Edit tour

Windows Analysis Report
Arixcel_Explorer_v8.7.8793.msi

Overview

General Information

Sample name:	Arixcel_Explorer_v8.7.8793.msi
Analysis ID:	1445900
MD5:	a9fabc2227e5a5ce5aa17c3783e56110
SHA1:	602a2f1521d423a6111e62ff4d38d8353e5e9eae
SHA256:	da7c2031d596747b9afdde61ccfc469977495e3f3406acfbe733b6f598f02a73
Infos:

Detection

Score:	18
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Compliance

Score:	62
Range:	0 - 100

Signatures

Sigma detected: File With Uncommon Extension Created By An Office Application

Checks for available system drives (often done to infect USB drives)

Contains long sleeps (>= 3 min)

Creates files inside the system directory

Deletes files inside the Windows folder

Drops PE files

Found dropped PE file which has not been started or loaded

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Classification

Process Tree

System is w10x64_ra

msiexec.exe (PID: 5452 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Arixcel_Explorer_v8.7.8793.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6648 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6860 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding F8241E459A5D63C6243CC8C18663CA0E C MD5: 9D09DC1EDA745A5F87553048E57620CF)

rundll32.exe (PID: 3972 cmdline: rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI8CFF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6065437 16 ArixcelSetup!Arixcel.Explorer.Setup.CustomActions.CheckSystemRequirements MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2016 cmdline: rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI8E86.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6065843 22 ArixcelSetup!Arixcel.Explorer.Setup.CustomActions.ResetAllUsers MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6932 cmdline: rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI905C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6066312 28 ArixcelSetup!Arixcel.Explorer.Setup.CustomActions.SetDefaultInstallFolders MD5: 889B99C52A60DD49227C5E485A016679)

msiexec.exe (PID: 6304 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding C01FE4677FFB48E5645FF86B60FEF20B MD5: 9D09DC1EDA745A5F87553048E57620CF)

rundll32.exe (PID: 6664 cmdline: rundll32.exe "C:\Windows\Installer\MSIB910.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6076750 2 ArixcelSetup!Arixcel.Explorer.Setup.CustomActions.RenameExplorer3Registry MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6668 cmdline: rundll32.exe "C:\Windows\Installer\MSIBAF5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6077218 8 ArixcelSetup!Arixcel.Explorer.Setup.CustomActions.RegisterVbaAddin MD5: 889B99C52A60DD49227C5E485A016679)

EXCEL.EXE (PID: 424 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" MD5: 4A871771235598812032C822E6F68F19)

cleanup

Sigma Signatures

System Summary

Sigma detected: File With Uncommon Extension Created By An Office Application

Source: File created

Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, ProcessId: 424, TargetFilename: C:\Users\user\AppData\Local\assembly\tmp\ZDZO238B\ArixcelExplorer.DLL

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: Arixcel Explorer 8.7, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\msiexec.exe, ProcessId: 6648, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Excel\Addins\ArixcelExplorer\Description

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Compliance

Creates a software uninstall entry

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C22576F4-B0E1-4CB8-A237-B8F2C5DF3505}

PE / OLE file has a valid certificate

Source: Arixcel_Explorer_v8.7.8793.msi

Static PE information: certificate valid

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Spreading

Source: C:\Windows\System32\msiexec.exe	File opened: z:
Source: C:\Windows\System32\msiexec.exe	File opened: x:
Source: C:\Windows\System32\msiexec.exe	File opened: v:
Source: C:\Windows\System32\msiexec.exe	File opened: t:
Source: C:\Windows\System32\msiexec.exe	File opened: r:
Source: C:\Windows\System32\msiexec.exe	File opened: p:
Source: C:\Windows\System32\msiexec.exe	File opened: n:
Source: C:\Windows\System32\msiexec.exe	File opened: l:
Source: C:\Windows\System32\msiexec.exe	File opened: j:
Source: C:\Windows\System32\msiexec.exe	File opened: h:
Source: C:\Windows\System32\msiexec.exe	File opened: f:
Source: C:\Windows\System32\msiexec.exe	File opened: b:
Source: C:\Windows\System32\msiexec.exe	File opened: y:
Source: C:\Windows\System32\msiexec.exe	File opened: w:
Source: C:\Windows\System32\msiexec.exe	File opened: u:
Source: C:\Windows\System32\msiexec.exe	File opened: s:
Source: C:\Windows\System32\msiexec.exe	File opened: q:
Source: C:\Windows\System32\msiexec.exe	File opened: o:
Source: C:\Windows\System32\msiexec.exe	File opened: m:
Source: C:\Windows\System32\msiexec.exe	File opened: k:
Source: C:\Windows\System32\msiexec.exe	File opened: i:
Source: C:\Windows\System32\msiexec.exe	File opened: g:
Source: C:\Windows\System32\msiexec.exe	File opened: e:
Source: C:\Windows\System32\msiexec.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:

Software Vulnerabilities

Source: excel.exe

Memory has grown: Private usage: 7MB later: 49MB

System Summary

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5cb73a.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{C22576F4-B0E1-4CB8-A237-B8F2C5DF3505}
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB8FF.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB910.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBAF5.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5cb73c.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5cb73c.msi
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSIB910.tmp-
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSIB910.tmp-\ArixcelSetup.dll
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSIB910.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSIB910.tmp-\CustomAction.config
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSIBAF5.tmp-
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSIBAF5.tmp-\ArixcelSetup.dll
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSIBAF5.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSIBAF5.tmp-\CustomAction.config

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIB910.tmp

Source: classification engine

Classification label: clean18.winMSI@17/47@0/5

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\Programs

Source: C:\Windows\SysWOW64\rundll32.exe

Mutant created: NULL

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\Temp\MSI8C71.tmp

Source: C:\Windows\System32\msiexec.exe

File read: C:\Windows\win.ini

Source: C:\Windows\System32\msiexec.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI8CFF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6065437 16 ArixcelSetup!Arixcel.Explorer.Setup.CustomActions.CheckSystemRequirements

Source: Arixcel_Explorer_v8.7.8793.msi

Static file information: TRID: Microsoft Windows Installer (60509/1) 88.31%

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Arixcel_Explorer_v8.7.8793.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding F8241E459A5D63C6243CC8C18663CA0E C
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI8CFF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6065437 16 ArixcelSetup!Arixcel.Explorer.Setup.CustomActions.CheckSystemRequirements
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI8E86.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6065843 22 ArixcelSetup!Arixcel.Explorer.Setup.CustomActions.ResetAllUsers
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI905C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6066312 28 ArixcelSetup!Arixcel.Explorer.Setup.CustomActions.SetDefaultInstallFolders
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding F8241E459A5D63C6243CC8C18663CA0E C
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI8CFF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6065437 16 ArixcelSetup!Arixcel.Explorer.Setup.CustomActions.CheckSystemRequirements
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI8E86.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6065843 22 ArixcelSetup!Arixcel.Explorer.Setup.CustomActions.ResetAllUsers
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI905C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6066312 28 ArixcelSetup!Arixcel.Explorer.Setup.CustomActions.SetDefaultInstallFolders
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding C01FE4677FFB48E5645FF86B60FEF20B
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSIB910.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6076750 2 ArixcelSetup!Arixcel.Explorer.Setup.CustomActions.RenameExplorer3Registry
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSIBAF5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6077218 8 ArixcelSetup!Arixcel.Explorer.Setup.CustomActions.RegisterVbaAddin
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding C01FE4677FFB48E5645FF86B60FEF20B
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSIB910.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6076750 2 ArixcelSetup!Arixcel.Explorer.Setup.CustomActions.RenameExplorer3Registry
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSIBAF5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6077218 8 ArixcelSetup!Arixcel.Explorer.Setup.CustomActions.RegisterVbaAddin

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: riched20.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: usp10.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msls31.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cabinet.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88d96a05-f192-11d4-a65f-0040963251e5}\InProcServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File written: C:\Users\user\AppData\Local\assembly\tmp\ZDZO238B\__AssemblyInfo__.ini

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Checks if Microsoft Office is installed

Source: C:\Windows\SysWOW64\rundll32.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Excel\Options

Creates a software uninstall entry

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C22576F4-B0E1-4CB8-A237-B8F2C5DF3505}

PE / OLE file has a valid certificate

Source: Arixcel_Explorer_v8.7.8793.msi

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: Arixcel_Explorer_v8.7.8793.msi

Static file information: File size 2240512 > 1048576

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Persistence and Installation Behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Arixcel Explorer\Arixcel.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Arixcel Explorer\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Arixcel Explorer\System.Memory.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Arixcel Explorer\System.Threading.Channels.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Arixcel Explorer\System.Buffers.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Arixcel Explorer\Microsoft.Office.Tools.Common.v4.0.Utilities.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI8C71.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Arixcel Explorer\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI905C.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\MSI8CFF.tmp-\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Arixcel Explorer\Arixcel.Controls.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Arixcel Explorer\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Arixcel Explorer\log4net.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Arixcel Explorer\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\MSI8E86.tmp-\ArixcelSetup.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Arixcel Explorer\Aga.Controls.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Arixcel Explorer\Arixcel.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Arixcel Explorer\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Arixcel Explorer\System.Memory.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Arixcel Explorer\System.Buffers.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Arixcel Explorer\System.Threading.Channels.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Arixcel Explorer\Microsoft.Office.Tools.Common.v4.0.Utilities.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI8C71.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Arixcel Explorer\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI905C.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI8CFF.tmp-\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Arixcel Explorer\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Arixcel Explorer\Arixcel.Controls.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Arixcel Explorer\log4net.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Arixcel Explorer\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI8E86.tmp-\ArixcelSetup.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Arixcel Explorer\Aga.Controls.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Anti Debugging

Source: C:\Windows\SysWOW64\rundll32.exe

Memory allocated: page read and write | page guard

Language, Device and Operating System Detection

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MSI8CFF.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MSI8CFF.tmp-\ArixcelSetup.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MSI8E86.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MSI8E86.tmp-\ArixcelSetup.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MSI905C.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MSI905C.tmp-\ArixcelSetup.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Installer\MSIB910.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Installer\MSIB910.tmp-\ArixcelSetup.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Installer\MSIBAF5.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Installer\MSIBAF5.tmp-\ArixcelSetup.dll VolumeInformation

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	Windows Management Instrumentation	1 Windows Service	1 Windows Service	11 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Process Injection	1 Disable or Modify Tools	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	Security Account Manager	11 Peripheral Device Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 Process Injection	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	14 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Extra Window Memory Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Source	Detection	Scanner	Label	Link
Arixcel_Explorer_v8.7.8793.msi	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\MSI8C71.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI8CFF.tmp-\Microsoft.Deployment.WindowsInstaller.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI8E86.tmp-\ArixcelSetup.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI905C.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Arixcel Explorer\Aga.Controls.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Arixcel Explorer\Arixcel.Common.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Arixcel Explorer\Arixcel.Controls.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Arixcel Explorer\Microsoft.Office.Tools.Common.v4.0.Utilities.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Arixcel Explorer\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Arixcel Explorer\System.Buffers.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Arixcel Explorer\System.Memory.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Arixcel Explorer\System.Numerics.Vectors.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Arixcel Explorer\System.Runtime.CompilerServices.Unsafe.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Arixcel Explorer\System.Threading.Channels.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Arixcel Explorer\System.Threading.Tasks.Extensions.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Arixcel Explorer\log4net.dll	0%	ReversingLabs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.109.28.46	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.42.73.25	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.18.97.153	unknown	European Union	20940	AKAMAI-ASN1EU	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1445900
Start date and time:	2024-05-22 18:23:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	Arixcel_Explorer_v8.7.8793.msi
Detection:	CLEAN
Classification:	clean18.winMSI@17/47@0/5
Cookbook Comments:	Found application associated with file extension: .msi

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 52.109.28.46, 52.113.194.132, 2.18.97.153, 20.42.73.25
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: Arixcel_Explorer_v8.7.8793.msi

Created / dropped Files

C:\Config.Msi\5cb73b.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	13212
Entropy (8bit):	5.785527605783875
Encrypted:	false
SSDEEP:
MD5:	2BF7B634835B6252D3B35BBA342E762E
SHA1:	1A831E1541B53659B8963EBB553B89D71B4E030F
SHA-256:	8481D4665D3375281714260CA347B110157E7ED7CED234F90A52807FB73EA588
SHA-512:	AC5E2A39BEE716C798CC08748CD0514CC012D54FC431330040AE6525E746F00175D85B7A7EC96ADF77BA9478B6FE6CC7927BEE87567F93BBE8DEE51CD48B176E
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.b.X.@.....@.....@.....@.....@.....@......&.{C22576F4-B0E1-4CB8-A237-B8F2C5DF3505}..Arixcel Explorer 8.7..Arixcel_Explorer_v8.7.8793.msi.@.....@Y"...@.....@......arixcel.ico..&.{536F3CBA-F2A0-411E-AC41-4EE4C94EE2D8}.....@.....@.....@.....@.......@.....@.....@.......@......Arixcel Explorer 8.7......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{B3A90744-DCEB-59FB-9F0D-C6A0CEB2F0CA}&.{C22576F4-B0E1-4CB8-A237-B8F2C5DF3505}.@......&.{F8541F6E-59B7-517A-8AA0-05A6BEE218E5}&.{C22576F4-B0E1-4CB8-A237-B8F2C5DF3505}.@......&.{1A931256-68FD-5C0A-979E-B093D2036F91}&.{C22576F4-B0E1-4CB8-A237-B8F2C5DF3505}.@......&.{BBFD4F7D-EBFD-5CE7-992A-96CE43B046F2}&.{C22576F4-B0E1-4CB8-A237-B8F2C5DF3505}.@......&.{BB60335A-5CA8-5606-A68B-0D4E4AFA14C8}&.{C22576F4-B0E1-4CB8-A237-B8F2C5DF3505}.@......&.{1170262E-21F1-5322-B992-E212B692EEF2}&.{C22576F4-B0E1-4CB8-A237-B8F2C5DF3505}.@......&.{7DC3913F-0CF

C:\Users\user\AppData\Local\Arixcel Explorer\Aga.Controls.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	154112
Entropy (8bit):	6.096376548726116
Encrypted:	false
SSDEEP:
MD5:	DB3C32DCD0A7D75428276775A8970306
SHA1:	74C982CF68A092711F70E68E1FA4930960A5621E
SHA-256:	AB249705287659BF3C417FA83578E4154510BA22F16D3EE4FFF4830CEFBB937E
SHA-512:	83F1F3BD71B4B0F67FF6D9FAFDB41B108FBE2CB9DB57724D966C28AF0817FC621E7FAEF1AF1D194DDB083B6F43E4B5337EC4130B15A4E21B9F17D7B15D6762A6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0..R...........p... ........... ....................................`..................................p..O...................................Po............................................... ............... ..H............text....P... ...R.................. ..`.rsrc................T..............@..@.reloc...............X..............@..B.................p......H............1...........3..P;...n........................................(1...:.(1.....}......{......{....V.(2.....}......}......{-...6..(....o......{.......}..... .........} ....(2.....}......(....,.s3...z.0............{....o4...Z.{....o5...Z..........+N..+8...o6.........(7......X.....(8......X.....(9......X...X...{....o4...2...X...{....o5...2....0..j...........+5..+...%.X..(:.....{.......o;.....X...{....o4...2...X...{....o5...2..{....,..{.....{......o6...o<...*..

