Edit tour

Windows Analysis Report
cfrv_4_0_setup_ALL.exe

Overview

General Information

Sample name:	cfrv_4_0_setup_ALL.exe
Analysis ID:	1490348
MD5:	9197aeadf996dd8cd3885a205927671e
SHA1:	3bf1368b4dae680e580d3958299f9636e255cba8
SHA256:	94e6740812caeb857ef6065984ab4138d56ad4b517c62f2611f303eab519676c
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Injects code into the Windows Explorer (explorer.exe)

May use the Tor software to hide its network traffic

Sigma detected: Files With System Process Name In Unsuspected Locations

Checks for available system drives (often done to infect USB drives)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Creates Visual Basic Runtime Dlls

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file contains strange resources

PE file does not import any functions

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample file is different than original file name gathered from version info

Sigma detected: Explorer Process Tree Break

Sigma detected: Suspicious Msiexec Execute Arbitrary DLL

Sigma detected: Use NTFS Short Name in Command Line

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

cfrv_4_0_setup_ALL.exe (PID: 7520 cmdline: "C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe" MD5: 9197AEADF996DD8CD3885A205927671E)

cfrv_4_0_setup_ALL.exe (PID: 7624 cmdline: .\cfrv_4_0_setup_ALL.exe /m="C:\Users\user\Desktop\CFRV_4~1.EXE" /k="" MD5: 3B2D532673D1567116105D04C621CDBA)

regsvr32.exe (PID: 7888 cmdline: "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\mscomctl.ocx" /s MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 7928 cmdline: "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\COMDLG32.OCX" /s MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 7968 cmdline: "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\COMCT332.OCX" /s MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 7996 cmdline: "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\TABCTL32.OCX" /s MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 8088 cmdline: "C:\Windows\system32\regsvr32.exe" "C:\Program Files (x86)\Common Files\microsoft shared\DAO\DAO350.DLL" /s MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 8124 cmdline: "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_CR_control.dll" /s MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 8152 cmdline: "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_DB_Connect.dll" /s MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 8176 cmdline: "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_File_Data.dll" /s MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 7176 cmdline: "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_File_Export.dll" /s MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 7260 cmdline: "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_Rmt_DB4_Update.dll" /s MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

explorer.exe (PID: 2672 cmdline: "C:\Windows\explorer.exe" /separate /root,::{21ec2020-3aea-1069-a2dd-08002b30309d} MD5: 662F4F92FDE3557E86D110526BB578D5)

msiexec.exe (PID: 7296 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7188 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding BC4BF7B426F2DEC97D7EFEF329A7CA50 MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 7268 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\craxdrt.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 7508 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crviewer.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 7580 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\Crystal\Cdo32.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 1816 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crtslv.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 4268 cmdline: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\ExportModeller.dll" MD5: 9D09DC1EDA745A5F87553048E57620CF)

explorer.exe (PID: 2380 cmdline: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding MD5: 662F4F92FDE3557E86D110526BB578D5)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000000.1800575548.0000000000401000.00000020.00000001.01000000.00000004.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Process Memory Space: cfrv_4_0_setup_ALL.exe PID: 7520	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
1.0.cfrv_4_0_setup_ALL.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe, ProcessId: 7520, TargetFilename: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiexec.exe

Sigma detected: Explorer Process Tree Break

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber: Data: Command: "C:\Windows\explorer.exe" /separate /root,::{21ec2020-3aea-1069-a2dd-08002b30309d}, CommandLine: "C:\Windows\explorer.exe" /separate /root,::{21ec2020-3aea-1069-a2dd-08002b30309d}, CommandLine|base64offset|contains: j, Image: C:\Windows\explorer.exe, NewProcessName: C:\Windows\explorer.exe, OriginalFileName: C:\Windows\explorer.exe, ParentCommandLine: .\cfrv_4_0_setup_ALL.exe /m="C:\Users\user\Desktop\CFRV_4~1.EXE" /k="", ParentImage: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe, ParentProcessId: 7624, ParentProcessName: cfrv_4_0_setup_ALL.exe, ProcessCommandLine: "C:\Windows\explorer.exe" /separate /root,::{21ec2020-3aea-1069-a2dd-08002b30309d}, ProcessId: 2672, ProcessName: explorer.exe

Sigma detected: Suspicious Msiexec Execute Arbitrary DLL

Source: Process started

Author: frack113: Data: Command: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\craxdrt.dll", CommandLine: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\craxdrt.dll", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\msiexec.exe, NewProcessName: C:\Windows\SysWOW64\msiexec.exe, OriginalFileName: C:\Windows\SysWOW64\msiexec.exe, ParentCommandLine: C:\Windows\system32\msiexec.exe /V, ParentImage: C:\Windows\System32\msiexec.exe, ParentProcessId: 7296, ParentProcessName: msiexec.exe, ProcessCommandLine: "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\craxdrt.dll", ProcessId: 7268, ProcessName: msiexec.exe

Sigma detected: Use NTFS Short Name in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: Command: .\cfrv_4_0_setup_ALL.exe /m="C:\Users\user\Desktop\CFRV_4~1.EXE" /k="", CommandLine: .\cfrv_4_0_setup_ALL.exe /m="C:\Users\user\Desktop\CFRV_4~1.EXE" /k="", CommandLine|base64offset|contains: , Image: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe, NewProcessName: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe, OriginalFileName: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe, ParentCommandLine: "C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe", ParentImage: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe, ParentProcessId: 7520, ParentProcessName: cfrv_4_0_setup_ALL.exe, ProcessCommandLine: .\cfrv_4_0_setup_ALL.exe /m="C:\Users\user\Desktop\CFRV_4~1.EXE" /k="", ProcessId: 7624, ProcessName: cfrv_4_0_setup_ALL.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: cfrv_4_0_setup_ALL.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe

File created: c:\tmp\log\installs\CF_Remote\install.log

Jump to behavior

Source:	Binary string: MsiHnd.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005B42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MsiHnd.pdbV source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005B42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shfolder.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shfolder.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rF,c:\Windows\System32\ImgXTwain61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gacutil.pdb source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2074052704.000000000519C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000000.1801199896.0000000000842000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: GameuxInstallHelper.pdb source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000000.1801199896.0000000000842000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: c:\Windows\System32\ImgX61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gacutil.pdb(0 source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2074052704.000000000519C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000000.1801199896.0000000000842000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: sdbapiu.pdbU source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: usp10.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msisip.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005B42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Windows\System32\ImgXPrint61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rFXc:\Windows\System32\ImgX61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000069F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sdbapiu.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: riched20.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mspatcha.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005DA3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Y:\EPFXlate\HTML\ReleaseSym\exlate32.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000533A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msi.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005984000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Windows\System32\ImgXTwain61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rFWc:\Windows\System32\ImgX61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gacutil.pdb, AH/@ source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000000.1801199896.0000000000842000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: sdbapi.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msi_l.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: usp10.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imagehlp.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000533A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msi.pdbh source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005984000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mspatcha.pdbtvbl01\LOCALS~1\Temp\2\DBGtoPDB\mspatcha.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005DA3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imagehlp.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000533A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: riched20.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sdbapi.pdbU source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Y:\EPFXlate\HTML\ReleaseSym\exlate32.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000533A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: tvbl01\LOCALS~1\Temp\2\DBGtoPDB\mspatcha.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005DA3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msisip.pdb3 source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005B42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rF,c:\Windows\System32\ImgXPrint61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gacutlrc.pdb source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2074052704.000000000519C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000000.1801199896.0000000000842000.00000002.00000001.01000000.00000004.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:
Source: C:\Windows\System32\msiexec.exe	File opened: x:
Source: C:\Windows\System32\msiexec.exe	File opened: v:
Source: C:\Windows\System32\msiexec.exe	File opened: t:
Source: C:\Windows\System32\msiexec.exe	File opened: r:
Source: C:\Windows\System32\msiexec.exe	File opened: p:
Source: C:\Windows\System32\msiexec.exe	File opened: n:
Source: C:\Windows\System32\msiexec.exe	File opened: l:
Source: C:\Windows\System32\msiexec.exe	File opened: j:
Source: C:\Windows\System32\msiexec.exe	File opened: h:
Source: C:\Windows\System32\msiexec.exe	File opened: f:
Source: C:\Windows\System32\msiexec.exe	File opened: b:
Source: C:\Windows\System32\msiexec.exe	File opened: y:
Source: C:\Windows\System32\msiexec.exe	File opened: w:
Source: C:\Windows\System32\msiexec.exe	File opened: u:
Source: C:\Windows\System32\msiexec.exe	File opened: s:
Source: C:\Windows\System32\msiexec.exe	File opened: q:
Source: C:\Windows\System32\msiexec.exe	File opened: o:
Source: C:\Windows\System32\msiexec.exe	File opened: m:
Source: C:\Windows\System32\msiexec.exe	File opened: k:
Source: C:\Windows\System32\msiexec.exe	File opened: i:
Source: C:\Windows\System32\msiexec.exe	File opened: g:
Source: C:\Windows\System32\msiexec.exe	File opened: e:
Source: C:\Windows\explorer.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_00407E20 FindNextFileW,FindClose,FindFirstFileW,FindFirstFileW,	0_2_00407E20
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD82A30 _memset,FindFirstFileW,LoadLibraryW,FindClose,FindResourceW,LoadLibraryW,	1_2_6CD82A30
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD72470 FindClose,FindFirstFileW,FindFirstFileW,	1_2_6CD72470

Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File opened: C:\ProgramData\Microsoft\Windows\Start Menu	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File opened: C:\ProgramData\Microsoft\Windows\Start Menu\Programs	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File opened: C:\ProgramData\Microsoft	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File opened: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Campaign Finance\CF Remote.lnk	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File opened: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Campaign Finance	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File opened: C:\ProgramData\Microsoft\Windows	Jump to behavior

Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2245112023.00000000027A4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: HTTP://WWW.MYWEBSITE.COM/NEW
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2245112023.0000000002763000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: HTTP://WWW.NCSBE.GOVMICROSOFT
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054BA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteCodeSigningCA.crl0
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054BA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawtePremiumServerCA.crl0
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054BA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1800575548.0000000000418000.00000020.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://standards.iso.org/iso/19770/-2/2008/schema.xsd
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://subca.ocsp-certum.com01
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://subca.ocsp-certum.com02
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://subca.ocsp-certum.com05
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ImgX.net/
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ImgX.net/ImgX/purchase.asp
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.certum.pl/CPS0
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1800575548.0000000000418000.00000020.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.installaware.com/
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.installaware.com/0
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.installaware.com/InstallAware
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2074052704.000000000519C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000000.1801199896.0000000000842000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.installaware.comz
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2074052704.000000000519C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2245112023.00000000027A4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mywebsite.com/New
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2245112023.00000000027A4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ncsbe.gov
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ncsbe.govMicrosoft
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000678A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.seagatesoftware.com/xml/schema.xsdxsddtdw
Source: explorer.exe, 00000018.00000002.2964544574.00000000068B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000018.00000002.2964544574.00000000068B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmX5W$8
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0C
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1800575548.00000000007AE000.00000020.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FFC7D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.installaware.com/buydirect.aspopen

Source: Yara match

File source: Process Memory Space: cfrv_4_0_setup_ALL.exe PID: 7520, type: MEMORYSTR

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe

File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.cat

Jump to dropped file

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe

File created: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\msvbvm60.dll

Jump to behavior

Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File created: C:\Windows\NCSBOE	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File created: C:\Windows\system32\myah0.cpl	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4937c6.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI38EF.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI396D.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{152D390A-DD7B-4E57-B3A5-14CADE7E1207}
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI39BC.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI39DC.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3A5A.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\Crpe32.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\Crpaig80.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\Implode.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\crwrap32.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\craxdrt.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\crviewer.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\sscsdk80.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\pg32conv.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\P2smon.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\Cdo32.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\p2ixbse.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\p2lodbc.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\p2sodbc.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\exlate32.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\QECR.LIC
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRBAS15.DLL
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRBAS15R.DLL
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRUTL15.DLL
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRUTL15R.DLL
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRXML15.DLL
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRXML15R.DLL
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRXML15S.DLL
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRxmlx07.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRxmlx07r.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2lsamp1.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u25dts.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2ldts.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2lfinra.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2lexch.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2l2000.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u252000.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2lcom.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\Crxlat32.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2dapp.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2ddisk.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2dmapi.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2dnotes.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2dpost.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2dvim.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2fcr.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2fhtml.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\crxf_pdf.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\crtslv.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ExportModeller.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\crxf_rtf.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2fsepv.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2fxml.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2fxls.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4937c9.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4937c9.msi

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI38EF.tmp

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_0040B1D0	0_2_0040B1D0
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_00419D20	0_2_00419D20
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_0041FF60	0_2_0041FF60
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_00401000	0_2_00401000
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_00401100	0_2_00401100
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_004011C0	0_2_004011C0
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_004011D8	0_2_004011D8
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_00409180	0_2_00409180
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_004042D0	0_2_004042D0
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_0040F2F0	0_2_0040F2F0
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_004013F0	0_2_004013F0
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_004234D0	0_2_004234D0
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_004105D0	0_2_004105D0
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_004055E0	0_2_004055E0
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_004045A0	0_2_004045A0
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_004015B0	0_2_004015B0
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_0040E740	0_2_0040E740
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_00403760	0_2_00403760
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_00425AE7	0_2_00425AE7
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_00401AB0	0_2_00401AB0
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_00412B50	0_2_00412B50
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_0040DC00	0_2_0040DC00
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_10001000	1_2_10001000
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_10009028	1_2_10009028
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_10017330	1_2_10017330
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_100153E0	1_2_100153E0
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_1000D450	1_2_1000D450
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_1001E5C3	1_2_1001E5C3
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_10017710	1_2_10017710
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_1001E751	1_2_1001E751
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_1000E770	1_2_1000E770
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_100127E0	1_2_100127E0
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_1001E82B	1_2_1001E82B
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_100178D0	1_2_100178D0
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_1000C8E0	1_2_1000C8E0
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_10014A40	1_2_10014A40
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_1000EB10	1_2_1000EB10
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_1000CCA0	1_2_1000CCA0
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_1001AD1A	1_2_1001AD1A
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_10016D80	1_2_10016D80
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_10017DC0	1_2_10017DC0
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_10012F00	1_2_10012F00
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_10016F80	1_2_10016F80
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD74C00	1_2_6CD74C00
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD6AE70	1_2_6CD6AE70
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD68AB0	1_2_6CD68AB0
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD66460	1_2_6CD66460
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD735F0	1_2_6CD735F0
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD7FEE0	1_2_6CD7FEE0
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD88E1B	1_2_6CD88E1B
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD7B9C0	1_2_6CD7B9C0
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD7E950	1_2_6CD7E950
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD6B447	1_2_6CD6B447
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD8E6B0	1_2_6CD8E6B0
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD6E670	1_2_6CD6E670
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD8E78B	1_2_6CD8E78B
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD6D1B0	1_2_6CD6D1B0

Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: String function: 6CD87AA4 appears 37 times
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: String function: 6CD64C80 appears 39 times
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: String function: 10018EB0 appears 94 times
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: String function: 00405140 appears 35 times
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: String function: 00423A98 appears 36 times

Source: cfrv_4_0_setup_ALL.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: cfrv_4_0_setup_ALL.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: cfrv_4_0_setup_ALL.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows
Source: cfrv_4_0_setup_ALL.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: cfrv_4_0_setup_ALL.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (console) Intel 80386, for MS Windows
Source: cfrv_4_0_setup_ALL.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: cfrv_4_0_setup_ALL.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (console) Intel 80386, for MS Windows
Source: msi.dll.0.dr	Static PE information: Resource name: None type: DOS executable (COM)
Source: msi.dll0.0.dr	Static PE information: Resource name: None type: DOS executable (COM)

Source: crviewer.dll.0.dr	Static PE information: Resource name: None type: GLS_BINARY_LSB_FIRST
Source: crviewer.dll.0.dr	Static PE information: Resource name: None type: GLS_BINARY_LSB_FIRST
Source: crviewer.dll.0.dr	Static PE information: Resource name: None type: GLS_BINARY_LSB_FIRST
Source: crviewer.dll.0.dr	Static PE information: Resource name: None type: GLS_BINARY_LSB_FIRST
Source: crviewer.dll.0.dr	Static PE information: Resource name: None type: GLS_BINARY_LSB_FIRST
Source: crviewer.dll.0.dr	Static PE information: Resource name: None type: GLS_BINARY_LSB_FIRST
Source: crviewer.dll.0.dr	Static PE information: Resource name: None type: GLS_BINARY_LSB_FIRST

Source: stdole2.tlb.0.dr	Static PE information: No import functions for PE file found
Source: CRxmlx07r.dll.0.dr	Static PE information: No import functions for PE file found

Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005D7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMSLS31.DLLR vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005507000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLogFile.dll, vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005DA3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMSLS31.DLLR vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005DA3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemspatcha.dll: vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1799448541.00000000072E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCS40_CA.DLLj% vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000006C1C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevbalColumnTreeView6.ocx, vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000058E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsi.dllX vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000052AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCS40_CA.DLLj% vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005AA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsi.dllD vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1799448541.00000000072C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCS40_CA.DLLj% vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000006B76000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMSCOMCTL.OCX2 vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1799260205.00000000024A9000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCS40_CA.DLLj% vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000006729000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSSubTmr6.dll, vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000006729000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameu252000.dllP vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000006729000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameU25dts.dll vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000006729000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameuxdapp.dllP vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000006729000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameuxddisk.dllDisk file vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000006729000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameuxdmapi.dll" vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000006729000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameuxdnotes.dll vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000006723000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSSCsdk32.dll vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameU2ldts.dll vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameu2lexch.dll vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameu2lfinra.dll2FRCurrentRatio(CurrentAssets, CurrentLiabilities)=FRQuickRatio(CurrentAssets, Inventories, CurrentLiabilities)1FRDebtEquityRatio(TotalLiabilities, TotalEquity)0FREquityVsTotalAssets(TotalEquity, TotalAssets)$FRNetProfitMargin(NetProfit, Sales)(FRGrossProfitMargin(GrossProfit, Sales)0FROperatingProfitMargin(OperatingProfit, Sales)/FRInterestCoverage(CashFlow, InterestExpenses)+FRCashFlowVsTotalDebt(CashFlow, TotalDebt))FRReturnOnEquity(NetProfit, TotalEquity)4FRReturnOnNetFixedAssets(NetProfit, NetFixedAssets).FRReturnOnTotalAssets(NetProfit, TotalAssets)BFRReturnOnInvestedCapital(NetProfit, TotalBankDebts, TotalEquity)CFRReturnOnCommonEquity(NetProfit, PreferredDividend, CommonEquity)IFREarningsPerCommonShare(NetProfit, PreferredDividend, NumOfCommonShare)6FRAccRecTurnover(AccountReceivable, Sales, NumOfDays)1FRInventoryTurnover(Inventory, Sales, NumOfDays)4FRPriceEarningsRatio(MarketPrice, EarningsPerShare)'FRDividendYield(Dividend, MarketPrice) vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameu2lsamp1.dll vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUniscribe vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevbalFlBr6.dll, vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameW95INF16.DLL5%ProductNameMicrosoft vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameW95INF32.DLLj% vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCF_Login.ocx, vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCF_Transaction.ocx, vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamecomct332.ocx, vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCOMDLG32.OCX2 vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005B42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsihnd.dllX vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005B42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsihnd.dllD vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005B42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsimsg.dllX vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005B42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMSISIP.DLLX vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005B42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMSISIP.DLLD vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000052CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCS40_CA.DLLj% vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000052CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEXLATE32.DLL" vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000681A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameu2fxml.dll vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000681A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameu2l2000.dllP vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000681A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameu2lcom.dll@ vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameOLEPRO32.DLL( vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamep2ixbse.dll vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepdlodbc.dll vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamep2smon.dll@ vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamep2sodbc.dll" vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameriched20.dllp( vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VerQueryValueAGetFileVersionInfoAGetFileVersionInfoSizeALegalCopyrightInternalNameOriginalFilenameFileVersionProductNameCompanyNameFileDescriptionProductVersionDOSWIN32WIN16NONETAGIDTAGSTRTAB_ITEMINDEX_BITSINDEX_KEYINDEX_TAGINDEXINDEXESSTRINGTABLEMATCH_MODEDATABASE_ID(GUID)MSI_PACKAGE_ID(GUID)DATA_BITSEXE_ID(GUID)FILE_BITSPATCH_BITSFLAGS_NTVDM3FLAGS_NTVDM2FLAGS_NTVDM1DATA_QWORDUPTO_BIN_FILE_VERSIONUPTO_BIN_PRODUCT_VERSIONFLAG_MASK_SHELLFLAG_MASK_USERFLAG_MASK_KERNELMODTIMEBIN_PRODUCT_VERSIONBIN_FILE_VERSIONTIMEAPPLY_ALL_SHIMSMATCH_LOGIC_NOTGENERALINCLUDERUNTIME_PLATFORMMSI_TRANSFORM_TAGIDDATA_DWORDVALUETYPEFLAGSENGINEAPPHELP_LANGIDINDEXFLAGSHTMLHELPIDPROBLEM_SEVERITYPREVOSBUILDNOPREVOSPLATFORMIDPREVOSMINORVERSIONPREVOSMAJORVERSIONVER_LANGUAGEOS_SERVICE_PACKUPTO_LINK_DATELINK_DATELINKER_VERSIONPE_CHECKSUMVERFILETYPEVERFILEOSVERFILEDATELOVERFILEDATEHIMODULE_TYPEFLAG_TAGIDLAYER_TAGIDPATCH_TAGIDSHIM_TAGIDCHECKSUMOFFSETSIZECOMPILER_VERSIONLAYER_DISPLAYNAMES16BIT_MODULE_NAMEMSI_TRANSFORM_FILEDATA_STRINGSXS_MANIFESTAPPHELP_CONTACTAPPHELP_TITLELINK_TEXTLINK_URLPROBLEM_DETAILSS16BIT_DESCRIPTIONLEGAL_COPYRIGHTINTERNAL_NAMEORIGINAL_FILENAMEFILE_VERSIONFILE_DESCRIPTIONPRODUCT_VERSIONPRODUCT_NAMEWILDCARD_NAMECOMPANY_NAMECOMMAND_LINEDLLFILEAPP_NAMEVENDORAPIMODULEDESCRIPTIONNAMEMSI CUSTOM ACTIONMSI PACKAGEMSI TRANSFORM REFMSI TRANSFORMDATALINKAPPHELPFILELAYERFLAG_REFPATCH_REFSHIM_REFMATCHING_FILEEXEAPPFLAGPATCHSHIMINEXCLUDELIBRARYDATABASETagToIndexInvalid attribute 0x%x. vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesdbapi.dll vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VerQueryValueWGetFileVersionInfoWGetFileVersionInfoSizeWLegalCopyrightInternalNameOriginalFilenameFileVersionProductNameCompanyNameFileDescriptionProductVersionDOSWIN32WIN16NONETAGIDTAGSTRTAB_ITEMINDEX_BITSINDEX_KEYINDEX_TAGINDEXINDEXESSTRINGTABLEMATCH_MODEDATABASE_ID(GUID)MSI_PACKAGE_ID(GUID)DATA_BITSEXE_ID(GUID)FILE_BITSPATCH_BITSFLAGS_NTVDM3FLAGS_NTVDM2FLAGS_NTVDM1DATA_QWORDUPTO_BIN_FILE_VERSIONUPTO_BIN_PRODUCT_VERSIONFLAG_MASK_SHELLFLAG_MASK_USERFLAG_MASK_KERNELMODTIMEBIN_PRODUCT_VERSIONBIN_FILE_VERSIONTIMEAPPLY_ALL_SHIMSMATCH_LOGIC_NOTGENERALINCLUDERUNTIME_PLATFORMMSI_TRANSFORM_TAGIDDATA_DWORDVALUETYPEFLAGSENGINEAPPHELP_LANGIDINDEXFLAGSHTMLHELPIDPROBLEM_SEVERITYPREVOSBUILDNOPREVOSPLATFORMIDPREVOSMINORVERSIONPREVOSMAJORVERSIONVER_LANGUAGEOS_SERVICE_PACKUPTO_LINK_DATELINK_DATELINKER_VERSIONPE_CHECKSUMVERFILETYPEVERFILEOSVERFILEDATELOVERFILEDATEHIMODULE_TYPEFLAG_TAGIDLAYER_TAGIDPATCH_TAGIDSHIM_TAGIDCHECKSUMOFFSETSIZECOMPILER_VERSIONLAYER_DISPLAYNAMES16BIT_MODULE_NAMEMSI_TRANSFORM_FILEDATA_STRINGSXS_MANIFESTAPPHELP_CONTACTAPPHELP_TITLELINK_TEXTLINK_URLPROBLEM_DETAILSS16BIT_DESCRIPTIONLEGAL_COPYRIGHTINTERNAL_NAMEORIGINAL_FILENAMEFILE_VERSIONFILE_DESCRIPTIONPRODUCT_VERSIONPRODUCT_NAMEWILDCARD_NAMECOMPANY_NAMECOMMAND_LINEDLLFILEAPP_NAMEVENDORAPIMODULEDESCRIPTIONNAMEMSI CUSTOM ACTIONMSI PACKAGEMSI TRANSFORM REFMSI TRANSFORMDATALINKAPPHELPFILELAYERFLAG_REFPATCH_REFSHIM_REFMATCHING_FILEEXEAPPFLAGPATCHSHIMINEXCLUDELIBRARYDATABASETagToIndexInvalid attribute 0x%x. vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000678A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUXDPOST.dll vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000678A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameuxdvim.dllP vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000678A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameuxfcr.dll vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000678A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameu2fhtml.dll vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000678A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameuxfsepv.dllD vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000678A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUxfxls.dll" vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000533A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExportModeller.DLL vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000533A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameimagehlp.dllz- vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000533A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImgX61.dll, vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImgXPrint61.dll, vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImgXTwain61.dll, vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameimplode.dllL vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImgX61.ocx, vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000006A8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMSChart.ocx@ vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000006CDD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zxa.dll, vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000550E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLogFile.dll, vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2074052704.000000000519C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegacutil.exeT vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2074052704.000000000519C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamez vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2074052704.000000000519C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegacutlrc.dllT vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename7zxa.dll, vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2078124953.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameA- vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilename7zxa.dll, vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2107166034.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameA- vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2246318412.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameA- vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameahadmin_wrapper.dll4 vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameahadmin_.dll4 vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGameuxInstallHelper.DLLb! vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameManagedVCL.Utils.dll8 vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegacutil.exeT vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegacutlrc.dllT vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamez vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2246809922.0000000000C7A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEXPLORER.EXEj% vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1898657978.0000000000CA2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameREGSVR32.EXEj% vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2081929468.0000000005326000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zxa.dll, vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1806183496.00000000FFE03000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zxa.dll, vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1801199896.0000000000842000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameahadmin_wrapper.dll4 vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1801199896.0000000000842000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameahadmin_.dll4 vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1801199896.0000000000842000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameGameuxInstallHelper.DLLb! vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1801199896.0000000000842000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameManagedVCL.Utils.dll8 vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1801199896.0000000000842000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamegacutil.exeT vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1801199896.0000000000842000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamegacutlrc.dllT vs cfrv_4_0_setup_ALL.exe
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1801199896.0000000000842000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamez vs cfrv_4_0_setup_ALL.exe

Source: cfrv_4_0_setup_ALL.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4*\AC:\SteveMac\VB6\Develop\vbalFolderBrowse\vbalFolderBrowse6.vbp,
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000006729000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .*\AC:\SteveMac\VB6\XHELPE~1\SSubTmr\SubTimer6.vbp
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2074052704.000000000519C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: TRUE\|.wse;.zip;.vbp;.vbw;.vbg;.frm;.frx;.bas;.cls;.ctl;*.ctx
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000006C1C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GD*\AC:\SteveMac\VB6\Controls\vbalTreeView6\MultiColumn\vbalColumnTreeViewLib6.vbp

Source: classification engine

Classification label: mal52.evad.winEXE@39/565@0/0

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe

Code function: 0_2_0041B110 GetLastError,FormatMessageW,LocalFree,

0_2_0041B110

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe

Code function: 0_2_0041F320 GetVersion,CoCreateInstance,

0_2_0041F320

Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe

Code function: 1_2_6CD82980 LoadResource,SizeofResource,LockResource,CreateFileW,WriteFile,CloseHandle,DeleteFileW,

1_2_6CD82980

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\SBoE

Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe

File created: C:\Users\user\AppData\Local\IIIQF

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Mutant created: NULL

Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe

File created: C:\Users\user\AppData\Local\Temp\mia1

Jump to behavior

Source: Yara match	File source: 1.0.cfrv_4_0_setup_ALL.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1800575548.0000000000401000.00000020.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe, type: DROPPED

Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\explorer.exe	Jump to behavior

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Command line argument: kernel32.dll	0_2_0041FF60
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Command line argument: SetDllDirectory	0_2_0041FF60
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Command line argument: "-k=	0_2_0041FF60
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Command line argument: "/k=	0_2_0041FF60
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Command line argument: -k=	0_2_0041FF60
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Command line argument: /k=	0_2_0041FF60
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Command line argument: Title	0_2_0041FF60
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Command line argument: BeginPrompt	0_2_0041FF60
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Command line argument: Progress	0_2_0041FF60
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Command line argument: Directory	0_2_0041FF60
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Command line argument: RunProgram	0_2_0041FF60
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Command line argument: ExecuteFile	0_2_0041FF60
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Command line argument: `A	0_2_0041FF60
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Command line argument: setup.exe	0_2_0041FF60
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Command line argument: %%T	0_2_0041FF60
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Command line argument: %%T\	0_2_0041FF60
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Command line argument: mia.lib	0_2_0041FF60
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Command line argument: runas	0_2_0041FF60

Source: cfrv_4_0_setup_ALL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1918612676.0000000000CA2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO `Property` ( `Property` , `Value` ) VALUES ( 'PA818FD51_1' , 'C:\Users\user\Desktop\' )O;p=
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000052AE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1799448541.00000000072C0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000524A000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1799448541.0000000007260000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: select * from CS_ErrorDescription'select * from sysdatabases where name='masterSQLSERVER_FATAL_ERROR1ValidateDB;Network Library=dbmssocnNetwork Library=dbmssocnd:\cs40\private\cs40\setup\ca_dll\database.cppCommitDB%s
Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000006A8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Selects the chart legend.W9Returns/sets the number of data columns in the data grid.WMReturns/sets the number of levels of labels on data columns in the data grid.WJReturns/sets the number of levels of labels on data rows in the data grid.6Returns/sets the number of data rows in the data grid.GDeletes columns of data and their associated labels from the data grid.WWW/Adds one or more data columns to the data grid.WWW>Deletes levels of labels from the data columns in a data grid.GAdds one or more levels of labels to the data columns in the data grid.WWWDDeletes rows of data and their associated labels from the data grid.WW,Adds one or more data rows to the data grid.WW;Deletes levels of labels from the data rows in a data grid.WWWDAdds one or more levels of labels to the data rows in the data grid.WW1Fills the data grid with randomly generated data.W4Sets the number and levels of data columns and rows.WWNAssigns each label in the first level of data grid labels a unique identifier.HFills one or more columns of the data grid with randomly generated data.WWEFills one or more rows of the data grid with randomly generated data.W(Moves a block of cells on the data grid.WW#Gets the value of a data grid cell.WWW#Sets the value of a data grid cell.WWW9Returns/sets the label on a data column in the data grid.WHReturns the multi-level label that identifies a column in the data grid.WWEReturns the multi-level label that identifies a row in the data grid.W6Returns/sets the label on a data row in the data grid.EReturns/sets the strength of the light coming from the light source.WCReturns/sets the X coordinate for the location of the LightSource.WWWCReturns/sets the Y coordinate for the location of the LightSource.WWWCReturns/sets the Z coordinate for the location of the LightSource.WWW]Sets the X,Y,Z coordinates for the LightSource location and the intensity of the LightSource.W

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe

File read: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe "C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe"
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Process created: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe .\cfrv_4_0_setup_ALL.exe /m="C:\Users\user\Desktop\CFRV_4~1.EXE" /k=""
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\mscomctl.ocx" /s
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\COMDLG32.OCX" /s
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\COMCT332.OCX" /s
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\TABCTL32.OCX" /s
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Program Files (x86)\Common Files\microsoft shared\DAO\DAO350.DLL" /s
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_CR_control.dll" /s
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_DB_Connect.dll" /s
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_File_Data.dll" /s
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_File_Export.dll" /s
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_Rmt_DB4_Update.dll" /s
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding BC4BF7B426F2DEC97D7EFEF329A7CA50
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\craxdrt.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crviewer.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\Crystal\Cdo32.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crtslv.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\ExportModeller.dll"
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" /separate /root,::{21ec2020-3aea-1069-a2dd-08002b30309d}
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Process created: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe .\cfrv_4_0_setup_ALL.exe /m="C:\Users\user\Desktop\CFRV_4~1.EXE" /k=""	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\mscomctl.ocx" /s	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\COMDLG32.OCX" /s	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\COMCT332.OCX" /s	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\TABCTL32.OCX" /s	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Program Files (x86)\Common Files\microsoft shared\DAO\DAO350.DLL" /s	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_CR_control.dll" /s	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_DB_Connect.dll" /s	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_File_Data.dll" /s	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_File_Export.dll" /s	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_Rmt_DB4_Update.dll" /s	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" /separate /root,::{21ec2020-3aea-1069-a2dd-08002b30309d}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding BC4BF7B426F2DEC97D7EFEF329A7CA50
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\craxdrt.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crviewer.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\Crystal\Cdo32.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crtslv.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\ExportModeller.dll"

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvbvm60.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvcrt40.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvbvm60.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvbvm60.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvbvm60.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvbvm60.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvbvm60.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: craxdrt.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mfc42.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: olepro32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msvcp60.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: craxdrt_res_zzz.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: craxdrt_res_zz.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: crviewer.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: olepro32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msvcp60.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: crtslv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: exportmodeller.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: atl.dll
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: apphelp.dll
Source: C:\Windows\explorer.exe	Section loaded: dlnashext.dll
Source: C:\Windows\explorer.exe	Section loaded: wpdshext.dll
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll
Source: C:\Windows\explorer.exe	Section loaded: dlnashext.dll
Source: C:\Windows\explorer.exe	Section loaded: wpdshext.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe	Section loaded: actxprxy.dll
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe	Section loaded: actxprxy.dll
Source: C:\Windows\explorer.exe	Section loaded: sxs.dll
Source: C:\Windows\explorer.exe	Section loaded: textinputframework.dll
Source: C:\Windows\explorer.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll
Source: C:\Windows\explorer.exe	Section loaded: dui70.dll
Source: C:\Windows\explorer.exe	Section loaded: duser.dll
Source: C:\Windows\explorer.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll
Source: C:\Windows\explorer.exe	Section loaded: thumbcache.dll
Source: C:\Windows\explorer.exe	Section loaded: policymanager.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\explorer.exe	Section loaded: dataexchange.dll
Source: C:\Windows\explorer.exe	Section loaded: d3d11.dll
Source: C:\Windows\explorer.exe	Section loaded: dcomp.dll
Source: C:\Windows\explorer.exe	Section loaded: textshaping.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.fileexplorer.dll
Source: C:\Windows\explorer.exe	Section loaded: oleacc.dll
Source: C:\Windows\explorer.exe	Section loaded: xmllite.dll
Source: C:\Windows\explorer.exe	Section loaded: atlthunk.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryclient.dll
Source: C:\Windows\explorer.exe	Section loaded: apphelp.dll
Source: C:\Windows\explorer.exe	Section loaded: devicecenter.dll
Source: C:\Windows\explorer.exe	Section loaded: wsock32.dll
Source: C:\Windows\explorer.exe	Section loaded: msimg32.dll
Source: C:\Windows\explorer.exe	Section loaded: linkinfo.dll
Source: C:\Windows\explorer.exe	Section loaded: appresolver.dll
Source: C:\Windows\explorer.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\explorer.exe	Section loaded: sppc.dll
Source: C:\Windows\explorer.exe	Section loaded: twext.dll
Source: C:\Windows\explorer.exe	Section loaded: cscui.dll
Source: C:\Windows\explorer.exe	Section loaded: cscobj.dll
Source: C:\Windows\explorer.exe	Section loaded: cscapi.dll
Source: C:\Windows\explorer.exe	Section loaded: workfoldersshell.dll
Source: C:\Windows\explorer.exe	Section loaded: ntshrui.dll
Source: C:\Windows\explorer.exe	Section loaded: version.dll
Source: C:\Windows\explorer.exe	Section loaded: msasn1.dll
Source: C:\Windows\explorer.exe	Section loaded: secur32.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe	Section loaded: starttiledata.dll
Source: C:\Windows\explorer.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\explorer.exe	Section loaded: usermgrproxy.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: appextension.dll
Source: C:\Windows\explorer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Windows\explorer.exe	Section loaded: edputil.dll
Source: C:\Windows\explorer.exe	Section loaded: acppage.dll
Source: C:\Windows\explorer.exe	Section loaded: sfc.dll
Source: C:\Windows\explorer.exe	Section loaded: msi.dll
Source: C:\Windows\explorer.exe	Section loaded: sfc_os.dll
Source: C:\Windows\explorer.exe	Section loaded: mpr.dll
Source: C:\Windows\explorer.exe	Section loaded: drprov.dll
Source: C:\Windows\explorer.exe	Section loaded: winsta.dll
Source: C:\Windows\explorer.exe	Section loaded: ntlanman.dll
Source: C:\Windows\explorer.exe	Section loaded: davclnt.dll
Source: C:\Windows\explorer.exe	Section loaded: davhlpr.dll
Source: C:\Windows\explorer.exe	Section loaded: wkscli.dll
Source: C:\Windows\explorer.exe	Section loaded: dlnashext.dll
Source: C:\Windows\explorer.exe	Section loaded: playtodevice.dll
Source: C:\Windows\explorer.exe	Section loaded: devdispitemprovider.dll
Source: C:\Windows\explorer.exe	Section loaded: mmdevapi.dll
Source: C:\Windows\explorer.exe	Section loaded: devobj.dll
Source: C:\Windows\explorer.exe	Section loaded: wpdshext.dll
Source: C:\Windows\explorer.exe	Section loaded: portabledeviceapi.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorapi.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: zipfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: sendmail.dll
Source: C:\Windows\explorer.exe	Section loaded: mydocs.dll

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32

Jump to behavior

Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\regsvr32.exe

Key value created or modified: HKEY_CURRENT_USER\Control Panel\Mouse MouseHoverTime

Jump to behavior

Source: cfrv_4_0_setup_ALL.exe

Static file information: File size 14277760 > 1048576

Source:	Binary string: MsiHnd.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005B42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MsiHnd.pdbV source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005B42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shfolder.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shfolder.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rF,c:\Windows\System32\ImgXTwain61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gacutil.pdb source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2074052704.000000000519C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000000.1801199896.0000000000842000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: GameuxInstallHelper.pdb source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000000.1801199896.0000000000842000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: c:\Windows\System32\ImgX61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gacutil.pdb(0 source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2074052704.000000000519C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000000.1801199896.0000000000842000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: sdbapiu.pdbU source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: usp10.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msisip.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005B42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Windows\System32\ImgXPrint61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rFXc:\Windows\System32\ImgX61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000069F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sdbapiu.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: riched20.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mspatcha.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005DA3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Y:\EPFXlate\HTML\ReleaseSym\exlate32.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000533A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msi.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005984000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Windows\System32\ImgXTwain61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rFWc:\Windows\System32\ImgX61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gacutil.pdb, AH/@ source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000000.1801199896.0000000000842000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: sdbapi.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msi_l.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: usp10.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imagehlp.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000533A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msi.pdbh source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005984000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mspatcha.pdbtvbl01\LOCALS~1\Temp\2\DBGtoPDB\mspatcha.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005DA3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imagehlp.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000533A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: riched20.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sdbapi.pdbU source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000646F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Y:\EPFXlate\HTML\ReleaseSym\exlate32.pdbMZ source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000533A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: tvbl01\LOCALS~1\Temp\2\DBGtoPDB\mspatcha.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005DA3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msisip.pdb3 source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005B42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rF,c:\Windows\System32\ImgXPrint61.pdb source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gacutlrc.pdb source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2074052704.000000000519C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000000.1801199896.0000000000842000.00000002.00000001.01000000.00000004.sdmp

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe

Code function: 0_2_0041F0E0 GetSystemDefaultUILanguage,GetSystemDefaultUILanguage,LoadLibraryW,GetProcAddress,FreeLibrary,_malloc,__CxxThrowException@8,LoadLibraryW,GetProcAddress,FreeLibrary,_swscanf,GetSystemDefaultUILanguage,SetThreadUILanguage,GetUserDefaultUILanguage,SetThreadUILanguage,SetThreadLocale,

