: 9, Instructions: 177COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LCMapStringW.KERNEL32(00000000,00000100,10021660,00000001,00000000,00000000,74DEE860,1002CE50,?,00000003,00000000,00000001,00000000,?,?,1001DA1F), ref: 1001DD7F
                                                                          • LCMapStringA.KERNEL32(00000000,00000100,1002165C,00000001,00000000,00000000,?,?,1001DA1F,?), ref: 1001DD9B
                                                                          • LCMapStringA.KERNEL32(?,?,00000000,00000001,00000000,00000003,74DEE860,1002CE50,?,00000003,00000000,00000001,00000000,?,?,1001DA1F), ref: 1001DDE4
                                                                          • MultiByteToWideChar.KERNEL32(?,1002CE51,00000000,00000001,00000000,00000000,74DEE860,1002CE50,?,00000003,00000000,00000001,00000000,?,?,1001DA1F), ref: 1001DE1C
                                                                          • MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,?,00000000), ref: 1001DE74
                                                                          • LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 1001DE8A
                                                                          • LCMapStringW.KERNEL32(?,?,?,00000000,?,?), ref: 1001DEBD
                                                                          • LCMapStringW.KERNEL32(?,?,?,?,?,00000000), ref: 1001DF25
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: String$ByteCharMultiWide
                                                                          • String ID:
                                                                          • API String ID: 352835431-0
                                                                          • Opcode ID: 7282f78b9d4349d0a3e93c4e54105c3ff287b2395515df487960fdaa6e95e452
                                                                          • Instruction ID: 295e34877b95ddc79519c14bcd414cd7068b9c5c0158a783dd3936514e77c558
                                                                          • Opcode Fuzzy Hash: 7282f78b9d4349d0a3e93c4e54105c3ff287b2395515df487960fdaa6e95e452
                                                                          • Instruction Fuzzy Hash: FB517B31400259ABDF22EF94CD85ADE3FF9FB59751F20411AF910A9160C732DDA1EB60
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEAFD20 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 294COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: hUl$xl$|Ul
                                                                          • API String ID: 0-1399582490
                                                                          • Opcode ID: 63e72b18d8013bab6cfbabb7ffb49e213857fd34a83c6f467445d6f99f96728a
                                                                          • Instruction ID: 4aeec4e1f508f3c1f58bfd7a5d822c08014a97a1d272f6d0efb0376618c176be
                                                                          • Opcode Fuzzy Hash: 63e72b18d8013bab6cfbabb7ffb49e213857fd34a83c6f467445d6f99f96728a
                                                                          • Instruction Fuzzy Hash: 3DC1AFB5D04109DFCB04CF98C580AEEB7B5FF49318F34865AE825AB750D734AA06CBA1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1001CDB6 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 1001CE23
                                                                          • GetStdHandle.KERNEL32(000000F4,10021594,00000000,?,00000000,?), ref: 1001CEF9
                                                                          • WriteFile.KERNEL32(00000000), ref: 1001CF00
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: File$HandleModuleNameWrite
                                                                          • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                                          • API String ID: 3784150691-4022980321
                                                                          • Opcode ID: 1d1f0148e6be3939dc2033fdbd363d62c3fffa52be97f4f1b611f55ef9c5ba02
                                                                          • Instruction ID: d8c9acc08caec27d87d178c777f48a963db8df66c36a8e0edad6fccd900c7ff8
                                                                          • Opcode Fuzzy Hash: 1d1f0148e6be3939dc2033fdbd363d62c3fffa52be97f4f1b611f55ef9c5ba02
                                                                          • Instruction Fuzzy Hash: 4131C476A0022CAFEB11EAA0CD85FDE77BDFB45344F6001A6F945DA041E770EAC5CA61
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1001CC4B Relevance: 12.1, APIs: 8, Instructions: 132COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,10019F70), ref: 1001CC66
                                                                          • GetEnvironmentStrings.KERNEL32(?,?,?,?,10019F70), ref: 1001CC7A
                                                                          • GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,10019F70), ref: 1001CCA6
                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,10019F70), ref: 1001CCDE
                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,10019F70), ref: 1001CD00
                                                                          • FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,10019F70), ref: 1001CD19
                                                                          • GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,10019F70), ref: 1001CD2C
                                                                          • FreeEnvironmentStringsA.KERNEL32(00000000), ref: 1001CD6A
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: EnvironmentStrings$ByteCharFreeMultiWide
                                                                          • String ID:
                                                                          • API String ID: 1823725401-0
                                                                          • Opcode ID: 27e7f926a98a65f15a8b3ff8da03a04564288c716e1c3f2051146ef706dc850c
                                                                          • Instruction ID: 10dabb665d0db05ed410ab17b42963db07fe2840a9ab64d8aea903b972c4df90
                                                                          • Opcode Fuzzy Hash: 27e7f926a98a65f15a8b3ff8da03a04564288c716e1c3f2051146ef706dc850c
                                                                          • Instruction Fuzzy Hash: 7331A6B25043AE5FE311EBB8ACC5D2A7ADDEB4A1D4B220639F545CB111EA31DCC187A1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEC02B0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 271COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEC060F
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEC0329
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEC0624
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw$ExceptionRaise
                                                                          • String ID: -an$(_l$7za
                                                                          • API String ID: 3476068407-2522948319
                                                                          • Opcode ID: 5488172b3e67041d8be23f59f3e8a6d05636bfe0ba08d21740a042b8b2a31483
                                                                          • Instruction ID: 8489adc7f93512863edd48a8ab008376f10455b31859abb1b7e1c7f6d9e2b5d2
                                                                          • Opcode Fuzzy Hash: 5488172b3e67041d8be23f59f3e8a6d05636bfe0ba08d21740a042b8b2a31483
                                                                          • Instruction Fuzzy Hash: 6BB181B6901148EFDB01DFE8DA84BDEBBB4AF05308F304458E8157B741D775AA49CBA2
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEC0AA0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 213COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 6CEC0C28
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEC0C42
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEC0D3F
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEC0D54
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw$ExceptionRaise_malloc
                                                                          • String ID: -an$7za l
                                                                          • API String ID: 1305767944-193614407
                                                                          • Opcode ID: 1a7d54be8521164b523a638ab47d2d46c7a8d7d7a9a2d00787da674b9584a5d2
                                                                          • Instruction ID: 67e83454fbec17603f00ae8a72e0f480f39c745fb7b2b549629b6d532aa4cdb7
                                                                          • Opcode Fuzzy Hash: 1a7d54be8521164b523a638ab47d2d46c7a8d7d7a9a2d00787da674b9584a5d2
                                                                          • Instruction Fuzzy Hash: 389163B5A01248DFCF04DFE8CA80BDEBBB4AF15308F244559D815AB741D774EA4ACB92
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CECE5CE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FindMITargetTypeInstance.LIBCMT ref: 6CECE624
                                                                            • Part of subcall function 6CECE370: PMDtoOffset.LIBCMT ref: 6CECE400
                                                                          • FindVITargetTypeInstance.LIBCMT ref: 6CECE62B
                                                                          • PMDtoOffset.LIBCMT ref: 6CECE63B
                                                                          • std::bad_exception::bad_exception.LIBCMT ref: 6CECE661
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CECE66F
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: FindInstanceOffsetTargetType$Exception@8Throwstd::bad_exception::bad_exception
                                                                          • String ID: Bad dynamic_cast!