C:\Users\user\AppData\Local\Arixcel Explorer\Arixcel.Common.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	480768
Entropy (8bit):	5.983845132885013
Encrypted:	false
SSDEEP:
MD5:	7BC6349906F974579065699C8836CEFF
SHA1:	FF3589CE0FBFBBFB9CF70DD65F040E11F7D0A7C6
SHA-256:	ECBBB293AAEC4A2099B0EB87BC2B4FAD5756A70133668C056CE3115A3C9E1634
SHA-512:	26F6462F9E9CD45E16E37F36ABFCC27AF47FB731492DCA235AC4F3B434FE5E99CCB06FDE618E4B5B44C94FB94B333EACAF1BBFA412ED47CD36EC47F148AB6092
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0..L...........i... ........... ...............................f....`..................................i..O.......H...........................0h..8............................................ ............... ..H............text....K... ...L.................. ..`.rsrc...H............N..............@..@.reloc...............T..............@..B.................i......H.......<....y...........?...'...g........................................(G...^.(G..........%...}....:.(G.....}....:.(G.....}....^.(G..........%...}....:.(G.....}....:.(G.....}....:.(G.....}......{....:.(G.....}......{....:.(G.....}......{....:.(G.....}......{....:.(G.....}......{......{...."..}.....~............~...........j(....r...p(!...(....(H...>~....%-.&(.....~....%-.&.+.oI...%-.&(J...oK...sb....~............(&...o....*...0..G.......~...."..

C:\Users\user\AppData\Local\Arixcel Explorer\Arixcel.Controls.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60416
Entropy (8bit):	7.064201575562964
Encrypted:	false
SSDEEP:
MD5:	58D81630A0E9114ABE67E39A95C1314D
SHA1:	535E0384F46846ED7CBE1041DAD989FACB5D527E
SHA-256:	0B0EAF12AA84F398140D9640E4D8FF9C8FA40BC1B6CEC6408ACA63BC93044972
SHA-512:	02A31B2EAF0A127EFF3354396646889B413997550B96451420F11F1832B5C600608DC85261C068334BD1DA139306D3398D5A5402A6AAB4386EEBE82895CCEDE8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0.............j.... ... ....... .......................`......e.....`.....................................O.... ..\....................@..........8............................................ ............... ..H............text...p.... ...................... ..`.rsrc...\.... ......................@..@.reloc.......@......................@..B................K.......H........>..<I...............v............................................(....^.(.......X...%...}....:.(......}....:.(......}....:.(......}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}.......0..@.........(.......(......(....Z.(.......(......(....Zs....(.......( ....0..].........(!....o....9J....(........(.........(........(....+..(........(......(....k.Zi.Y...[...]..(".......(#...k.(........(....Zi...(".......($...k.(........(...

C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1149440
Entropy (8bit):	6.68949795451891
Encrypted:	false
SSDEEP:
MD5:	10FF4C798C1559E97B9B715268860780
SHA1:	1F655C2F99F2514B05410A7DD7C48762C8AFCC58
SHA-256:	27E492180E6E413E668CFCF3DE4B42EC471557EDF1851A842473A1AA25809FEE
SHA-512:	DAE2A0E7CE2336AD007A5FC5BCCA158B23D279D32762075E48F9E2B3CF439D6ADB34954093AE0D8A0DB86A666C81FD3F1418DD9BE63727BD4A07F8BAF0299DB3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0.............n.... ........... ....................................`.....................................O................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H.......xP...T..................d.........................................(M...^.(M......_...%...}....:.(M.....}....:.(M.....}....^.(M......`...%...}....:.(M.....}....:.(M.....}....:.(M.....}......{....:.(M.....}......{....:.(M.....}......{....:.(M.....}......{......{......{....>..}......}.....0...........(N...,.r...psO...z...a...%.r7..p.(P.........(...+-.r;..p.re..p(R...sO...z..}.....\|......).....i.11....(S.....(T...-.ri..p...(U...sO...z..sV...}....*....0..

C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.dll.config

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	650
Entropy (8bit):	5.0893178747806695
Encrypted:	false
SSDEEP:
MD5:	71B73270EB64849E15A0F0BF2C6BC166
SHA1:	2F944FCAA3038096E1B3668D74CC6E76F014955A
SHA-256:	0D14F3205CBE608A32EBA359F5709A3B1FC9580D1EE1D3FABA439AC5DDFCEAE1
SHA-512:	494EB5583E4C046875052EC4D0194B20C8032BC064CBABD354402E9145FB5C0A28F83A05308087C96C5BFD383911AB2D8DE89FEBA553E1AD5C178F7C339486F8
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>.<configuration>. <runtime>. <enforceFIPSPolicy enabled="false"/>. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">. <dependentAssembly>. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral"/>. <bindingRedirect oldVersion="0.0.0.0-12.0.0.0" newVersion="12.0.0.0"/>. </dependentAssembly>. </assemblyBinding>. </runtime>. <appSettings>. <add key="EnableWindowsFormsHighDpiAutoResizing" value="true"/>. </appSettings> .<startup><supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.7.2"/></startup></configuration>.

C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.dll.manifest

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (9465), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	70423
Entropy (8bit):	5.620036402328506
Encrypted:	false
SSDEEP:
MD5:	0585429C9B3622983FEE7A9B1FE24065
SHA1:	4CC54BC2BDAABCFE844EB481765700CA599F334D
SHA-256:	FCAF8393A8AF59FB7103B4C745EF1A2CADA5AEC92F80258B78FA9E11E6829202
SHA-512:	5F89B9A41D340F308C3CAABC58C2F55335DCC61E060C3122406F4FA99A16AE50247F14BD4BABDF294189B555784A6A0759D0739503A46ED5E78E3EE30F5C7931
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <asmv1:assemblyIdentity name="ArixcelExplorer.dll" version="8.7.0.0" publicKeyToken="60a47f33649ac2db" language="neutral" processorArchitecture="msil" type="win32" />.. <description xmlns="urn:schemas-microsoft-com:asm.v1">Arixcel Explorer is a formula analysis add-in for Excel.</description>.. <application />.. <entryPoint>.. <co.v1:customHostSpecified />.. </entryPoint>.. <trustInfo>.. <security>.. <applicationRequestMinimum>..

C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.log4net

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	622
Entropy (8bit):	4.622492348319434
Encrypted:	false
SSDEEP:
MD5:	17C91EA909D1CC3034783BF20BEEFC2D
SHA1:	B9FAB578D8415209214A807AE24454ED23C27CC5
SHA-256:	EF41A3436C716905ACAEA64F57F34DC49668F03A398DEC7C10333CFFC6109B72
SHA-512:	E626A9FDB9D8A7CE54C5275AC39C2DD6B706CFC65485EAF55CCACB63BCD2C50092313FFA818E4E8344FE19C17ED145FA2335602957C0B48C4EF6C4E1BF624804
Malicious:	false
Reputation:	unknown
Preview:	<log4net>. <appender name="RollingFile" type="log4net.Appender.RollingFileAppender">. <file value="${TEMP}\ArixcelExplorer.log" />. <encoding value="utf-8" />. <appendToFile value="true" />. <maximumFileSize value="2MB" />. <rollingStyle value="Size" />. <maxSizeRollBackups value="1" />. <layout type="log4net.Layout.PatternLayout">. <conversionPattern value="%date %-5level %logger - %message%newline %exception" />. </layout>. </appender>. <root>. <level value="INFO" />. <appender-ref ref="RollingFile" />. </root>.</log4net>

C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.vsto

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (9494), with CRLF line terminators
Category:	dropped
Size (bytes):	19770
Entropy (8bit):	6.1170297565125615
Encrypted:	false
SSDEEP:
MD5:	B12A6FB328E52987242D315011F50A20
SHA1:	FA95B14977CE6BCC130C745EBEF49FBF9EEB25B8
SHA-256:	158D12B6BC1FDEECE196CDCD89817F41D53BEC3409C93494FE4C0B7CDAA46928
SHA-512:	C81CD4D642BB997A0252554E3F26CBECCDF7784927A10C874F91BFC460F9D9A738C361607E60AF0F2F516AE0ACD41B1A7E1E723A54AFEAADB2B5BF198A39948D
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xrml="urn:mpeg:mpeg21:2003:01-REL-R-NS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <assemblyIdentity name="ArixcelExplorer.vsto" version="8.7.0.0" publicKeyToken="60a47f33649ac2db" language="neutral" processorArchitecture="msil" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <description asmv2:publisher="ArixcelExplorer" asmv2:product="ArixcelExplorer" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <deployment install="false" />.. <dependency>.. <dependentAssembly dependencyTyp

C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.xlam

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	47521
Entropy (8bit):	7.827570152744385
Encrypted:	false
SSDEEP:
MD5:	F28F5450F58DB67D3C8B4ECA5073B510
SHA1:	93F93332DD371EEE059BF067B58E6520D68D533C
SHA-256:	F57DE678FE332BD2E287E5103643E3340BAB59FBD236182A0CF09F2D345B41F4
SHA-512:	2BEA0C31CEED4EA1B0CD841C61F383F2C925BAFCE089227507C0E1ADA6ED913D1C12DCDD2C7AC52B6117A82F381B9B3FE7B607A6C020854C8771F8DF4835C6CC
Malicious:	false
Reputation:	unknown
Preview:	PK..........!..T..............[Content_Types].xml ...(...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Qo.0...'.;D~...M.D...{.V...}...l....lh.M@(.%.$....l.n.)V.v.dW\|....)m.%...e..!.U`..m0....7..M...h.JV..\|."..k..5h....."..s.\.........F.q......p.K...5..u2.......d.4FK.dT...u...LK.)<x..edb..G.:...<........MxG9. .7....S..VX<........./..-.q.]..h8(Z!^...... ...}vx....D.]....0.+'.5. ..GPY.6<e..;\|D.&(..r.Y.....`.9.h.....1z:P..x......".].....;,x-.;. .J.+0K\|...v.)D..q..E...P...e.g..{d.yJ. ..n}..,...`.mE........S/.....*'-.N.........^....D

C:\Users\user\AppData\Local\Arixcel Explorer\Microsoft.Office.Tools.Common.v4.0.Utilities.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32664
Entropy (8bit):	6.067183560016906
Encrypted:	false
SSDEEP:
MD5:	090635087D067BCEF8056D5751F2D0C4
SHA1:	0AD9C2B6C79A3327D138819ED0435D18EE9AAC78
SHA-256:	8CB09317C326E9B0F83C337EAE7CCDEAAD3E45E5DA3603E1EBC90C5A06AD1702
SHA-512:	41F3075E362710FFCEB088623967A795E58E632BB48B237A38AB2BB443B06900BC3C9A77CEB3B9379AFEF5BE0C2F90BDE8161B2A3264F0C7DD089BA569403DDC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#..K...........!.....X..........nv... ........... ..............................,x....@..................................v..O.......d............h..............tu............................................... ............... ..H............text...tV... ...X.................. ..`.rsrc...d............Z..............@..@.reloc...............f..............@..B................Pv......H....... &..TO..................P .......................................2...B..5....vO{:R.G.._(P%+.....\|cn.A..@.E.#.....w.....?o......."[......6...\|..z...:,.L.......A..\|.T^k.A....R-...N.......(/............o~...}......{....op...}......{....v.{....ox.....o....u.........2.{....ov...2.{....ow...2.{....ox...6.{.....or...6.{.....os...6.{.....ot...6.{.....ou...2.{....on...2.{....oe...2.{....of...2.{....oo...2.{....ok...2.{....oi...2.{....oj...*2.{....om...

C:\Users\user\AppData\Local\Arixcel Explorer\Newtonsoft.Json.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	711952
Entropy (8bit):	5.96669864901384
Encrypted:	false
SSDEEP:
MD5:	715A1FBEE4665E99E859EDA667FE8034
SHA1:	E13C6E4210043C4976DCDC447EA2B32854F70CC6
SHA-256:	C5C83BBC1741BE6FF4C490C0AEE34C162945423EC577C646538B2D21CE13199E
SHA-512:	BF9744CCB20F8205B2DE39DBE79D34497B4D5C19B353D0F95E87EA7EF7FA1784AEA87E10EFCEF11E4C90451EAA47A379204EB0533AA3018E378DD3511CE0E8AD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...D.}..........." ..0.................. ........... ....................... ............`.....................................O......................../.............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......d....9..................h.........................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Users\user\AppData\Local\Arixcel Explorer\System.Buffers.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20856
Entropy (8bit):	6.425485073687783
Encrypted:	false
SSDEEP:
MD5:	ECDFE8EDE869D2CCC6BF99981EA96400
SHA1:	2F410A0396BC148ED533AD49B6415FB58DD4D641
SHA-256:	ACCCCFBE45D9F08FFEED9916E37B33E98C65BE012CFFF6E7FA7B67210CE1FEFB
SHA-512:	5FC7FEE5C25CB2EEE19737068968E00A00961C257271B420F594E5A0DA0559502D04EE6BA2D8D2AAD77F3769622F6743A5EE8DAE23F8F993F33FB09ED8DB2741
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..$..........BC... ...`....... ....................................@..................................B..O....`..@...............x#...........A............................................... ............... ..H............text...H#... ...$.................. ..`.rsrc...@....`.......&..............@..@.reloc...............,..............@..B................$C......H........'...............?..X...8A......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(.....~....2r...p.(....B.....(.........R.....(...+%-.&(!...^.....("....(...+&~.....s$..."..s%.....(&........0......................

C:\Users\user\AppData\Local\Arixcel Explorer\System.Memory.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	142240
Entropy (8bit):	6.142019016866883
Encrypted:	false
SSDEEP:
MD5:	F09441A1EE47FB3E6571A3A448E05BAF
SHA1:	3C5C5DF5F8F8DB3F0A35C5ED8D357313A54E3CDE
SHA-256:	BF3FB84664F4097F1A8A9BC71A51DCF8CF1A905D4080A4D290DA1730866E856F
SHA-512:	0199AE0633BCCFEAEFBB5AED20832A4379C7AD73461D41A9DA3D6DC044093CC319670E67C4EFBF830308CBD9A48FB40D4A6C7E472DCC42EB745C6BA813E8E7C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6wb.........." ..0.................. ... ....... .......................`.......>....@.................................`...O.... ..@................'...@......(................................................ ............... ..H............text........ ...................... ..`.rsrc...@.... ......................@..@.reloc.......@......................@..B........................H........,................................................................('...>..}......}......{......{......{.....{....3..{.....{....((......0...........%.u....,..........(.....z.{....%-.&.+.o)....{....(a.....(....zN........o...s+....(....z.s,.....(....zF(U....(O...s-....(....z.(V...s-....(....z.s.....(....z.s/.....(....zN........o...s0....(....zrr...p(\....c.K...(O...s1....(....zBr...p(Y...s1....(....z.s2....(....z.(X...s3....(!...z.(_...s3...*.(#...z

C:\Users\user\AppData\Local\Arixcel Explorer\System.Numerics.Vectors.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	115856
Entropy (8bit):	5.631610124521223
Encrypted:	false
SSDEEP:
MD5:	AAA2CBF14E06E9D3586D8A4ED455DB33
SHA1:	3D216458740AD5CB05BC5F7C3491CDE44A1E5DF0
SHA-256:	1D3EF8698281E7CF7371D1554AFEF5872B39F96C26DA772210A33DA041BA1183
SHA-512:	0B14A039CA67982794A2BB69974EF04A7FBEE3686D7364F8F4DB70EA6259D29640CBB83D5B544D92FA1D3676C7619CD580FF45671A2BB4753ED8B383597C6DA8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.Z.........." ..0..v............... ........... ..............................DF....@.................................f...O........................>.......................................................... ............... ..H............text....u... ...v.................. ..`.rsrc................x..............@..@.reloc..............................@..B........................H........Q..\|?..........$... ...D.........................................(....&.l(....k&.l(....k..l.l(....k..l.l(....k&.l(....k&.l(....k&.l(....kj~....%-.&(....s....%........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(.....~....2r...p.(....2rG..p.(....2r...p.(....*2r...p.(.