0_2_0041F0E0

Source: stdole2.tlb.0.dr	Static PE information: real checksum: 0x0 should be: 0x52af
Source: sscsdk80.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x128651
Source: Crpe32.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x4d2dd3
Source: CRxmlx07r.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x1dd3a
Source: u2lcom.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x29105
Source: exlate32.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xaffcb
Source: u2fsepv.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x19f64
Source: u2ddisk.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x103c1
Source: Crpaig80.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x9e40f
Source: u2dnotes.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x149ee
Source: crxf_rtf.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x32017
Source: AtalaImaging.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x136494
Source: cfrv_4_0_setup_ALL.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x56e113
Source: CRxmlx07.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xea5a8
Source: u2fxls.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x41a2a
Source: ExportModeller.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x4ae62
Source: Implode.dll.0.dr	Static PE information: real checksum: 0xb8c2 should be: 0x104a3
Source: craxdrt.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x4f77f9
Source: u2dmapi.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xdf55
Source: u2fhtml.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x10ea0

Source: cfrv_4_0_setup_ALL.exe.0.dr	Static PE information: section name: .didata
Source: usp10.dll.0.dr	Static PE information: section name: Shared
Source: usp10.dll0.0.dr	Static PE information: section name: Shared
Source: craxdrt.dll.0.dr	Static PE information: section name: _CODE
Source: Crpe32.dll.0.dr	Static PE information: section name: _CODE
Source: exlate32.dll.0.dr	Static PE information: section name: _CODE
Source: mDownExec.dll.0.dr	Static PE information: section name: .didata
Source: mMSIExec.dll.0.dr	Static PE information: section name: .didata
Source: msi.dll.0.dr	Static PE information: section name: .orpc
Source: msi.dll0.0.dr	Static PE information: section name: .orpc

Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Program Files (x86)\Common Files\microsoft shared\DAO\DAO350.DLL" /s

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_00434168 pushad ; iretd	0_2_00434169
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_00423ADD push ecx; ret	0_2_00423AF0
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_00437F08 push ecx; retf	0_2_00437F09
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_10013130 push ecx; mov dword ptr [esp], ecx	1_2_10013131
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_1001D2C0 push eax; ret	1_2_1001D2EE
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_10018EB0 push eax; ret	1_2_10018ECE
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD87AE9 push ecx; ret	1_2_6CD87AFC

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\C2C59FBE\1517B7F7\CF_File_Export.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\E3BD0475\1517B7F7\LogFile.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2lexch.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2lsamp1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\comcat.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\1DF81C7A\34510A4\ImgXPrint61.dll	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File created: C:\Users\user\AppData\Local\Temp\mia1\pPin32.cpl	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\2ADC2324\1835CB68\u25dts.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\92CEEA92\34510A4\DAO350.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\679B857\34510A4\COMDLG32.OCX	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\p2ixbse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\mDown.dll\mDownExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\riched20.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2lfinra.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiinst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\8BAE8D59\7204BF44\p2sodbc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\cabinet.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\3D003E72\1835CB68\u2fxml.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msihnd.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\asycfilt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\riched20.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\A52CA551\7204BF44\CRXML15S.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\B2966187\1517B7F7\CF_File_Data.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\3B44007A\1835CB68\u252000.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2fxml.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msihnd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\Crxlat32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\E04462E5\1517B7F7\CF_Report_Verify_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\BB709D56\1517B7F7\CF_Trans_bus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI38EF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRXML15R.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\A8299B92\7204BF44\CRXML15R.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2dapp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\416B4F42\1517B7F7\CF_org_history_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\D4B1A979\1835CB68\u2l2000.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\Crpaig80.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\474E307D\1835CB68\u2lsamp1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\C847D812\1835CB68\Cdo32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\DC878553\34510A4\AtalaImaging.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\msvbvm60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\usp10.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI396D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRxmlx07.dll	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File created: C:\Users\user\AppData\Local\Temp\mia1\pPin64.cpl	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRBAS15R.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\43981525\7204BF44\pg32conv.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\80B1517D\1835CB68\u2dvim.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\usp10.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\crwrap32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\Implode.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\6DEA5FF3\7204BF44\CRXML15.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\BA3E37E4\1517B7F7\CF_CR_control.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\mVBExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msisip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\33BB160B\1835CB68\u2dapp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\D25B4F4E\7204BF44\CRBAS15.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u252000.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\DF17326D\1835CB68\Crxlat32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\p2sodbc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\A157FA05\1835CB68\crxf_rtf.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\D71275EF\1517B7F7\CF_org_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\487DDF\1835CB68\u2ddisk.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\1BF788A5\1517B7F7\CF_Name_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiinst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\C964AC44\1835CB68\u2lfinra.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\3E323407\1835CB68\u2fxls.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\crxf_pdf.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msimsg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRUTL15R.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2dvim.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\7CC1D691\34510A4\TABCTL32.OCX	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2ddisk.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\1D5631E8\1517B7F7\CF_Login.ocx	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\A9695CDF\1517B7F7\CF_Rmt_DB4_Update.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\51868479\1517B7F7\CF_report_main_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\9F0CE7B6\7204BF44\CRxmlx07.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRxmlx07r.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\C7D8D83E\34510A4\SSubTmr6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\90E4D581\1517B7F7\CF_ref_report_bus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI39BC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2dpost.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2l2000.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ExportModeller.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\A95AB0B4\34510A4\ImgX61.ocx	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\DAE69E8\7204BF44\craxdrt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\5A4D542C\7204BF44\CRUTL15R.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\205EBC50\34510A4\ImgXTwain61.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2fxls.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\7C02DA3A\CF_Remote.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2ldts.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\imagehlp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\Crpe32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\craxdrt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\1A28DE63\34510A4\dao360.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\mspatcha.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\880D11DF\1835CB68\P2smon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\crviewer.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\184596D6\1517B7F7\CF_login_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\832FC268\1517B7F7\LogFile.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\47C10F79\7204BF44\CRxmlx07r.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\W95INF16.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\oleaut32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msls31.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\W95INF32.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\83ED17B7\1517B7F7\CF_report_history_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\FCE647BF\1835CB68\u2ldts.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msls31.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRBAS15.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\EEBF1E87\7204BF44\exlate32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiexec.exe	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\4D29780E\1835CB68\u2fsepv.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\FBA4A636\1835CB68\p2lodbc.dll	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File created: C:\Users\user\AppData\Local\Temp\mia1\mWinRunExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\2EC6F5ED\34510A4\vbalColumnTreeView6.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\pg32conv.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\sscsdk80.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\stdole2.tlb	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\mVB.dll\mVBExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\701CB7F7\34510A4\mscomctl.ocx	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msisip.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2dmapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\shfolder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\exlate32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\2D3E0D90\7204BF44\Crpe32.dll	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File created: C:\Users\user\AppData\Local\Temp\mia1\mDownExec.dll	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File created: C:\Windows\System32\myah0.cpl	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\F0E0F85C\1517B7F7\cf_rpt_link_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\68965F3A\1835CB68\u2fhtml.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\EABD308B\1835CB68\u2dnotes.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\mia.lib	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\olepro32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\526A560A\1835CB68\u2lcom.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\E76BBEDE\7204BF44\crviewer.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\CBB1E6D9\1517B7F7\CF_Transaction.ocx	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\1F62DE62\1517B7F7\CF_File_Import_bus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI39DC.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\DD3D7189\34510A4\COMCT332.OCX	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\2E81A74\34510A4\vbalColumnTreeView6.oca	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2fsepv.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\A297C06E\1517B7F7\CF_audit_review_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\6C6652B9\1517B7F7\CF_report_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\83C5D67\7204BF44\crtslv.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\496C80D6\34510A4\MSCHRT20.OCX	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\imagehlp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\p2lodbc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\161F85F0\7204BF44\CRUTL15.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\E2BBEE13\1835CB68\p2ixbse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msimsg.dll	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\mia.lib	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\4B371E22\34510A4\vbalFlBr6.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRUTL15.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\CE1E931F\7204BF44\sscsdk80.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\FE57A718\1517B7F7\CF_DB_Connect.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\sdbapi.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\crxf_rtf.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msi.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2lcom.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\mWinRun.dll\mWinRunExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\B3FFCC7F\1835CB68\u2dmapi.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\P2smon.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\C8E76B1B\1835CB68\u2lexch.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\mWinRunExec.dll	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File created: C:\Users\user\AppData\Local\IIIQF\7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\BED664EA\7204BF44\Crpaig80.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\496179\1517B7F7\CF_rs_browse_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\63200452\1835CB68\u2dpost.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2dnotes.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\ED7284FA\1517B7F7\CF_report_export_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\D63D429\1517B7F7\CF_document_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\6D4D0E7\34510A4\ImgX61.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u25dts.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\Cdo32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\cabinet.dll	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File created: C:\Users\user\AppData\Local\Temp\mia1\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\7DB1D6B0\7204BF44\CRBAS15R.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiexec.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRXML15.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\F7CFC206\7204BF44\Implode.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\2E5B6414\1835CB68\u2fcr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\ADVPACK.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\D77E7C08\7204BF44\crwrap32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\crtslv.dll	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File created: C:\Users\user\AppData\Local\Temp\mia1\mVBExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\sdbapiU.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\AB3A15F4\34510A4\TABCTL32.OCX	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\shfolder.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\mspatcha.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2fhtml.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2fcr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\7A300D31\1835CB68\crxf_pdf.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\DCDC5FB4\1517B7F7\CF_File_Import.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRXML15S.DLL	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\CF_Remote.exe	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\FAAEA181\7204BF44\ExportModeller.dll	Jump to dropped file

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\C2C59FBE\1517B7F7\CF_File_Export.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\E3BD0475\1517B7F7\LogFile.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\1A28DE63\34510A4\dao360.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\mspatcha.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\880D11DF\1835CB68\P2smon.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\184596D6\1517B7F7\CF_login_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\832FC268\1517B7F7\LogFile.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\47C10F79\7204BF44\CRxmlx07r.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\comcat.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\W95INF16.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\1DF81C7A\34510A4\ImgXPrint61.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\oleaut32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msls31.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\2ADC2324\1835CB68\u25dts.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\92CEEA92\34510A4\DAO350.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\W95INF32.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\83ED17B7\1517B7F7\CF_report_history_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\679B857\34510A4\COMDLG32.OCX	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\FCE647BF\1835CB68\u2ldts.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msls31.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\mDown.dll\mDownExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiexec.exe	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\EEBF1E87\7204BF44\exlate32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\riched20.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\4D29780E\1835CB68\u2fsepv.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\FBA4A636\1835CB68\p2lodbc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiinst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\8BAE8D59\7204BF44\p2sodbc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\cabinet.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\3D003E72\1835CB68\u2fxml.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msihnd.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\2EC6F5ED\34510A4\vbalColumnTreeView6.ocx	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\stdole2.tlb	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\mVB.dll\mVBExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\701CB7F7\34510A4\mscomctl.ocx	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msisip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\asycfilt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\riched20.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\shfolder.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\A52CA551\7204BF44\CRXML15S.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\2D3E0D90\7204BF44\Crpe32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\B2966187\1517B7F7\CF_File_Data.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\3B44007A\1835CB68\u252000.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msihnd.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\F0E0F85C\1517B7F7\cf_rpt_link_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\E04462E5\1517B7F7\CF_Report_Verify_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\BB709D56\1517B7F7\CF_Trans_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\68965F3A\1835CB68\u2fhtml.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\A8299B92\7204BF44\CRXML15R.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\EABD308B\1835CB68\u2dnotes.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\416B4F42\1517B7F7\CF_org_history_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\mia.lib	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\olepro32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\D4B1A979\1835CB68\u2l2000.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\474E307D\1835CB68\u2lsamp1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\526A560A\1835CB68\u2lcom.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\E76BBEDE\7204BF44\crviewer.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\C847D812\1835CB68\Cdo32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\CBB1E6D9\1517B7F7\CF_Transaction.ocx	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\1F62DE62\1517B7F7\CF_File_Import_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\DD3D7189\34510A4\COMCT332.OCX	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\DC878553\34510A4\AtalaImaging.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\2E81A74\34510A4\vbalColumnTreeView6.oca	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\msvbvm60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\A297C06E\1517B7F7\CF_audit_review_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\6C6652B9\1517B7F7\CF_report_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\83C5D67\7204BF44\crtslv.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\usp10.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\496C80D6\34510A4\MSCHRT20.OCX	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\imagehlp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\43981525\7204BF44\pg32conv.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\80B1517D\1835CB68\u2dvim.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\usp10.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\161F85F0\7204BF44\CRUTL15.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\E2BBEE13\1835CB68\p2ixbse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msimsg.dll	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\mia.lib	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\4B371E22\34510A4\vbalFlBr6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\6DEA5FF3\7204BF44\CRXML15.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\BA3E37E4\1517B7F7\CF_CR_control.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\mVBExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\CE1E931F\7204BF44\sscsdk80.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\FE57A718\1517B7F7\CF_DB_Connect.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\sdbapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msisip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\mWinRun.dll\mWinRunExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\33BB160B\1835CB68\u2dapp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\B3FFCC7F\1835CB68\u2dmapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\C8E76B1B\1835CB68\u2lexch.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\mWinRunExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\BED664EA\7204BF44\Crpaig80.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\496179\1517B7F7\CF_rs_browse_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\63200452\1835CB68\u2dpost.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\ED7284FA\1517B7F7\CF_report_export_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\D63D429\1517B7F7\CF_document_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\D25B4F4E\7204BF44\CRBAS15.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\DF17326D\1835CB68\Crxlat32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\6D4D0E7\34510A4\ImgX61.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\cabinet.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\A157FA05\1835CB68\crxf_rtf.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\D71275EF\1517B7F7\CF_org_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\487DDF\1835CB68\u2ddisk.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\1BF788A5\1517B7F7\CF_Name_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiinst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\C964AC44\1835CB68\u2lfinra.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\3E323407\1835CB68\u2fxls.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\7DB1D6B0\7204BF44\CRBAS15R.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msimsg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiexec.exe	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\7CC1D691\34510A4\TABCTL32.OCX	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\F7CFC206\7204BF44\Implode.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\2E5B6414\1835CB68\u2fcr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\ADVPACK.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\1D5631E8\1517B7F7\CF_Login.ocx	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\51868479\1517B7F7\CF_report_main_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\A9695CDF\1517B7F7\CF_Rmt_DB4_Update.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\D77E7C08\7204BF44\crwrap32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\9F0CE7B6\7204BF44\CRxmlx07.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\C7D8D83E\34510A4\SSubTmr6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\90E4D581\1517B7F7\CF_ref_report_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\sdbapiU.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\AB3A15F4\34510A4\TABCTL32.OCX	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\shfolder.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\A95AB0B4\34510A4\ImgX61.ocx	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\mspatcha.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\DAE69E8\7204BF44\craxdrt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\5A4D542C\7204BF44\CRUTL15R.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\7A300D31\1835CB68\crxf_pdf.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\DCDC5FB4\1517B7F7\CF_File_Import.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\205EBC50\34510A4\ImgXTwain61.dll	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.exe	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\7C02DA3A\CF_Remote.exe	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\FAAEA181\7204BF44\ExportModeller.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\imagehlp.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\crwrap32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\Implode.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2lexch.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\crviewer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2lsamp1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRUTL15.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\crxf_rtf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2lcom.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\P2smon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\p2ixbse.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRBAS15.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2dnotes.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u252000.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2lfinra.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\p2sodbc.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u25dts.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\Cdo32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\pg32conv.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\sscsdk80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2dmapi.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\crxf_pdf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRUTL15R.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2dvim.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\exlate32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRXML15.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2fxml.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2ddisk.dll	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File created: C:\Windows\System32\myah0.cpl	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRxmlx07r.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\Crxlat32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\crtslv.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI39BC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2dpost.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI38EF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRXML15R.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2l2000.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\ExportModeller.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2dapp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2fhtml.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\Crpaig80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2fcr.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI39DC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2fxls.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRXML15S.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2fsepv.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\u2ldts.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI396D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Crystal\p2lodbc.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRxmlx07.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\Crpe32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\CRBAS15R.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\craxdrt.dll	Jump to dropped file

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\mia.lib	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\miaE495.tmp\data\OFFLINE\2E81A74\34510A4\vbalColumnTreeView6.oca	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File created: C:\Users\user\AppData\Local\Temp\mia1\pPin64.cpl	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File created: C:\Windows\System32\myah0.cpl	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File created: C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\mia.lib	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File created: C:\Users\user\AppData\Local\Temp\mia1\pPin32.cpl	Jump to dropped file

Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe

File created: c:\tmp\log\installs\CF_Remote\install.log

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Campaign Finance
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Campaign Finance\CF Remote.lnk

Hooking and other Techniques for Hiding and Protection

May use the Tor software to hide its network traffic

Source: cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: torConnect

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\C2C59FBE\1517B7F7\CF_File_Export.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\E3BD0475\1517B7F7\LogFile.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\1A28DE63\34510A4\dao360.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\u2lexch.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\mspatcha.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\880D11DF\1835CB68\P2smon.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\184596D6\1517B7F7\CF_login_bus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\u2lsamp1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\832FC268\1517B7F7\LogFile.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\47C10F79\7204BF44\CRxmlx07r.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\comcat.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\W95INF16.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\1DF81C7A\34510A4\ImgXPrint61.dll	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia1\pPin32.cpl	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msls31.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\2ADC2324\1835CB68\u25dts.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\92CEEA92\34510A4\DAO350.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\W95INF32.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\83ED17B7\1517B7F7\CF_report_history_bus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\p2ixbse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msls31.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\FCE647BF\1835CB68\u2ldts.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\CRBAS15.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\mDown.dll\mDownExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\riched20.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\u2lfinra.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\EEBF1E87\7204BF44\exlate32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiexec.exe	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\4D29780E\1835CB68\u2fsepv.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\FBA4A636\1835CB68\p2lodbc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiinst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\8BAE8D59\7204BF44\p2sodbc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\cabinet.dll	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia1\mWinRunExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\3D003E72\1835CB68\u2fxml.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msihnd.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\2EC6F5ED\34510A4\vbalColumnTreeView6.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\pg32conv.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\sscsdk80.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\stdole2.tlb	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\mVB.dll\mVBExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msisip.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\u2dmapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\asycfilt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\riched20.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\shfolder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\exlate32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\A52CA551\7204BF44\CRXML15S.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\2D3E0D90\7204BF44\Crpe32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\B2966187\1517B7F7\CF_File_Data.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\3B44007A\1835CB68\u252000.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\u2fxml.dll	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia1\mDownExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msihnd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\Crxlat32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\F0E0F85C\1517B7F7\cf_rpt_link_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\BB709D56\1517B7F7\CF_Trans_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\E04462E5\1517B7F7\CF_Report_Verify_bus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI38EF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\CRXML15R.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\68965F3A\1835CB68\u2fhtml.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\A8299B92\7204BF44\CRXML15R.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\u2dapp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\EABD308B\1835CB68\u2dnotes.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\416B4F42\1517B7F7\CF_org_history_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\D4B1A979\1835CB68\u2l2000.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Crpaig80.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\474E307D\1835CB68\u2lsamp1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\526A560A\1835CB68\u2lcom.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\C847D812\1835CB68\Cdo32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\CBB1E6D9\1517B7F7\CF_Transaction.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI39DC.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\1F62DE62\1517B7F7\CF_File_Import_bus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\u2fsepv.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\2E81A74\34510A4\vbalColumnTreeView6.oca	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\DC878553\34510A4\AtalaImaging.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\6C6652B9\1517B7F7\CF_report_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\A297C06E\1517B7F7\CF_audit_review_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\usp10.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\496C80D6\34510A4\MSCHRT20.OCX	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI396D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\CRxmlx07.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\p2lodbc.dll	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia1\pPin64.cpl	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\CRBAS15R.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\43981525\7204BF44\pg32conv.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\80B1517D\1835CB68\u2dvim.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\161F85F0\7204BF44\CRUTL15.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\usp10.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\E2BBEE13\1835CB68\p2ixbse.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\crwrap32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Implode.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msimsg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\4B371E22\34510A4\vbalFlBr6.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\CRUTL15.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\6DEA5FF3\7204BF44\CRXML15.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\BA3E37E4\1517B7F7\CF_CR_control.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\mVBExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\FE57A718\1517B7F7\CF_DB_Connect.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\CE1E931F\7204BF44\sscsdk80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\crxf_rtf.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\sdbapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msisip.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\u2lcom.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\mWinRun.dll\mWinRunExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\33BB160B\1835CB68\u2dapp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\P2smon.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\B3FFCC7F\1835CB68\u2dmapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\C8E76B1B\1835CB68\u2lexch.dll	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\IIIQF\7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\mWinRunExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\BED664EA\7204BF44\Crpaig80.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\496179\1517B7F7\CF_rs_browse_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\63200452\1835CB68\u2dpost.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\u2dnotes.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\ED7284FA\1517B7F7\CF_report_export_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\D25B4F4E\7204BF44\CRBAS15.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\D63D429\1517B7F7\CF_document_bus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\u252000.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\DF17326D\1835CB68\Crxlat32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\6D4D0E7\34510A4\ImgX61.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\p2sodbc.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\u25dts.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\Cdo32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\cabinet.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\A157FA05\1835CB68\crxf_rtf.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\D71275EF\1517B7F7\CF_org_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\487DDF\1835CB68\u2ddisk.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\1BF788A5\1517B7F7\CF_Name_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiinst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\C964AC44\1835CB68\u2lfinra.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\3E323407\1835CB68\u2fxls.dll	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia1\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\7DB1D6B0\7204BF44\CRBAS15R.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\crxf_pdf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\CRUTL15R.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msimsg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\u2dvim.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiexec.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\CRXML15.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\u2ddisk.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\F7CFC206\7204BF44\Implode.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\2E5B6414\1835CB68\u2fcr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\ADVPACK.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\1D5631E8\1517B7F7\CF_Login.ocx	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\A9695CDF\1517B7F7\CF_Rmt_DB4_Update.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\9F0CE7B6\7204BF44\CRxmlx07.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\51868479\1517B7F7\CF_report_main_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\D77E7C08\7204BF44\crwrap32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\CRxmlx07r.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\C7D8D83E\34510A4\SSubTmr6.dll	Jump to dropped file
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia1\mVBExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\90E4D581\1517B7F7\CF_ref_report_bus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\sdbapiU.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI39BC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\u2dpost.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\u2l2000.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\shfolder.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\A95AB0B4\34510A4\ImgX61.ocx	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\mspatcha.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\u2fhtml.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\u2fcr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\5A4D542C\7204BF44\CRUTL15R.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\7A300D31\1835CB68\crxf_pdf.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\DCDC5FB4\1517B7F7\CF_File_Import.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\205EBC50\34510A4\ImgXTwain61.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\CRXML15S.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\u2fxls.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\CF_Remote.exe	Jump to dropped file
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Dropped PE file which has not been started: C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\7C02DA3A\CF_Remote.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Crystal\u2ldts.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Crpe32.dll	Jump to dropped file