                                                                          • API String ID: 3308565544-2956939130
                                                                          • Opcode ID: 015944e1ec7e50f067bb3ab28080012be45d80f2bdf2e411ad43623c5b0afeb3
                                                                          • Instruction ID: ab67dc76467c5c9816cb3561ec99e88cdfc675c05dc7ffb41565c7410b33290c
                                                                          • Opcode Fuzzy Hash: 015944e1ec7e50f067bb3ab28080012be45d80f2bdf2e411ad43623c5b0afeb3
                                                                          • Instruction Fuzzy Hash: 8711AF32B10A049FCB04DF68CA42ADE77B4AF45358F340558E831E7B90DB34D9068BD2
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEB0450 Relevance: 9.2, APIs: 6, Instructions: 236COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 6CEB2A70: CloseHandle.KERNEL32(?,388BE448,?,00000000,?,?,00000000,?,?,?,00000000,6CED0C38,000000FF), ref: 6CEB2A9F
                                                                            • Part of subcall function 6CEB2A70: CreateFileW.KERNEL32(?,?,00000000,00000000,?,00000080,00000000,388BE448,?,00000000,?,?,00000000), ref: 6CEB2ACC
                                                                            • Part of subcall function 6CEB2A70: CreateFileW.KERNEL32(?,?,?,00000000,00000000,00000080,00000000), ref: 6CEB2B2B
                                                                          • GetFileSize.KERNEL32(FFFFFFFF,?,00000004,80000000,00000001,00000003,388BE448,?,?,00000000,?,?,?,00000000,6CED0C38,000000FF), ref: 6CEB04A7
                                                                          • GetLastError.KERNEL32(?,?,?,00000000,6CED0C38,000000FF), ref: 6CEB04B4
                                                                          • CloseHandle.KERNEL32(FFFFFFFF,00000004,80000000,00000001,00000003,388BE448,?,?,00000000,?,?,?,00000000,6CED0C38,000000FF), ref: 6CEB051D
                                                                          • CloseHandle.KERNEL32(FFFFFFFF,?,00000000,00000000,00000001,?,?,?,00000000,6CED0C38,000000FF), ref: 6CEB053D
                                                                          • CloseHandle.KERNEL32(FFFFFFFF,FFFFFFFF,00000000,?,00000000,00000000,00000001,?,?,?,00000000,6CED0C38,000000FF), ref: 6CEB056C
                                                                            • Part of subcall function 6CEB0A20: MultiByteToWideChar.KERNEL32(00000002,00000000,?,?,?,?,388BE448,00000000), ref: 6CEB0AA7
                                                                            • Part of subcall function 6CEB0A20: __CxxThrowException@8.LIBCMT ref: 6CEB0AC1
                                                                          • CloseHandle.KERNEL32(FFFFFFFF,?,?,?,?,00000000,00000001,?,?,?,00000000), ref: 6CEB06D8
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CloseHandle$File$Create$ByteCharErrorException@8LastMultiSizeThrowWide
                                                                          • String ID:
                                                                          • API String ID: 1518168698-0
                                                                          • Opcode ID: d5b954064470a450bd41d5d94fbd26b95d0784bf80e72888f003d1c46ad56882
                                                                          • Instruction ID: fabef4ba1f06f2fcbe6a6648702df82315bf49f0067157df93841ec5f2e4d2b4
                                                                          • Opcode Fuzzy Hash: d5b954064470a450bd41d5d94fbd26b95d0784bf80e72888f003d1c46ad56882
                                                                          • Instruction Fuzzy Hash: 388194B2E012499BCF11DBA4DB44BEEB774EF45318F304619E921B7B90DB34A909CB61
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEC2CE0 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 472COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw_malloc
                                                                          • String ID: -ir-!$ -p$ -r$7za A
                                                                          • API String ID: 3476970888-2239425251
                                                                          • Opcode ID: 80516741a8165ddc0f1a0d69a89b5ad10de432e44c04ea98dd0bfc0427df2732
                                                                          • Instruction ID: e0f27b06bc9b93628bda7538f34844281568dadcfd90bdb12cf3ca1e6537c48f
                                                                          • Opcode Fuzzy Hash: 80516741a8165ddc0f1a0d69a89b5ad10de432e44c04ea98dd0bfc0427df2732
                                                                          • Instruction Fuzzy Hash: 0902A072E012489FDB11CBE4CA44BCEBBB4AF15308F34459DD8657B741DB71AA09CBA2
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1001DF8C Relevance: 9.1, APIs: 6, Instructions: 117COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetStringTypeW.KERNEL32(00000001,10021660,00000001,?,74DEE860,1002CE50,?,?,00000002,00000000,?,?,1001DA1F,?), ref: 1001DFCB
                                                                          • GetStringTypeA.KERNEL32(00000000,00000001,1002165C,00000001,?,?,?,1001DA1F,?), ref: 1001DFE5
                                                                          • GetStringTypeA.KERNEL32(?,?,?,00000000,00000002,74DEE860,1002CE50,?,?,00000002,00000000,?,?,1001DA1F,?), ref: 1001E019
                                                                          • MultiByteToWideChar.KERNEL32(?,1002CE51,?,00000000,00000000,00000000,74DEE860,1002CE50,?,?,00000002,00000000,?,?,1001DA1F,?), ref: 1001E051
                                                                          • MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?), ref: 1001E0A7
                                                                          • GetStringTypeW.KERNEL32(?,?,00000000,?,?,?), ref: 1001E0B9
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: StringType$ByteCharMultiWide
                                                                          • String ID:
                                                                          • API String ID: 3852931651-0
                                                                          • Opcode ID: 9cb96698784a2f131f153e3bcad8cc4bc2e41755872ea77c6cd091048275da51
                                                                          • Instruction ID: 73f36e6d74bf66f6ce57e3c8a420cabe8a1af6d8c6052cc8844ff2d98f481940
                                                                          • Opcode Fuzzy Hash: 9cb96698784a2f131f153e3bcad8cc4bc2e41755872ea77c6cd091048275da51
                                                                          • Instruction Fuzzy Hash: 0041577250029AAFDB21DF94CC85EDE7BBAEB09790F20052AFA119A150C735DDD1CBA0
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CECACE3 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __CreateFrameInfo.LIBCMT ref: 6CECAD0B
                                                                            • Part of subcall function 6CEC6968: __getptd.LIBCMT ref: 6CEC6976
                                                                            • Part of subcall function 6CEC6968: __getptd.LIBCMT ref: 6CEC6984
                                                                          • __getptd.LIBCMT ref: 6CECAD15
                                                                            • Part of subcall function 6CEC72BB: __getptd_noexit.LIBCMT ref: 6CEC72BE
                                                                            • Part of subcall function 6CEC72BB: __amsg_exit.LIBCMT ref: 6CEC72CB
                                                                          • __getptd.LIBCMT ref: 6CECAD23
                                                                          • __getptd.LIBCMT ref: 6CECAD31
                                                                          • __getptd.LIBCMT ref: 6CECAD3C
                                                                          • _CallCatchBlock2.LIBCMT ref: 6CECAD62
                                                                            • Part of subcall function 6CEC6A0D: __CallSettingFrame@12.LIBCMT ref: 6CEC6A59
                                                                            • Part of subcall function 6CECAE09: __getptd.LIBCMT ref: 6CECAE18
                                                                            • Part of subcall function 6CECAE09: __getptd.LIBCMT ref: 6CECAE26
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
                                                                          • String ID:
                                                                          • API String ID: 1602911419-0
                                                                          • Opcode ID: a1e94e06025149d3e7aa52e0acceefaff80d63937c5c2b0c2d76d171cc6c635b
                                                                          • Instruction ID: 92cbe0653839fafdeb1158b1b5fdac375e5c313fedf69f30a9a8ec926c68b551
                                                                          • Opcode Fuzzy Hash: a1e94e06025149d3e7aa52e0acceefaff80d63937c5c2b0c2d76d171cc6c635b
                                                                          • Instruction Fuzzy Hash: 6A11B4B19006099FDB00DFA4C684BEE7BB4BF04318F208069E825A7750DB389A199BA1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEC0DB0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 236COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEC109D
                                                                            • Part of subcall function 6CEBF640: __CxxThrowException@8.LIBCMT ref: 6CEBF66A
                                                                            • Part of subcall function 6CEB82B0: __CxxThrowException@8.LIBCMT ref: 6CEB8324
                                                                            • Part of subcall function 6CEB82B0: __CxxThrowException@8.LIBCMT ref: 6CEB8390
                                                                            • Part of subcall function 6CEB82B0: _malloc.LIBCMT ref: 6CEB83B1