C:\Users\user\AppData\Local\Arixcel Explorer\System.Runtime.CompilerServices.Unsafe.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16768
Entropy (8bit):	6.361391591273708
Encrypted:	false
SSDEEP:
MD5:	DA04A75DDC22118ED24E0B53E474805A
SHA1:	2D68C648A6A6371B6046E6C3AF09128230E0AD32
SHA-256:	66409F670315AFE8610F17A4D3A1EE52D72B6A46C544CEC97544E8385F90AD74
SHA-512:	26AF01CA25E921465F477A0E1499EDC9E0AC26C23908E5E9B97D3AFD60F3308BFBF2C8CA89EA21878454CD88A1CDDD2F2F0172A6E1E87EF33C56CD7A8D16E9C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^...........!................^2... ...@....@.. ...............................y....@..................................2..S....@...................#...`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@2......H........#..@...................P ......................................{.v.`)!.t..@.62C<.=...h....X..}.`v.r...g.e...yXa.dat.mwQ.XdJ...M..`..J...$\|.j.6W.U.3.r.A.h.....9Q..\|..,<g..gy..6V9o%..Gd.r.0...........q......0..............q.......0..............q.......0..................0......................0......................0............q.............0............q.............0..............0..................0..................0..................0..........

C:\Users\user\AppData\Local\Arixcel Explorer\System.Threading.Channels.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	53904
Entropy (8bit):	6.328404491602846
Encrypted:	false
SSDEEP:
MD5:	59436C9E3EDF074ACFB2C32C58D0C28C
SHA1:	8ECBB9D024C6B54F1D13EFE4C4AFFF3286992CAE
SHA-256:	4AAF175D1823A14899931C6257B7D0C1479F18FD3C1A5D30551786F900D41C5C
SHA-512:	A4E846FAE51AC3DAF89DCA2B122B4F761A5A2FF0ED5A6E619D465115EB8328811C1BAAB41A0A1F10ED177ACAA56EFA2BDD2F91E93B244AA5FDB09FE4E90F5DE9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............z.... ........... ...............................4....`.................................'...O........................(..........<...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................[.......H........R..(f...........................................................(%...^.(%......L...%...}....:.(%.....}....:.(%.....}....:.(%.....}....:.(%.....}.....~......0..........(....,....(.....o&......&......................0...........(.......('...-..,....(....,.r...p......%...%...((.....()....(....,.r...p......%...%...%...((......(....(....,!r...p......%...%...%...%...((.......(+.....,&(....,..r...pr...p.((...(,.....(-....*.(....,.r...p......%...%...((..

C:\Users\user\AppData\Local\Arixcel Explorer\System.Threading.Tasks.Extensions.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25984
Entropy (8bit):	6.291520154015514
Encrypted:	false
SSDEEP:
MD5:	E1E9D7D46E5CD9525C5927DC98D9ECC7
SHA1:	2242627282F9E07E37B274EA36FAC2D3CD9C9110
SHA-256:	4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
SHA-512:	DA7AB8C0100E7D074F0E680B28D241940733860DFBDC5B8C78428B76E807F27E44D1C5EC95EE80C0B5098E8C5D5DA4D48BCE86800164F9734A05035220C3FF11
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ....................................@..................................V..O....`...............B...#..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(......(....z..(....z2.(....s....2.(....s....:........o.....~....~.-..(......}......}......}....~.-..(......}......}......}....Z..}......}......}....J.{....%-.&.o....^.u....,........(.....~.{.....{....3..{.....{.......&...(....2...(...........0..'........{......,..u....%-.&..(...+(....(....n.{....,..(....s.....q......0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

C:\Users\user\AppData\Local\Arixcel Explorer\log4net.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	5.596191661109029
Encrypted:	false
SSDEEP:
MD5:	46319A38CE5D09020D2AC56B67829C6C
SHA1:	FFE64CA4D4BC9E1DAB1D195982D22121A6BAA058
SHA-256:	1D45A6AFA38F0B10814063F2A42E6EFCE45752853667650E765844B8566B3332
SHA-512:	0DE61771A92EE71470E51BCCF66D3A39C105AE23D60E73D8E4E7D44135DFF4C8D1DDDFF9BBB6BE72FF083D51C784E5CA829A6ADEFEE87FD901D2DE58DB0DDB03
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....O..........." ..0...... ........... ... ....... .......................`...........`.....................................O.... .......................@......\|................................................ ............... ..H............text...(.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1D601E47.tmp (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	F28F5450F58DB67D3C8B4ECA5073B510
SHA1:	93F93332DD371EEE059BF067B58E6520D68D533C
SHA-256:	F57DE678FE332BD2E287E5103643E3340BAB59FBD236182A0CF09F2D345B41F4
SHA-512:	2BEA0C31CEED4EA1B0CD841C61F383F2C925BAFCE089227507C0E1ADA6ED913D1C12DCDD2C7AC52B6117A82F381B9B3FE7B607A6C020854C8771F8DF4835C6CC
Malicious:	false
Reputation:	unknown
Preview:	PK..........!..T..............[Content_Types].xml ...(...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Qo.0...'.;D~...M.D...{.V...}...l....lh.M@(.%.$....l.n.)V.v.dW\|....)m.%...e..!.U`..m0....7..M...h.JV..\|."..k..5h....."..s.\.........F.q......p.K...5..u2.......d.4FK.dT...u...LK.)<x..edb..G.:...<........MxG9. .7....S..VX<........./..-.q.]..h8(Z!^...... ...}vx....D.]....0.+'.5. ..GPY.6<e..;\|D.&(..r.Y.....`.9.h.....1z:P..x......".].....;,x-.;. .J.+0K\|...v.)D..q..E...P...e.g..{d.yJ. ..n}..,...`.mE........S/.....*'-.N.........^....D

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\6O27WT20.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	3.757684233944689
Encrypted:	false
SSDEEP:
MD5:	B25126F1158AFE2D90A0C14108298102
SHA1:	18186C4989920AC2FF75BE7EC635B25AA9C6D765
SHA-256:	E0A6D67593094424816B0AE3AE1382CD1F9CE68F972853C9785EE9B7CCE49951
SHA-512:	4139582F95C09CEE33DF2581E03807F2C3A04D1F0070725F7E82C3CD2CD1DB5DF6188AF92E9F971BF5BB171258369DFAFD940CDA1A00CE721AEEBEB3DFBE48C4
Malicious:	false
Reputation:	unknown
Preview:	..P.L.A.T.F.O.R.M. .V.E.R.S.I.O.N. .I.N.F.O.......W.i.n.d.o.w.s. .......:. .1.0...0...1.9.0.4.5...0. .(.W.i.n.3.2.N.T.).......C.o.m.m.o.n. .L.a.n.g.u.a.g.e. .R.u.n.t.i.m.e. ...:. .4...0...3.0.3.1.9...4.2.0.0.0.......S.y.s.t.e.m...D.e.p.l.o.y.m.e.n.t...d.l.l. .....:. .4...8...4.6.5.4...0. .b.u.i.l.t. .b.y.:. .N.E.T.4.8.R.E.L.1.L.A.S.T._.B.......c.l.r...d.l.l. .......:. .4...8...4.6.4.5...0. .b.u.i.l.t. .b.y.:. .N.E.T.4.8.R.E.L.1.L.A.S.T._.B.......d.f.d.l.l...d.l.l. .......:. .4...8...4.6.5.4...0. .b.u.i.l.t. .b.y.:. .N.E.T.4.8.R.E.L.1.L.A.S.T._.B.......d.f.s.h.i.m...d.l.l. .......:. .1.0...0...1.9.0.4.1...3.0.0.0.0. .(.W.i.n.B.u.i.l.d...1.6.0.1.0.1...0.8.0.0.).........S.O.U.R.C.E.S.......D.e.p.l.o.y.m.e.n.t. .u.r.l.......:. .f.i.l.e.:./././.C.:./.U.s.e.r.s./.c.a.l.i./.A.p.p.D.a.t.a./.L.o.c.a.l./.A.r.i.x.c.e.l.%.2.0.E.x.p.l.o.r.e.r./.A.r.i.x.c.e.l.E.x.p.l.o.r.e.r...v.s.t.o.......A.p.p.l.i.c.a.t.i.o.n. .u.r.l.......:. .f.i.l.e.:./././.C.:./.U.s.e.r.s./.c.a.l.i./.A.p.p.D.a.t.a./.L.o.c.a.l.

C:\Users\user\AppData\Local\Temp\ArixcelExplorer.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1599
Entropy (8bit):	5.184742958201135
Encrypted:	false
SSDEEP:
MD5:	8ACF2CD7C22660A966EC93E9EF0BE032
SHA1:	FD7FF4304B1B5893E4A5FEC7799D48DF5886EF2D
SHA-256:	1D1059D5C447DBD766292B7FC7222938658899C654CBB69240A287EAA49DD900
SHA-512:	99FAC5D5AD1CCBC8BA50A575B1CCD23F33E3DC3F8CF82DBF67B5CE94820540A888EA641B5225035C64ED7A576F62D0CDBB55E471244EAE17D453F6EC4384600D
Malicious:	false
Reputation:	unknown
Preview:	.2024-05-22 12:24:13,090 INFO Arixcel.Explorer.App - ... Logging initialized.. 2024-05-22 12:24:13,106 INFO Arixcel.Explorer.App - Arixcel Explorer 8.7.8793.. 2024-05-22 12:24:13,106 INFO Arixcel.Explorer.App - OS version: Microsoft Windows NT 10.0.19045.2006.. 2024-05-22 12:24:13,106 INFO Arixcel.Explorer.App - Process: 32 bit.. 2024-05-22 12:24:13,106 INFO Arixcel.Explorer.App - .NET Framework: 4.8.04084, release 528372.. 2024-05-22 12:24:13,106 INFO Arixcel.Explorer.App - VSTO: HKLM32:v4: 10.0.60910.. 2024-05-22 12:24:13,106 INFO Arixcel.Explorer.App - Excel version: 16.0.16827.20130 (32 bit).. 2024-05-22 12:24:13,106 INFO Arixcel.Explorer.App - Excel language: en-US, different formulas: False.. 2024-05-22 12:24:13,106 INFO Arixcel.Explorer.App - Current culture: en-CH, UI culture: en-GB.. 2024-05-22 12:24:13,106 INFO Arixcel.Explorer.App - Machine Id: 284ED21B.. 2024-05-22 12:24:13,186 INFO Arixcel.Common.BackgroundService.QueuedHostedService - Background service is ru

C:\Users\user\AppData\Local\Temp\MSI8C71.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	156888
Entropy (8bit):	6.031305225900342
Encrypted:	false
SSDEEP:
MD5:	C90F51E8F8C547CE8A48C22ECDCF5304
SHA1:	B7A5831E3678693EBB254B5720A58020C0772551
SHA-256:	226F3E224BFC7D77AFFF0F3D9048D1727EEA7AA5E2E443F8CC55BAA7DC5C6473
SHA-512:	AE667B38251F4EC2062A42F8238AC8391A2AED0A2833A5320D3B296347A689E59A4F442ADD547B6A202AEA4DDCAB16E3DB823452E18714C69585EFED0C4E9903
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......cJ.'+..'+..'+....k.6+....h.!+....h.&+....i..+....h.T+...S%.$+...S5.>+..'+...+....i.1+....l.&+....o.&+..'+1.&+....j.&+..Rich'+..........PE..L.....U...........!.....J..........F........`......................................................................p...E............@...............H.......P..@...................................H...@............`...............................text....I.......J.................. ..`.rdata.......`.......N..............@..@.data...t2..........................@....rsrc........@......................@..@.reloc...K...P...L..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI8CFF.tmp-\CustomAction.config

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1500
Entropy (8bit):	4.7443746690988435
Encrypted:	false
SSDEEP:
MD5:	82FACDCE498CD0F186C355760C5CF0EC
SHA1:	EEA81CE69BE03DF9B8670FC8B4DE53BEBC5E7972
SHA-256:	B46DB7ED88826F9D30C4DBDA37BA5C021C94A16A144FF889E1D5BBD77B0B0D71
SHA-512:	062736405F51D957BFD206618E755E02E3129826C70F6DB179FD77EB4E893016515162F8EDB4AFF4480B99C836C302344311CADE58010F06FF863E928EE03A2E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.... .. Use supportedRuntime tags to explicitly specify the version(s) of the .NET Framework runtime that.. the custom action should run on. If no versions are specified, the chosen version of the runtime.. will be the "best" match to what Microsoft.Deployment.WindowsInstaller.dll was built against..... WARNING: leaving the version unspecified is dangerous as it introduces a risk of compatibility.. problems with future versions of the .NET Framework runtime. It is highly recommended that you specify.. only the version(s) of the .NET Framework runtime that you have tested against..... Note for .NET Framework v3.0 and v3.5, the runtime version is still v2.0..... In order to enable .NET Framework version 2.0 runtime activation policy, which is to load all assemblies.. by using the latest

C:\Users\user\AppData\Local\Temp\MSI8CFF.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	183904
Entropy (8bit):	5.879610839431918
Encrypted:	false
SSDEEP:
MD5:	C591EF33FEAD6C99DDB6A3138E8BC58F
SHA1:	C2E9E64C542A3C9DC44AFDF688161C3BD25C83D6
SHA-256:	F0BAB56DA3E3D1793668AD6A5C3A1117A07ACB0997C095BA41C7FB0D9C793E7E
SHA-512:	A19321CCEACA1F43253B5E6C8E3D0BFC4862615510D5B92B8356B64B12B0F73E6DA1E7215156D55BD2D3E662B866F52BB6FD14A250E7A39DFDA69027928380FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....RKa.........." ..0...... ......z.... ........... ...............................L....@.................................(...O.......................`........................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI8E86.tmp-\ArixcelSetup.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.174522385270341
Encrypted:	false
SSDEEP:
MD5:	CC13F1F1DD28EBF8137D8181808C0F21
SHA1:	A197426D3AE90769ABD896FB1D32C8AC89A865D0
SHA-256:	C4ADFC8268A54653057340E416A199A950EDC1D006F740A8F6048F4AAB2C64C2
SHA-512:	5A842BDC64372B0229164273E10E9384F46F1E050DC50793A004F4A609BDFF2A81DDF19ABE0C53140E9CCEC9FD3019F41BE7A599ACD075E3508C290C2A899EC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0..2...........Q... ...`....... ..............................Q/....`..................................P..O....`..@............................O............................................... ............... ..H............text... 1... ...2.................. ..`.rsrc...@....`.......4..............@..@.reloc...............:..............@..B.................P......H.......\|+...#...................N........................................(....:.(......}...........%. .... ....(.....%. .... ....(.......0............... t...s....}....(.......+>...r...po......,).rO..po......(....-..rU..po......(....,...X....i2.r]..p.{....(....rR..p(....s....z...0..8........,3.r...po......,$.o....(....-..o....s.....{....(.......~....%-.&~..........s....%.....r...p(......~....%-.&~...... ...s....%.....rK..p(.....0..*.......s!......}.....{......."...s.