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-20218
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_0-20121

Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe

API coverage: 8.2 %

Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_00407E20 FindNextFileW,FindClose,FindFirstFileW,FindFirstFileW,	0_2_00407E20
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD82A30 _memset,FindFirstFileW,LoadLibraryW,FindClose,FindResourceW,LoadLibraryW,	1_2_6CD82A30
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD72470 FindClose,FindFirstFileW,FindFirstFileW,	1_2_6CD72470

Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe

Code function: 1_2_10001B41 GetSystemInfo,

1_2_10001B41

Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File opened: C:\ProgramData\Microsoft\Windows\Start Menu	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File opened: C:\ProgramData\Microsoft\Windows\Start Menu\Programs	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File opened: C:\ProgramData\Microsoft	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File opened: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Campaign Finance\CF Remote.lnk	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File opened: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Campaign Finance	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	File opened: C:\ProgramData\Microsoft\Windows	Jump to behavior

Source: cfrv_4_0_setup_ALL.exe, 00000001.00000003.2245112023.0000000002755000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: NC:\Windows\system32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563

Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe

API call chain: ExitProcess graph end node

graph_1-37085

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe

Code function: 0_2_00424C1E _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00424C1E

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe

0_2_0041F0E0

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_004251D4 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004251D4
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_00424C1E _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00424C1E
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_00426C2A SetUnhandledExceptionFilter,	0_2_00426C2A
Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: 0_2_00421DDF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00421DDF
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_1001B723 SetUnhandledExceptionFilter,	1_2_1001B723
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_1001B735 SetUnhandledExceptionFilter,	1_2_1001B735
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD86CD8 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6CD86CD8
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD85A8A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_6CD85A8A
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: 1_2_6CD851C7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_6CD851C7

HIPS / PFW / Operating System Protection Evasion

Injects code into the Windows Explorer (explorer.exe)

Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Memory written: PID: 2672 base: 530000 value: 00			Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Memory written: PID: 2672 base: 6DE2D8 value: 00			Jump to behavior

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe

Code function: 0_2_0041FF60 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,MessageBoxW,CoInitialize,_memset,GetVersionExW,GetCommandLineW,_malloc,__CxxThrowException@8,MessageBoxW,_malloc,__CxxThrowException@8,MessageBoxW,MessageBoxW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,ShellExecuteExW,SetCurrentDirectoryW,SetCurrentDirectoryW,CreateProcessW,GetLastError,GetLastError,CoInitializeEx,ShellExecuteExW,GetLastError,SetCurrentDirectoryW,SetCurrentDirectoryW,CloseHandle,WaitForSingleObject,GetExitCodeProcess,CloseHandle,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_0041FF60

Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\mscomctl.ocx" /s	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\COMDLG32.OCX" /s	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\COMCT332.OCX" /s	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\TABCTL32.OCX" /s	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Program Files (x86)\Common Files\microsoft shared\DAO\DAO350.DLL" /s	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_CR_control.dll" /s	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_DB_Connect.dll" /s	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_File_Data.dll" /s	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_File_Export.dll" /s	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_Rmt_DB4_Update.dll" /s	Jump to behavior
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" /separate /root,::{21ec2020-3aea-1069-a2dd-08002b30309d}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\craxdrt.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crviewer.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\Crystal\Cdo32.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crtslv.dll"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\ExportModeller.dll"

Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1800575548.0000000000418000.00000020.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Progmanadvapi32.dllCreateProcessWithTokenW
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1800575548.0000000000418000.00000020.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ProgmanU
Source: cfrv_4_0_setup_ALL.exe, 00000001.00000000.1800575548.0000000000418000.00000020.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndU

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe	Code function: GetLocaleInfoA,		0_2_0042C5C6
Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	Code function: GetLocaleInfoA,		1_2_6CD8DEDB

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe

Code function: 0_2_004273A1 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_004273A1

Source: C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe

Code function: 0_2_0041F320 GetVersion,CoCreateInstance,

0_2_0041F320

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Exploitation for Privilege Escalation	32 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	112 Process Injection	112 Process Injection	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Multi-hop Proxy	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Proxy	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	2 Obfuscated Files or Information	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Regsvr32	LSA Secrets	2 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	35 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
cfrv_4_0_setup_ALL.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\CF_Remote.exe	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\ADVPACK.DLL	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\W95INF16.DLL	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\W95INF32.DLL	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\asycfilt.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\comcat.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\mVBExec.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\msvbvm60.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\oleaut32.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\olepro32.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\stdole2.tlb	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\cabinet.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\imagehlp.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msi.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiexec.exe	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msihnd.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiinst.exe	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msimsg.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msisip.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msls31.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\mspatcha.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\riched20.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\sdbapi.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\shfolder.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\usp10.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\mWinRunExec.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\cabinet.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\imagehlp.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiexec.exe	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msihnd.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiinst.exe	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msimsg.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msisip.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msls31.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\mspatcha.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\riched20.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\sdbapiU.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\shfolder.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\usp10.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\161F85F0\7204BF44\CRUTL15.DLL	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\184596D6\1517B7F7\CF_login_bus.dll	2%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\1A28DE63\34510A4\dao360.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\1BF788A5\1517B7F7\CF_Name_bus.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\1D5631E8\1517B7F7\CF_Login.ocx	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\1DF81C7A\34510A4\ImgXPrint61.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\1F62DE62\1517B7F7\CF_File_Import_bus.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\205EBC50\34510A4\ImgXTwain61.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\2ADC2324\1835CB68\u25dts.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\2D3E0D90\7204BF44\Crpe32.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\2E5B6414\1835CB68\u2fcr.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\2E81A74\34510A4\vbalColumnTreeView6.oca	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\2EC6F5ED\34510A4\vbalColumnTreeView6.ocx	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\33BB160B\1835CB68\u2dapp.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\3B44007A\1835CB68\u252000.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\3D003E72\1835CB68\u2fxml.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\3E323407\1835CB68\u2fxls.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\416B4F42\1517B7F7\CF_org_history_bus.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\43981525\7204BF44\pg32conv.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\474E307D\1835CB68\u2lsamp1.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\47C10F79\7204BF44\CRxmlx07r.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\487DDF\1835CB68\u2ddisk.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\496179\1517B7F7\CF_rs_browse_bus.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\496C80D6\34510A4\MSCHRT20.OCX	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\4B371E22\34510A4\vbalFlBr6.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\4D29780E\1835CB68\u2fsepv.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\51868479\1517B7F7\CF_report_main_bus.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\526A560A\1835CB68\u2lcom.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\5A4D542C\7204BF44\CRUTL15R.DLL	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\63200452\1835CB68\u2dpost.dll	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\679B857\34510A4\COMDLG32.OCX	0%	ReversingLabs
C:\ProgramData\miaE495.tmp\data\OFFLINE\68965F3A\1835CB68\u2fhtml.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://crl.certum.pl/ctsca2021.crl0o	0%	URL Reputation	safe
http://repository.certum.pl/ctnca.cer09	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crl.certum.pl/ctnca.crl0k	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	0%	URL Reputation	safe
https://aka.ms/Vh5j3k	0%	URL Reputation	safe
http://subca.ocsp-certum.com05	0%	URL Reputation	safe
http://subca.ocsp-certum.com02	0%	URL Reputation	safe
http://subca.ocsp-certum.com01	0%	URL Reputation	safe
http://crl.certum.pl/ctnca2.crl0l	0%	URL Reputation	safe
http://repository.certum.pl/ctnca2.cer09	0%	URL Reputation	safe
http://www.certum.pl/CPS0	0%	URL Reputation	safe
http://www.installaware.com/0	0%	Avira URL Cloud	safe
http://standards.iso.org/iso/19770/-2/2008/schema.xsd	0%	Avira URL Cloud	safe
http://www.ncsbe.govMicrosoft	0%	Avira URL Cloud	safe
http://www.ImgX.net/	0%	Avira URL Cloud	safe
http://www.installaware.com/	0%	Avira URL Cloud	safe
https://aka.ms/odirmX5W$8	0%	Avira URL Cloud	safe
http://crl.thawte.com/ThawteCodeSigningCA.crl0	0%	Avira URL Cloud	safe
http://www.installaware.comz	0%	Avira URL Cloud	safe
http://www.mywebsite.com/New	0%	Avira URL Cloud	safe
http://repository.certum.pl/ctsca2021.cer0	0%	Avira URL Cloud	safe
http://www.seagatesoftware.com/xml/schema.xsdxsddtdw	0%	Avira URL Cloud	safe
http://www.ncsbe.gov	0%	Avira URL Cloud	safe
http://www.installaware.com/InstallAware	0%	Avira URL Cloud	safe
https://sectigo.com/CPS0C	0%	Avira URL Cloud	safe
https://www.installaware.com/buydirect.aspopen	0%	Avira URL Cloud	safe
http://www.ImgX.net/ImgX/purchase.asp	0%	Avira URL Cloud	safe
http://crl.thawte.com/ThawtePremiumServerCA.crl0	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.certum.pl/ctsca2021.crl0o	cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://repository.certum.pl/ctnca.cer09	cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.ncsbe.govMicrosoft	cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.certum.pl/ctnca.crl0k	cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.thawte.com0	cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054BA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054D1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://standards.iso.org/iso/19770/-2/2008/schema.xsd	cfrv_4_0_setup_ALL.exe, 00000001.00000000.1800575548.0000000000418000.00000020.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/odirmX5W$8	explorer.exe, 00000018.00000002.2964544574.00000000068B5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.installaware.com/0	cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.installaware.comz	cfrv_4_0_setup_ALL.exe, 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2074052704.000000000519C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FFCA4000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000000.1801199896.0000000000842000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.ImgX.net/	cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.installaware.com/	cfrv_4_0_setup_ALL.exe, 00000001.00000000.1800575548.0000000000418000.00000020.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mywebsite.com/New	cfrv_4_0_setup_ALL.exe, 00000001.00000003.2074052704.000000000519C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2245112023.00000000027A4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/Vh5j3k	explorer.exe, 00000018.00000002.2964544574.00000000068B5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
HTTP://WWW.NCSBE.GOVMICROSOFT	cfrv_4_0_setup_ALL.exe, 00000001.00000003.2245112023.0000000002763000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://crl.thawte.com/ThawteCodeSigningCA.crl0	cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054BA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054D1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
HTTP://WWW.MYWEBSITE.COM/NEW	cfrv_4_0_setup_ALL.exe, 00000001.00000003.2245112023.00000000027A4000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://repository.certum.pl/ctsca2021.cer0	cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://subca.ocsp-certum.com05	cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.ncsbe.gov	cfrv_4_0_setup_ALL.exe, 00000001.00000003.2245112023.00000000027A4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://subca.ocsp-certum.com02	cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.seagatesoftware.com/xml/schema.xsdxsddtdw	cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000678A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://subca.ocsp-certum.com01	cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0C	cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.installaware.com/buydirect.aspopen	cfrv_4_0_setup_ALL.exe, 00000001.00000000.1800575548.00000000007AE000.00000020.00000001.01000000.00000004.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FFC7D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.certum.pl/ctnca2.crl0l	cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://repository.certum.pl/ctnca2.cer09	cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.installaware.com/InstallAware	cfrv_4_0_setup_ALL.exe, 00000001.00000003.1804004618.00000000FF8D0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ImgX.net/ImgX/purchase.asp	cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000683E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawtePremiumServerCA.crl0	cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054BA000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000054D1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.certum.pl/CPS0	cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000329C000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000617F000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000062B0000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000003162000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005691000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.000000000604D000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005F1B000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.00000000033CE000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000000.00000003.1794213378.0000000005525000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818571479.00000000032D0000.00000004.00001000.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.2079216892.0000000007ACB000.00000004.00000020.00020000.00000000.sdmp, cfrv_4_0_setup_ALL.exe, 00000001.00000003.1818483205.0000000003430000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1490348
Start date and time:	2024-08-09 01:18:57 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	cfrv_4_0_setup_ALL.exe
Detection:	MAL
Classification:	mal52.evad.winEXE@39/565@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 124 Number of non-executed functions: 114
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetValueKey calls found.
VT rate limit hit for: cfrv_4_0_setup_ALL.exe

Simulations

Behavior and APIs

Time	Type	Description
19:20:24	API Interceptor	1x Sleep call for process: explorer.exe modified
19:20:27	API Interceptor	13x Sleep call for process: cfrv_4_0_setup_ALL.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\ADVPACK.DLL	8ue90oYkrv.exe	Get hash	malicious	Unknown	Browse
	8ue90oYkrv.exe	Get hash	malicious	Unknown	Browse
	TextSpeaker.exe	Get hash	malicious	Unknown	Browse
	TextSpeaker.exe	Get hash	malicious	Unknown	Browse
	TextSpeaker.exe	Get hash	malicious	Unknown	Browse
	MXrpqIRV2z.exe	Get hash	malicious	Unknown	Browse
	MXrpqIRV2z.exe	Get hash	malicious	Unknown	Browse
	Bonzify.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\4937c8.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	225941
Entropy (8bit):	5.035210410823578
Encrypted:	false
SSDEEP:	768:RZYJDHm0NZ/DVtVtVt1tVtVtVtVtVtVtVtVtVtVtVtVtVtVtVtVtVtltVtVtVtIV:nYocZ/DePXcxhaHiqZa7FHa2Ufo2PoVk
MD5:	D4C1508DA7230E8AD4743E8A540BA4EB
SHA1:	1E3F3F880233D2CE1771246118D3EBD0D3BF9179
SHA-256:	B41109CDE79BF9BD9576C4618DA925CC5503E66159AD1E0390E8A8D8A5BE45F1
SHA-512:	D29CD51963C4AC4E8655EDF263FF4EA573D1704482AF8B468C61DF58A15FE76CE32982E9D5E703379E7DAB35E523AFB356A1A65F41EB93ECB2D604F078B84EF2
Malicious:	false
Preview:	...@IXOS.@.....@...Y.@.....@.....@.....@.....@.....@......&.{152D390A-DD7B-4E57-B3A5-14CADE7E1207}..CF Remote..cfrv_4_0_setup_ALL.msi.@.....@!....@.....@........\PROGRA~3\miaE495.tmp\&.{D529246B-78E5-4E65-A3A2-8E1040E91E59}.....@.....@.....@.....@.......@.....@.....@.......@......CF Remote......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{DBAF7F90-6797-4BCB-8426-E799FE0D75FA}&.{152D390A-DD7B-4E57-B3A5-14CADE7E1207}.@......&.{10B1E2F4-E12B-4D18-847D-3579632C4DA0}&.{152D390A-DD7B-4E57-B3A5-14CADE7E1207}.@......&.{70233733-63B7-4686-8B22-F467B98A5511}&.{152D390A-DD7B-4E57-B3A5-14CADE7E1207}.@......&.{100D9843-4837-4C77-9382-C4AB79C16EC6}&.{152D390A-DD7B-4E57-B3A5-14CADE7E1207}.@......&.{360CA8FA-B89D-40E5-8E5D-E0358F8448B5}&.{152D390A-DD7B-4E57-B3A5-14CADE7E1207}.@......&.{AAA707EE-74C6-4091-8DF1-A6063B1CAF22}&.{152D390A-DD7B-4E57-B3A5-14CADE7E1207}.@......&.{9C72C003-1DC2-41F4-AD0C-E99FEB6

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\CF_Remote.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4243456
Entropy (8bit):	5.904631501447873
Encrypted:	false
SSDEEP:	98304:j24cB0pukTqkRXBpPw0l3mpkaL8vmN0sPVYaCKlOO5BRBwqyPQbgZ5WEVMRJT3VB:fcB0pukTqkRXBpPw0l3mpkaL8vmN0sPn
MD5:	8963AF52B51008AA64C0DFC38978E561
SHA1:	C76A9A66AFDB305791674B365B078B48343B7C98
SHA-256:	F8D68F5A2685B78B8AD9B7FF3C1BD720AFC1F337EAE521AB8AAB6ACB5E5337BE
SHA-512:	C2EF66D6AB3D075C706DCFC85B67DDDA7261A052B037B0E1854B64A9D58054503EB25214B62AFE565A9A7EDE8A981B280F4CCBCF253336000A7D42C3F6E19C06
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y....................................Rich............PE..L...a.ie..................@......... .........@...@...........................B.....{.@......................................{@.(.....A.~...................................................................(... .......d............................text....z@.......@................. ..`.data...`T....@.......@.............@....rsrc...~.....A.. ....@.............@..@..^............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\CF_Remote.exe.manifest

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.0713464478909565
Encrypted:	false
SSDEEP:	12:MMHdt4N5SgVQ9TNRRgAhxAQkrEHUi95Jz:Jdt4XSgOTNRyADAQkrEHUiDt
MD5:	E9CECB1E5CFDDF82CE102D096FC6DB92
SHA1:	EEA233E02455050A95B7AD30FA42E077ED473293
SHA-256:	499E0178C9C74ACC9DED7E9F66A99C2915C6ADEBF08D33907538180466D1535B
SHA-512:	B61B1B718B9FF3F84174E3BA8CC2B6F1135659AADDA8C0FE1CFE3561F206A1746C48F16DD669C7E36AC960B0A4B1404739DADED074956A7454B738E37E1D6F47
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">...<assemblyIdentity version="1.0.0.0".processorArchitecture="X86".name="ExeName".type="win32"/>...<description>elevate execution level</description>...<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">....<security>.....<requestedPrivileges>......<requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>.....</requestedPrivileges>....</security>...</trustInfo>..</assembly>

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Campaign Finance Remote.chm

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	302779
Entropy (8bit):	7.927639628283951
Encrypted:	false
SSDEEP:	6144:SVRZVBdxgL1ART/Q+4Ghr6qUeaLAOw6cxf8JYxjv029IDuuj7Y79d/wq5fgSk:SVXVBzWAtQDGtnUxAfx0JEtGDR/Yj/dU
MD5:	286D69BB312003FA01ECBCAF6587C7D5
SHA1:	C611D2D743FC45A5BC419D0A255DB4A174100F77
SHA-256:	F7EDE38A17EC24C0AFA54815DBEA222E17452C4A9A872B7FE462741B70199B6A
SHA-512:	07A9D2C6F327873C4B2836FD6F434B1012C13CEE3816594C43430B0CA356814AAF0CAE4B490FEF8D89ED51112C3BF2FC240A2AA03B7183D135903B7E9B03F384
Malicious:	false
Preview:	ITSF....`..................\|.{.......".....\|.{......."..`...............x.......T@.......@..............................ITSP....T...........................................j..].!......."..T...............PMGLV................/..../#BSSC...7../#IDXHDR....../#ITBITS..../#STRINGS..B..q./#SYSTEM..n.+./#TOPICS.....P./#URLSTR.....*./#URLTBL..P.H./#WINDOWS....L./$FIftiMain.....g./$OBJINST......./$WWAssociativeLinks/..../$WWAssociativeLinks/Property....../$WWKeywordLinks/..../$WWKeywordLinks/BTree..[..L./$WWKeywordLinks/Data...'.(./$WWKeywordLinks/Map...O.../$WWKeywordLinks/Property...i ./AccountTransferAdd.htm...B.~./AccountTransferDelete.htm...@.7./AccountTransferEdit.htm...m.+./AddingACandidateCommittee.htm..._.C,/AddingAElectioneeringCommunicationFiler.htm......'/AddingAIndependentExpenditureFiler.htm...".0%/AddingAIndependentExpenditurePAC.htm...7..#/AddingAJointCandidateCommittee.htm.....`&/AddingAJudicialCandidateCommittee.htm...".w./AddingALegalExpenseFund.htm...U.D./AddingAPAC

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\1998_NC_Disclosure.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: 1998 Discloure Report, Subject: 1998 Discloure Report, Author: James Lell, Last Saved By: James Lell, Revision Number: 101, Total Editing Time: 08:02:50, Last Printed: Sun Jun 27 21:04:02 1999, Last Saved Time/Date: Tue Feb 22 13:39:32 2005, Create Time/Date: Tue Jun 15 22:03:11 1999, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	442368
Entropy (8bit):	5.764291489711934
Encrypted:	false
SSDEEP:	1536:gqriKCi4JCS0DlTzwKg3Vj/I+HJL9uEXueM5g2ggLR4BZG3OF6OIIKE85+DN:gq0I5cJXXuQ4
MD5:	4623BE2BABA8AF4A48897E14029EE29F
SHA1:	12F217A06B3ADD4A579D6E6F4BFF0D60D44F256D
SHA-256:	24A472D4FD42007DE58116171D84B77906C90D6781C835CCFFF1F3DD704A074B
SHA-512:	423FD6ECC7F377CAC0EECB7F5B173171E6545FFBAE2964CC33A85114D9D62F783D0ABB6B83C3E00C127A58E74ABDD3CD28B420E503EDAA78B0BF485C22CF7235
Malicious:	false
Preview:	......................>...................................................~...............0...................................................................................................................................................................................................................................................................................................................................................................................................................................S.u.b.d.o.c.u.m.e.n.t. .8.9.....................................................................................................C.o.n.t.e.n.t.s..........................................................................................................L......D.a.t.a.b.a.s.e. .(.T.L.V.).............................................................................................t.......S.u.b.d.o.c.u.m.e.n.t. .1.0.1................................... ...................................0...