                                                                            • Part of subcall function 6CEB82B0: __CxxThrowException@8.LIBCMT ref: 6CEB83CB
                                                                            • Part of subcall function 6CEB82B0: __CxxThrowException@8.LIBCMT ref: 6CEB8416
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw$_malloc
                                                                          • String ID: -mhe$ -w$7za d$D_l
                                                                          • API String ID: 175252994-4053582928
                                                                          • Opcode ID: b1d2b02535f3f2643105f6ef2065698c543246a4818dedd7980d0316a87339b5
                                                                          • Instruction ID: 3ff9720eb83ac89f7167329e81b8d46f2fb709c17506ed673666c34e6178709f
                                                                          • Opcode Fuzzy Hash: b1d2b02535f3f2643105f6ef2065698c543246a4818dedd7980d0316a87339b5
                                                                          • Instruction Fuzzy Hash: 489182B6901248EFDB01DBE4CA84BDEBBB8AF04308F24455CD8057B741D775AA4DDBA2
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1001A27C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetVersionExA.KERNEL32 ref: 1001A29B
                                                                          • GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 1001A2D0
                                                                          • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1001A330
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: EnvironmentFileModuleNameVariableVersion
                                                                          • String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
                                                                          • API String ID: 1385375860-4131005785
                                                                          • Opcode ID: 8d68a081adb5fb00688b35fa97c12b05e84aee0a2816abf6642aa1a3e48e784b
                                                                          • Instruction ID: ff41b7170f7c9f9639ed0085cf635e38180a7bd29c628196ad01e98acd5c5e28
                                                                          • Opcode Fuzzy Hash: 8d68a081adb5fb00688b35fa97c12b05e84aee0a2816abf6642aa1a3e48e784b
                                                                          • Instruction Fuzzy Hash: DB310575C412986EEB61D6745C81BDD37E9DB17344F2400EAF195DE042E631DFC99B20
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEBF5A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 48COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEBF621
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw
                                                                          • String ID: -aoa$ -aos$ -aot$ -aou
                                                                          • API String ID: 2005118841-2698752949
                                                                          • Opcode ID: c1c5e3cc5beaf1e5b9c5b6321e27fafed61c8e5f2f51a9e1dc3041896dcbbcbc
                                                                          • Instruction ID: a3332c841bf0541ac485d4deeeab8c5b1178771dfe841fdf0aeda21800a3caa5
                                                                          • Opcode Fuzzy Hash: c1c5e3cc5beaf1e5b9c5b6321e27fafed61c8e5f2f51a9e1dc3041896dcbbcbc
                                                                          • Instruction Fuzzy Hash: 80F04F6070A41C6745108EDC6C006AE73BCC70595AF3059DBF80DDBB00DB669E1717DA
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEAEF70 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 6CEAEF8A
                                                                            • Part of subcall function 6CEC5F2A: __FF_MSGBANNER.LIBCMT ref: 6CEC5F4D
                                                                            • Part of subcall function 6CEC5F2A: __NMSG_WRITE.LIBCMT ref: 6CEC5F54
                                                                            • Part of subcall function 6CEC5F2A: RtlAllocateHeap.NTDLL(00000000,6CEAFA6F,?,00000000,?,?,6CEA4D3F,0000000C,388BE448,?,?,00000000,?,?,6CECEF9B,000000FF), ref: 6CEC5FA1
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEAEFA4
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          • std::exception::exception.LIBCMT ref: 6CEAEFC3
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEAEFD8
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw$AllocateExceptionHeapRaise_mallocstd::exception::exception
                                                                          • String ID: d2l
                                                                          • API String ID: 1974103008-2889290444
                                                                          • Opcode ID: caa332565c6825255a2238cfde60d591df270a4b8c5a8c1b0767382837d0df40
                                                                          • Instruction ID: c4fad4cc2a2f04b2dff06a191921747464d3e6497a8443ed04f3a9900fb22c6c
                                                                          • Opcode Fuzzy Hash: caa332565c6825255a2238cfde60d591df270a4b8c5a8c1b0767382837d0df40
                                                                          • Instruction Fuzzy Hash: 28F0FCB1D052046AD70CDFF49A42BEF773D9B84308F24877DD41192A44EB74922E82E3
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEAF310 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 6CEAF320
                                                                            • Part of subcall function 6CEC5F2A: __FF_MSGBANNER.LIBCMT ref: 6CEC5F4D
                                                                            • Part of subcall function 6CEC5F2A: __NMSG_WRITE.LIBCMT ref: 6CEC5F54
                                                                            • Part of subcall function 6CEC5F2A: RtlAllocateHeap.NTDLL(00000000,6CEAFA6F,?,00000000,?,?,6CEA4D3F,0000000C,388BE448,?,?,00000000,?,?,6CECEF9B,000000FF), ref: 6CEC5FA1
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEAF33A
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          • std::exception::exception.LIBCMT ref: 6CEAF359
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEAF36E
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw$AllocateExceptionHeapRaise_mallocstd::exception::exception
                                                                          • String ID: d2l
                                                                          • API String ID: 1974103008-2889290444
                                                                          • Opcode ID: c8632d3b2fba08dab0f85bbe778fc26be5ace4a0cfb9e150d0e663913ff507b7
                                                                          • Instruction ID: e15ee46f098b46eec3a42f053c397cd882ef941e87c8bf6ac6a4dc3b82300361
                                                                          • Opcode Fuzzy Hash: c8632d3b2fba08dab0f85bbe778fc26be5ace4a0cfb9e150d0e663913ff507b7
                                                                          • Instruction Fuzzy Hash: 50F096B09152087ACB0CDFB4DA41ADE77789F44358F20875EEC2996A44FB74E30D8696
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CECAA32 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __getptd.LIBCMT ref: 6CECAA4C
                                                                            • Part of subcall function 6CEC72BB: __getptd_noexit.LIBCMT ref: 6CEC72BE
                                                                            • Part of subcall function 6CEC72BB: __amsg_exit.LIBCMT ref: 6CEC72CB
                                                                          • __getptd.LIBCMT ref: 6CECAA5D
                                                                          • __getptd.LIBCMT ref: 6CECAA6B
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: __getptd$__amsg_exit__getptd_noexit
                                                                          • String ID: MOC$csm
                                                                          • API String ID: 803148776-1389381023
                                                                          • Opcode ID: 66512fbb1fdfae65ddc3ab14898e2b81321cc8c81d018f826881ec3a7f1cfdf2
                                                                          • Instruction ID: 577cc6a44449d366a790bcb5d0196e999eac4a9a19a15cb1ad4d7cf587d304ed
                                                                          • Opcode Fuzzy Hash: 66512fbb1fdfae65ddc3ab14898e2b81321cc8c81d018f826881ec3a7f1cfdf2
                                                                          • Instruction Fuzzy Hash: 29E04F713501048FC700DB64C344B9937B8FB4631CF7501A5E46DC7B22DB34D4489A53
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1001C735 Relevance: 7.6, APIs: 5, Instructions: 150COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetStartupInfoA.KERNEL32(?), ref: 1001C793
                                                                          • GetFileType.KERNEL32(00000480), ref: 1001C83E
                                                                          • GetStdHandle.KERNEL32(-000000F6), ref: 1001C8A1
                                                                          • GetFileType.KERNEL32(00000000), ref: 1001C8AF
                                                                          • SetHandleCount.KERNEL32 ref: 1001C8E6
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: FileHandleType$CountInfoStartup
                                                                          • String ID:
                                                                          • API String ID: 1710529072-0
                                                                          • Opcode ID: 96bd8d765951caf66320892a5d82298be417aadad03bc705412f471f5a66fdb5
                                                                          • Instruction ID: 9e0b50c6418c78b4ce1b27a1f486aee3850f1a3a2b75f6582e04b96d90fbb996
                                                                          • Opcode Fuzzy Hash: 96bd8d765951caf66320892a5d82298be417aadad03bc705412f471f5a66fdb5