C:\Users\user\AppData\Local\Temp\MSI905C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
Category:	dropped
Size (bytes):	258045
Entropy (8bit):	6.256870163299765
Encrypted:	false
SSDEEP:
MD5:	AB1CCA3723B0803C7BB01D9761169B95
SHA1:	55BAAB5F8EF24554FA2C63DE6DA342609AE9975A
SHA-256:	5CBCBA474881F712C84244AE00EB903C3ED4AE8ED870BD6034F9D78D516B1016
SHA-512:	38E75A3ABE48BDDD9CD51C001C2AABFA43C37D27EE73405B26A4333D57B3022A268DF003971AACA289CD8E8D737D137AC75E5565376133A31A29582FFB61C94C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........j.h.j.h.j.h...k.`.h...m..h...l.x.h.8.l.z.h.8.k.{.h.8.m.K.h...i.a.h.j.i..h...m.m.h...h.k.h....k.h.j...k.h...j.k.h.Richj.h.........PE..L....RKa...........!.....P...\|.......M.......`............................................@.........................`}...*..(...x...............................,... s..T...........................xs..@............`..d............................text....O.......P.................. ..`.rdata...Q...`...R...T..............@..@.data...............................@....rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF1BF63C73D47F646D.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.051180922408337
Encrypted:	false
SSDEEP:
MD5:	4F5EB3E0A7C1F6C39C2D6E2A839B6650
SHA1:	F80307D98C4391266A018CB4FB8AC5C352EFF36E
SHA-256:	23F7C55F7F5BC88A6EEED81E6FD4C7281C7938273A405540FC1AB4164B819A39
SHA-512:	4EA614DB6ACE7D711259EA8578C00DA07CA5B4C1A2B313A17D48D0BF856EEEC7692B223355C8EDF06B5CB2F73E73BAFF167E2462F93C62417793CBF610005F2F
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFD2AA41CFBB79474C.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	3.9940426594581613
Encrypted:	false
SSDEEP:
MD5:	A09F945CA676A09EF2E560D92B9E5DDE
SHA1:	05C69054FDDF03A8E84D4CF0E9780071A8958386
SHA-256:	73CC88F294B649CA0DAF75C29A2EFE7A9CF3C15861FBED775781753464F79DB6
SHA-512:	B499BAECED33A82BCB594446ABE8ABD753F99DF88AB01E6FF405C10170E272995903170FC6F1935993503513966BEB4ADF36BFD77AEC23403A783C42F22CF910
Malicious:	false
Reputation:	unknown
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%...-....................... ...!..."...#...$.......&...'...(...)...*...+...,...........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\assembly\tmp\2YQK1WIO\AssemblyInfo.ini

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	3.382619857626537
Encrypted:	false
SSDEEP:
MD5:	4A58AABA7098BB8E9DC973C8BD242CD6
SHA1:	BD17A10CF4D51C39E9FDB88293A098CBF8D7A7A4
SHA-256:	B9C09387D1FDC637A3E3F4645C1EF84B51D1CD3EB90ACB98563C37C9B443D590
SHA-512:	F36B36B05D9B6A115FDF75CDFD9669EC800673F187F7537700194BFCB60F58F5B4565AE698D27C204768D2C835512C22EC1AAB0DF1E821BD2AF7027DB160FC3A
Malicious:	false
Reputation:	unknown
Preview:	A.r.i.x.c.e.l...C.o.m.m.o.n.,.8...7...8.7.9.3...3.6.3.5.1.,.,.7.b.5.1.c.7.c.c.3.e.c.f.8.4.0.d...f.i.l.e.:./././.C.:./.U.s.e.r.s./.c.a.l.i./.A.p.p.D.a.t.a./.L.o.c.a.l./.A.r.i.x.c.e.l. .E.x.p.l.o.r.e.r./.A.r.i.x.c.e.l...C.o.m.m.o.n...D.L.L...

C:\Users\user\AppData\Local\assembly\tmp\9WIRSJYC\AssemblyInfo.ini

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	348
Entropy (8bit):	3.352718136566885
Encrypted:	false
SSDEEP:
MD5:	9F8A550A8601C373C08F451D952C0601
SHA1:	51B888EBB6DE4A64170E3BDF7F8A21CA9FD9C3BD
SHA-256:	7174CB5F752A6DDCE020575959460D18FF32BE4935598E2E1C2040DE8B614CB2
SHA-512:	136F567445F089FC0829AEAFC91E1B615C3221EE1B6A63E801D01D103522667DF41544B52AE7C2CE775C9EA91A4C5E4AA96D41C9956F85342B18C2935D46391C
Malicious:	false
Reputation:	unknown
Preview:	M.i.c.r.o.s.o.f.t...O.f.f.i.c.e...T.o.o.l.s...C.o.m.m.o.n...v.4...0...U.t.i.l.i.t.i.e.s.,.1.0...0...0...0.,.,.b.0.3.f.5.f.7.f.1.1.d.5.0.a.3.a...f.i.l.e.:./././.C.:./.U.s.e.r.s./.c.a.l.i./.A.p.p.D.a.t.a./.L.o.c.a.l./.A.r.i.x.c.e.l. .E.x.p.l.o.r.e.r./.M.i.c.r.o.s.o.f.t...O.f.f.i.c.e...T.o.o.l.s...C.o.m.m.o.n...v.4...0...U.t.i.l.i.t.i.e.s...D.L.L...

C:\Users\user\AppData\Local\assembly\tmp\FNYW4YDD\AssemblyInfo.ini

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	270
Entropy (8bit):	3.4239518422616997
Encrypted:	false
SSDEEP:
MD5:	828F819DD6241F2FC6E4D87EA8100FB5
SHA1:	A88A59A181D7A926F9767AFDBF7FC3E167B8B883
SHA-256:	7ADC8E946569FC09CDF5C6BBDE548DD41F66489FDF39047C1720E0BCC8AEC271
SHA-512:	BA57934E53D5D594892548FB0EC1EC0506613C037C0A55B07CAB86C9CECCEFBCA40E711F695459FA4E5D0C21E23982E68FEAB14E1FE93EBADCE47821917C778F
Malicious:	false
Reputation:	unknown
Preview:	S.y.s.t.e.m...T.h.r.e.a.d.i.n.g...C.h.a.n.n.e.l.s.,.7...0...0...0.,.,.c.c.7.b.1.3.f.f.c.d.2.d.d.d.5.1...f.i.l.e.:./././.C.:./.U.s.e.r.s./.c.a.l.i./.A.p.p.D.a.t.a./.L.o.c.a.l./.A.r.i.x.c.e.l. .E.x.p.l.o.r.e.r./.S.y.s.t.e.m...T.h.r.e.a.d.i.n.g...C.h.a.n.n.e.l.s...D.L.L...

C:\Users\user\AppData\Local\assembly\tmp\HWC6L5O8\AssemblyInfo.ini

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	322
Entropy (8bit):	3.411196688630613
Encrypted:	false
SSDEEP:
MD5:	B7541983F65D346C5FA3B2B589D2A54B
SHA1:	933193805146AA93BBAB0F84211C95E940D6469E
SHA-256:	DF3249BB9C947BA691063D61D2F306038D9319E99D544FAD32699E107B0103BD
SHA-512:	9854308E3B5FBB2DD934915014290A9F0C712A8BCF54255B975B7FD8E6D6C149E961640B3FBDEF098B25F69A3AC5AFB15DC798E2F56B2C71D69DA7CCF6727BCB
Malicious:	false
Reputation:	unknown
Preview:	S.y.s.t.e.m...R.u.n.t.i.m.e...C.o.m.p.i.l.e.r.S.e.r.v.i.c.e.s...U.n.s.a.f.e.,.4...0...4...1.,.,.b.0.3.f.5.f.7.f.1.1.d.5.0.a.3.a...f.i.l.e.:./././.C.:./.U.s.e.r.s./.c.a.l.i./.A.p.p.D.a.t.a./.L.o.c.a.l./.A.r.i.x.c.e.l. .E.x.p.l.o.r.e.r./.S.y.s.t.e.m...R.u.n.t.i.m.e...C.o.m.p.i.l.e.r.S.e.r.v.i.c.e.s...U.n.s.a.f.e...D.L.L...

C:\Users\user\AppData\Local\assembly\tmp\OCUJWGU0\AssemblyInfo.ini

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.3628289142077143
Encrypted:	false
SSDEEP:
MD5:	DD2960F7835EE55FC030061DC74242A4
SHA1:	23D754E0C89849E66C555CEB9CD2B2937481D58B
SHA-256:	3F0C6576755AD5576D56675F9939DD73FECB0E0987ACE48C1BF97C981501F1E9
SHA-512:	22DC6528D96D65D711429E9C77A83994AD54405EDE9C63E291F18889528A433C9B660CA54427D039867F1DC9AA234115EB73D4294413A2C82F7BB2EB86F428A9
Malicious:	false
Reputation:	unknown
Preview:	N.e.w.t.o.n.s.o.f.t...J.s.o.n.,.1.3...0...0...0.,.,.3.0.a.d.4.f.e.6.b.2.a.6.a.e.e.d...f.i.l.e.:./././.C.:./.U.s.e.r.s./.c.a.l.i./.A.p.p.D.a.t.a./.L.o.c.a.l./.A.r.i.x.c.e.l. .E.x.p.l.o.r.e.r./.N.e.w.t.o.n.s.o.f.t...J.s.o.n...D.L.L...

C:\Users\user\AppData\Local\assembly\tmp\PFAA2LU0\AssemblyInfo.ini

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4377194171895726
Encrypted:	false
SSDEEP:
MD5:	7131AF442072F7DF1CAAF1422844600D
SHA1:	21218A2C20CE93197F7F0EABEB1B7E71C4C2BD85
SHA-256:	3DBCAE84F5B904653F8C35AD747B592512DC50BD0B0549F72E148F30D7099CBF
SHA-512:	E5A5B2E2BD51CA402967B0D7417560F87AD55953FFD1326148BB3D0B48CFF247900379DA72226B509CD367D762D4850359C71EA1306F79388D7FFE8E7B22E949
Malicious:	false
Reputation:	unknown
Preview:	S.y.s.t.e.m...T.h.r.e.a.d.i.n.g...T.a.s.k.s...E.x.t.e.n.s.i.o.n.s.,.4...2...0...1.,.,.c.c.7.b.1.3.f.f.c.d.2.d.d.d.5.1...f.i.l.e.:./././.C.:./.U.s.e.r.s./.c.a.l.i./.A.p.p.D.a.t.a./.L.o.c.a.l./.A.r.i.x.c.e.l. .E.x.p.l.o.r.e.r./.S.y.s.t.e.m...T.h.r.e.a.d.i.n.g...T.a.s.k.s...E.x.t.e.n.s.i.o.n.s...D.L.L...

C:\Users\user\AppData\Local\assembly\tmp\QMQ4QZ9O\AssemblyInfo.ini

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	218
Entropy (8bit):	3.3510035537056524
Encrypted:	false
SSDEEP:
MD5:	C7F8B9D4318CAD10CF39B287FBEFE62E
SHA1:	78AEB0D16F447B654DFEB8F0F03D4B147A38F027
SHA-256:	29FED2B5F22493DD6F82AA42E60372BD4694E74D48025F4070784F6BFE232A63
SHA-512:	6D6267F82CE38B28AA0415EF560FEFDD6444CEA3FC883DA9F8914171225CD2EBD6B3B2C8C9C92F297AE9433CE7F5D63587956295009EC2B627884D7740611603
Malicious:	false
Reputation:	unknown
Preview:	A.g.a...C.o.n.t.r.o.l.s.,.1...7...0...5.,.,.7.b.5.1.c.7.c.c.3.e.c.f.8.4.0.d...f.i.l.e.:./././.C.:./.U.s.e.r.s./.c.a.l.i./.A.p.p.D.a.t.a./.L.o.c.a.l./.A.r.i.x.c.e.l. .E.x.p.l.o.r.e.r./.A.g.a...C.o.n.t.r.o.l.s...D.L.L...

C:\Users\user\AppData\Local\assembly\tmp\V1H78IGM\AssemblyInfo.ini

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	200
Entropy (8bit):	3.360853748423405
Encrypted:	false
SSDEEP:
MD5:	EFF24CB7429327987E6EC5D348580C23
SHA1:	44A074F574A71D1B2AD0916CA0E1CDDEBD167813
SHA-256:	CC6DE6333A740B1BB4562D5091D04C443F7511917871292A91C6F7DA2D0A9096
SHA-512:	E82C276874DD94BFD05D54D74D9D7BA0A3F8A246A4AF20D839625807B6D37556A153F375410DFA6102B183FE3BFA155E01CA9D02C9E88CFC0FA1CD72BF5EA9F0
Malicious:	false
Reputation:	unknown
Preview:	l.o.g.4.n.e.t.,.2...0...1.5...0.,.,.6.6.9.e.0.d.d.f.0.b.b.1.a.a.2.a...f.i.l.e.:./././.C.:./.U.s.e.r.s./.c.a.l.i./.A.p.p.D.a.t.a./.L.o.c.a.l./.A.r.i.x.c.e.l. .E.x.p.l.o.r.e.r./.l.o.g.4.n.e.t...D.L.L...

C:\Users\user\AppData\Local\assembly\tmp\ZDZO238B\AssemblyInfo.ini

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	244
Entropy (8bit):	3.3102228726013143
Encrypted:	false
SSDEEP:
MD5:	EEDB18F64F6A322D8919E00938B3E1B5
SHA1:	A60CD6CEAFAD55EC01D71790F95CDD6E5F82B388
SHA-256:	C28C226ACE9AE965EE19D41CF7405D27E6674A0765007129ECFA70E20CD54525
SHA-512:	93B8B16C50FD9C54FD5C7EA85E3CBAC1A61F60731111EB2815A4C0B4B91A73F2E0FA08029E68D951F466B0EA55A10CBAB7EB50ADEEF711C2F7B747C19E2FD974
Malicious:	false
Reputation:	unknown
Preview:	A.r.i.x.c.e.l.E.x.p.l.o.r.e.r.,.8...7...8.7.9.3...3.6.3.5.1.,.,.7.b.5.1.c.7.c.c.3.e.c.f.8.4.0.d...f.i.l.e.:./././.C.:./.U.s.e.r.s./.c.a.l.i./.A.p.p.D.a.t.a./.L.o.c.a.l./.A.r.i.x.c.e.l. .E.x.p.l.o.r.e.r./.A.r.i.x.c.e.l.E.x.p.l.o.r.e.r...D.L.L...

C:\Users\user\AppData\Roaming\Microsoft\Installer\{C22576F4-B0E1-4CB8-A237-B8F2C5DF3505}\arixcel.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 4 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	9622
Entropy (8bit):	2.126126989614935
Encrypted:	false
SSDEEP:
MD5:	FB1A2572AA6A1FEC044A24393B5DAE36
SHA1:	F669A5DF360A6F177587C83293EA5015E256FE80
SHA-256:	532986712EC13F59A176F58753012BA6EA44F12EC569D53A28860E2861582B0F
SHA-512:	AE515B99DB8081F0E8DAFBA501F3DA55E06A5F7C3487A221EA56B73EA15F91DB96CF3170337B9FD46A4097F85926FD54435787C6F3BA53750C4F90CF6148F5E7
Malicious:	false
Reputation:	unknown
Preview:	...... .... .....F......... ............... .....v......... .h....!..(... ...@..... ..................................................................................................................................................................................................................................................................................................................................^._.\...]...\...]...[...\.@.............................................................................................`...]...\...\...\...\...\...\...\...\...........................................................................................\...\...\...\...P...K...V...\...\...\./.....................................................................................^._.\...\...P..%...1...1........1...\./.........................................................................................\...\...\..$...1...1...1...1...1../..........................................................