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\Accounts.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Account List, Subject: Account List, Author: James Lell, Last Saved By: James Lell, Revision Number: 47, Total Editing Time: 07:03:51, Last Printed: Sun Jun 27 21:04:02 1999, Last Saved Time/Date: Tue Feb 22 13:38:30 2005, Create Time/Date: Tue Jun 15 22:03:11 1999, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	17408
Entropy (8bit):	5.353280867175744
Encrypted:	false
SSDEEP:	192:en+EcA/aGyp318p8x3Wb5vNxjOJMHCdrYvQqFvAi1mnYuA8Z7Bu7P7Z7b7gUSA7Q:BjASGyp3uNhJ73O
MD5:	1A6030B5072235B0965869D19E08A9BB
SHA1:	BB3A30F534C655B1E2726219CA5BF49B817A2C58
SHA-256:	17098538A0A0EB865ECBAA17D00CFD09AB83400DA70BC9AE467C506E0F05CBA7
SHA-512:	2313A99DA787F451009A3BEC94BD4BFECA8A9FCBCAED3954F2923918B0DC1BBEE9E69E82AC978E864E1291692020F246D22F30D5FEF1EB8BBE78901B516EB3F9
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\Contributions.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Contributions List, Subject: Contributions List, Author: James Lell, Last Saved By: James Lell, Revision Number: 113, Total Editing Time: 12:36:42, Last Printed: Tue Aug 18 20:22:57 1998, Last Saved Time/Date: Tue Feb 22 13:33:52 2005, Create Time/Date: Sun Feb 9 18:04:38 1997, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional
Category:	dropped
Size (bytes):	47104
Entropy (8bit):	5.729017991338511
Encrypted:	false
SSDEEP:	384:gYbjI9PoSInCZuHqSTMRHXu+I3PWoCYnp:gYXGoB
MD5:	A02E3ED15993B8B8CF631068941EFDFA
SHA1:	68609F9F0CCBF698D602F15DF2783ED919B48DE3
SHA-256:	19EEE76FD82EC48C325BC696D85989C20BA39DC4D9903C440ECC8A3A91A9E2CC
SHA-512:	997B08C754A5D0625F39311971BB6113C44EE69F9DB7C3B6D1EC676C9591FCFFD40E428A042A677CB2237DCBE1AD7CDCB463BF721365C9541BD2CEFEB27EDC29
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\Cover.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Disclosure Report Cover, Subject: Disclosure Report Cover, Author: James Lell, Last Saved By: James Lell, Revision Number: 71, Total Editing Time: 09:09:36, Last Printed: Sun Jun 27 21:04:02 1999, Last Saved Time/Date: Mon Feb 21 14:12:42 2005, Create Time/Date: Tue Jun 15 22:03:11 1999, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	102993
Entropy (8bit):	5.775513240751137
Encrypted:	false
SSDEEP:	384:8iPllYflrU4GTGvsz057kQz5xACSYwp3m6MgqGFSIU5DmQ6rfmsduaaahWpQCcxI:ZllI+DQzXAgg3cDtjpM3a
MD5:	D6C23BB2D2B74DE1C9C452C58ECB7477
SHA1:	63409B79C746B01C0F12A76BB511849D77B709A2
SHA-256:	956C888758279B814FEDD7F48D76DFD49F5DF7C75A3FD23FDE0F97BAF0D710AE
SHA-512:	A43BEACAD2716DF068C68F5FEEB529BBBB2D89706ECC9604BF86F422F26558C98C304387CE134408E329D550E0978F385E0825ED15F4ACD88B94095EB0473A96
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\Debts.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Debts and Obligations List, Subject: Debts and Obligations List, Author: James Lell, Last Saved By: James Lell, Revision Number: 74, Total Editing Time: 05:41:49, Last Printed: Wed Dec 18 13:51:44 1996, Last Saved Time/Date: Tue Feb 22 13:38:41 2005, Create Time/Date: Sun Feb 9 19:12:49 1997, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional
Category:	dropped
Size (bytes):	52224
Entropy (8bit):	5.638520545168639
Encrypted:	false
SSDEEP:	384:VA3VCHSQW4z84Bd9CGLVJkhzWRajCIFaydsm4GM:VA3VCyVR4BRyK
MD5:	C5B71EFA6AFA72802DFD0D8055D128D8
SHA1:	77DA5148A255488EB4BD30493D2D3BD6DF11735C
SHA-256:	8F16CC0CB03D6406F4C6A7612F4C9D94D43DA774FC1C6662D76329B177B91F19
SHA-512:	5C8F634210E3E75F0EFF3975112E7C30AD166B1F8067AFBA65155F6339D198F10E5B5CC2D89CBD2422C32E0AA44EE75F4B00E5F3D936C03C360A3DBA1F0F45EE
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...........................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\Expenditures.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Expenditures List, Subject: Expenditures List, Author: James Lell, Last Saved By: James Lell, Revision Number: 74, Total Editing Time: 09:02:18, Last Printed: Wed Dec 18 13:51:44 1996, Last Saved Time/Date: Tue Feb 22 13:38:47 2005, Create Time/Date: Sun Feb 9 19:12:49 1997, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	5.681619568331793
Encrypted:	false
SSDEEP:	192:DNBaBX0B2BUz5jTRE8gxgdPk4tHze8yYWU8M1lt/EsrAmbaplydwDyTgzIF8WPka:ohmNx/zLbkuMC9OqjHWN/VYQBSSu/p
MD5:	761DBD0A2426A34D51F3362C051B37F9
SHA1:	5CC1CC3206398C6D7C121EBD2F676C36E9833A94
SHA-256:	1C0FC5BD6548947A189BED1A0EC51661528A725202E35792D9699C73C095B796
SHA-512:	D437D6041EC1A412415AE1F99EFB040D8E137378A53CCD9B03F26B1CE38C32ED1294C23D7264C6D8FF59CF39D26B9FF86747AFE7AC99EC7CB50DAB89F5F13C70
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\LoanEndorsers.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Endorsers List, Subject: Endorsers List, Author: James Lell, Last Saved By: James Lell, Revision Number: 45, Total Editing Time: 03:21:14, Last Saved Time/Date: Tue Feb 22 13:38:54 2005, Create Time/Date: Thu Dec 19 13:29:16 1996, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional, Security: 0
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.421908987486584
Encrypted:	false
SSDEEP:	192:2LAHPNxk0i2OLPU8GV8BErS8x3Wb5vNxjOJMHCdr5w7lqm9AmAYm9quAm97ZyPbF:W47k33/MrM4A
MD5:	BFCC78606337F1ADD7B87FC8E1C8C734
SHA1:	99B2673556D8A8730DDF60BA15A58BDAAFC9FC4A
SHA-256:	85CE8C392A2E7FEEE7FABE7A1F3E0F70C7F61F0EF20203EA343F025017803EEA
SHA-512:	7CC684AE706896B4D4C624941C7D71E6CF8D4C388FC02ABA50DAA23FDE8F9A145C0E998788FF01A9902AF469103281FC8B378F902BCD5E9DBB21DF2C6FADA27A
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!.......................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\LoanProceeds.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Loan Proceeds List, Subject: Loan Proceeds List, Author: James Lell, Last Saved By: James Lell, Revision Number: 71, Total Editing Time: 05:07:43, Last Saved Time/Date: Tue Feb 22 13:39:05 2005, Create Time/Date: Thu Dec 19 13:29:16 1996, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional, Security: 0
Category:	dropped
Size (bytes):	59904
Entropy (8bit):	5.764839915499194
Encrypted:	false
SSDEEP:	384:2VsucDl8+hn7iszAu1YYDJP99qdKjHFCvCiZ/sHxz/JJ2afOj:isu+uu1YY1Pb
MD5:	DEF0B47C2A857A3380C7DD9FC55BD7AA
SHA1:	A42C01237FCEB20AF3C679ACAE403EE64FF0A080
SHA-256:	AC75DAC13D2DA4BB0AA279C8FB4C45EB2235111F30C76602861768147D61ED98
SHA-512:	CBA2B92BEA3EEA5E8ACC866AEE856BEEEC8DFCFF7470E5CDB22C7DA5E0AB48682EBD9966D00B11EAF750533FDFB0409145671FAABA93FEDC1EFAFA6386B7234D
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...............................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\LoanRepayments.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Loan Repayments List, Subject: Loan Repayments List, Author: James Lell, Last Saved By: James Lell, Revision Number: 33, Total Editing Time: 02:32:42, Last Saved Time/Date: Tue Feb 22 13:39:11 2005, Create Time/Date: Fri Dec 20 15:00:22 1996, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional, Security: 0
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6245741985399995
Encrypted:	false
SSDEEP:	192:22EQNdickudiauN8dEZEQcAmbUipjatZkLWkC6lnU/c5HhW8x3b5vNxjOJMHCdru:0QN3ub55LOnz1BNdZSkw4fjjfnWX2R
MD5:	D96F0BFA34C620CB0904A5C7CD652D76
SHA1:	8848F994A2873BFA2BC73DFF35A8D1C617575DFF
SHA-256:	367CC798B9F28285A257274083D43D9CA34822AFBD0026BD7A6B407651AF5F38
SHA-512:	5207ACF7F10F23DB57FAB85126A7BE970C104088562128B2D982F9CF23C5177558DAAD6063E3A1897C0A1AE65A46D313FE9C32F4B394434455F00BB0E650D97E
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...............................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\Summary.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Summary, Subject: Summary, Author: James Lell, Last Saved By: James Lell, Revision Number: 50, Total Editing Time: 06:54:28, Last Printed: Sun Jun 27 21:04:02 1999, Last Saved Time/Date: Fri Jul 9 19:49:26 2004, Create Time/Date: Tue Jun 15 22:03:11 1999, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	93814
Entropy (8bit):	5.439847807690734
Encrypted:	false
SSDEEP:	384:SGmlkmzysH867TSqxdEjuPCPN2ScQ12ScrOgVzRDoYsg7VSclhhy6gGhJA1zfcOy:gtc67TSqtPCV2S0/
MD5:	AE82C60145B9DB14E62CFFEDCFDA30E6
SHA1:	8853BB15A95A0C0BAA23AFC99EC7CDB9303D4974
SHA-256:	164E5BD41A118A0075260EF11CC157C3AE23D6EC287E1C0F6C56AC0D97CBB627
SHA-512:	9189A0A9FD15A60BB293F3DDC9D9DBA1AA4EFBF23C70DB81E6A0CA12528F541ED09CB8B9359CEF9F7367BA05D22FF1C46DE8504154F41147CA00F9B462E74EAB
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\2003_Disclosure.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 62, Total Editing Time: 02:41:01, Last Saved Time/Date: Thu Jul 29 14:33:26 2004, Create Time/Date: Mon Mar 22 15:03:08 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	2074624
Entropy (8bit):	5.277108105692261
Encrypted:	false
SSDEEP:	3072:tAcGm88F/D6zksqVGpStaTbIfkI15eJWFNHXaPEOrZGERaot3n5fGeZlVE/hP5Zj:t5YksqVyStMwkTsFda/geZ3E/hP5Z
MD5:	3BF8C3B91E578461B194D6620D227F23
SHA1:	254D4D58E68F01DE591E9207898B0774499E98DC
SHA-256:	D38D74FBB7818D5E01251D91E290BDF2B8C0F2835F45E18039A4426FB536F20B
SHA-512:	8FF5177AC387B55FBD39712C3578FEA41F8447479B49C56FE6F66FDB31E12385D328867C3441C9A7DA2D100E38D14EB615D70D439F7DF3E38D5233381E8737C3
Malicious:	false
Preview:	......................>................... ...3.......................................{...L...4...N.......................(...........~...r...t...........Z...............}.......c...b.........../...y.........................................................................................................................................................................................................................................................................................................................O.l.e.............................................................................................................0.............O.l.e.P.r.e.s.0.0.0...................................................................................................d.......S.u.b.d.o.c.u.m.e.n.t. .5.5............................................."........................... ...pu.. ...pu..............C.o.n.t.e.n.t.s.........................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\2003_Electioneering_Report.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Thu Sep 2 16:11:52 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Wed Sep 29 20:57:07 2004, Security: 0
Category:	dropped
Size (bytes):	435712
Entropy (8bit):	5.210313030830372
Encrypted:	false
SSDEEP:	1536:DhRq0fBeerIhQVQ+3I+9gc9R6P7KUJSXCMxqAG1V4vS+Zq8veRNXncMEUR21HF:7ser/9WTPTJSXCMxqjevS+ZTveB21
MD5:	9953C4F01E97E2EAF6D408A9637954AA
SHA1:	C0CA83C8458AA1A569586CF343E7AC6ABDA51F32
SHA-256:	D64D4097CC36841AE5E105119E7BD9AF6E099E203C2B6625B5170CCB3AA9EE10
SHA-512:	43A445C46110992A37B40A9B3D73C89443024FEE6374C7B0AB8B3D047CF5888F0DC25C6FC6A11E8139AA5838907D7005BD11D2A58405679F3D14AF8022BFBA1D
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................\CFRS Common\CF_Common\cf_reports\2003 Forms\cro-2320.ttx..........cro-2320.ttx.......................SQL.....Pdsmon.dll....%Active Data (Field Definitions Only)....HC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\2003 Forms\cro-2340.ttx..........cro-2340.ttx.......................SQL.....Pdsmon.dll....%Active Data (Field Definitions Only)....HC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\2003 Forms\cro-2330.ttx..........cro-2330.ttx.......................SQL.....Pdsmon.dll....%Act

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\2003_FED_Disclosure.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 16 15:54:41 2003, Create Time/Date: Tue Mar 18 18:48:47 2003, Last Saved Time/Date: Wed Sep 29 17:56:45 2004, Security: 0
Category:	dropped
Size (bytes):	474624
Entropy (8bit):	5.097844904674963
Encrypted:	false
SSDEEP:	3072:mWnYtI5uI5ZzxgLD9yQl2FzHc6AsnkrRcycDCTCQd4iNbN:mG5uaml28/
MD5:	B27917F1EDBCF0193DD90615BEC558A9
SHA1:	6FD7536E2D2EDBA9F19AF0C38CEEEE77FA5FD524
SHA-256:	37162A3D98BBB39027C9E77394BE2928E22E50967213B9FCAA1B371E60B1B298
SHA-512:	293BB3097A5BEC7C6A757811C1B4F76247C93E39E3BEA5285F80EA31EC8267725B1BC811F2DCC5386B6A191D8C32B8303F18D3165418D740D17414272539ED04
Malicious:	false
Preview:	......................>...........................................................<...6.......}.......~......................................................................................................................................................................................................................................................................................................................................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................:...`.......S.u.b.d.o.c.u.m.e.n.t. .4.6.............................................g...0.......................p..,.1.....,.1..............C.o.n.t.e.n.t.s.....................................................................................................?...........D.a.t.a.b.a.s.e. .(.T.L.V.).............................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\2003_FED_Org_Statement.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 53, Total Editing Time: 02:01:06, Last Saved Time/Date: Wed Apr 14 12:43:38 2004, Create Time/Date: Mon Mar 22 15:03:08 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	200192
Entropy (8bit):	5.169152554231805
Encrypted:	false
SSDEEP:	768:gY1gd28LOecPd/HWE03kAoEl1FVledXN/bYNsnDnNH33wvuatdTuBaBn3Dn5E0fp:n1gd28LOecPVSkAPNyTx3wvuRBaNDVV
MD5:	A64029646B20A91508A70A4BD30D777A
SHA1:	53C5AAE52951DD3E493EF04295B345CD0A4A3828
SHA-256:	39BC863CDECC987002C7BDDBEE15FB0226C4640B795E11B6FDC12EF90F3AB48A
SHA-512:	A5F3EA125987F11157CFC76DA99A5D816C665CCDFE6D9FA141D5AF5D926F85504B8EECCE417570D413DEDDE8EA4CF2C3E4F2FDCC585A0F04FF343E83C1FB4347
Malicious:	false
Preview:	......................>.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...........................................................................................................S.u.b.d.o.c.u.m.e.n.t. .3.0..........................................................................?O.."...?O.."..............C.o.n.t.e.n.t.s.........................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\2003_Judicial_Qualify_Report.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:51:41 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Wed Apr 29 22:15:36 2009, Security: 0
Category:	dropped
Size (bytes):	160256
Entropy (8bit):	5.0388804598932895
Encrypted:	false
SSDEEP:	1536:P1eto9rC6gvneLbeMXHwKY0/Fb57GgYINSfUSfBg:Y6mMXHwKY0/KgSH
MD5:	4695DF6904EADF85F3BB5A039159BB20
SHA1:	BDB639C12D0ED8A8C0393169D51859282D5FA7EC
SHA-256:	0688E65C8A9DAFC70CBACEB99A5B9C97C15E8545149BD907D48F6CB4472EF896
SHA-512:	02C191C002D5D212ED30893EA8E561A1C07FE1E86B49D6A1F40E7960B95B28EA241EB7F953D00681B76AC5798532CDCFD1FAFDC3B46DF416C8D118C5A4D4C6A2
Malicious:	false
Preview:	......................>...................................z.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.............................................................................................................:.............O.l.e.P.r.e.s.0.0.0...............................................................................................A...Fe......S.u.b.d.o.c.u.m.e.n.t. .3.8......................................................................... .F......IH.................C.o.n.t.e.n.t.s.........................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\2003_NC_Disclosure.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Mar 5 20:19:07 2004, Create Time/Date: Tue Mar 18 18:33:40 2003, Last Saved Time/Date: Mon Nov 19 15:30:01 2007, Security: 0
Category:	dropped
Size (bytes):	2127872
Entropy (8bit):	5.298889348940432
Encrypted:	false
SSDEEP:	6144:nEd7toe+rgeeNPGd7crgEpc8mwE/hP5r8:nEdHiA9c2E/hP5
MD5:	74FDFC53C374A476FFDFABA9958F8D42
SHA1:	BFE8448D89E848DD7A14EEB8CC10DB0082B04198
SHA-256:	71D0000B9B8E8DF9F9E34B81F7BBDD0529C0B8D99BAB2DC83170628C34C33DF3
SHA-512:	1DE68F6ED46CF91F47110697F97058B7793794455EFCB73F57501FA683EBD004AA2285326E43D5264E12594973BDC49E8CBEE6A580B170D7E0F34EE312054412
Malicious:	false
Preview:	......................>...................!...................................d...m...o...........%...............L...............s.......D.......C...................W...............z...m...J.......t...u.....................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.1...........................................................................................................S.u.b.d.o.c.u.m.e.n.t. .2.7.6................................... ....................................>........................C.o.n.t.e.n.t.s.........................................................................................................x.......D.a.t.a.b.a.s.e. .(.T.L.V.).............................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\2003_NC_Informational.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: State, Name of Creating Application: Microsoft Excel, Last Printed: Thu Jun 15 19:07:57 2006, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Mon Jun 19 13:10:06 2006, Security: 0
Category:	dropped
Size (bytes):	2065408
Entropy (8bit):	5.312823323440365
Encrypted:	false
SSDEEP:	6144:8Ed1Xb0+PgeDeGGHERLAEgipEXZacZzl9zjBABgppv/5/vR6WOyx:8EdFEwMi9cZzl9z
MD5:	756B7BA54EC030397464A91A2CA8A8F0
SHA1:	46DBA88F3E7B08D7CC26F2A771E4C0D233140153
SHA-256:	6D27506B998E52767972E9BE275509AE1287640C3CABA0D850E21BE9D4E62844
SHA-512:	F35B723ED73D6BE222F402C6839E4E042949AAC33ED959CD82782672FF9AAE4695DC45F7D63317184267A07D085B2FE5001D528B70ADE57DAB68BFDA96BBCD1E
Malicious:	false
Preview:	......................>................... ...f...............................d...m...o...........%...............L...............s.......D.......C...................W...............m...J...h.......~.........................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.1...........................................................................................................S.u.b.d.o.c.u.m.e.n.t. .2.7.6................................... ...................................0".......................C.o.n.t.e.n.t.s.........................................................................................................x.......D.a.t.a.b.a.s.e. .(.T.L.V.).............................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\2003_NC_Org_Statement.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 52, Total Editing Time: 02:10:55, Last Saved Time/Date: Thu Apr 15 16:01:09 2004, Create Time/Date: Mon Mar 22 15:03:08 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	901120
Entropy (8bit):	5.196993760121088
Encrypted:	false
SSDEEP:	3072:C8q9+TeL0hZGnIillNma52eiBisyZm9aahAN:r6Jc
MD5:	B64E6E0CF32FC4A7CCB5C8D3BB92381D
SHA1:	427DBECB4E18B11CDC6EE54B4FCEA1231535DFDA
SHA-256:	5019F534DC87B51EDFB8DFF231118328587CCD3572C595E452E57AA7B84E74F3
SHA-512:	B87857D15D620FE3AE41B0B8761B67FD85ED48D65EB4D081FBC12A94C6ED2303972341B2B4C076C898FBB4063342E8A49DEA5357F0DE559FA6E59423B83B40A0
Malicious:	false
Preview:	......................>.......................*...............................................................3...........$...,.................................................................................................................................................................................................................................................................................................................................................................................................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...................................................................................................2.......S.u.b.d.o.c.u.m.e.n.t. .4.2............................................................................\|.".....\|."..............C.o.n.t.e.n.t.s.........................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1000.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 76, Total Editing Time: 06:03:59, Last Saved Time/Date: Mon Jul 28 15:25:51 2008, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	187399
Entropy (8bit):	4.9388946711249355
Encrypted:	false
SSDEEP:	768:hP25wAQghxgQwBRaKgQwAQBRhxBRRAgwAQCF1lS8Fgwfv/mTnFGZE/hP5Si6N+2/:huOjFuE/hP5Si6x62
MD5:	D09CD0BF633CD0605976F14AE87B35B9
SHA1:	6FDE766F4DB41383C067AB5179CE47D83413F5B2
SHA-256:	D63BEBE3FC83950403F69AFCEFAB59612F44B3D5817C419F3383D95A079BC025
SHA-512:	297F15C9315AB2159C8630C14DA3E9C25B1A0B200B51A64EF3EB2A82FEA4619D61A7024A07C166C17B6DE8440247193247F436CD1C8383C95B8F3C4D4E46583F
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m.......................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1010.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 53, Total Editing Time: 04:08:04, Last Saved Time/Date: Fri Dec 17 19:08:06 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	4.833909151781048
Encrypted:	false
SSDEEP:	384:G9NvsBioHfL2O1hhCncEnYeKnDslIADOrlBHYH3sVIc:JL2+hwnDnYeKn
MD5:	010437FD9249DE33A524028CB861559E
SHA1:	343EEE5E9C4F8CCDD3BA0962BE55238D58F3F448
SHA-256:	07E783E5242BFED746924B7678AADABC12C52E463EC0161778BDA98882073612
SHA-512:	DFD2E2E68ED5C8624EAC69EB559F45FE5F08A902745E400CF7AB1ACF3B8800B919CA74851783DD94CCE313027D5F9BFA69CFD9B88F4773151C24F5F0BB2C40DB
Malicious:	false
Preview:	......................>.......................E...........A...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .9..........................................................................F....`!F.k.....I.k.................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................*......E.m.b.e.d.d.i.n.g. .1.1........................................................................F......M.