                                                                          • Instruction Fuzzy Hash: 0C51243190436A8FE710DB68C8C4F697BE0EB05768F354669D5A29F2E2DB30DC86CB51
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 100010A6 Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CharUpperW.USER32 ref: 100010C1
                                                                          • GetLastError.KERNEL32 ref: 100010CD
                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,00000004,00000000,00000000), ref: 100010E8
                                                                          • CharUpperA.USER32(?), ref: 10001101
                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,00000001), ref: 10001114
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Char$ByteMultiUpperWide$ErrorLast
                                                                          • String ID:
                                                                          • API String ID: 3939315453-0
                                                                          • Opcode ID: 8383e40484a713360037c6af6127c53484664dbcfb1822a6f6cfd995dd4f40d0
                                                                          • Instruction ID: 5dd45f2d0006c2546d84b721a00360ca66f9a592c23ae8bd0920251664c2bfef
                                                                          • Opcode Fuzzy Hash: 8383e40484a713360037c6af6127c53484664dbcfb1822a6f6cfd995dd4f40d0
                                                                          • Instruction Fuzzy Hash: 210156B68002697BFB15EBE09CC9EDFB6ADEB082D4F110551FA42D3101E2B45D448770
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CECC0C6 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __getptd.LIBCMT ref: 6CECC0D2
                                                                            • Part of subcall function 6CEC72BB: __getptd_noexit.LIBCMT ref: 6CEC72BE
                                                                            • Part of subcall function 6CEC72BB: __amsg_exit.LIBCMT ref: 6CEC72CB
                                                                          • __amsg_exit.LIBCMT ref: 6CECC0F2
                                                                          • __lock.LIBCMT ref: 6CECC102
                                                                          • InterlockedDecrement.KERNEL32(?), ref: 6CECC11F
                                                                          • InterlockedIncrement.KERNEL32(00B81658), ref: 6CECC14A
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                                                          • String ID:
                                                                          • API String ID: 4271482742-0
                                                                          • Opcode ID: af0e8f48a8c7af8b3d362b3191d268d0ca9d781d42f79efb14d9dbc51b6f2eca
                                                                          • Instruction ID: 5e39fcf6d0c6007f3d34b78a23b7f5b825d548cd0b62a0de5ef2c2c8dab47f4b
                                                                          • Opcode Fuzzy Hash: af0e8f48a8c7af8b3d362b3191d268d0ca9d781d42f79efb14d9dbc51b6f2eca
                                                                          • Instruction Fuzzy Hash: 4F016137B46A169BDB11AB66960578A7770BF0571CF350109E430A7F80CB24A546CFD3
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEC5FF4 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __lock.LIBCMT ref: 6CEC6012
                                                                            • Part of subcall function 6CEC81D4: __mtinitlocknum.LIBCMT ref: 6CEC81EA
                                                                            • Part of subcall function 6CEC81D4: __amsg_exit.LIBCMT ref: 6CEC81F6
                                                                            • Part of subcall function 6CEC81D4: EnterCriticalSection.KERNEL32(?,?,?,6CECC6AB,00000004,6CED82E8,0000000C,6CEC7669,6CEAFA7E,?,00000000,00000000,00000000,?,6CEC726D,00000001), ref: 6CEC81FE
                                                                          • ___sbh_find_block.LIBCMT ref: 6CEC601D
                                                                          • ___sbh_free_block.LIBCMT ref: 6CEC602C
                                                                          • HeapFree.KERNEL32(00000000,6CEAFA7E,6CED7EB0,0000000C,6CEC81B5,00000000,6CED8028,0000000C,6CEC81EF,6CEAFA7E,?,?,6CECC6AB,00000004,6CED82E8,0000000C), ref: 6CEC605C
                                                                          • GetLastError.KERNEL32(?,6CECC6AB,00000004,6CED82E8,0000000C,6CEC7669,6CEAFA7E,?,00000000,00000000,00000000,?,6CEC726D,00000001,00000214), ref: 6CEC606D
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                          • String ID:
                                                                          • API String ID: 2714421763-0
                                                                          • Opcode ID: a2545ee004dc6531ff686d42660dc12b1d6bc087cbddfb643091aa0755e173dd
                                                                          • Instruction ID: a1aa6c13053d5775c01b805ad15efc79c72877f10e06c30ee6579f558f11c3c7
                                                                          • Opcode Fuzzy Hash: a2545ee004dc6531ff686d42660dc12b1d6bc087cbddfb643091aa0755e173dd
                                                                          • Instruction Fuzzy Hash: 21018FB1B05242AADB305B71AB06B9B3BB89F0136DF30411DE530FAA80CB389644CA57
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1001C031 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetLastError.KERNEL32(00000103,7FFFFFFF,1001C473,1001D0D7,00000000,?,?,00000000,00000001), ref: 1001C033
                                                                          • TlsGetValue.KERNEL32 ref: 1001C041
                                                                          • SetLastError.KERNEL32(00000000), ref: 1001C08D
                                                                            • Part of subcall function 1001C480: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,10019E24,10021318,000000FF,?,1001C056,00000001,00000074), ref: 1001C576
                                                                          • TlsSetValue.KERNEL32(00000000), ref: 1001C065
                                                                          • GetCurrentThreadId.KERNEL32 ref: 1001C076
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLastValue$AllocCurrentHeapThread
                                                                          • String ID:
                                                                          • API String ID: 2020098873-0
                                                                          • Opcode ID: 2a7b4345b55e60806f6563897d190d9d6c15b8e2791512da656746999b9ff8e8
                                                                          • Instruction ID: c7b26c2ea065f329baa6dbda2ade13875997561f4633f5fb0c8b07fada39eb07
                                                                          • Opcode Fuzzy Hash: 2a7b4345b55e60806f6563897d190d9d6c15b8e2791512da656746999b9ff8e8
                                                                          • Instruction Fuzzy Hash: 0DF0BB35901331DBF2329B749C89F1A3AA6EF097B1F214318F6559E1A1CB30D8C29690
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1001A0CE Relevance: 7.5, APIs: 5, Instructions: 34COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • DeleteCriticalSection.KERNEL32(00000000,?,?,1001C005,10019FBC,1001A015,?,?,?), ref: 1001A102
                                                                            • Part of subcall function 100189EE: HeapFree.KERNEL32(00000000,?,?,?,?), ref: 10018AC2
                                                                          • DeleteCriticalSection.KERNEL32(?,?,1001C005,10019FBC,1001A015,?,?,?), ref: 1001A11D
                                                                          • DeleteCriticalSection.KERNEL32 ref: 1001A125
                                                                          • DeleteCriticalSection.KERNEL32 ref: 1001A12D
                                                                          • DeleteCriticalSection.KERNEL32 ref: 1001A135
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalDeleteSection$FreeHeap
                                                                          • String ID:
                                                                          • API String ID: 447823528-0
                                                                          • Opcode ID: 31fd23f1ab8c03e9a7f37bef3c6a7256c8a93bd33ca8f004c8e74067c6c1dcf0
                                                                          • Instruction ID: 436f94670acdd869086ea8be0b95e1bb75b4415bd69928cd2107d9a27a45b4f1
                                                                          • Opcode Fuzzy Hash: 31fd23f1ab8c03e9a7f37bef3c6a7256c8a93bd33ca8f004c8e74067c6c1dcf0
                                                                          • Instruction Fuzzy Hash: 1AF0F4268002647AEA65F719AD8C8A97BD5DB822B27920476EC53B7030CD778CC29DA5
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEBFC00 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 128COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEBFD8E
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEBFDA3
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw
                                                                          • String ID: -u$ -v
                                                                          • API String ID: 2005118841-1451257818
                                                                          • Opcode ID: ea76465223aafdbea1a634a6e0684afe9e40995ab2b0d95f824dfa5322870996
                                                                          • Instruction ID: 2608b1476764996e70ba16cf88fe65d14716cced234e25e3ddf71f5107ccc566
                                                                          • Opcode Fuzzy Hash: ea76465223aafdbea1a634a6e0684afe9e40995ab2b0d95f824dfa5322870996