C:\Windows\Installer\5cb73a.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Arixcel Explorer Installer, Author: Arixcel Ltd, Keywords: Arixcel Installer, Comments: Arixcel Explorer is a spreadsheet analysis add-in for Microsoft Excel., Template: x64;1033, Revision Number: {536F3CBA-F2A0-411E-AC41-4EE4C94EE2D8}, Create Time/Date: Sun Jan 28 20:44:34 2024, Last Saved Time/Date: Sun Jan 28 20:44:34 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Category:	dropped
Size (bytes):	2240512
Entropy (8bit):	7.638717425789046
Encrypted:	false
SSDEEP:
MD5:	A9FABC2227E5A5CE5AA17C3783E56110
SHA1:	602A2F1521D423A6111E62FF4D38D8353E5E9EAE
SHA-256:	DA7C2031D596747B9AFDDE61CCFC469977495E3F3406ACFBE733B6F598F02A73
SHA-512:	1BD2344CCE7955FCD505141FBF3CAF83486A450F3490A45281A6BB2718E18BED3B89B8897FF93C9A1EBDACEB79CB5E47A848357D1C1BE2A14271E44E8DC48BF7
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIB8FF.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	18314
Entropy (8bit):	4.349810416374007
Encrypted:	false
SSDEEP:
MD5:	54BA28E9EDD4B72EBECA9D247DC823BC
SHA1:	B6B5017B7B8DBAD76B02BFF8C891179B0462BEFB
SHA-256:	9212DC8EFC35C220C5F3E43BBD5132B2CC60EA0036F02352100F4B172940E217
SHA-512:	C7C9C987E88B24F0CB048AB1966530CB3CF2D750B769184C49F326BCFCCF8B37C46B82CC2CF4C18382A53FF7DCCE6A26249005FD1991F4168A8DBF5033EBFDF4
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.b.X.@.....@.....@.....@.....@.....@......&.{C22576F4-B0E1-4CB8-A237-B8F2C5DF3505}..Arixcel Explorer 8.7..Arixcel_Explorer_v8.7.8793.msi.@.....@Y"...@.....@......arixcel.ico..&.{536F3CBA-F2A0-411E-AC41-4EE4C94EE2D8}.....@.....@.....@.....@.......@.....@.....@.......@......Arixcel Explorer 8.7......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{B3A90744-DCEB-59FB-9F0D-C6A0CEB2F0CA}=.C:\Users\user\AppData\Local\Arixcel Explorer\Aga.Controls.dll.@.......@.....@.....@......&.{F8541F6E-59B7-517A-8AA0-05A6BEE218E5}@.C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.dll.@.......@.....@.....@......&.{1A931256-68FD-5C0A-979E-B093D2036F91}G.C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.dll.config.@.......@.....@.....@......&.{BBFD4F7D-EBFD-5CE7-992A-96CE43B046F2}I.C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplo

C:\Windows\Installer\SourceHash{C22576F4-B0E1-4CB8-A237-B8F2C5DF3505}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1729169874222374
Encrypted:	false
SSDEEP:
MD5:	94F57B011447FC2D1C53D6ED8ADF5B20
SHA1:	DECA919AEE2C9BE8018FE19B1F1048B1068896F9
SHA-256:	48EA113181D54B959FDBE190022A0E36D3D70D00FE58ED4D72B5A4594615552B
SHA-512:	120E95E5B846914925C7B98706A24BDB298B3EC628E2B549551298FAFD0678FC56E4A737FDA6D7830D9CC67E49EC915B3EE598AFE64F09EBE7CFD466914EEC47
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5359309894672553
Encrypted:	false
SSDEEP:
MD5:	0B89D58554D581FB3AF7F67AED673525
SHA1:	0C6060F8181BD0C1B5F5A268C085F5AB2EF9AC09
SHA-256:	FEA658AD959E2C7068F1013F04259F8715662C1EA7486E641528DC20550ECD6E
SHA-512:	184D33058A02DF53BCF15F953CF9F775CB2EB5910A7C36811669C32F4D8A6FA114F2A27CCCF5B28ED22FCB75E0C561FC0C8867D89D7ED97816FC1CFDC2E6921D
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	454234
Entropy (8bit):	5.356171700478858
Encrypted:	false
SSDEEP:
MD5:	373DF61BCB2152DAED76DD3727B50655
SHA1:	F11F631C7D40D83CFF74702B23200E60FF0B570A
SHA-256:	F239ABA95945B919BCF7180B71812196578D65B63C94F400B111554230A4D52C
SHA-512:	2CEC41DC69B752F872F761537C498CA9DCD146693827ED752EE7F7F150C9290F4930D0E4AECFA06682D308123330A378FC2BED8FB6338F33A63975578B9009C4
Malicious:	false
Reputation:	unknown
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF4DC108F2BF5F5926.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.231342184291806
Encrypted:	false
SSDEEP:
MD5:	0B8A0AFA9C9CA68D5230808A4E82B836
SHA1:	69D82A8B74C7F3955204DD913754AE44711131A4
SHA-256:	F603763F650FE60FC44929380EC0290BC799652D0D09A78E533BD9EC7A0DA542
SHA-512:	4858CA51D6C29EE5A353B69E80D52960BDBA9BE252B313DE300E6E94B544FD4CDE51C0EEB55ADAB74CA5423603FC393B1F691580B8A0BD63765862DF6E391AF1
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5055E0BD43DB7F38.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.13119249583520878
Encrypted:	false
SSDEEP:
MD5:	B3BD791736CC08D86244ED62AA577C67
SHA1:	65EDBAB2819C65374B41BE7CC9711155DA3EBCC2
SHA-256:	D9179562683322227FCC02C784A6319ED5D1E2C7D2379882D2581596AFBB3DBE
SHA-512:	762072569E92F649A85B8438D82EF2C784DC9905EAFA343E8ECAC01D19B075C109EAFC56AAE534082D9186F0BD2461C2AA4B507FA98669CE7D9F0FDBE49918E6
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF56D4A918F02576FC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8E149199FA49F656.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07854837411207781
Encrypted:	false
SSDEEP:
MD5:	53A4132F8B9C1C68A9086943F8764757
SHA1:	9C4380F8CB37C4E20762CA6DC8089CBD78D2D6A5
SHA-256:	A94D8C94DE782857920923E5CB73A3B735D52F100DE3F6262D68B168FBE40353
SHA-512:	2715C2C1F3695B1845C30AC635BCF90DAA707775EB038A9C88FD68B4CBC870C5C92B6303CE331E9B93912C00EFF2CD1F5003CA82B4AA8D69CB93562F28522363
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Arixcel Explorer Installer, Author: Arixcel Ltd, Keywords: Arixcel Installer, Comments: Arixcel Explorer is a spreadsheet analysis add-in for Microsoft Excel., Template: x64;1033, Revision Number: {536F3CBA-F2A0-411E-AC41-4EE4C94EE2D8}, Create Time/Date: Sun Jan 28 20:44:34 2024, Last Saved Time/Date: Sun Jan 28 20:44:34 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Entropy (8bit):	7.638717425789046
TrID:	Microsoft Windows Installer (60509/1) 88.31% Generic OLE2 / Multistream Compound File (8008/1) 11.69%
File name:	Arixcel_Explorer_v8.7.8793.msi
File size:	2'240'512 bytes
MD5:	a9fabc2227e5a5ce5aa17c3783e56110
SHA1:	602a2f1521d423a6111e62ff4d38d8353e5e9eae
SHA256:	da7c2031d596747b9afdde61ccfc469977495e3f3406acfbe733b6f598f02a73
SHA512:	1bd2344cce7955fcd505141fbf3caf83486a450f3490a45281a6bb2718e18bed3b89b8897ff93c9a1ebdaceb79cb5e47a848357d1c1be2a14271e44e8dc48bf7
SSDEEP:	49152:TAn5ftVvJ6FDzPbNjrhbwwtIWGfPn13vcOSu3R+f:E5V6FnR9UuGfPnFVSuB+f
TLSH:	C9A5022472918031E26B17344935F6955B3EFD219AB0C98B738DF67D2FB16C0DA36B22
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "Arixcel_Explorer_v8.7.8793.msi"

Indicators

Has Summary Info:
Application Name:	Windows Installer XML Toolset (3.14.0.5722)
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Code Page:	1252
Title:	Installation Database
Subject:	Arixcel Explorer Installer
Author:	Arixcel Ltd
Keywords:	Arixcel Installer
Comments:	Arixcel Explorer is a spreadsheet analysis add-in for Microsoft Excel.
Template:	x64;1033
Revion Number:	{536F3CBA-F2A0-411E-AC41-4EE4C94EE2D8}
Create Time:	2024-01-28 20:44:34
Last Saved Time:	2024-01-28 20:44:34
Number of Pages:	200
Number of Words:	2
Creating Application:	Windows Installer XML Toolset (3.14.0.5722)
Security:	2

Streams

Stream Path: \x5DigitalSignature, File Type: data, Stream Size: 11775

General
Stream Path:	\x5DigitalSignature
CLSID:
File Type:	data
Stream Size:	11775
Entropy:	7.651740637009454
Base64 Encoded:	True
Data ASCII:	0 - . . * H . . . . - 0 - . . . 1 . 0 . . . ` H . e . . . . . . 0 w . . + . . . . 7 . . . i 0 g 0 2 . . + . . . . 7 . . . 0 $ . . . . . . . . . . . . . . . . . . F . . . . . . . . . . . . . . . 0 1 0 . . . ` H . e . . . . . . . N , : @ . * j . . . ( p . . ` 0 . 0 . x . . . . . . . . W ! 2 9 . w u \\ 0 . . . * H . . . . . . 0 b 1 . 0 . . . U . . . . U S 1 . 0 . . . U . . . . D i g i C e r t I n c 1 . 0 . . . U . . . . w w w . d i g i c e r t . c o m 1 ! 0 . . . U . . . . D i g i C e r t T r u s t e d
Data Raw:	30 82 2d fb 06 09 2a 86 48 86 f7 0d 01 07 02 a0 82 2d ec 30 82 2d e8 02 01 01 31 0f 30 0d 06 09 60 86 48 01 65 03 04 02 01 05 00 30 77 06 0a 2b 06 01 04 01 82 37 02 01 04 a0 69 30 67 30 32 06 0a 2b 06 01 04 01 82 37 02 01 1e 30 24 02 01 02 04 10 f1 10 0c 00 00 00 00 00 c0 00 00 00 00 00 00 46 02 01 00 02 01 00 02 01 00 02 01 00 02 01 00 30 31 30 0d 06 09 60 86 48 01 65 03 04 02 01

Stream Path: \x5MsiDigitalSignatureEx, File Type: data, Stream Size: 32

General
Stream Path:	\x5MsiDigitalSignatureEx
CLSID:
File Type:	data
Stream Size:	32
Entropy:	4.875
Base64 Encoded:	False
Data ASCII:	I f T . . . . " 0 * s R v a c A 3 0 P 8 Y \\ .
Data Raw:	49 66 54 01 1c 2e 02 22 88 30 2a a2 73 52 76 61 63 f2 41 fa 33 ed 30 50 d2 38 fa 59 5c 1d da c8

Stream Path: \x5SummaryInformation, File Type: dBase III DBT, version number 0, next free block index 65534, 1st item "olset (3.14.0.5722)", Stream Size: 540

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	dBase III DBT, version number 0, next free block index 65534, 1st item "olset (3.14.0.5722)"
Stream Size:	540
Entropy:	4.668543893004074
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D . . . . . . . X . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I n s t a l l a t i o n D a t a b a s e . . . . . . . . . . . A r i x c e l E x p l o r e r I n s t a l l e r . . . . . . . . . . A r i x c e l L t d . . . . . . . . . A r i x c e l
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 ec 01 00 00 0e 00 00 00 01 00 00 00 78 00 00 00 02 00 00 00 80 00 00 00 03 00 00 00 a0 00 00 00 04 00 00 00 c4 00 00 00 05 00 00 00 d8 00 00 00 06 00 00 00 f4 00 00 00 07 00 00 00 44 01 00 00 09 00 00 00 58 01 00 00 0c 00 00 00 88 01 00 00

Stream Path: \x16678\x14437\x16830\x16740, File Type: Microsoft Cabinet archive data, many, 1464256 bytes, 18 files, at 0x2c +A "Aga.Controls.dll" +A "Arixcel.Common.dll", number 1, 103 datablocks, 0x1 compression, Stream Size: 1464256

General
Stream Path:	\x16678\x14437\x16830\x16740
CLSID:
File Type:	Microsoft Cabinet archive data, many, 1464256 bytes, 18 files, at 0x2c +A "Aga.Controls.dll" +A "Arixcel.Common.dll", number 1, 103 datablocks, 0x1 compression
Stream Size:	1464256
Entropy:	7.997986179388627
Base64 Encoded:	True
Data ASCII:	M S C F . . . . W . . . . . . , . . . . . . . . . . . . . . . . . . . . . . . g . . . . Z . . . . . . . . < X v . A g a . C o n t r o l s . d l l . . V . . . Z . . . . < X v . A r i x c e l . C o m m o n . d l l . . . . . . . . . < X v . A r i x c e l . C o n t r o l s . d l l . . . . . . . . . < X w . A r i x c e l E x p l o r e r . d l l . . . . . & . . . . T . A r i x c e l E x p l o r e r . d l l . c o n f i g . . . . . ( . . . . < X . A r i x c e l E x p l o r e r . d l l . m a n i f e s t
Data Raw:	4d 53 43 46 00 00 00 00 c0 57 16 00 00 00 00 00 2c 00 00 00 00 00 00 00 03 01 01 00 12 00 00 00 00 00 00 00 14 03 00 00 67 00 01 00 00 5a 02 00 00 00 00 00 00 00 3c 58 76 a1 20 00 41 67 61 2e 43 6f 6e 74 72 6f 6c 73 2e 64 6c 6c 00 00 56 07 00 00 5a 02 00 00 00 3c 58 76 a1 20 00 41 72 69 78 63 65 6c 2e 43 6f 6d 6d 6f 6e 2e 64 6c 6c 00 00 ec 00 00 00 b0 09 00 00 00 3c 58 76 a1 20 00

Stream Path: \x16786\x17522\x16702\x17205\x16827\x17384\x17214\x17574, File Type: MS Windows icon resource - 4 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel, Stream Size: 9622

General
Stream Path:	\x16786\x17522\x16702\x17205\x16827\x17384\x17214\x17574
CLSID:
File Type:	MS Windows icon resource - 4 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
Stream Size:	9622
Entropy:	2.126126989614935
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . F . . . . . . . . . . . . . . . . . . . . . . . . . . v . . . . . . . . . . h . . . . ! . . ( . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	00 00 01 00 04 00 20 20 00 00 01 00 20 00 a8 10 00 00 46 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 ee 10 00 00 14 14 00 00 01 00 20 00 b8 06 00 00 76 1a 00 00 10 10 00 00 01 00 20 00 68 04 00 00 2e 21 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x17163\x16689\x18229\x15038\x17205\x16827\x17384\x16924\x17975\x18483, File Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive, Stream Size: 258045

General
Stream Path:	\x17163\x16689\x18229\x15038\x17205\x16827\x17384\x16924\x17975\x18483
CLSID:
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
Stream Size:	258045
Entropy:	6.256870163299765
Base64 Encoded:	True
Data ASCII:	M Z . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ! . L ! T h i s p r o g r a m c a n n o t b e r u n i n D O S m o d e . . . . $ . . . . . . . . . j h j h j h . k ` h . m h . l x h 8 l z h 8 k { h 8 m K h . i a h j i . h m m h h k h . k h j k h j k h R i c h j h . . . . . . . . P E . . L . . . . R K a . . . . . . . . . . ! . . . . . P . . . \| . . . . . . . M . . . . . . . ` . . . . . . . . . . . . . . . . . . . .
Data Raw:	4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00

Stream Path: \x17163\x16689\x18229\x16190\x17896\x17354\x16303\x16950\x17845, File Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, Stream Size: 156888