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1100.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Mar 5 20:19:07 2004, Create Time/Date: Tue Mar 18 18:33:40 2003, Last Saved Time/Date: Mon Nov 19 15:30:01 2007, Security: 0
Category:	dropped
Size (bytes):	161356
Entropy (8bit):	5.177382724517874
Encrypted:	false
SSDEEP:	768:ep2c9joPH0MdlojY7vmW1EtujSD9DvcRwS+Ln9:9c9amGmWAujI9DvceS49
MD5:	38AE604FEB6ECCB8EF90ED989E95B55C
SHA1:	1B48DFDB4F3572758EF88460B29D03879620AC5D
SHA-256:	61E0E173791B801B023AF5987484487A59CF5FE19C0642BEC8BFBE49677451F9
SHA-512:	3C41155FDF0A2963C87F1272899C6E3A8C525E2C6982BB080624C8374970B02AD4BD36BFBC570975147BD3E73C3304D71960D48767C7172F45847B9011F28D40
Malicious:	false
Preview:	......................>.......................................................]........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1205.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 65, Total Editing Time: 14:30:00, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Wed Dec 22 20:39:36 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	65024
Entropy (8bit):	5.10343096382262
Encrypted:	false
SSDEEP:	384:wIyubiGxnps2q3/FanLN4oCYoBUXmfZn11DP5MN5GY3WqN1xYNifO8fda9C44CVD:wunpTq3/FaZFXmfZnj
MD5:	097E6B26FE7DD4437D8A343EF52EC517
SHA1:	BF9B400E4D56BD9D4D6E58CF07F5647428BDB03D
SHA-256:	79ACD4650E807D66454E0B6B935D3A7E7EFCB728C1DDF33DBA6F65CFA074BA58
SHA-512:	E6D13C7D55F6C803E530F6BC358ECC4282F32C06F5F75F45FFEE7E05CD1A29CA24E4E1799CBEF86A8325DD46FA6FB88451A4C487B6B642DCD80D710C695B4E8A
Malicious:	false
Preview:	......................>.......................;...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .2.0........................................................................F....@..Yf...@..Yf.................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...............................................................................................p...p.......E.m.b.e.d.d.i.n.g. .2.3........................................................................F.......Y

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1210.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 125, Total Editing Time: 1d+06:37:40, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Apr 2 15:23:54 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	108725
Entropy (8bit):	5.347342388943793
Encrypted:	false
SSDEEP:	768:Etuya2n71onFjEkEOnUD8hS2ktBmm8F/pm+g:Et5oLC8F/p1g
MD5:	24625381A4A79D98BB9D42D6B7F9A5FE
SHA1:	5D71A3C809D7DBE54A1D7D124C56471B419F1A7F
SHA-256:	391152A4E0F66892A48EF07066A845E346C749ED479501402C907BA3E4639677
SHA-512:	9263939EAB0EBD221D17F45A76AA0CF00F4A38E6204E25990B4C1226D06035D7856F3F6239BBCC86F81B9C4DDA1A46BD741FE9976AE50780B69BF078B38075BF
Malicious:	false
Preview:	......................>.......................E...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.8........................................................................F.....7..2u.. ...2u................O.l.e.............................................................................................................C.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .2.0........................................................................F......!.

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1220.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 60, Total Editing Time: 1d+02:34:48, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Apr 2 15:44:49 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	89600
Entropy (8bit):	5.324389651089383
Encrypted:	false
SSDEEP:	384:AUfKDNLa1NuYqe26TngjniVd9znZUAQ1FYRzJ8+m63q6dUyAyxjR4avUuVxV79eV:pR2OngjniVd9znfTRDU
MD5:	D4AF83ED906C7B634BB7988F5FC77D9E
SHA1:	2C473D306D0071F75D891A2F108677E4563D8609
SHA-256:	96D3F4B240FCAEEB80222FB2107C4D1274FA3E87E46CBE11F5465657B143C28A
SHA-512:	FA3B57EC70D34C33BAA41891FC2C8B4A34113027C9B1BE743F14E3EA823E6AAA9E296CEE1A3B1FE8E210DFB2A3A02BF2AAA777EE79642729D7E0813268F05074
Malicious:	false
Preview:	......................>.......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.9........................................................................F......)w5u...-.w5u................O.l.e.............................................................................................................=.............O.l.e.P.r.e.s.0.0.0...................................................................................................8.......E.m.b.e.d.d.i.n.g. .2.1........................................................................F......:w

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1230.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 56, Total Editing Time: 11:09:29, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Apr 2 15:46:24 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	112773
Entropy (8bit):	5.250973108086118
Encrypted:	false
SSDEEP:	768:EX82dynZ8nzdp1UQhrV6x0KvnPC5F3RnO:T4LLOPQF3RnO
MD5:	C776CCEA447F74098919D2CD84E21F27
SHA1:	39A2C1D292006A4EFF7572393DBF5534D835C95A
SHA-256:	EA699B7EA87FC4A1F48ABEDA29707D3991950ADD632B54E5CD82D6ED6E19E5A4
SHA-512:	E7A0001ABDABD65F597C77688A14291AC67FB993BFFEFAB98B35548832DA0823435D4C694CE26E2DDF8D91AA2A39EAE8A52A938463F70BA7074C6F879A7AD982
Malicious:	false
Preview:	......................>.......................O...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .2.2........................................................................F.... v}.5u..`...5u................O.l.e.............................................................................................................@.............O.l.e.P.r.e.s.0.0.0...................................................................................................8.......E.m.b.e.d.d.i.n.g. .2.4........................................................................F.....K..

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1240.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 65, Total Editing Time: 1d+15:03:26, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:13:15 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	108914
Entropy (8bit):	5.248018963968515
Encrypted:	false
SSDEEP:	768:U48gnilnzJ1HdBEXHHXiQtsCnm5KYiuqqmrRQ:UekzJb4sEEziuqVVQ
MD5:	12CB40DE811F5393136639186EFD472E
SHA1:	22AA2F1FFAEEA90D910E93EDA4DC1B042769DFD5
SHA-256:	EBD8E59E2EBBC54B139F101EDFDD4972A7466AE8836D956F78BE53258F960A93
SHA-512:	3DB9E9380DEAECE075B4F82D81E881B385191BC48517600AAB48428669CDF9F13E6D108EC26FF0B1B914E368E0A6B4E8F9D967132556C9A2A781D73844D711F3
Malicious:	false
Preview:	......................>.......................Q...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .2.5........................................................................F......r..u...<~..u................O.l.e.............................................................................................................:.............O.l.e.P.r.e.s.0.0.0...................................................................................................&.......E.m.b.e.d.d.i.n.g. .2.7........................................................................F........

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1250.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 69, Total Editing Time: 1d+06:12:29, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:18:06 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	5.336808297146148
Encrypted:	false
SSDEEP:	384:nZ3AqRFh9vx5LsU1WtnPMn3kB/lH8gUPVncL3heqR3TzGaQnQ1nXLuM3X3s3tkRh:5vx5LsUEtnPMnUB/lRUPVn7MHcM
MD5:	A38D6C5A69B882D02ECF73C0E5AFAAE1
SHA1:	0B8C51858A55123050184ACAA72D031C82B34968
SHA-256:	84EB99CD7F7F121443C559759B9E79DB0095F6001B304E343BEFB14876BE21E2
SHA-512:	2DFF4584EED803BDCF89F8B4764180B354E6A0A56A016303678643D1BBD6FD797006CD05044C03E880FC7B7489029ED3AD7EFF7179B0ED3AF2C07F078F9AE94B
Malicious:	false
Preview:	......................>.......................G...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .2.9........................................................................F........u..p....u................O.l.e.............................................................................................................:.............O.l.e.P.r.e.s.0.0.0...................................................................................................b'......E.m.b.e.d.d.i.n.g. .3.1........................................................................F........

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1260.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 77, Total Editing Time: 13:19:08, Last Printed: Fri Nov 19 19:45:23 2004, Last Saved Time/Date: Fri Jan 21 14:19:25 2005, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	87552
Entropy (8bit):	5.292860622249849
Encrypted:	false
SSDEEP:	384:0IVAgpIDVV3pdY7J84+ZEHnUzmLmCnFJBPncQ5olvPmKgTQVbDpdTC0xIBpIlxyi:UBHpS64+ZEHn0CnVPncxcA
MD5:	D57ABF650F3A7C4ABAFE3A95464A576E
SHA1:	888CC2AB4F445D3C25F5030ABC91839D7A75F015
SHA-256:	4F11CC3F6D5DBA4EC2B1A05ABF3819BA081F21131B80F092F0E8A4EC0E8109A4
SHA-512:	C46831025A5856D9559A9EE045105931441F2EF813202FCA6DFD7E33D71CF63175103BAB94E4F0F07E98E66E21746B182C9F550942E3CECBCB655437FC48509C
Malicious:	false
Preview:	......................>.......................@...........0...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .3.2........................................................................F......5....`\|.5..................O.l.e.............................................................................................................8.............O.l.e.P.r.e.s.0.0.0....................................................................................................:......E.m.b.e.d.d.i.n.g. .3.4........................................................................F.... ..5

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1310.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 81, Total Editing Time: 1d+08:19:54, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:20:08 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	107061
Entropy (8bit):	5.2458729633908385
Encrypted:	false
SSDEEP:	384:pGEVny+Or43UTn0jgysu+snyMQnf07AGfiEgwmrqnqMYF18r6q0fcdcClUvKPLjU:tZW10jgysu+snyMQnCAGfiEgwm+nqqDw
MD5:	0E08FBEEF0207A68F62D4B1D7DEF1C7A
SHA1:	D27D5D35A399A73F82025A1EDCABE1E2071681B8
SHA-256:	40E0F4AC3C8E326230535E4553AEC1B51F941A863417538E5EDF35A86F2B7F6F
SHA-512:	51B6660B2667AB4E6312BBD54765B15150D24C8E93A07F0755DF4733936323A8614F2F15EA6016D1CD1E69D2DDB398A6442B94F4F82C74E7154A86AFCF29E500
Malicious:	false
Preview:	......................>.......................P...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .3.5........................................................................F........u..@...u................O.l.e.............................................................................................................:.............O.l.e.P.r.e.s.0.0.0...................................................................................................,'......E.m.b.e.d.d.i.n.g. .3.7........................................................................F....Pr..

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1320.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 84, Total Editing Time: 1d+08:03:53, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:21:39 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	106941
Entropy (8bit):	5.190240409169272
Encrypted:	false
SSDEEP:	384:1/3D+TQ+w2k8nbrnHvqKbV9QhrVRxhBRUQ7ItnF+PQXj01JoRTqQVeOBGws9t8O7:Dh2k8nbrn5QhrVRxhBRUQ7ItnApbRz
MD5:	D5250C1D0DC2D60F86C6F3709FFD814D
SHA1:	2043CE28896350EE6382B3172C5766332B09D890
SHA-256:	36C9C8DDB2D33CABDE074D4D11E53CF22E41C822B0CB6C48FC64CE6036B9494B
SHA-512:	3C6B69E7FA422A1597F3C75F24163F7D75FD0E357F6060C610CB71AE1CE7777E01BFE58B0B4268AA1316F653BBE1DE34A001270C43322D1D4D577D899FC3F6F7
Malicious:	false
Preview:	......................>.......................Q...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .3.9........................................................................F....p.?.u..P..?.u................O.l.e.............................................................................................................9.............O.l.e.P.r.e.s.0.0.0...................................................................................................$.......E.m.b.e.d.d.i.n.g. .4.1........................................................................F....p#.?

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1330.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 96, Total Editing Time: 07:53:47, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:22:29 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	100864
Entropy (8bit):	5.165912085213481
Encrypted:	false
SSDEEP:	384:xMLqp7YPTQPy7qUDcNinkW1dlE31rlsI2nG9XdjnHjjIH2An0zuuNz8wcNAMULKM:q3BDwinkoCD6nG9XdjnHjjIH2AnsBPY
MD5:	41E08E237789E1CD4CA9D79EA0104A51
SHA1:	35822182ADD8504CBAD4F16E2A2709F1B79BB859
SHA-256:	4E5371E38A984141C2F9922C1A1FFAE659F0E33D86ECC0381F2F24595187634B
SHA-512:	EC7386B8FF167AC216B796B7FD684560B2D51E0C9452F94AA01BD6BC4EE9471ED019035744B464973E1E8C3B9B5D3741C15758678DE1D6D1A1E4AEBA79801E0C
Malicious:	false
Preview:	......................>.......................P...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .4.2........................................................................F......c.p.....f.p.................O.l.e.............................................................................................................3.............O.l.e.P.r.e.s.0.0.0...................................................................................................4.......E.m.b.e.d.d.i.n.g. .4.4........................................................................F.....Fr.

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1410.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 100, Total Editing Time: 10:28:55, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:23:03 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	5.351003521831334
Encrypted:	false
SSDEEP:	384:46cHcDWNkq1ED1vvdmnYGngnmJn6RsLDE/TIYDrUIMNevHA5/AXTeANq+cpAJx2h:cmD1vvdmn7gnmJn645t0
MD5:	820B972D957DB3C16FBDB57EFCBD5FED
SHA1:	7406A6C07D42F7F5B3FD1B6D566A7D301A25E99E
SHA-256:	49DBD73C4739A9BCF13D6D41850413DD22A60E0DF1AF880BAF2598DFEC818A54
SHA-512:	532EDECFDDA49275BAA849A3802B2A49156D4C0AD7E2423D1CADC81CAD132C0661F1FCBFA6173F5CE60D84D59C84C2B4159A525BE0374FBA236371D1A71DCD8F
Malicious:	false
Preview:	......................>.......................D...........2...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .4.6........................................................................F........p...p~..p.................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................;......E.m.b.e.d.d.i.n.g. .4.8........................................................................F....@...

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1420.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 95, Total Editing Time: 08:04:47, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:23:32 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	5.321035397652944
Encrypted:	false
SSDEEP:	384:u/qIV+qqnAtr6napq/7cen2cvUV9XjQscvbWFlgMFWpoNi7abqN3NE50o8KwBv2a:fqqnAtr6nJcen2cv8
MD5:	BE5B1FB3E899FABC3EB7401E12F6DAE5
SHA1:	F1A260B5E17D3FDAF84544CDE55F76F117C0B34A
SHA-256:	19BDDCBD575C3F844BF482ECF3ADA47DA84DFC0CB8F795E56E8657D16546078F
SHA-512:	9F8E821FFD7E88450CC8C0C0B9407B763A0EFD536B6DFABA80E6053E82492E83F2836D360D918427FD0A4716CC395462F5BEB6954A15C2C660A0EE8D3A617962
Malicious:	false
Preview:	......................>.......................<...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .4.6........................................................................F.......q.......q.................O.l.e.............................................................................................................7.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .4.8........................................................................F....P...

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1430.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 98, Total Editing Time: 08:25:46, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:23:51 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	79872
Entropy (8bit):	5.287604768176084
Encrypted:	false
SSDEEP:	384:UULRea+qwnUfPLUnihpE/Hdi17bNnnJGcI7G9R+ysRUlFtBCyAyx1dmLdJ1/UWmJ:OqwnU7UnrVS71nu8RtOO5
MD5:	27085F01DE4D3142E9E4B9BB211557EF
SHA1:	B2B45E3ADCB2E595633992C976C9A261AA6C6D8D
SHA-256:	CA9A355143C4A90E927BEFB8BBB313DACF45E6ABC5FD8C9395AAF2A1518F1254
SHA-512:	399AAB73C33F278E058B0506F9D056E99E2F39D62E73F611AF0C3E2A512647567A238F5B1DC1E2B4F0A7EDFCCE79688B130D1ACFCA154EC0E658E50ABA073AAC
Malicious:	false
Preview:	......................>.......................=...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .5.0........................................................................F....P.\|.q.......q.................O.l.e.............................................................................................................4.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .5.2........................................................................F.....w..