                                                                          • Instruction Fuzzy Hash: D24185B9905209EFCB11DFD8CA40ADEB7F4EB05344F71491AE814B7B40D734BA468B95
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEA2830 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEA2893
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEA28BD
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw$ExceptionRaise
                                                                          • String ID: 0Ml$Cannot find listfile
                                                                          • API String ID: 3476068407-2491006773
                                                                          • Opcode ID: 659e65c4160eef651a8bd23849df8104555bcc8cfedad55c8043d2984fd4b7eb
                                                                          • Instruction ID: 3b1946c7aeb894763ca2122edd536ee827bef8c4edb59a4ab7c6965bf324c252
                                                                          • Opcode Fuzzy Hash: 659e65c4160eef651a8bd23849df8104555bcc8cfedad55c8043d2984fd4b7eb
                                                                          • Instruction Fuzzy Hash: 0C31A4B2D002599FCB04CF99C945AEFB7B8FF18308F24066DE814B7B40D7356A068BA1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEA3BE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: __fileno
                                                                          • String ID: (_l
                                                                          • API String ID: 1873356214-3037686567
                                                                          • Opcode ID: 219b989ff10da0859039292e1d66a3e887e986080335332c313ccd84a3dad8ed
                                                                          • Instruction ID: f33014ca4a63b8ca22cf2c58c6c9e5b29bead40eec5dddd651ba56645de0c8ca
                                                                          • Opcode Fuzzy Hash: 219b989ff10da0859039292e1d66a3e887e986080335332c313ccd84a3dad8ed
                                                                          • Instruction Fuzzy Hash: 3D312DB160A7C5BFD300DB798940A86FFB9EF11208F28C69DD46487B01D735E808D761
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEB5BE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61registryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • RegOpenKeyExW.ADVAPI32(80000001,Software\7-zip,00000000,00020019,6CECFD48,388BE448,00000000,?,80000001,00000000,6CECFD48,000000FF,?,6CEB5DBD,?,6CEDFCC8), ref: 6CEB5C1D
                                                                            • Part of subcall function 6CEB2FE0: RegQueryValueExW.ADVAPI32(00000000,Path,00000000,?,00000000,6CEB5DBD,?,?,6CEB5C37,?,6CEB5DBD,?,6CEDFCC8,00000000,00000000), ref: 6CEB300E
                                                                            • Part of subcall function 6CEB2FE0: RegQueryValueExW.ADVAPI32(6CEB5DBD,Path,00000000,6CEB5DBD,?,6CEB5DBD,?,6CEB5DBD,?,6CEDFCC8,00000000,00000000), ref: 6CEB304E
                                                                          • RegCloseKey.ADVAPI32(?,?,6CEB5DBD,?,6CEDFCC8,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6CEB5C47
                                                                          • RegCloseKey.ADVAPI32(?,?,6CEB5DBD,?,6CEDFCC8,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6CEB5C65
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CloseQueryValue$Open
                                                                          • String ID: Software\7-zip
                                                                          • API String ID: 4082589901-3321436535
                                                                          • Opcode ID: 38e496507dbcba4b9d2b470c8fc22de18156a5438e8ebaa1cb13e2bcfefff2f8
                                                                          • Instruction ID: 4aff5e00c7408c7a763a265bee2d31b0ab153cd3b49455e8cc6eaa78dae17940
                                                                          • Opcode Fuzzy Hash: 38e496507dbcba4b9d2b470c8fc22de18156a5438e8ebaa1cb13e2bcfefff2f8
                                                                          • Instruction Fuzzy Hash: A8117372A05A28ABCB118F85DD44AAFBB78FB05B24F10066BFC15B7740D73565058AD4
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEBC8BE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEBC8C2
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          • GetLastError.KERNEL32(00000000,00000000), ref: 6CEBC8C7
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorExceptionException@8LastRaiseThrow
                                                                          • String ID: 7-Zip cannot load Mapi32.dll$Rl
                                                                          • API String ID: 2060628206-887741125
                                                                          • Opcode ID: a8a8100d8590f570c2c298d49031588349cb2269bdcaf8b228d9d31f12deb978
                                                                          • Instruction ID: 8dfefb05f3371c59f63ebd09efd98822e0d680027ef087d2ad56813df34f68d8
                                                                          • Opcode Fuzzy Hash: a8a8100d8590f570c2c298d49031588349cb2269bdcaf8b228d9d31f12deb978
                                                                          • Instruction Fuzzy Hash: D211A572A05248DEEB00DBE4ED44BEDB7B4AF05314F34419DE518A7780DB315A09CB72
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CECB090 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ___BuildCatchObject.LIBCMT ref: 6CECB0A3
                                                                            • Part of subcall function 6CECAFFE: ___BuildCatchObjectHelper.LIBCMT ref: 6CECB034
                                                                          • _UnwindNestedFrames.LIBCMT ref: 6CECB0BA
                                                                          • ___FrameUnwindToState.LIBCMT ref: 6CECB0C8
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
                                                                          • String ID: csm
                                                                          • API String ID: 2163707966-1018135373
                                                                          • Opcode ID: 140d385d04fdb06c5864635da4643ae5f7030d20822db344ff7144d47db4523a
                                                                          • Instruction ID: 160f23c2437f787818bd01a4387cc9a149b087bc1de24f4cfa6961df6178164b
                                                                          • Opcode Fuzzy Hash: 140d385d04fdb06c5864635da4643ae5f7030d20822db344ff7144d47db4523a
                                                                          • Instruction Fuzzy Hash: 9B011271601109FBDF125F51CE42EEB7E7AEF08348F204014BD3854A20DB3298A1DBA6
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEBF640 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEBF66A
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ExceptionException@8RaiseThrow
                                                                          • String ID: -r$ -r-$ -r0
                                                                          • API String ID: 3976011213-1696425382
                                                                          • Opcode ID: d49544f64344e831f9d604e09ea2f03206666454d69f9dc8b77cde70c7817421
                                                                          • Instruction ID: 9b4a28290b51e1ee5b3322af2d55b80a09a11edec5ace7ff8eba05880c3a3c22
                                                                          • Opcode Fuzzy Hash: d49544f64344e831f9d604e09ea2f03206666454d69f9dc8b77cde70c7817421
                                                                          • Instruction Fuzzy Hash: 1FF0A064706009ABC6018EECAE047AE77BCC70550CF310A8AF808EBF14DB669E1643DA
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 100197CF Relevance: 6.5, APIs: 5, Instructions: 278COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: fd9724b1c61d381fd748c7ffe039d77dfbf158c8da40872393acd8e509287be1
                                                                          • Instruction ID: c5e9eab5286596022c0fc86455b854ac72cbfdbbf2fd81343e62aa3bf37372db
                                                                          • Opcode Fuzzy Hash: fd9724b1c61d381fd748c7ffe039d77dfbf158c8da40872393acd8e509287be1
                                                                          • Instruction Fuzzy Hash: 7791C371D01664AADB11EB68CC81ADE7AF9EF497A0F600226F854BE191D731DDC0CBA1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1001B010 Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • HeapAlloc.KERNEL32(00000000,00002020,10025958,10025958,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?), ref: 1001B031
                                                                          • VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?), ref: 1001B055
                                                                          • VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?), ref: 1001B06F
                                                                          • VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?,?), ref: 1001B130
                                                                          • HeapFree.KERNEL32(00000000,00000000,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?,?,?), ref: 1001B147
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AllocVirtual$FreeHeap
                                                                          • String ID:
                                                                          • API String ID: 714016831-0
                                                                          • Opcode ID: 08a6be7fdf41f6db4eaa31ea6addab7da968f7782194b53cc123b6d70fe20246
                                                                          • Instruction ID: 9791cdc1e8676e8be9240cb2db72b85fdf48b460ca22e9baef45e6ba91bfb517
                                                                          • Opcode Fuzzy Hash: 08a6be7fdf41f6db4eaa31ea6addab7da968f7782194b53cc123b6d70fe20246