General
Stream Path:	\x17163\x16689\x18229\x16190\x17896\x17354\x16303\x16950\x17845
CLSID:
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Stream Size:	156888
Entropy:	6.031305225900342
Base64 Encoded:	True
Data ASCII:	M Z . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ! . L ! T h i s p r o g r a m c a n n o t b e r u n i n D O S m o d e . . . . $ . . . . . . . c J . ' + ' + ' + k 6 + . h ! + h & + i . + h T + . S % $ + . S 5 > + ' + + i 1 + l & + o & + ' + 1 & + j & + R i c h ' + . . . . . . . . P E . . L . . . U . . . . . . . . . . ! . . . . . J . . . . . . . . . . F . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00

Stream Path: \x17163\x16689\x18229\x16446\x18156\x15518\x15103\x17648\x15103\x17508\x16945\x18485, File Type: PNG image data, 493 x 58, 8-bit/color RGBA, non-interlaced, Stream Size: 23203

General
Stream Path:	\x17163\x16689\x18229\x16446\x18156\x15518\x15103\x17648\x15103\x17508\x16945\x18485
CLSID:
File Type:	PNG image data, 493 x 58, 8-bit/color RGBA, non-interlaced
Stream Size:	23203
Entropy:	3.8934084550757597
Base64 Encoded:	True
Data ASCII:	P N G . . . . . . . . I H D R . . . . . . : . . . . . . . . . . p H Y s . . . . . . . . . . . . . . O i C C P P h o t o s h o p I C C p r o f i l e . . x . S g T S . = B K K o R . . R B . & * ! . . J ! . Q . E E . . . . . Q , . . . ! { k . > . . . H 3 Q 5 . B . . . @ . $ p . . . d ! s # . . ~ < < + " . . . x . . . M 0 . . B \\ . . t 8 K . . . @ z B . @ F . & S . . . ` c b . P - . ` ' . . { . . [ ! . . . . e D . h ; . V E . X 0 . . f K 9 . - . 0 I W f H . . . . . . . . 0 Q ) . . { . ` # # x . . . F W
Data Raw:	89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 ed 00 00 00 3a 08 06 00 00 00 9d f8 01 d8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 0a 4f 69 43 43 50 50 68 6f 74 6f 73 68 6f 70 20 49 43 43 20 70 72 6f 66 69 6c 65 00 00 78 da 9d 53 67 54 53 e9 16 3d f7 de f4 42 4b 88 80 94 4b 6f 52 15 08 20 52 42 8b 80 14 91 26 2a 21 09 10 4a 88 21 a1 d9 15 51 c1

Stream Path: \x17163\x16689\x18229\x16446\x18156\x15518\x15103\x17648\x15231\x16684\x17583\x18474, File Type: PNG image data, 493 x 312, 8-bit/color RGBA, non-interlaced, Stream Size: 29551

General
Stream Path:	\x17163\x16689\x18229\x16446\x18156\x15518\x15103\x17648\x15231\x16684\x17583\x18474
CLSID:
File Type:	PNG image data, 493 x 312, 8-bit/color RGBA, non-interlaced
Stream Size:	29551
Entropy:	4.964453665784693
Base64 Encoded:	True
Data ASCII:	P N G . . . . . . . . I H D R . . . . . . 8 . . . . . v G g . . . . p H Y s . . . . . . . . . . . . . . O i C C P P h o t o s h o p I C C p r o f i l e . . x . S g T S . = B K K o R . . R B . & * ! . . J ! . Q . E E . . . . . Q , . . . ! { k . > . . . H 3 Q 5 . B . . . @ . $ p . . . d ! s # . . ~ < < + " . . . x . . . M 0 . . B \\ . . t 8 K . . . @ z B . @ F . & S . . . ` c b . P - . ` ' . . { . . [ ! . . . . e D . h ; . V E . X 0 . . f K 9 . - . 0 I W f H . . . . . . . . 0 Q ) . . { . ` # # x . . .
Data Raw:	89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 ed 00 00 01 38 08 06 00 00 00 76 47 ab 67 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 0a 4f 69 43 43 50 50 68 6f 74 6f 73 68 6f 70 20 49 43 43 20 70 72 6f 66 69 6c 65 00 00 78 da 9d 53 67 54 53 e9 16 3d f7 de f4 42 4b 88 80 94 4b 6f 52 15 08 20 52 42 8b 80 14 91 26 2a 21 09 10 4a 88 21 a1 d9 15 51 c1

Stream Path: \x17163\x16689\x18229\x16446\x18156\x15518\x15103\x17648\x15871\x18088, File Type: MS Windows icon resource - 1 icon, 16x16, 16 colors, Stream Size: 318

General
Stream Path:	\x17163\x16689\x18229\x16446\x18156\x15518\x15103\x17648\x15871\x18088
CLSID:
File Type:	MS Windows icon resource - 1 icon, 16x16, 16 colors
Stream Size:	318
Entropy:	2.034441580055181
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . ( . . . . . . . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . } . . . . . . . . . .
Data Raw:	00 00 01 00 01 00 10 10 10 00 00 00 00 00 28 01 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 04 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 80 00 00 00 80 80 00 80 00 00 00 80 00 80 00 80 80 00 00 c0 c0 c0 00 80 80 80 00 00 00 ff 00 00 ff 00 00 00 ff ff 00 ff 00 00 00 ff 00 ff 00 ff ff 00 00 ff ff ff 00 00 00

Stream Path: \x17163\x16689\x18229\x16446\x18156\x15518\x15103\x17648\x16319\x18483, File Type: MS Windows icon resource - 1 icon, 16x16, 16 colors, Stream Size: 318

General
Stream Path:	\x17163\x16689\x18229\x16446\x18156\x15518\x15103\x17648\x16319\x18483
CLSID:
File Type:	MS Windows icon resource - 1 icon, 16x16, 16 colors
Stream Size:	318
Entropy:	2.0369361465218003
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . ( . . . . . . . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	00 00 01 00 01 00 10 10 10 00 00 00 00 00 28 01 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 04 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 80 00 00 00 80 80 00 80 00 00 00 80 00 80 00 80 80 00 00 c0 c0 c0 00 80 80 80 00 00 00 ff 00 00 ff 00 00 00 ff ff 00 ff 00 00 00 ff 00 ff 00 ff ff 00 00 ff ff ff 00 00 00

Stream Path: \x17163\x16689\x18229\x16446\x18156\x15518\x15551\x17574\x15295\x16827\x16687\x18480, File Type: MS Windows icon resource - 1 icon, 32x32, 16 colors, Stream Size: 766

General
Stream Path:	\x17163\x16689\x18229\x16446\x18156\x15518\x15551\x17574\x15295\x16827\x16687\x18480
CLSID:
File Type:	MS Windows icon resource - 1 icon, 32x32, 16 colors
Stream Size:	766
Entropy:	3.3484862648999827
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . ( . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 3 1 . . . . . . . . . . . . 3 3 2 3 3 3 3 3 3 3 3 3 3 3 3 . 3 3 $ D D D D D D D D D D D @ 1 . 2 D D D D D D D D D D D D D . . 2 D D D D D D @ D D D D D D C . 2 D D D D D D 3 4 D D D D D C . 2 D D D D D @ 3 0 D D D D D . . 3 $ D D D D D 3 4 D D D D D 1 . 3 $ D D D D D @ D D D D D @
Data Raw:	00 00 01 00 01 00 20 20 10 00 00 00 00 00 e8 02 00 00 16 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 c0 c0 00 80 80 80 00 00 80 80 00 00 00 00 00 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 33

Stream Path: \x17163\x16689\x18229\x16446\x18156\x15518\x15551\x17574\x15551\x17009\x18482, File Type: MS Windows icon resource - 2 icons, 32x32, 16 colors, 16x16, 16 colors, Stream Size: 1078

General
Stream Path:	\x17163\x16689\x18229\x16446\x18156\x15518\x15551\x17574\x15551\x17009\x18482
CLSID:
File Type:	MS Windows icon resource - 2 icons, 32x32, 16 colors, 16x16, 16 colors
Stream Size:	1078
Entropy:	2.8642269548572474
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . & . . . . . . . . . . . ( . . . . . . . ( . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . p . . . . . . . . . . . . . . w p . . . . . . . . . . . . . . . p . . . . . . . . . . . . . . . p . . . . . . . . . . . . . . p . . . . . . . . . . . . . . p . . . . . . . . . . w w . . w w . . . . . . . . w p . . w w w . . . . . . . . . . w w p . . . . . . . w w .
Data Raw:	00 00 01 00 02 00 20 20 10 00 00 00 00 00 e8 02 00 00 26 00 00 00 10 10 10 00 00 00 00 00 28 01 00 00 0e 03 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 80 00 00 00 80 80 00 80 00 00 00 80 00 80 00 80 80 00 00 80 80 80 00 c0 c0 c0 00 00 00 ff 00 00 ff 00 00 00 ff ff 00 ff 00

Stream Path: \x17163\x16689\x18229\x16446\x18156\x15518\x17184\x16827\x18468, File Type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, Stream Size: 119392

General
Stream Path:	\x17163\x16689\x18229\x16446\x18156\x15518\x17184\x16827\x18468
CLSID:
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Stream Size:	119392
Entropy:	6.636868693516671
Base64 Encoded:	True
Data ASCII:	M Z . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ! . L ! T h i s p r o g r a m c a n n o t b e r u n i n D O S m o d e . . . . $ . . . . . . . x @ 1 < . b < . b < . b Y - c 6 . b Y + c . b Y * c . . b n * c , . b n - c - . b n + c ! . b Y / c / . b < / b . b + c , . b . c = . b b = . b < b = . b , c = . b R i c h < . b . . . . . . . . . . . . . . . . P E . . L . . . K S K a . . . . . . . . . . ! . . . . . . . . .
Data Raw:	4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00

Stream Path: \x18496\x15167\x17394\x17464\x17841, File Type: data, Stream Size: 1352

General
Stream Path:	\x18496\x15167\x17394\x17464\x17841
CLSID:
File Type:	data
Stream Size:	1352
Entropy:	4.99030390093225
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . " . " . " . ) . ) . ) . * . * . * . + . + . , . , . 1 . 1 . 5 . 5 . 9 . 9 . 9 . 9 . 9 . 9 . ? . ? . ? . G . G . G . G . G . G . G . G . G . G . G . G . I . I . I . I . I . I . I . I . I . I . [ . [ . [ . [ . b . b . b . b . b . b . k . k . k . k . k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	07 00 07 00 07 00 07 00 07 00 07 00 07 00 07 00 07 00 07 00 22 00 22 00 22 00 29 00 29 00 29 00 2a 00 2a 00 2a 00 2b 00 2b 00 2c 00 2c 00 31 00 31 00 35 00 35 00 39 00 39 00 39 00 39 00 39 00 39 00 3f 00 3f 00 3f 00 47 00 47 00 47 00 47 00 47 00 47 00 47 00 47 00 47 00 47 00 47 00 47 00 49 00 49 00 49 00 49 00 49 00 49 00 49 00 49 00 49 00 49 00 5b 00 5b 00 5b 00 5b 00 62 00 62 00

Stream Path: \x18496\x15518\x16925\x17915, File Type: MS Windows COFF Alpha object file, Stream Size: 204

General
Stream Path:	\x18496\x15518\x16925\x17915
CLSID:
File Type:	MS Windows COFF Alpha object file
Stream Size:	204
Entropy:	4.35680956267016
Base64 Encoded:	False
Data ASCII:	. B . C . D . E . F . G . I . K . M . O . Q . S . U . X . Z . \\ . ^ . ` . b . d . f . h . j . l . n . p . r . t . v . x . z . \| . ~ . . . . . . . . . . . . . . . . . . W . . . C . D . E . F . H . J . L . N . P . R . T . V . Y . [ . ] . _ . a . c . e . g . i . k . m . o . q . s . u . w . y . { . } . . . . . . . . . . . . . . . . . . . .
Data Raw:	84 01 42 03 43 03 44 03 45 03 46 03 47 03 49 03 4b 03 4d 03 4f 03 51 03 53 03 55 03 58 03 5a 03 5c 03 5e 03 60 03 62 03 64 03 66 03 68 03 6a 03 6c 03 6e 03 70 03 72 03 74 03 76 03 78 03 7a 03 7c 03 7e 03 80 03 82 03 84 03 86 03 88 03 8a 03 8c 03 8e 03 90 03 92 03 94 03 96 03 98 03 9a 03 9c 03 9e 03 a0 03 57 03 00 00 43 03 44 03 45 03 46 03 48 03 4a 03 4c 03 4e 03 50 03 52 03 54 03

Stream Path: \x18496\x16191\x17783\x17516\x15210\x17892\x18468, File Type: ASCII text, with very long lines (20240), with CRLF line terminators, Stream Size: 96881

General
Stream Path:	\x18496\x16191\x17783\x17516\x15210\x17892\x18468
CLSID:
File Type:	ASCII text, with very long lines (20240), with CRLF line terminators
Stream Size:	96881
Entropy:	5.311327990914525
Base64 Encoded:	True
Data ASCII:	N a m e T a b l e T y p e C o l u m n V a l u e _ V a l i d a t i o n N P r o p e r t y I d _ S u m m a r y I n f o r m a t i o n D e s c r i p t i o n S e t C a t e g o r y K e y C o l u m n M a x V a l u e N u l l a b l e K e y T a b l e M i n V a l u e I d e n t i f i e r N a m e o f t a b l e N a m e o f c o l u m n Y ; N W h e t h e r t h e c o l u m n i s n u l l a b l e Y M i n i m u m v a l u e a l l o w e d M a x i m u m v a l u e a l l o w e d F o r f o r e i g n k e y
Data Raw:	4e 61 6d 65 54 61 62 6c 65 54 79 70 65 43 6f 6c 75 6d 6e 56 61 6c 75 65 5f 56 61 6c 69 64 61 74 69 6f 6e 4e 50 72 6f 70 65 72 74 79 49 64 5f 53 75 6d 6d 61 72 79 49 6e 66 6f 72 6d 61 74 69 6f 6e 44 65 73 63 72 69 70 74 69 6f 6e 53 65 74 43 61 74 65 67 6f 72 79 4b 65 79 43 6f 6c 75 6d 6e 4d 61 78 56 61 6c 75 65 4e 75 6c 6c 61 62 6c 65 4b 65 79 54 61 62 6c 65 4d 69 6e 56 61 6c 75 65

Stream Path: \x18496\x16191\x17783\x17516\x15978\x17586\x18479, File Type: data, Stream Size: 3736

General
Stream Path:	\x18496\x16191\x17783\x17516\x15978\x17586\x18479
CLSID:
File Type:	data
Stream Size:	3736
Entropy:	3.5027214583325175
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . g . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 . . . . . . . . . . . . . . . . . . . L . . . . . . . . . 6 . . . $ . . . . . . . . . . . . ~ . . . . . . . . . . . . . . . . B . . . . . . . . . . . . . . o . . . . . . . . . . . . . . . . . . . ( . . . . . . . 5 . . . . . . . . . . ' . . . . . . . . . . . . . . . ( . . . . . . . * . . . . . . . ; . . . . . . . . . . . > . . . . . . . . . . . . . . .
Data Raw:	e4 04 00 00 04 00 0a 00 05 00 02 00 00 00 00 00 04 00 06 00 06 00 02 00 05 00 0b 00 0b 00 15 00 01 00 67 00 0a 00 01 00 13 00 02 00 0b 00 1c 00 03 00 02 00 08 00 02 00 09 00 02 00 08 00 02 00 08 00 02 00 08 00 02 00 08 00 02 00 0a 00 36 00 0d 00 01 00 0e 00 01 00 03 00 01 00 1e 00 01 00 01 00 4c 00 15 00 01 00 15 00 01 00 36 00 01 00 24 00 01 00 f5 00 01 00 0f 00 01 00 04 00 7e 00