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1440.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 108, Total Editing Time: 1d+11:09:54, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:26:09 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	111586
Entropy (8bit):	5.367325742316195
Encrypted:	false
SSDEEP:	384:jzJFVv9kfjZNPWGeQY99TnjOaLhnniomsnnnzJX556HPipVqxzeixiIAkzk2tMfH:FvmfL+jQY99Tn/hnnLnzJaN9MT
MD5:	607F6373C804F27F8FDF44A67900FB2F
SHA1:	3B40ECB8AB64990E950052E75D7A1839F7157705
SHA-256:	7839AB6F8668346B93AD1A5FB2F6010E768F746C22746A3698A9F8CEFB2240FA
SHA-512:	B70530BBD70B79E3C2A4DA844CCA9666F79F2A2CE3E07578788A0B8CED4DC65829FF1090B98739E31DA96BAE32B7F94FC982E84C266293046D0F5094ACDF6C34
Malicious:	false
Preview:	......................>.......................W...........S...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .5.3........................................................................F.........u.......u................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...................................................................................................XO......E.m.b.e.d.d.i.n.g. .5.5........................................................................F....p...

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1510.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 100, Total Editing Time: 1d+10:02:03, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:23:06 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	96768
Entropy (8bit):	5.253739160278084
Encrypted:	false
SSDEEP:	384:vKm+fLcKtI4w9+IZnT3vWAlrNcEBa75JL7s8+GtGP37Wufq63f4ZlUWDgnfO9U7E:Iw9+IZniArqka75JL7s8+Yi37
MD5:	DCAB179D3AD3ACFD7A7233C780C4535A
SHA1:	CAE2FA8660F933F310E00CE62EF0BE2EA3870873
SHA-256:	3C96A70007A1F72F740E2145478000E1B5AF48EC302B90B44362316C7F6483FF
SHA-512:	C3848B1E96E8C7AF5F163E0F0D182DCD86259A3DC66E90C872D82603687ED3D8C4904BE4B83D7A75242273629DDD91C7A4C6E9483291D27D7FC7A26ED8EC4D67
Malicious:	false
Preview:	......................>.......................H...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .5.2........................................................................F.......s.u..P..s.u................O.l.e.............................................................................................................6.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .5.4........................................................................F.......s

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1610.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 102, Total Editing Time: 12:46:54, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:25:56 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	97280
Entropy (8bit):	5.433407303868964
Encrypted:	false
SSDEEP:	768:Xv8TdJn1L9e/XR1njdFKaVgSoLUW2nE0QNjNH9//SxR2OfRuBtxVet0eYxeggQYv:Xv+kRRpAooLUWoE0F9
MD5:	172733484051DE3076D0A569F645045D
SHA1:	8BE5BB91E53AAD1EFBACC2C54AEE07FE1C1F164A
SHA-256:	E9BB1BA3289F596D025A5231320B03235BE5B816DC0F488EA01C515E4901E54E
SHA-512:	1252FA1225208BFAAFF9DC65A6825B795EF0909A9998978734615FE782595B3A8A816D08393D36694D02EAA7B292A8328274681CBC4005881F0D071FA08186B8
Malicious:	false
Preview:	......................>.......................I...........E...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .5.5........................................................................F.....}.]q...@..]q.................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...................................................................................................2.......E.m.b.e.d.d.i.n.g. .5.7........................................................................F....`..]

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1620.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 101, Total Editing Time: 10:20:22, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:26:15 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	94720
Entropy (8bit):	5.272781101700666
Encrypted:	false
SSDEEP:	768:gNuIJnEBd9cuF8Un89429gapL8LbniyRbV:g5ETv8aNApL8LrzRbV
MD5:	1B37C2A8DEC9E777B46E116BA50A3563
SHA1:	A8898F875CBC592BC5E20CE53B6EF9F0BB78D7DF
SHA-256:	DF084AB74DF1D8A747C1249B49E6D8D59FBF0502605F32E441B197E8E2A93242
SHA-512:	189D4B233FC19C87796B2CBAA963C482E91DF34BBAB9A07EDAD432383C672FD283CB9A7E4D5A65330767F229357A460E77443E5A05DDD56209B72AD9CB444C0C
Malicious:	false
Preview:	......................>.......................E...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .5.9........................................................................F....P..iq...@A.iq.................O.l.e.............................................................................................................?.............O.l.e.P.r.e.s.0.0.0...................................................................................................T.......E.m.b.e.d.d.i.n.g. .6.1........................................................................F.....N.i

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1710.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 102, Total Editing Time: 13:13:55, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Fri Dec 17 19:22:29 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	61952
Entropy (8bit):	5.197538641051164
Encrypted:	false
SSDEEP:	384:Hed98gAdS0dfq8n4hwlnTntEU/19uS6cEa7NyxPRkgmKAKc4IEztItr7XLXjfM:C8gAddRq8n4unTntEU/oV
MD5:	36859ACF22527BC88FBFB9E37440A55F
SHA1:	18AF08920D3346871C714D7BD6FA9CE15EB1ACC5
SHA-256:	75FC4385FB8AD4B3D51363C5698ACB8282103660B6976247C2C2BF503D375A2E
SHA-512:	29FDB57A280EAE39C3F358601885953CB80361AD30390877DD4A1CAACFE1B3921D021FEA3FF9411642FB32BDBCAC486BCA413F834046E793BD304A51449C0F5B
Malicious:	false
Preview:	......................>.......................5...........$...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .6.2........................................................................F....p..m....q.m.................O.l.e.............................................................................................................$.............O.l.e.P.r.e.s.0.0.0....................................................................................................*......E.m.b.e.d.d.i.n.g. .6.4........................................................................F.....,.

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-1720.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 101, Total Editing Time: 10:00:19, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Fri Dec 17 19:22:46 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	59392
Entropy (8bit):	5.168408859847519
Encrypted:	false
SSDEEP:	384:+wfUNpSgv0nWjVnVdffnhzK8h4pJQK68JqYVyVSheqCizxT:OpSg8nWjVnVdffnhe
MD5:	97E1308BA3ADF310E6A2DB558CA9D4EE
SHA1:	3FEE31C76C8A7648B9019C07D20A20352906D10E
SHA-256:	4AA41550EC612F8F97BBB2FC015E81FD493DA6C463C4B6A2FE8BA1430BEB5AE9
SHA-512:	2DE6880192BFE2D4B79F6FCCF0E976B573FF3E0E4468BDBDA75C73E07541ECEA6CAA1D5A2345E103DFD40E68D5C1E5F8B91BE40513879AE87AA1384B4E7F2C2C
Malicious:	false
Preview:	......................>.......................1...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .6.5........................................................................F....P...m....,..m.................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .6.7........................................................................F.....9..

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2100A.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 37, Total Editing Time: 03:53:01, Last Saved Time/Date: Tue Apr 13 14:20:34 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	114962
Entropy (8bit):	5.261604527673691
Encrypted:	false
SSDEEP:	768:I2e2hGE0kS1gDYq3nly76JfvRtncMZC03Eew:IjqDJ/cMZC03Eew
MD5:	1FB07367EEE8E3F2FFA696DA778F9018
SHA1:	170EF1512BB373E4EC8FBCA5263B5A08F36B9512
SHA-256:	1D33DC7FF4AD1B4893E9DB4C72C5F6D8D0D86075D397B9186B2854854AB81939
SHA-512:	178EC58D64CD56BC646D86F86E1ACE92425133C10B7761F5049BD2C091464EC32A570B1E2473B5D0FC011119C74266AEF41B48A12E159F2A262A2F0FD9A2ABA3
Malicious:	false
Preview:	......................>.......................X...........T...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2100B.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 48, Total Editing Time: 05:04:50, Last Saved Time/Date: Tue Apr 13 14:21:45 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	146388
Entropy (8bit):	5.235020092891038
Encrypted:	false
SSDEEP:	768:lHhUlBYVEpjE0l/8ygiedZ/ZXA2GGWOnxviPNisAtk71j3/NhaWVh:cisyzxviJhaWVh
MD5:	47FE2ABB3C4266AA429CAAF719CF71BC
SHA1:	E4C54798A9BCCF3C701159269C45D7E100260917
SHA-256:	18FF6C961A1882DBD1F73D84F8FD8EC5B8C15D93216D070AB4B700D56F7D4DE7
SHA-512:	2C298236AC196DFE6D63D4C39E4E61E33657B6EB532E6C8997238555B8E9D4D0114AA0765B1CD1ED8335595A41BEED6021F80A25ACA9F1CA1F5B830352468DBC
Malicious:	false
Preview:	......................>.......................p...........l...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2100C.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 43, Total Editing Time: 04:21:42, Last Saved Time/Date: Thu Apr 8 20:48:13 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	107008
Entropy (8bit):	5.203668389142667
Encrypted:	false
SSDEEP:	768:z/e2h2SnE0VWT+1+CiQCQGWPn32nhLn9ltYpM:XlWTQGnhL9ltYpM
MD5:	EC5ED3BE771AF6005AFCAC6A4C51F499
SHA1:	CA5DB43D68B152900E6F53E8E612EC8797F2A3D9
SHA-256:	DF063F6FB7499AD1ED1A1119619EB53522AAE076943B44014F88D29C546256F8
SHA-512:	55AE15036ADE8A92BD83E18F5BC56164E2C591E28C8F27F2DD50EBF0510B2A9F5B593FE58967EBEF7BBD2A49B515E13D66435624A8ACCCB6D4C2ADF924F8B266
Malicious:	false
Preview:	......................>.......................T...........P...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2100D.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 51, Total Editing Time: 05:01:15, Last Saved Time/Date: Tue Apr 13 14:23:15 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	166675
Entropy (8bit):	5.129449327763986
Encrypted:	false
SSDEEP:	768:GM4hVe2h2WE0VSAcZ7qW5xp7XnWGHP/3HcMJMkcp8sbHVrtHXGnPr9swMnvUgFKG:GjqZGW52uPr9sxDNe6pwO
MD5:	304833086B629BFAF6693DA65E39EE77
SHA1:	F76E35DE8ECC14B02F43CA081BCA9564401A98ED
SHA-256:	7798FE0E09498A983A14564088513DCFF524A92B029E696FA7666E7D2F21CD52
SHA-512:	3B7BC1572975669F1F0C6C47A4DF4F1D790010432CB1B192A878E765135383937188B7A303804C0650AB95BBF3D49CDC86F1926098830880CF1CCBA01244385F
Malicious:	false
Preview:	......................>...................................~....................................................................................................................................................................................................................................................................................................................................................................................................................................................................d.....gdldd.dddddedd........ddddddde.dcddddtdA..dd.gddd.dddddddddddddddddddddddddddddddddddddddddd$dddddddddle.f.....cfkfffffffffffd.ffd.fffgfgfgfffffffffgfffffefffffffffgfffff.fffffgfgffff.7affffl7776777777_4afffffgf..........8....o..... ..hoooo}...;..............oooooo.s.....F..tssssS.p......ppp\|9.1........pxprpppqpc{si...^ABCC7,...]:.2........s.s.....@..tssssn.p......pppy94>.....p{pepppqpc{sd...^ABCC7,...]:7=.....s.s.....J..tssssQ.p......ppp~3........>...p{qppppqpc{so...^ABCC7,..

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2100E.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 50, Total Editing Time: 04:33:45, Last Saved Time/Date: Tue Apr 13 14:24:17 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	107008
Entropy (8bit):	5.212905544497119
Encrypted:	false
SSDEEP:	768:Ve2hrxPE0TNYWedi46AMWnX9KtpskNNf:lx7NmX9KtpskNNf
MD5:	0EDE1C44051050AC187DA8AE1A31C2F8
SHA1:	6727E18195931D9FFED15210436147C34CF1CC87
SHA-256:	8D79794DCE8E8102C720728292C6F6EBFA0001110DB7AFB4E02F82F3DC59CAC5
SHA-512:	AD0387D629DD90745A5566F5DBEFD2EC2F7EBAE6428AB89F0169F11D412B917359CE61DFCB47365CD0D0BFEF58DD57CB7991534B97CAED8778321480062F4842
Malicious:	false
Preview:	......................>.......................T...........P...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2110.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 49, Total Editing Time: 03:46:39, Last Saved Time/Date: Thu Apr 15 15:57:48 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	5.009447532664834
Encrypted:	false
SSDEEP:	384:TPJJ7E0hxrneCraahyLQnKwtdKqDnfpACZZkqelRmEChcbSfjSwHbSwT+4suZMs:VZE0hxrneCraah1nKwtdKqDnf6/uaT
MD5:	DFF552E4E496944479F953253BBD7351
SHA1:	C1B05DD86E65721096C510D61D58BD98ED6DF24A
SHA-256:	F694DB14FCF41F4AB49B0E78A5BB6013F5DBB3C98FE2419A8B4F31E9EC6C01E7
SHA-512:	C5C7C86701687A794F69CE62BA2283866641C2BC4DF06E81D2B82B13AFE19EE1F3DB98374CACB0BD10ECCAC55BECA350C074B53132878FF7F167B26104D8ED63
Malicious:	false
Preview:	......................>.......................I...........F...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.2........................................................................F....P(_.."..P(_.."................O.l.e.............................................................................................................(.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .1.4........................................................................F....@M\|.

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2120.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 51, Total Editing Time: 04:10:11, Last Saved Time/Date: Tue Apr 13 14:26:03 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	4.932281798856309
Encrypted:	false
SSDEEP:	384:my8vFCp9Baa2ei+8dnKS+Mn8ApHNbjjVkyCSiyCizjyfanlIz1c5Ok28Zfcu3HUJ:AFei+8dnXDnjN5ayCSiyCizjyfan
MD5:	CA9D0B00E917E157CC2408DD4DC2EA90
SHA1:	DC8EAF0340917B476C13C22392A923FC9FF2A544
SHA-256:	C08686BA7C85FE2046B9CDDC4A1DD01D46D46C2380097622D01BA26C7FEE2DA0
SHA-512:	17E3A6CD88BA189CB3661E5A297F208B1460B22920B3C49E2388C521694D6A9857AB388530E606F4672671934F7BF29DACD4526881A46427550EE2BCCCD59779
Malicious:	false
Preview:	......................>.......................X...........T...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.7........................................................................F....pn8.Z!..pn8.Z!................O.l.e.............................................................................................................".............O.l.e.P.r.e.s.0.0.0...................................................................................................H.......E.m.b.e.d.d.i.n.g. .1.9........................................................................F....0.U.

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2130.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 53, Total Editing Time: 04:44:01, Last Saved Time/Date: Thu Apr 15 16:32:30 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	91648
Entropy (8bit):	5.076995311538233
Encrypted:	false
SSDEEP:	384:IjZfGSJA38On49XQTyknFq8OgwWu1w8va5Eqbe8E7wtzwaxJbhA4zCeh5oORTJJA:IsaA38On4UnWgwWu17qbe8E7wtzLxJ
MD5:	5F1D64DB7229FEF2119003A2215D06C4
SHA1:	42A8A4F7B01CC3363741734F4B3191E835B745ED
SHA-256:	6DC59A6992E5543D655C584C7E969C76BE1B5E56A7472A89879FD5D78F94CFD7
SHA-512:	03DEBC9A70F6C3BE45DE952D959B8CD26C30DC1F08C8D1E9383C380592A2158A2209CBB9DB75275838BAB40CA6374609FA472E78EE67216168F322BA357EDBAC
Malicious:	false
Preview:	......................>.......................U...........Q...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.9........................................................................F....P...."..@...."................O.l.e.............................................................................................................4.............O.l.e.P.r.e.s.0.0.0...................................................................................................."......E.m.b.e.d.d.i.n.g. .2.1........................................................................F........

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2210.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 68, Total Editing Time: 06:54:28, Last Saved Time/Date: Wed Nov 3 19:31:39 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	175839
Entropy (8bit):	5.344109633971589
Encrypted:	false
SSDEEP:	768:rrFkQq5mlq6EppSEijiV6SArIbn+6UhUHMO5us0LNH:VAvUhUsLxH
MD5:	AA067548970C7B00CBD1AB3D163064DE
SHA1:	E72267289B4399F1F51979382060F3A4015D95EE
SHA-256:	7E38CC0B0BE481B16A64708EAB29064AAA1E7FC9603B479F3A1027C89599C443
SHA-512:	F9FD3F88F52846DD922F17555AF1E390EE1FEBEF38FE4A8633AC34E1E7B60BFBCD14240FBB1A9A006C6F937453961AB5846ACB6169678DE041EEDB811A450615
Malicious:	false
Preview:	......................>...................................~....................................................................................................................................................................................................................................................................................................................................................................................................................................................................d.....gdldd.dddddedd........ddddddde.dcddddtdA.$dd..ddd.dddddddddddddddddddddddddddddddddddddddddd$dddddddddle.f.....cfkfffffffffffd.ffd.fffgfgfgfffffffffgfffffbfffffffffgfffff.fffffgfgffff.7affffl7776777777_4afffffgf..........8....o..... ..hoooo}...\.)............oooooo.s.....?..tssssn.p......pppy3...4...p.pxpppqpc{se...^AABC,...]0...7...s.s.....E..tssssS.p......ppp\|9.1........pxprpppqpc{sj...^AABC,...]:.2........s.s.....=..tsssso.p......pppx=.. ...pvpxpppqpc{sf...^AABC,...]>..#...

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2220.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 64, Total Editing Time: 07:36:52, Last Saved Time/Date: Wed Nov 3 19:32:42 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	183665
Entropy (8bit):	5.227388050044036
Encrypted:	false
SSDEEP:	768:MVSBlBnqKOBlueO+O+u7yuLZJ5p5pZQgBx4Un5pFmWfN1pmSoNZl50Qa+OOKF/RI:M0BISTEWfQSoNZl50Qa+ONdu
MD5:	FBC80A0187F08266BE1BF548458C222B
SHA1:	407678E96CB6077C13DD905E4773B2EF1EC765BF
SHA-256:	5A5FC33AFE7368245E28A7713662C9BDA876F5AC927394A5A8A30836FE725DE5
SHA-512:	11F5E8D401D6FB0172B501776B6DEF21BD11B1081B602F1AC98E8F42D114CDE9EF8EE0728E1F0D509506FCEF5D7D27296290227AF513F4950C40E4F32FCDC8E3
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e.......................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2310.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Thu Sep 2 16:11:52 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Wed Sep 29 20:57:07 2004, Security: 0
Category:	dropped
Size (bytes):	97792
Entropy (8bit):	5.235321248671491
Encrypted:	false
SSDEEP:	384:h3FE+JrT1W4O7jhcWvL4LRNXncMEUYAkEUANCfn/+ckPJa0ihYpkeQd9H1tiADS5:ijh7vLqRNXncMEUYAs/fn7fOpiq
MD5:	343EF05BA42CEA68AF2C93D6A13D1DDA
SHA1:	48696E1A874EC0D9359750ED88AB9DD120556EE6
SHA-256:	1E7B03D67BDBDA7E22A68F91690B917B454A35B7797A67782DAA970E035E32BC
SHA-512:	7B2135F9A204F2D06C1AF46AA7E0822ADBDD3FA7D7642B759AA46C56966E864DA2D713C36193DE51F5C7148DF0D1961ED98A14D07A798165065F60CF0478B6F0
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f_reports\2003 Forms\cro-2310.ttx..........cro-2310.ttx.............................................................0...................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2320.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Wed Sep 1 18:17:24 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Thu Sep 30 13:20:19 2004, Security: 0
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	4.878667838414998
Encrypted:	false
SSDEEP:	384:jaLie5bHqeAsUpQZE0CoYnSmrWJKQa0CoY2SirQ8Oa0CoPp7ft7wMvWwdmhWwSY/:gx6hQA1vWg1SQ8bepLtH8h
MD5:	5708195C58E3C42049C1B39A69A778CB
SHA1:	A7B8E652A3719B0495FF8BD553E01518F3D3E6C5
SHA-256:	7192672E01BE235F4AEE589F8C89AB98CA3937B0E578E707D2C80104EA658F3D
SHA-512:	9BE7F2BEDB67C1BCB57C713FBE99483F2F59576458FFF2979BD09BB56669AC19A42A5A32B03398163BE93D7011C39C807831901CF90BEEE3A97EF754B32C0F17
Malicious:	false
Preview:	......................>.......................J...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.4...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................[...........E.m.b.e.d.d.i.n.g. .2.3............................................."........... ..............F....p...