                                                                          • Instruction Fuzzy Hash: F4312670500B56EBE332CF24CCC5B2677E0EB447A5FA14529F5669B290E771E8C5CB48
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CECCEA8 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 6CECCEDC
                                                                          • __isleadbyte_l.LIBCMT ref: 6CECCF10
                                                                          • MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,?,?,00000000,?,?,?), ref: 6CECCF41
                                                                          • MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,00000001,?,00000000,?,?,?), ref: 6CECCFAF
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                          • String ID:
                                                                          • API String ID: 3058430110-0
                                                                          • Opcode ID: e5ca5f79707f1ba758e6dd469052c6aee72d13076d8b0326c3ddd7942e47a82a
                                                                          • Instruction ID: 20cd261ea627c8f2dc2f4c3b1c83d712b19b3e115798f9097c64ba9f3f6d412f
                                                                          • Opcode Fuzzy Hash: e5ca5f79707f1ba758e6dd469052c6aee72d13076d8b0326c3ddd7942e47a82a
                                                                          • Instruction Fuzzy Hash: D031CE31B05285EFDB10EF64CA81AAA3BB5BF0231CF3485A8E4709BA90D330D941CB52
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEB0F70 Relevance: 6.1, APIs: 4, Instructions: 86filetimeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateFileW.KERNEL32(00000000,40000000,00000003,00000000,00000003,02000000,00000000,388BE448,00000000,?,?,00000000,00000000,00000000), ref: 6CEB0FAE
                                                                          • CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 6CEB100C
                                                                          • SetFileTime.KERNEL32(00000000,?,?,?,?,?,?), ref: 6CEB1033
                                                                          • CloseHandle.KERNEL32(00000000,?,?,?), ref: 6CEB103F
                                                                            • Part of subcall function 6CEB28A0: GetCurrentDirectoryW.KERNEL32(00000105,?,388BE448,FFFFFFFF,?,00000004), ref: 6CEB2994
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: File$Create$CloseCurrentDirectoryHandleTime
                                                                          • String ID:
                                                                          • API String ID: 2622452211-0
                                                                          • Opcode ID: f0a72b18dae02421e55cb43dc2a045f465a1ccfccd6cbd4da99a9fa3b4024cff
                                                                          • Instruction ID: 1673a669b593a5ebf414364158c973e2a1c2cd9462590a36f089dd376b99ecfa
                                                                          • Opcode Fuzzy Hash: f0a72b18dae02421e55cb43dc2a045f465a1ccfccd6cbd4da99a9fa3b4024cff
                                                                          • Instruction Fuzzy Hash: 0C21B271A00204AFEB10CF94DC85FAFB7B8EB45768F204229FA15A77C0C734AE0586A0
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1000112C Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CharUpper$ErrorH_prologLast
                                                                          • String ID:
                                                                          • API String ID: 826227211-0
                                                                          • Opcode ID: ff1246a03657b54eff9156cf09a95992e04e2b4fa534e0be7897412a772be6bf
                                                                          • Instruction ID: 99cf40d06858b6207db1331b5053b1e25ae539a9e8e767eb293be6f8fe8ea0fc
                                                                          • Opcode Fuzzy Hash: ff1246a03657b54eff9156cf09a95992e04e2b4fa534e0be7897412a772be6bf
                                                                          • Instruction Fuzzy Hash: 8A11043590025BDFEB05EFA0D8919EEB7F4FF09384F200424F542A2269EB705E41CB80
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEBD4C0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • EnterCriticalSection.KERNEL32(6CEDFC98,388BE448,?,?,?,6CECFB68,000000FF), ref: 6CEBD4F2
                                                                          • LeaveCriticalSection.KERNEL32(6CEDFC98,?,?,?,6CECFB68,000000FF), ref: 6CEBD50A
                                                                          • LeaveCriticalSection.KERNEL32(6CEDFC98,?,?,?,?,6CECFB68,000000FF), ref: 6CEBD547
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalSection$Leave$Enter
                                                                          • String ID: [Content]
                                                                          • API String ID: 2978645861-3799411330
                                                                          • Opcode ID: 44176693de75de0233956f30d0d47067f211f88550d46de819572559f84a4ddf
                                                                          • Instruction ID: e3477222eabfb510a38934009291f55aecb0e23bb8be36d2e2393cf997074d07
                                                                          • Opcode Fuzzy Hash: 44176693de75de0233956f30d0d47067f211f88550d46de819572559f84a4ddf
                                                                          • Instruction Fuzzy Hash: AE01F972904508AFD720DF58E905B9DB7F8FB09624F51866BF801E7B80D779B904CB94
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEA1A30 Relevance: 6.0, APIs: 4, Instructions: 46fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetStdHandle.KERNEL32(000000F6,?,00100000,?,00000000), ref: 6CEA1A4E
                                                                          • ReadFile.KERNEL32(00000000), ref: 6CEA1A55
                                                                          • GetLastError.KERNEL32 ref: 6CEA1A72
                                                                          • GetLastError.KERNEL32 ref: 6CEA1A80
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLast$FileHandleRead
                                                                          • String ID:
                                                                          • API String ID: 2244327787-0
                                                                          • Opcode ID: e5cfcc069422599cef377cbae531a2481c5f93be49bece485f1c68eb25355806
                                                                          • Instruction ID: 5a5269397c7ea2b82760ea36c19f001c0e78dbebbbff86b49b02c4bdf45b3a04
                                                                          • Opcode Fuzzy Hash: e5cfcc069422599cef377cbae531a2481c5f93be49bece485f1c68eb25355806
                                                                          • Instruction Fuzzy Hash: A001867334420A9FDB04DAD4AD00BBB377C9B457A9F208536F916CBA80D634E85187A1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CECBE2A Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __getptd.LIBCMT ref: 6CECBE36
                                                                            • Part of subcall function 6CEC72BB: __getptd_noexit.LIBCMT ref: 6CEC72BE
                                                                            • Part of subcall function 6CEC72BB: __amsg_exit.LIBCMT ref: 6CEC72CB
                                                                          • __getptd.LIBCMT ref: 6CECBE4D
                                                                          • __amsg_exit.LIBCMT ref: 6CECBE5B
                                                                          • __lock.LIBCMT ref: 6CECBE6B
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                                                          • String ID:
                                                                          • API String ID: 3521780317-0
                                                                          • Opcode ID: b22db546c92336c3e326c380cd35761640bf3c3a77470ec1320920188c8451a5
                                                                          • Instruction ID: 847007305bfcca8ef3c2226dc71a6891c2e8cbfc80a8cd9236116e223383782e
                                                                          • Opcode Fuzzy Hash: b22db546c92336c3e326c380cd35761640bf3c3a77470ec1320920188c8451a5
                                                                          • Instruction Fuzzy Hash: D1F01D32F40B088EDB219BA586017CE76B4AB05B28F35465DD57197B90CB346909CBA3
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEC1C20 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 226COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEC1C93
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ExceptionException@8RaiseThrow
                                                                          • String ID: map/set<T> too long$|2l
                                                                          • API String ID: 3976011213-60869788
                                                                          • Opcode ID: dcd1e6bf3da85b8c2ec23ba17b8663056f44e9ac5393ed369afeefd80ee91967
                                                                          • Instruction ID: 8bcbdcd722113200732dcdf064f03e887c49639f3882c207ef21968be95c3744
                                                                          • Opcode Fuzzy Hash: dcd1e6bf3da85b8c2ec23ba17b8663056f44e9ac5393ed369afeefd80ee91967
                                                                          • Instruction Fuzzy Hash: ACA110B1A45642DFC704CF59D280805FBB2BF9A718739869ED8696BB11C732F852CBC1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 100081EF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: H_prolog
                                                                          • String ID: $
                                                                          • API String ID: 3519838083-227171996