Stream Path: \x18496\x16255\x16740\x16943\x18486, File Type: data, Stream Size: 68

General
Stream Path:	\x18496\x16255\x16740\x16943\x18486
CLSID:
File Type:	data
Stream Size:	68
Entropy:	3.7051099000738668
Base64 Encoded:	False
Data ASCII:	. . " . ) . * . + . , . 1 . 5 . 9 . ? . G . I . [ . b . k . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	07 00 22 00 29 00 2a 00 2b 00 2c 00 31 00 35 00 39 00 3f 00 47 00 49 00 5b 00 62 00 6b 00 8a 00 8f 00 9d 00 a2 00 b0 00 b3 00 b4 00 b5 00 b8 00 be 00 ca 00 d5 00 de 00 e8 00 eb 00 ee 00 ff 00 09 01 0c 01

Stream Path: \x18496\x16383\x17380\x16876\x17892\x17580\x18481, File Type: data, Stream Size: 4104

General
Stream Path:	\x18496\x16383\x17380\x16876\x17892\x17580\x18481
CLSID:
File Type:	data
Stream Size:	4104
Entropy:	2.5282386464409887
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . " . " . " . ) . ) . ) . * . * . * . + . + . , . , . 1 . 1 . 5 . 5 . 9 . 9 . 9 . 9 . 9 . 9 . ? . ? . ? . G . G . G . G . G . G . G . G . G . G . G . G . I . I . I . I . I . I . I . I . I . I . [ . [ . [ . [ . b . b . b . b . b . b . k . k . k . k . k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	07 00 07 00 07 00 07 00 07 00 07 00 07 00 07 00 07 00 07 00 0a 00 0a 00 22 00 22 00 22 00 29 00 29 00 29 00 2a 00 2a 00 2a 00 2b 00 2b 00 2c 00 2c 00 31 00 31 00 35 00 35 00 39 00 39 00 39 00 39 00 39 00 39 00 3f 00 3f 00 3f 00 47 00 47 00 47 00 47 00 47 00 47 00 47 00 47 00 47 00 47 00 47 00 47 00 49 00 49 00 49 00 49 00 49 00 49 00 49 00 49 00 49 00 49 00 5b 00 5b 00 5b 00 5b 00

Stream Path: \x18496\x16661\x17528\x17126\x17548\x16881\x17900\x17580\x18481, File Type: data, Stream Size: 8

General
Stream Path:	\x18496\x16661\x17528\x17126\x17548\x16881\x17900\x17580\x18481
CLSID:
File Type:	data
Stream Size:	8
Entropy:	1.75
Base64 Encoded:	False
Data ASCII:	. . . . . . .
Data Raw:	ba 02 03 03 02 03 04 03

Stream Path: \x18496\x16667\x17191\x15090\x17912\x17591\x18481, File Type: data, Stream Size: 72

General
Stream Path:	\x18496\x16667\x17191\x15090\x17912\x17591\x18481
CLSID:
File Type:	data
Stream Size:	72
Entropy:	3.6098900164775847
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . < ' ' ' ' . . . . . . . . . . . . . . . . . . . .
Data Raw:	b9 01 b9 01 11 02 11 02 01 80 02 80 01 80 02 80 18 03 1c 03 8d 02 8e 02 00 80 00 80 00 80 00 80 00 80 14 80 00 80 3c 80 27 81 27 81 27 81 27 81 10 80 10 80 10 80 10 80 1b 03 1d 03 1e 03 1f 03 00 00 00 00 00 00 00 00

Stream Path: \x18496\x16786\x17522, File Type: data, Stream Size: 4

General
Stream Path:	\x18496\x16786\x17522
CLSID:
File Type:	data
Stream Size:	4
Entropy:	2.0
Base64 Encoded:	False
Data ASCII:	. . .
Data Raw:	ed 02 01 00

Stream Path: \x18496\x16842\x17200\x15281\x16955\x17958\x16951\x16924\x17972\x17512\x16934, File Type: PDP-11 overlaid separate executable not stripped, Stream Size: 48

General
Stream Path:	\x18496\x16842\x17200\x15281\x16955\x17958\x16951\x16924\x17972\x17512\x16934
CLSID:
File Type:	PDP-11 overlaid separate executable not stripped
Stream Size:	48
Entropy:	3.5275690110927505
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . < .
Data Raw:	19 01 1a 01 1b 01 1c 01 1d 01 1e 01 1f 01 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 83 84 83 e8 83 78 85 dc 85 3c 8f a0 8f c8 99

Stream Path: \x18496\x16842\x17200\x16305\x16146\x17704\x16952\x16817\x18472, File Type: PDP-11 overlaid separate executable not stripped, Stream Size: 42

General
Stream Path:	\x18496\x16842\x17200\x16305\x16146\x17704\x16952\x16817\x18472
CLSID:
File Type:	PDP-11 overlaid separate executable not stripped
Stream Size:	42
Entropy:	3.428883414027889
Base64 Encoded:	False
Data ASCII:	. . . . . . ! . " . # . $ . . . . . . . . . . . . . . . . . . .
Data Raw:	19 01 1a 01 1b 01 21 01 22 01 23 01 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 83 84 83 e8 83 fd 7f fe 7f ff 7f 14 85

Stream Path: \x18496\x16842\x17913\x18126\x16808\x17912\x16168\x17704\x16952\x16817\x18472, File Type: PDP-11 overlaid separate executable not stripped, Stream Size: 42

General
Stream Path:	\x18496\x16842\x17913\x18126\x16808\x17912\x16168\x17704\x16952\x16817\x18472
CLSID:
File Type:	PDP-11 overlaid separate executable not stripped
Stream Size:	42
Entropy:	3.338630675432784
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . % . & . . . . . . . . . . . . . . . x . . .
Data Raw:	19 01 1b 01 1c 01 1d 01 20 01 25 01 26 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 83 e8 83 78 85 dc 85 c8 99 9c 98 00 99

Stream Path: \x18496\x16911\x17892\x17784\x15144\x17458\x17587\x16945\x17905\x18486, File Type: data, Stream Size: 108

General
Stream Path:	\x18496\x16911\x17892\x17784\x15144\x17458\x17587\x16945\x17905\x18486
CLSID:
File Type:	data
Stream Size:	108
Entropy:	3.188721875540867
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . 5 . 8 . : . < . > . @ . B . D . F . H . J . L . N . P . R . T . V . X . Z . _ . b . e . g . k . o . s . w .
Data Raw:	d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 d1 02 35 01 38 01 3a 01 3c 01 3e 01 40 01 42 01 44 01 46 01 48 01 4a 01 4c 01 4e 01 50 01 52 01 54 01 56 01 58 01 5a 01 5f 01 62 01 65 01 67 01 6b 01 6f 01 73 01 77 01

Stream Path: \x18496\x16911\x17892\x17784\x18472, File Type: data, Stream Size: 16

General
Stream Path:	\x18496\x16911\x17892\x17784\x18472
CLSID:
File Type:	data
Stream Size:	16
Entropy:	2.1774212838293647
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . .
Data Raw:	d1 02 00 00 d2 02 00 00 02 80 01 80 00 00 00 80

Stream Path: \x18496\x16918\x17191\x18468, File Type: MIPSEB Ucode, Stream Size: 14

General
Stream Path:	\x18496\x16918\x17191\x18468
CLSID:
File Type:	MIPSEB Ucode
Stream Size:	14
Entropy:	1.9502120649147472
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . .
Data Raw:	01 80 12 00 00 80 00 00 05 03 00 00 00 00

Stream Path: \x18496\x16923\x15722\x16818\x17892\x17778, File Type: data, Stream Size: 10

General
Stream Path:	\x18496\x16923\x15722\x16818\x17892\x17778
CLSID:
File Type:	data
Stream Size:	10
Entropy:	2.7219280948873625
Base64 Encoded:	False
Data ASCII:	( . . 3 . 4 . .
Data Raw:	28 01 02 80 33 03 34 03 02 80

Stream Path: \x18496\x16923\x17194\x17910\x18229, File Type: data, Stream Size: 192

General
Stream Path:	\x18496\x16923\x17194\x17910\x18229
CLSID:
File Type:	data
Stream Size:	192
Entropy:	4.018930248364255
Base64 Encoded:	False
Data ASCII:	^ . a . j . n . r . v . z . ! . # . & . ) . * . + . 0 . 1 . 2 . . . . . . . . . . . . . . . . . . . , . , . . , . , . . . . . . . . . . . . . . - . - . . . - . - . " . $ . ' . " . $ . ' . " . $ . ' . . . . . . . / . . . . . / . . . % . ( . . . % . ( . . . % . ( . Z . _ . g . k . o . s . w . Z . Z . Z . _ . _ . _ . o . o . o .
Data Raw:	5e 01 61 01 6a 01 6e 01 72 01 76 01 7a 01 21 03 23 03 26 03 29 03 2a 03 2b 03 30 03 31 03 32 03 02 80 02 80 02 80 02 80 01 80 01 80 01 80 02 80 02 80 02 80 02 80 02 80 02 80 01 80 01 80 01 80 20 03 20 03 2c 03 2c 03 20 03 2c 03 2c 03 20 03 20 03 20 03 20 03 20 03 20 03 20 03 20 03 20 03 0b 00 0b 00 2d 03 2d 03 0b 00 2d 03 2d 03 22 03 24 03 27 03 22 03 24 03 27 03 22 03 24 03 27 03

Stream Path: \x18496\x16923\x17584\x16953\x16923\x17194\x17910\x18229, File Type: data, Stream Size: 60

General
Stream Path:	\x18496\x16923\x17584\x16953\x16923\x17194\x17910\x18229
CLSID:
File Type:	data
Stream Size:	60
Entropy:	3.3393511208476414
Base64 Encoded:	False
Data ASCII:	5 . 8 . : . ; . < . = . . . . . . . 6 . 9 . . 6 . 6 . 6 . 7 . 7 . 7 . 7 . 7 . 7 . Z . Z . Z . b . e . o .
Data Raw:	35 03 38 03 3a 03 3b 03 3c 03 3d 03 01 80 01 80 01 80 02 80 02 80 01 80 36 03 39 03 20 03 36 03 36 03 36 03 37 03 37 03 37 03 37 03 37 03 37 03 5a 01 5a 01 5a 01 62 01 65 01 6f 01

Stream Path: \x18496\x16925\x17915\x17884\x17404\x18472, File Type: data, Stream Size: 48

General
Stream Path:	\x18496\x16925\x17915\x17884\x17404\x18472
CLSID:
File Type:	data
Stream Size:	48
Entropy:	2.711038815261277
Base64 Encoded:	False
Data ASCII:	. . ? . @ . A . > . > . > . > . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	15 03 3f 03 40 03 41 03 3e 03 3e 03 3e 03 3e 03 08 80 0c 80 09 80 08 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 80 01 80

Stream Path: \x18496\x17100\x16808\x15086\x18162, File Type: data, Stream Size: 8

General
Stream Path:	\x18496\x17100\x16808\x15086\x18162
CLSID:
File Type:	data
Stream Size:	8
Entropy:	1.75
Base64 Encoded:	False
Data ASCII:	2 . 4 . 3 . 3 .
Data Raw:	32 01 34 01 33 01 33 01

Stream Path: \x18496\x17163\x16689\x18229, File Type: data, Stream Size: 36

General
Stream Path:	\x18496\x17163\x16689\x18229
CLSID:
File Type:	data
Stream Size:	36
Entropy:	2.292481250360577
Base64 Encoded:	False
Data ASCII:	) . * . + . , . - . . . / . 0 . 1 . . . . . . . . . . . . . . . . . . .
Data Raw:	29 01 2a 01 2b 01 2c 01 2d 01 2e 01 2f 01 30 01 31 01 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00

Stream Path: \x18496\x17165\x16949\x17894\x17778\x18492, File Type: data, Stream Size: 18

General
Stream Path:	\x18496\x17165\x16949\x17894\x17778\x18492
CLSID:
File Type:	data
Stream Size:	18
Entropy:	2.927451224964519
Base64 Encoded:	False
Data ASCII:	7 . \\ . . . . . \\ . . . .
Data Raw:	37 01 5c 01 c8 02 c8 02 00 00 5c 01 c9 02 cb 02 ca 02

Stream Path: \x18496\x17165\x17380\x17074, File Type: data, Stream Size: 528

General
Stream Path:	\x18496\x17165\x17380\x17074
CLSID:
File Type:	data
Stream Size:	528
Entropy:	4.058350723560485
Base64 Encoded:	False
Data ASCII:	! . " . # . { . . . . . . . . . . . . . . . . . . . # . 0 . G . I . 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 r r r r r . r r r . r r . r r r . r r r r r r r . . . . . i . . . U . . U . . . U . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ' . . . . . . . . ' . . . . . . . . . . . . . . . . . . . . . . . . . . . . . \| . ~ . . . ~ . . . . . . . ~ . . ~ . . . . $ . 1 . .
Data Raw:	21 01 22 01 23 01 7b 01 91 01 98 01 ac 01 b6 01 bb 01 c2 01 c6 01 df 01 e5 01 ea 01 ee 01 f2 01 fc 01 fe 01 0d 02 1a 02 23 02 30 02 47 02 49 02 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80 32 80

Stream Path: \x18496\x17167\x16943, File Type: data, Stream Size: 360

General
Stream Path:	\x18496\x17167\x16943
CLSID:
File Type:	data
Stream Size:	360
Entropy:	4.459476294747479
Base64 Encoded:	False
Data ASCII:	5 . 8 . : . < . > . @ . B . D . F . H . J . L . N . P . R . T . V . X . 5 . 8 . : . < . > . @ . B . D . F . H . J . L . N . P . R . T . V . X . . . . . . . . . . H . . . . . . . . . . Z . . . . . . . . n . . : M . . . V . . . . . . . . . x Q . + . . . e . A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	35 01 38 01 3a 01 3c 01 3e 01 40 01 42 01 44 01 46 01 48 01 4a 01 4c 01 4e 01 50 01 52 01 54 01 56 01 58 01 35 01 38 01 3a 01 3c 01 3e 01 40 01 42 01 44 01 46 01 48 01 4a 01 4c 01 4e 01 50 01 52 01 54 01 56 01 58 01 d3 02 d5 02 d7 02 d8 02 d9 02 da 02 db 02 dc 02 dd 02 48 01 df 02 e1 02 e3 02 e5 02 e7 02 e9 02 eb 02 ec 02 00 5a 02 80 00 8a 11 80 8a 02 00 80 17 13 01 80 6e 02 00 80

Stream Path: \x18496\x17490\x17910\x17380\x15279\x16955\x17958\x16951\x16924\x17972\x17512\x16934, File Type: data, Stream Size: 186

General
Stream Path:	\x18496\x17490\x17910\x17380\x15279\x16955\x17958\x16951\x16924\x17972\x17512\x16934
CLSID:
File Type:	data
Stream Size:	186
Entropy:	4.8549469217687165
Base64 Encoded:	False
Data ASCII:	+ . . . . . . . . . . . . . . % . & . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . w . w . w . w . . . . . . . . . . . . . . . . . . . . . . . . . . 2 x . . . 3 e . ) . d @ . ( p . y
Data Raw:	2b 00 19 01 1a 01 1b 01 1c 01 1d 01 1f 01 20 01 25 01 26 01 b9 02 bb 02 bc 02 bd 02 be 02 bf 02 c0 02 c2 02 c3 02 ee 02 ef 02 f0 02 f1 02 f2 02 f3 02 f4 02 f5 02 f6 02 f7 02 f8 02 fc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 02 00 00 fb 02 fa 02 77 02 77 02 77 02 77 02 fd 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32 80 20 83