                                                                          • Opcode ID: 312c2aec7e709d08ccb2c85a8bc715850654904397243e69b9c15c2e37b53766
                                                                          • Instruction ID: 9585d42676a0d41e953fe7fe136552d86f024f2135ab78c93d006785aed77b76
                                                                          • Opcode Fuzzy Hash: 312c2aec7e709d08ccb2c85a8bc715850654904397243e69b9c15c2e37b53766
                                                                          • Instruction Fuzzy Hash: D471583090060ACFEB20CF94C881AAEB7B1FF88394F50456DD596A7255DB30BB86CF50
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1001D6A3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: Info
                                                                          • String ID: $
                                                                          • API String ID: 1807457897-3032137957
                                                                          • Opcode ID: 14eba8f351f7a606bf476568831cf335b29103052037c0e04881c2f51051340a
                                                                          • Instruction ID: 27a1dab1f5f815cb8d427bf576b62c8b4ec6ff9cec70f847aa7466e11b016868
                                                                          • Opcode Fuzzy Hash: 14eba8f351f7a606bf476568831cf335b29103052037c0e04881c2f51051340a
                                                                          • Instruction Fuzzy Hash: 2B41483140436C1AEB11FA64CD85FEA7F9ADB01744F1006F7D585CF092D271C989DBA2
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEA3CF0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 119COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CharUpperW.USER32(00000000,388BE448,00000002,00000000,00000000,6CEA43B8,0000001B,000000FF,(_l,00000002), ref: 6CEA3D92
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CharUpper
                                                                          • String ID: Incorrect command line$\l
                                                                          • API String ID: 9403516-3011573707
                                                                          • Opcode ID: ccbacc4c789db196110248658ff230ba0e9ebca408ef34cad391d3ca3c0a30b1
                                                                          • Instruction ID: 568cdf51e186c67dc92358e744d3c732eb2be2d366c680ee847a0715c6c04f4c
                                                                          • Opcode Fuzzy Hash: ccbacc4c789db196110248658ff230ba0e9ebca408ef34cad391d3ca3c0a30b1
                                                                          • Instruction Fuzzy Hash: F74103BAA04105CFCB10DF98D881AAAF7B4FF49324F25426AED199BB40D734E902C7D1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEA8400 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 6CEA84F6
                                                                            • Part of subcall function 6CEC5F2A: __FF_MSGBANNER.LIBCMT ref: 6CEC5F4D
                                                                            • Part of subcall function 6CEC5F2A: __NMSG_WRITE.LIBCMT ref: 6CEC5F54
                                                                            • Part of subcall function 6CEC5F2A: RtlAllocateHeap.NTDLL(00000000,6CEAFA6F,?,00000000,?,?,6CEA4D3F,0000000C,388BE448,?,?,00000000,?,?,6CECEF9B,000000FF), ref: 6CEC5FA1
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEA8510
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
                                                                          • String ID: ,Sl
                                                                          • API String ID: 2732643326-3949904944
                                                                          • Opcode ID: e67e8dba672a924ee75f9766606da44c10a114bb4e96837d8144720905e4e59a
                                                                          • Instruction ID: ba678f93681dcb0876be35e31f0f2b7cf5b9b8f536835ae28a61f579ed83d05a
                                                                          • Opcode Fuzzy Hash: e67e8dba672a924ee75f9766606da44c10a114bb4e96837d8144720905e4e59a
                                                                          • Instruction Fuzzy Hash: 385102B1A05B45EEC310CF6AC581786FBF4BB19304F608A6EC4AD87B10D375B559CB91
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEB0AF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,0000005F,00000000,388BE448,00000000), ref: 6CEB0B62
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEB0B88
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ByteCharExceptionException@8MultiRaiseThrowWide
                                                                          • String ID: _
                                                                          • API String ID: 3144726602-701932520
                                                                          • Opcode ID: 964dd6baeffb24fc948a2fbf44f7e9e69fd9c1946c434942de1cb94252af0336
                                                                          • Instruction ID: 9d287260811d0a3c2dad709330afc6a2d438e91af0d2b7768cbd16e0ac15ad2e
                                                                          • Opcode Fuzzy Hash: 964dd6baeffb24fc948a2fbf44f7e9e69fd9c1946c434942de1cb94252af0336
                                                                          • Instruction Fuzzy Hash: D2219275504249EFCB00CF99C980BABFBF8EF49718F20855EE9149B741D775AA04CBA1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEB2FE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67registryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • RegQueryValueExW.ADVAPI32(00000000,Path,00000000,?,00000000,6CEB5DBD,?,?,6CEB5C37,?,6CEB5DBD,?,6CEDFCC8,00000000,00000000), ref: 6CEB300E
                                                                          • RegQueryValueExW.ADVAPI32(6CEB5DBD,Path,00000000,6CEB5DBD,?,6CEB5DBD,?,6CEB5DBD,?,6CEDFCC8,00000000,00000000), ref: 6CEB304E
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: QueryValue
                                                                          • String ID: Path
                                                                          • API String ID: 3660427363-2875597873
                                                                          • Opcode ID: caa111584911976709792bbeaca9839007085dab9c9a5a9efae881403bb14ce7
                                                                          • Instruction ID: 5ce065eca0e55d00b72b04de25e0681af9353f5706526041a7bda8001da821bc
                                                                          • Opcode Fuzzy Hash: caa111584911976709792bbeaca9839007085dab9c9a5a9efae881403bb14ce7
                                                                          • Instruction Fuzzy Hash: 801160B5A05604EFDB14DFA8C9C18AEF7B9FF48704B30886EE146D3641EA70AD408B50
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEA22F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 6CEA231A
                                                                            • Part of subcall function 6CEC5F2A: __FF_MSGBANNER.LIBCMT ref: 6CEC5F4D
                                                                            • Part of subcall function 6CEC5F2A: __NMSG_WRITE.LIBCMT ref: 6CEC5F54
                                                                            • Part of subcall function 6CEC5F2A: RtlAllocateHeap.NTDLL(00000000,6CEAFA6F,?,00000000,?,?,6CEA4D3F,0000000C,388BE448,?,?,00000000,?,?,6CECEF9B,000000FF), ref: 6CEC5FA1
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEA2336
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
                                                                          • String ID: dLl
                                                                          • API String ID: 2732643326-3939847266
                                                                          • Opcode ID: a53d3793a3052be658c651751e941f8ccaf9d43613c0c98395347d3b76b6c5e5
                                                                          • Instruction ID: 3234c341d55c70db1b70ac0676357a34418f4e4fd8e3cf21835355d6a5feaecf
                                                                          • Opcode Fuzzy Hash: a53d3793a3052be658c651751e941f8ccaf9d43613c0c98395347d3b76b6c5e5
                                                                          • Instruction Fuzzy Hash: 8E21C3B2A00604AFC720CF9DC981A9AF7FCFF49614F21C62EE55997750D735AA058BA0
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEA5480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 6CEA54AD
                                                                            • Part of subcall function 6CEC5F2A: __FF_MSGBANNER.LIBCMT ref: 6CEC5F4D
                                                                            • Part of subcall function 6CEC5F2A: __NMSG_WRITE.LIBCMT ref: 6CEC5F54
                                                                            • Part of subcall function 6CEC5F2A: RtlAllocateHeap.NTDLL(00000000,6CEAFA6F,?,00000000,?,?,6CEA4D3F,0000000C,388BE448,?,?,00000000,?,?,6CECEF9B,000000FF), ref: 6CEC5FA1
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEA54C7
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
                                                                          • String ID: 7l
                                                                          • API String ID: 2732643326-164341269
                                                                          • Opcode ID: e64bc6091794c41febdaccd2b8b7ff3f05859c481fdbc16ad239133be99bbfb0
                                                                          • Instruction ID: e6c0253a6d07adbd89cf32ca8bacfe41b2b74a4b7f154453ce53b795b1338e46
                                                                          • Opcode Fuzzy Hash: e64bc6091794c41febdaccd2b8b7ff3f05859c481fdbc16ad239133be99bbfb0
                                                                          • Instruction Fuzzy Hash: B711E4B1605705EFC714CF94C841B9AB7F9EB45314F208A2EE826CBB90DB30A9058B90
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEAED10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEAED86