Stream Path: \x18496\x17490\x17910\x17380\x16303\x16146\x17704\x16952\x16817\x18472, File Type: data, Stream Size: 156

General
Stream Path:	\x18496\x17490\x17910\x17380\x16303\x16146\x17704\x16952\x16817\x18472
CLSID:
File Type:	data
Stream Size:	156
Entropy:	4.772410235054689
Base64 Encoded:	False
Data ASCII:	+ . . . . . . . ! . " . # . $ . . . . . . G . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . j . w . . . . . . . . w . w . . . . . . . . . . . 2 . . . . 1 . . . . . 3 e . f g . d
Data Raw:	2b 00 19 01 1a 01 1b 01 21 01 22 01 23 01 24 01 bb 01 c6 01 df 01 f2 01 fe 01 47 02 b9 02 bb 02 bc 02 bd 02 be 02 c0 02 c1 02 c4 02 ee 02 ef 02 f0 02 f1 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 6a 02 77 02 01 03 f9 02 00 00 fb 02 fa 02 77 02 77 02 fe 02 ff 02 00 00 00 00 00 00 00 00 32 80 20 83 84 83 e8 83 fd 7f fe 7f ff 7f 14 85 31 80 13 85 12 85 0f 85

Stream Path: \x18496\x17548\x17648\x17522\x17512\x18487, File Type: data, Stream Size: 324

General
Stream Path:	\x18496\x17548\x17648\x17522\x17512\x18487
CLSID:
File Type:	data
Stream Size:	324
Entropy:	3.9666210643729887
Base64 Encoded:	False
Data ASCII:	5 . 8 . : . < . > . @ . B . D . F . H . J . L . N . P . R . T . V . X . Z . _ . b . e . g . k . o . s . w . 6 . 9 . ; . = . ? . A . C . E . G . I . K . M . O . Q . S . U . W . Y . [ . ` . c . f . h . l . p . t . x . 7 . 7 . 7 . 7 . 7 . 7 . 7 . 7 . 7 . 7 . 7 . 7 . 7 . 7 . 7 . 7 . 7 . 7 . \\ . \\ . \\ . \\ . \\ . \\ . \\ . \\ . \\ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ] . ] . d . d . i . m . q . u . y . 5 . 8 . : . < . > . @ . B
Data Raw:	35 01 38 01 3a 01 3c 01 3e 01 40 01 42 01 44 01 46 01 48 01 4a 01 4c 01 4e 01 50 01 52 01 54 01 56 01 58 01 5a 01 5f 01 62 01 65 01 67 01 6b 01 6f 01 73 01 77 01 36 01 39 01 3b 01 3d 01 3f 01 41 01 43 01 45 01 47 01 49 01 4b 01 4d 01 4f 01 51 01 53 01 55 01 57 01 59 01 5b 01 60 01 63 01 66 01 68 01 6c 01 70 01 74 01 78 01 37 01 37 01 37 01 37 01 37 01 37 01 37 01 37 01 37 01 37 01

Stream Path: \x18496\x17548\x17905\x17589\x15151\x17522\x17191\x17207\x17522, File Type: data, Stream Size: 656

General
Stream Path:	\x18496\x17548\x17905\x17589\x15151\x17522\x17191\x17207\x17522
CLSID:
File Type:	data
Stream Size:	656
Entropy:	4.119469416598447
Base64 Encoded:	False
Data ASCII:	# . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . # . # . # . # . # . # . # . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ' . ' . ) . ) . 1 . 2 . 4 . 6 . 9 . ; . = . A . C . . . . . . . . . . . . ' . ' . ' . ) . ) . ) . 4 . ; . A . J . J . J . K . K . L . L . N . N . O
Data Raw:	23 01 23 01 c6 01 c6 01 c6 01 c6 01 c6 01 c6 01 c6 01 c6 01 c6 01 c6 01 df 01 df 01 f2 01 f2 01 f2 01 f2 01 fe 01 fe 01 fe 01 fe 01 fe 01 fe 01 fe 01 fe 01 fe 01 fe 01 0d 02 0d 02 0d 02 23 02 23 02 23 02 23 02 23 02 23 02 23 02 23 02 30 02 30 02 30 02 30 02 30 02 30 02 30 02 30 02 30 02 49 02 49 02 49 02 49 02 49 02 49 02 49 02 49 02 49 02 49 02 49 02 49 02 49 02 49 02 49 02 49 02

Stream Path: \x18496\x17548\x17905\x17589\x15279\x16953\x17905, File Type: data, Stream Size: 2052

General
Stream Path:	\x18496\x17548\x17905\x17589\x15279\x16953\x17905
CLSID:
File Type:	data
Stream Size:	2052
Entropy:	4.3339187633802165
Base64 Encoded:	False
Data ASCII:	! . " . # . { . { . { . { . { . { . { . { . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . # . # . # . # . # . # . # . # . # . # . # . # . # . # . # . # . # . # . # . # . # . # . # . # . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . G . G . G . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I . I
Data Raw:	21 01 22 01 23 01 7b 01 7b 01 7b 01 7b 01 7b 01 7b 01 7b 01 7b 01 91 01 98 01 98 01 98 01 98 01 98 01 98 01 98 01 ac 01 ac 01 ac 01 b6 01 b6 01 b6 01 bb 01 c2 01 c2 01 c6 01 df 01 df 01 df 01 df 01 df 01 df 01 df 01 df 01 df 01 df 01 df 01 df 01 df 01 e5 01 ea 01 ea 01 ea 01 ee 01 f2 01 f2 01 f2 01 fc 01 fe 01 fe 01 fe 01 fe 01 fe 01 fe 01 fe 01 fe 01 fe 01 fe 01 fe 01 fe 01 fe 01

Stream Path: \x18496\x17548\x17905\x17589\x18479, File Type: data, Stream Size: 6318

General
Stream Path:	\x18496\x17548\x17905\x17589\x18479
CLSID:
File Type:	data
Stream Size:	6318
Entropy:	4.26763918502298
Base64 Encoded:	True
Data ASCII:	! . ! . ! . ! . ! . ! . ! . " . " . " . " . " . " . " . # . # . # . # . # . # . # . # . # . { . { . { . { . { . { . { . { . { . { . { . { . { . { . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . # . # . # . # . # . # .
Data Raw:	21 01 21 01 21 01 21 01 21 01 21 01 21 01 22 01 22 01 22 01 22 01 22 01 22 01 22 01 23 01 23 01 23 01 23 01 23 01 23 01 23 01 23 01 23 01 7b 01 7b 01 7b 01 7b 01 7b 01 7b 01 7b 01 7b 01 7b 01 7b 01 7b 01 7b 01 7b 01 7b 01 91 01 91 01 91 01 91 01 91 01 91 01 91 01 91 01 98 01 98 01 98 01 98 01 98 01 98 01 98 01 98 01 98 01 ac 01 ac 01 ac 01 ac 01 ac 01 ac 01 ac 01 ac 01 ac 01 ac 01

Stream Path: \x18496\x17610\x16179\x16680\x16821\x18475, File Type: data, Stream Size: 4

General
Stream Path:	\x18496\x17610\x16179\x16680\x16821\x18475
CLSID:
File Type:	data
Stream Size:	4
Entropy:	1.5
Base64 Encoded:	False
Data ASCII:	' . ( .
Data Raw:	27 01 28 01

Stream Path: \x18496\x17630\x17770\x16868\x18472, File Type: data, Stream Size: 48

General
Stream Path:	\x18496\x17630\x17770\x16868\x18472
CLSID:
File Type:	data
Stream Size:	48
Entropy:	2.6261366138271107
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	13 03 13 03 13 03 00 00 d6 02 a4 03 d6 02 00 00 d6 02 00 00 00 00 00 00 01 00 00 80 02 00 00 80 00 01 00 80 00 00 00 00 00 00 a2 03 a3 03 a5 03

Stream Path: \x18496\x17753\x17650\x17768\x18231, File Type: data, Stream Size: 68

General
Stream Path:	\x18496\x17753\x17650\x17768\x18231
CLSID:
File Type:	data
Stream Size:	68
Entropy:	4.119105394885767
Base64 Encoded:	False
Data ASCII:	. . . . . . f . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 . . . . 3 . . . . . . . . . . . . . . . . . .
Data Raw:	0d 01 b9 01 11 02 20 02 66 02 06 03 08 03 09 03 0a 03 0c 03 0e 03 10 03 12 03 14 03 16 03 17 03 19 03 13 03 18 03 8d 02 37 01 07 03 ed 02 33 01 d2 02 0b 03 0d 03 0f 03 11 03 d6 02 15 03 08 02 98 01 1a 03

Stream Path: \x18496\x17814\x15340\x17388\x15464\x17828\x18475, File Type: data, Stream Size: 100

General
Stream Path:	\x18496\x17814\x15340\x17388\x15464\x17828\x18475
CLSID:
File Type:	data
Stream Size:	100
Entropy:	6.0555669755416295
Base64 Encoded:	False
Data ASCII:	: . < . > . @ . B . . . . . . q 2 . B . . . ) * o 3 T d . 6 " . . . ( ) . . ? ? z . 4 x ; r $ - 1 < N J , k . @ . . . P s
Data Raw:	3a 01 3c 01 3e 01 40 01 42 01 00 80 00 80 00 80 00 80 00 80 71 b7 32 f0 05 85 42 1c 17 c9 1e 29 b1 2a 6f 33 f2 8f 54 d0 eb 64 84 1e 9b 36 22 18 09 d1 cc b0 28 e5 29 07 f5 8d b6 fd 15 a0 f0 3f 3f ee 7a 1b 34 78 3b 72 24 2d 31 d0 3c 8b 4e 4a 2c 6b c1 e6 1f e2 40 e5 0b ee fc ad 11 f5 0a a0 50 73 b5 90

Stream Path: \x18496\x17932\x17910\x17458\x16778\x17207\x17522, File Type: data, Stream Size: 156

General
Stream Path:	\x18496\x17932\x17910\x17458\x16778\x17207\x17522
CLSID:
File Type:	data
Stream Size:	156
Entropy:	3.5096307907535707
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . A A 3 . 3 3 . . . . A A A + . + . . ) . 7 . 7 . ) . ) . * . ) . ) . ) . ) . . . 3 . . . . . . * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	89 02 b4 02 b9 02 bb 02 bc 02 bd 02 be 02 bf 02 c0 02 c1 02 c2 02 c3 02 c4 02 41 80 41 80 33 80 01 81 33 80 33 80 01 81 01 80 01 81 01 81 41 80 41 80 41 80 2b 01 2b 01 ba 02 29 01 37 01 37 01 29 01 29 01 2a 01 29 01 29 01 29 01 29 01 c5 02 c6 02 33 01 bb 02 95 02 96 02 be 02 bf 02 2a 01 c1 02 c2 02 c3 02 c4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x18496\x17998\x17512\x15799\x17636\x17203\x17073, File Type: data, Stream Size: 56

General
Stream Path:	\x18496\x17998\x17512\x15799\x17636\x17203\x17073
CLSID:
File Type:	data
Stream Size:	56
Entropy:	3.6190642393150787
Base64 Encoded:	False
Data ASCII:	{ . . . . . # . # . . . . . . , . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	7b 01 bb 01 bb 01 c6 01 c6 01 23 02 23 02 83 01 c0 01 c1 01 c1 01 db 01 2c 02 2e 02 cc 02 c0 01 c1 01 c1 01 cd 02 cf 02 d0 02 cc 02 1f 00 1f 00 1f 00 ce 02 1f 00 1f 00

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Arixcel_Explorer_v8.7.8793.msi

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Software Vulnerabilities

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Created / dropped Files

C:\Config.Msi\5cb73b.rbs

C:\Users\user\AppData\Local\Arixcel Explorer\Aga.Controls.dll

C:\Users\user\AppData\Local\Arixcel Explorer\Arixcel.Common.dll

C:\Users\user\AppData\Local\Arixcel Explorer\Arixcel.Controls.dll

C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.dll

C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.dll.config

C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.dll.manifest

C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.log4net

C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.vsto

C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.xlam

C:\Users\user\AppData\Local\Arixcel Explorer\Microsoft.Office.Tools.Common.v4.0.Utilities.dll

C:\Users\user\AppData\Local\Arixcel Explorer\Newtonsoft.Json.dll

C:\Users\user\AppData\Local\Arixcel Explorer\System.Buffers.dll

C:\Users\user\AppData\Local\Arixcel Explorer\System.Memory.dll

C:\Users\user\AppData\Local\Arixcel Explorer\System.Numerics.Vectors.dll

C:\Users\user\AppData\Local\Arixcel Explorer\System.Runtime.CompilerServices.Unsafe.dll

C:\Users\user\AppData\Local\Arixcel Explorer\System.Threading.Channels.dll

C:\Users\user\AppData\Local\Arixcel Explorer\System.Threading.Tasks.Extensions.dll

C:\Users\user\AppData\Local\Arixcel Explorer\log4net.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1D601E47.tmp (copy)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\6O27WT20.log

C:\Users\user\AppData\Local\Temp\ArixcelExplorer.log

C:\Users\user\AppData\Local\Temp\MSI8C71.tmp

C:\Users\user\AppData\Local\Temp\MSI8CFF.tmp-\CustomAction.config

C:\Users\user\AppData\Local\Temp\MSI8CFF.tmp-\Microsoft.Deployment.WindowsInstaller.dll

C:\Users\user\AppData\Local\Temp\MSI8E86.tmp-\ArixcelSetup.dll

C:\Users\user\AppData\Local\Temp\MSI905C.tmp

C:\Users\user\AppData\Local\Temp\~DF1BF63C73D47F646D.TMP

C:\Users\user\AppData\Local\Temp\~DFD2AA41CFBB79474C.TMP

C:\Users\user\AppData\Local\assembly\tmp\2YQK1WIO\__AssemblyInfo__.ini

C:\Users\user\AppData\Local\assembly\tmp\9WIRSJYC\__AssemblyInfo__.ini

C:\Users\user\AppData\Local\assembly\tmp\FNYW4YDD\__AssemblyInfo__.ini

C:\Users\user\AppData\Local\assembly\tmp\HWC6L5O8\__AssemblyInfo__.ini

C:\Users\user\AppData\Local\assembly\tmp\OCUJWGU0\__AssemblyInfo__.ini

C:\Users\user\AppData\Local\assembly\tmp\PFAA2LU0\__AssemblyInfo__.ini

Windows Analysis Report
Arixcel_Explorer_v8.7.8793.msi

C:\Users\user\AppData\Local\assembly\tmp\2YQK1WIO\AssemblyInfo.ini

C:\Users\user\AppData\Local\assembly\tmp\9WIRSJYC\AssemblyInfo.ini

C:\Users\user\AppData\Local\assembly\tmp\FNYW4YDD\AssemblyInfo.ini

C:\Users\user\AppData\Local\assembly\tmp\HWC6L5O8\AssemblyInfo.ini

C:\Users\user\AppData\Local\assembly\tmp\OCUJWGU0\AssemblyInfo.ini

C:\Users\user\AppData\Local\assembly\tmp\PFAA2LU0\AssemblyInfo.ini

C:\Users\user\AppData\Local\assembly\tmp\QMQ4QZ9O\AssemblyInfo.ini

C:\Users\user\AppData\Local\assembly\tmp\V1H78IGM\AssemblyInfo.ini

C:\Users\user\AppData\Local\assembly\tmp\ZDZO238B\AssemblyInfo.ini