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                            • Part of subcall function 6CEAEDB0: std::exception::exception.LIBCMT ref: 6CEAEDDE
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ExceptionException@8RaiseThrowstd::exception::exception
                                                                          • String ID: vector<T> too long$|2l
                                                                          • API String ID: 4171481480-2998974942
                                                                          • Opcode ID: 9e3bba463c56655fa59dc16f9b7f44d93964195446e96a1055b22f1d87d9fee0
                                                                          • Instruction ID: d3e7a1c63c0383df761d8c874fa9331fc2526cdcbe4a3f5b7af3ac20a59b79cd
                                                                          • Opcode Fuzzy Hash: 9e3bba463c56655fa59dc16f9b7f44d93964195446e96a1055b22f1d87d9fee0
                                                                          • Instruction Fuzzy Hash: 230171B1108344ABC310DFA8D941B8BBBF8EB48764F500A1DF59597B90DB74E6088BE6
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CECAE09 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 6CEC69BB: __getptd.LIBCMT ref: 6CEC69C1
                                                                            • Part of subcall function 6CEC69BB: __getptd.LIBCMT ref: 6CEC69D1
                                                                          • __getptd.LIBCMT ref: 6CECAE18
                                                                            • Part of subcall function 6CEC72BB: __getptd_noexit.LIBCMT ref: 6CEC72BE
                                                                            • Part of subcall function 6CEC72BB: __amsg_exit.LIBCMT ref: 6CEC72CB
                                                                          • __getptd.LIBCMT ref: 6CECAE26
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: __getptd$__amsg_exit__getptd_noexit
                                                                          • String ID: csm
                                                                          • API String ID: 803148776-1018135373
                                                                          • Opcode ID: c868b9202c40c128ab5c124d4baf2a7191ffbd882dd3f7671e77d16ed862952d
                                                                          • Instruction ID: 7c66816bacca537ae013b247502b20145cef2ae95680f75a8dded213a02e411a
                                                                          • Opcode Fuzzy Hash: c868b9202c40c128ab5c124d4baf2a7191ffbd882dd3f7671e77d16ed862952d
                                                                          • Instruction Fuzzy Hash: E4016D34A816058FCF248FA1D644AADB7B9BF0031DF34452DD46296FA0CB3095D9CB93
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CECE688 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CECE66F
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          • std::bad_exception::bad_exception.LIBCMT ref: 6CECE697
                                                                            • Part of subcall function 6CEC5DCA: std::bad_exception::bad_exception.LIBCMT ref: 6CEC5DD5
                                                                          Strings
                                                                          • Access violation - no RTTI data!, xrefs: 6CECE68F
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: std::bad_exception::bad_exception$ExceptionException@8RaiseThrow
                                                                          • String ID: Access violation - no RTTI data!
                                                                          • API String ID: 1432139112-2158758863
                                                                          • Opcode ID: bd5785191f7b832f110bd78a73544d6df2c660f27e5f170d3c31a1fb78cf1771
                                                                          • Instruction ID: 8aeeaec352ae239880b29a4a599f2710d08af50f785488d27a7e0fb4d03a7866
                                                                          • Opcode Fuzzy Hash: bd5785191f7b832f110bd78a73544d6df2c660f27e5f170d3c31a1fb78cf1771
                                                                          • Instruction Fuzzy Hash: 48E0EC75A14604CFCF04CBA8CA81AEE77B8AB19315F250858E412E7A50D734A9569F52
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 6CEC518F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __EH_prolog3.LIBCMT ref: 6CEC5196
                                                                          • __CxxThrowException@8.LIBCMT ref: 6CEC51C1
                                                                            • Part of subcall function 6CEC663B: RaiseException.KERNEL32(?,6CEC0629,388BE448,?,?,6CEC0629,?,6CED8388,388BE448), ref: 6CEC667D
                                                                          Strings
                                                                          • invalid string position, xrefs: 6CEC519B
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2248387735.000000006CEA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CEA0000, based on PE: true
                                                                          • Associated: 00000001.00000002.2248342144.000000006CEA0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248556021.000000006CED3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248647777.000000006CEDD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CEE3000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248684049.000000006CF08000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_6cea0000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: ExceptionException@8H_prolog3RaiseThrow
                                                                          • String ID: invalid string position
                                                                          • API String ID: 1961742612-1799206989
                                                                          • Opcode ID: 3eb59a6c3c97e73b1184d00c8cf73611d938e87d3d88b0ecdb8ef1686c55bc79
                                                                          • Instruction ID: 7a6a8d32f78578c971829624a0d7e8dbcd8b58c6baa04e2df6555485881de238
                                                                          • Opcode Fuzzy Hash: 3eb59a6c3c97e73b1184d00c8cf73611d938e87d3d88b0ecdb8ef1686c55bc79
                                                                          • Instruction Fuzzy Hash: 88D012729501089BCB00DBD0CD45FDD737C6B14314F645829A111A7940DB64AA0986A1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1001AB6E Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • HeapReAlloc.KERNEL32(00000000,?,?,00000000,1001A936,?,?,?,10018906,?,?,?,?,?,?), ref: 1001AB96
                                                                          • HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,1001A936,?,?,?,10018906,?,?,?,?,?,?), ref: 1001ABCA
                                                                          • VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 1001ABE4
                                                                          • HeapFree.KERNEL32(00000000,?), ref: 1001ABFB
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: AllocHeap$FreeVirtual
                                                                          • String ID:
                                                                          • API String ID: 3499195154-0
                                                                          • Opcode ID: 6f699eca9e893f575dde21e6c4b4ec1254527531fada708ecaea67c30c461b13
                                                                          • Instruction ID: 484c1ce75c38baac158856a15f7ab205fd40ab6127819ea80900b3ceb95b3c03
                                                                          • Opcode Fuzzy Hash: 6f699eca9e893f575dde21e6c4b4ec1254527531fada708ecaea67c30c461b13
                                                                          • Instruction Fuzzy Hash: E8112570240321AFE721EF19CCC6A167BF6FB86764B61491AF552C69B1D3729CA2CF40
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 1001A0A5 Relevance: 5.0, APIs: 4, Instructions: 12COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • InitializeCriticalSection.KERNEL32(?,1001BFB2,?,10019F53), ref: 1001A0B2
                                                                          • InitializeCriticalSection.KERNEL32 ref: 1001A0BA
                                                                          • InitializeCriticalSection.KERNEL32 ref: 1001A0C2
                                                                          • InitializeCriticalSection.KERNEL32 ref: 1001A0CA
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.2247936575.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                          • Associated: 00000001.00000002.2247908282.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248040053.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248094481.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248167906.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                          • Associated: 00000001.00000002.2248260945.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalInitializeSection
                                                                          • String ID:
                                                                          • API String ID: 32694325-0
                                                                          • Opcode ID: 9eddfc3165ec3fc15766a975bd316014652016b7c432d0d5cadee5ee0f614abc
                                                                          • Instruction ID: bb73eb11f573fb0f18e311b5dd9e76b2e5dde51fe535fe889abf8312516ef5db
                                                                          • Opcode Fuzzy Hash: 9eddfc3165ec3fc15766a975bd316014652016b7c432d0d5cadee5ee0f614abc
                                                                          • Instruction Fuzzy Hash: BEC00231801138AFFA556B55DC848493FA6EB042723210063E10561030CEB31C93DFE8
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%