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2330.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Wed Sep 1 18:30:22 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Thu Sep 30 14:12:24 2004, Security: 0
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	5.016829721181625
Encrypted:	false
SSDEEP:	384:Sf1lCrJRyG5G0aAYCMKiOqvsgyLfH0aAYxB3UoggtX20aAYpo0/6wMvWwdmhWwS6:1yGy9ygA9XEogIQ9pxM8hqO
MD5:	F5CDAB6A4DF5F715194C5DB56D5BC3D7
SHA1:	6C4A37A491B552AA28294D9B739CACD9738B0C0F
SHA-256:	702F5AB1C9D04BE301A38CAA092D2D77E3A572DF40D08FFC11F4CF875D2E0C9B
SHA-512:	E35E47012B974896F0904C276EB9BDB9587ABDD8A6891B06BDE60CC14E6D73448FBA3C6E3B536B30BDBE279D6729B2C227D626D7F058BD38C16342405B52E8E0
Malicious:	false
Preview:	......................>.......................V...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.4...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................t...........E.m.b.e.d.d.i.n.g. .2.3............................................."........... ..............F........

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2340.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Thu Sep 2 15:18:00 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Tue Nov 2 15:55:18 2004, Security: 0
Category:	dropped
Size (bytes):	172330
Entropy (8bit):	5.203209297538331
Encrypted:	false
SSDEEP:	768:ZMvUSXCbLRXY+OXLTgcbRRdUKuPkBLpYf78hhxhDhmVhShQhdh5vOG+6z:3SXCbg/gc9R6Pot9hQVQ+3h+G
MD5:	63F5FF7C2D7205CB2E4D97A709C8BC33
SHA1:	4E24825E5143987872329001C92F111290F14E84
SHA-256:	BCD7C0FCE94BA92252B53248F5A7720E9D05EDC5B509B6F5D05640F27C07513B
SHA-512:	C501643907DE3CB3F96C0B9EA6F8871DAA01DF15D6BE2951DD16E97CB346E19A55E12D58D9D2F71F703D42FEE5C8EA830D1657DFD77AF1C00907F73621ADBD84
Malicious:	false
Preview:	......................>.......................m...............................p...............................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.4...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................z...........E.m.b.e.d.d.i.n.g. .2.6............................................."........... ..............F....@o..

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2500.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 43, Total Editing Time: 05:27:46, Last Saved Time/Date: Wed Nov 3 19:33:51 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	4.912226439854232
Encrypted:	false
SSDEEP:	384:PWFml8E2XE848Qu9rC6gpbtne38GvfPVmPZn8IYpT0QCp3MaQRbx3eCWQ:1l8E2XEwQu9rC6gvnezvfPVmPZn43
MD5:	3CA49EB0F57DA94C615276F113798BBC
SHA1:	BF7BC7157F202F78272F8E523A3A79064BE0F9AF
SHA-256:	8D5E5F0BDA98BDD948625BD559E1E75E8D6409809A0527678156F602D7CCF44D
SHA-512:	E59A06824B6B995BE87054A7A43A09CDFE033177EEB2E1C2C21465F97C2C2D96CD919202836D23FBC21AF3DCFCCD22507E725E8BD8B9843B4FE08F6B0ADBDEC3
Malicious:	false
Preview:	......................>.......................B...........?...................................................................................................................................................................................................................................................................................................................................................................................................................................................................eld Definitions Only)....HC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\2003 Forms\cro-2500.ttx..........cro-2500.ttx.............................................................0...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2510.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:51:41 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Mon Oct 22 19:25:35 2007, Security: 0
Category:	dropped
Size (bytes):	97280
Entropy (8bit):	4.976430970520775
Encrypted:	false
SSDEEP:	768:B0jbfG0HYJffpgAnVY7PfsUMXHwKY0/Oxlu7cimw:0btHofHVCf/MXHwKY0/AuIi7
MD5:	8EAC4565C5C68E1989A9FF7987815CB2
SHA1:	0EB3FB50AEF02C35F85F65F5857A716C8AEFA682
SHA-256:	9EC7029D0766167D10E4D46F032B5B108B3B31B3A3237DE100D87E77D2B51386
SHA-512:	C70D33774D966A4E48970C1C3CECDF47F688603A7D50B707A61C4D8EF045C40997ED14CCE9784C08D05A2503BAAC36394E8E2BF1F137BB9CA21D646C73A27874
Malicious:	false
Preview:	......................>.......................b...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.3.............................................................!.......................................................T.h.i.s.W.o.r.k.b.o.o.k................................................."......................................................._.V.B.A._.P.R.O.J.E.C.T.................................................................................................).......E.m.b.e.d.d.i.n.g. .2.2.....................................................%... ..............F.......w

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2520.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Thu Sep 2 15:25:10 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Thu Sep 30 16:30:55 2004, Security: 0
Category:	dropped
Size (bytes):	135680
Entropy (8bit):	5.128156286632356
Encrypted:	false
SSDEEP:	1536:mV49P3yLKq8o4zLcb2UlUc4K+xTPNRPzUsdiallTonTIn2:1PQyN
MD5:	DA29DAC0A434ABC27100A3A4A367E110
SHA1:	C221D94A7BE299E5E14EBEC92A6DE9BF94480A15
SHA-256:	20D3D0DD26709E180F54668AB6C3699C1868925626FC6B1423D497605E7AD68E
SHA-512:	1472086D61EB119431EEFA82F285077CADAE6E242F704EE586A792E1D47FC241DDA2EE294FAF059CB172093929EBCAB6FFDFF067D1565F99DEF8C99FCB3E6C6D
Malicious:	false
Preview:	......................>...........................................................N...........................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.4...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................V...........E.m.b.e.d.d.i.n.g. .2.8............................................."........... ..............F.......

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2530.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: State, Name of Creating Application: Microsoft Excel, Last Printed: Thu Jun 15 19:07:57 2006, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Mon Jun 19 13:10:06 2006, Security: 0
Category:	dropped
Size (bytes):	163871
Entropy (8bit):	5.0807907373790036
Encrypted:	false
SSDEEP:	3072:BaoO2BABgppv/5/vR6WOyALYaHueLJJz9nZMEaGzI096cZzl9Q:BaqBABgppv/5/vR6WOyxcZzl9Q
MD5:	1305898D36FFA9B7F2588B4A1500E83A
SHA1:	401DFD86A8927D1CB5E22A6AC704398721C28943
SHA-256:	B1A4B2167F40F9CB5FF128CD49F194334D730ADC6C0B5C71DA91F0AEC41FB573
SHA-512:	E27CE2D9EB5A541E24F690D6951AB133DB81D9BEE17AEAD2A9FE0A562007F24D522FC9A920F0687BE12BCC3CA357760319D70C077992B2885FD8DED3FE36F5A4
Malicious:	false
Preview:	......................>.......................................................z........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...>.......?...............................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-2540.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: State, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 16 19:02:54 2006, Create Time/Date: Tue Mar 18 18:33:40 2003, Last Saved Time/Date: Fri Jun 16 19:04:24 2006, Security: 0
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	5.031239289107367
Encrypted:	false
SSDEEP:	768:FB9CHpBpB5GOLJTJBEb/1EMAsxv5JQUM0FKmoDd:ZApt1LdEb/nAEv5JQX0Fw5
MD5:	47FFCCC46A2FC77F5FE6538F2BBDAA65
SHA1:	B99466E07ACEBAECC9444EDE30769BE9DF08F5B9
SHA-256:	967BEAFE2035D7AD942A8DEF6BA82D5BD8ABE196A2DF615C7C39F9E6CC27B796
SHA-512:	3829104E23319091FF92652912E9AC6F7AD2812EDDC625599A8B41D4D855F619A46F61FFE797D0243FB3774F49B34C47E42D79B55AB9A53A0D650E4858766D75
Malicious:	false
Preview:	......................>.......................................................~...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-3100.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 11, Total Editing Time: 01:13:31, Last Saved Time/Date: Thu Apr 15 16:10:09 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	59392
Entropy (8bit):	5.20548689364493
Encrypted:	false
SSDEEP:	768:Xu/JhxbQkQmhQ5NM9maf1iZxIHbWCAnBHszjGBAX1mrx7SympaenjKC:eR0kQmsMRTu9sPCQ1
MD5:	F06A082EE26DC7A9FC9AF75EA78CF04B
SHA1:	6FA744D6397EE27FAD957FD2E835003CE0928D2A
SHA-256:	E0B846D5CA7F4D42E7801DA32552585399C441E3D3E3B7C209A1EE94603CBF2A
SHA-512:	0FB7785CE7713382D67CC5FA8E41D0C7371DF9536A0E23A2FCE3A1E9DEDD6A0AEE155B2A0ED95366966CF7A71545B4476A323DCC438615C51A7E70E75DDF4AA9
Malicious:	false
Preview:	......................>.......................O...........L...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .4..........................................................................F....0.H.."..0.H.."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .6..........................................................................F.....Mj.

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-3200.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 11, Total Editing Time: 59:12, Last Saved Time/Date: Thu Apr 15 16:10:40 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	58880
Entropy (8bit):	5.202598797564419
Encrypted:	false
SSDEEP:	768:9x/p8JhxbQkQmhQ5NM9maf1iZxIHbWC8nJfBna/KEn2:9Jpe0kQmsMRTabu
MD5:	F0C67D5BE0C6C23069A98FC9C42B21F0
SHA1:	3664DAC584F65485BDFDD03FC215D817B9DFC30B
SHA-256:	EF0E4EA896076843CCAAD02933AEDBE79482D8AA94CC7E42102E4138D665F274
SHA-512:	3EE740535B59E33A29D9B8B323DEC0B96E6C8552BC38D9C9FD344D91B85AB7284052F6D5968FB2094FC262EFB2F5D80842D9C42392FF1D51BD7169A8F441F0BD
Malicious:	false
Preview:	......................>.......................N...........K...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .6..........................................................................F....pP..."..pP..."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .7..........................................................................F....@..

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-3300.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 11, Total Editing Time: 53:27, Last Saved Time/Date: Thu Apr 15 16:11:02 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	59904
Entropy (8bit):	5.210459280768143
Encrypted:	false
SSDEEP:	768:LCRojJhxbQkQmhQ5NM9maf1iZxIHbWCnnkrnCIHWnJE:LEoF0kQmsMRTP62
MD5:	B511926EF1002CB1F4AAA6E2071672E3
SHA1:	3C1D20F9223C2CE424D6B906D9789C493576EC55
SHA-256:	4F495EC0387E14EE0F211F0A53C133D0362A75DFAD14315A9DAB42A7E6D7F6A0
SHA-512:	1958C9CFE296090A6407AB032CC2E160982942AAB6A5B1CDB466547E6503A612632764471AB7EC80546F960C7CB2E69C115CD7B82FEA90ED0D58BEB818BBD8E3
Malicious:	false
Preview:	......................>.......................P...........M...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .8..........................................................................F....pO..."..pO..."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.0........................................................................F.... ...

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-3400.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 14, Total Editing Time: 47:00, Last Saved Time/Date: Thu Apr 15 16:11:40 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	60928
Entropy (8bit):	5.198727350702287
Encrypted:	false
SSDEEP:	768:DQ+bXJhxbQkQmhQ5NM9maf1iZxIHbWCsnThHnRKqn8:DZb50kQmsMRTa9P
MD5:	F3E96121EF1FE4575C5112E52619A9DA
SHA1:	A308DD12F2DB9F5863631ABFBE97554C76E32C9C
SHA-256:	742D520C233C61433A794AB11DB5FBCD236565CFC63A82D2715241BABDEF4041
SHA-512:	94935A8F87744BBA7FEBCC8A5FEA0F3273CB558D7A385ABBB9CEA94DECD2BC247BB934D472D4136FB431C58956355D7DF9252A849D9731F0C546345C056EB6B2
Malicious:	false
Preview:	......................>.......................R...........O...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .9..........................................................................F......+.."....+.."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.1........................................................................F....@tO.

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-3500-add.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 15, Total Editing Time: 01:14:19, Last Saved Time/Date: Thu Apr 15 16:46:43 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	5.0872204368180025
Encrypted:	false
SSDEEP:	1536:KCrycGESg0kQmsMRTiGlrfSBaEEP4VpAH9fxFS:d0kQm9RT
MD5:	E6DBE6558E05030B529A9F71B1944DE0
SHA1:	EBB835D973C152D757845AD9E4EDE7A2DE5D4CB1
SHA-256:	C52F450DFAD410C2C177A91DB8C070BF63D3068A52C81092AE60D66AFE88F0A3
SHA-512:	49D6612314178EE866503856AE3E3079C858CA4375F827505BD40423429C120AA388C0CAFA63C4FFE7B36A81BF804AFEB87CDD8739E8F3BAF1E5FDDB533D29D2
Malicious:	false
Preview:	......................>.......................]...........;...............:...................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.2........................................................................F....._#..#..._#..#................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.4........................................................................F....@gN.

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-3500-main.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 17, Total Editing Time: 01:43:07, Last Saved Time/Date: Thu Apr 15 16:13:09 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	5.388710930708643
Encrypted:	false
SSDEEP:	768:+nVHYhxbQkQmhQ5NM9maf1iZxIHbWCFnjDnaUoqrnc94RHexedO:+i0kQmsMRTJPjpHA
MD5:	5A6E41E293A03AEBC93266499DA11B7C
SHA1:	6400957B493FED5E571912DB972EBABA94636FF5
SHA-256:	646174976696BE16DE2AE3D451EF356F83D4DE085329301AC5295F7C61342A4F
SHA-512:	1E0159E6EBAAFA8AD8BFC8FA7F000B813DC836A344B6112BCA751D0246196F5D9A0FC094842BFB53FD836CC9B7543FFC23656585E1F00BD09A79CAF4B0A6B84B
Malicious:	false
Preview:	......................>.......................c...........=...................]...............................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.3........................................................................F.....S>)."...S>)."................O.l.e.............................................................................................................7.............O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.4........................................................................F....P.b)

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-3500.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 55, Total Editing Time: 02:10:00, Last Saved Time/Date: Thu Apr 15 16:46:51 2004, Create Time/Date: Mon Mar 22 15:03:08 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	158208
Entropy (8bit):	5.340858554251574
Encrypted:	false
SSDEEP:	1536:oNe2HASmU0kQmsMRTXTcDCrycGES5orfSBaEE2pAH9fxWK0mU0kQmsMRTg:F+0kQm9RTY0kQm9RT
MD5:	0393A9F38F3AD7C4A34189358C9754F8
SHA1:	8622DE3DB6B32284333F4A63BD90B3F8F962CD31
SHA-256:	93B0F789471FEF00B74DD158933D1E8F9C5AE045183F89910C9472E91E66DA50
SHA-512:	9322F7A00928E023CE9C9EEC6CD94F338F7661AC2AB2A59BC71DC5B329A873817ABE91CA5788C2B1A6D2966B75DE76588FD57B3EFFC1C5378377DCDE6CD92C56
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................eld Definitions Only)....MC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\crystal version\cro-3500.ttx..........cro-3500.ttx.......................SQL.....Pdsmon.dll....%Active Data (Field Definitions Only)....RC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\crystal version\cro-3500-main.ttx..........cro-3500-main.ttx.......................SQL.....Pdsmon.dll....%Active Data (Field Definitions Only)....QC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\crystal version\cro-3500-add.ttx..

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-3600.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 13, Total Editing Time: 41:36, Last Saved Time/Date: Thu Apr 15 16:13:59 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	60416
Entropy (8bit):	5.20599462556192
Encrypted:	false
SSDEEP:	768:wTlmibYhxbQkQmhQ5NM9maf1iZxIHbWCjnH1I6nd6NbqnQF:glmiU0kQmsMRTLVSM
MD5:	9E7D6F992148FC5550D5DEA0932E7F24
SHA1:	EBA62B123B5CA75C49DC41FE142BF5589E88C2A8
SHA-256:	C09556C17C14E2286977FFB12BE987425EEE0803D607D7446057B55620A2F9D3
SHA-512:	F8B0EA0B0AFE0125E3662C5FF2145F0A25348FD0F8051E010ED7527AB3BA6AC47FF3207281340E73B47644DE3725C040BF2DADCC506C61DBD32AB1FF31F0E66D
Malicious:	false
Preview:	......................>.......................Q...........N...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .8..........................................................................F.......G.".....G."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.0........................................................................F.......G

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-3700.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 16, Total Editing Time: 01:16:19, Last Saved Time/Date: Thu Apr 15 16:14:26 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	59904
Entropy (8bit):	5.201214682908714
Encrypted:	false
SSDEEP:	768:Mm80tYhxbQkQmhQ5NM9maf1iZxIHbWCInu+lnxhvnK:M5020kQmsMRT2hj
MD5:	AA8902D4CD33C667E28AE4BB9A6CADE1
SHA1:	334D99391F65F36D54A444DAFC31572766E66039
SHA-256:	ED8FDE84B287084F0C961C7198ADAEEA4024DDB69A6613B893E0A3AF160A10EA
SHA-512:	1503E493ED48ED1132A7B3001CC7CB15AEB1F553C14163355A7529285393495C464325EC0EB9EE0D1E313C1B8B7573D7022838B301BD3865B443764EC6C241BB
Malicious:	false
Preview:	......................>.......................P...........M...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.0........................................................................F......\W."....\W."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.2........................................................................F......W

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-3800.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 16, Total Editing Time: 55:25, Last Saved Time/Date: Thu Apr 15 16:08:54 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	5.222279462324983
Encrypted:	false
SSDEEP:	768:3QvYhxbQkQmhQ5NM9maf1iZxIHbWCLnWnJ8nOvuquin:3r0kQmsMRTDWn8sak
MD5:	881CE3142335B809B9C88D3BAF0F1AC5
SHA1:	54316525510D401A686BA152A69E658C74F73481
SHA-256:	373BA0BB70D83F47E9F15967318379C42FC4FCDA8C1FF8CD3F7EE4AF47DBF6B7
SHA-512:	6F3C6088109D4FE2331A0DDC5A23B4894D0A9709209B042934794CAF72C05FC79187407D199476D7DD5BBABC2D95834097F194BAD3FCC8A211EF9F1B76C8AB14
Malicious:	false
Preview:	......................>.......................Y...........V...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.1........................................................................F........."......."................O.l.e............................................................................................................. .............O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.3........................................................................F........

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-4000.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Wed Jul 23 21:08:46 2003, Create Time/Date: Tue Mar 18 18:48:23 2003, Last Saved Time/Date: Wed Sep 29 16:09:05 2004, Security: 0
Category:	dropped
Size (bytes):	160055
Entropy (8bit):	5.274194490059007
Encrypted:	false
SSDEEP:	1536:LXM5UzLaFCbFD8UlI7wLS4s63a2EPo5FGyy:LXMiLaEbFD8UlI7wLS4s62
MD5:	37EB610A634C1DDFC81FFB4990591935
SHA1:	84E81DAED249A25AA2AEB41F15B57DE8867CC93C
SHA-256:	5D15551981C1099F202823541E981A577372E458BA345752B9B3B0E0E0E2D059
SHA-512:	72DCAA38E5BA795C56F2E5076064BCD683570FBC8ED4DBA83E88CFEC04AD7B30DBA6A78D7D92F8B8AC16BC5671E0D4359D1AEC1500CEC29D99EF68EAD158C17D
Malicious:	false
Preview:	......................>.......................................................g........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...............................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-4010.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: programmer, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Mon Mar 8 13:36:18 2004, Create Time/Date: Tue Mar 25 14:52:47 2003, Last Saved Time/Date: Wed Sep 29 17:55:29 2004, Security: 0
Category:	dropped
Size (bytes):	143872
Entropy (8bit):	4.929485413721053
Encrypted:	false
SSDEEP:	3072:/im9jlbEsrtvnwTDCI/dIj8yI5Fik6ulE69OsccKy5:
MD5:	4B55DAB27519155A12B873F1D7D44498
SHA1:	8B9BE194A8DAAECAD472660DB008326326A1C63B
SHA-256:	87BC25D6D57B23CE6CA2E6DB3E7FAB777FA5DE415B7347723EDBA7BF7FA43ED6
SHA-512:	F66495BD44022833DE875DC3788E45CED74D595A8099EB2938B6D2BD2B15DE156FD20557991E946D0CC17D14050A583E7AA3AEF823469C4BAFB805386069431B
Malicious:	false
Preview:	......................>.......................................................Q.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-4100.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 16 15:54:41 2003, Create Time/Date: Tue Mar 18 18:48:47 2003, Last Saved Time/Date: Wed Sep 29 17:56:45 2004, Security: 0
Category:	dropped
Size (bytes):	145920
Entropy (8bit):	4.9925301432159035
Encrypted:	false
SSDEEP:	1536:wHgr56AinkrRcycDCTCQd4iNbBm5+q+zG2F:wHc6AinkrRcycDCTCQd4iNbEN2F
MD5:	FC038A5D0FD1B115F67ABE16A2B997EE
SHA1:	F385AC3E5FBD3C5C7E463EA55714797FBA3D3FC1
SHA-256:	B4E8D00C75260301D54369D88E0EEEEF0D83FD4FB7D8D845D927738453497CD6
SHA-512:	85F600ABC3EFB7D782396F347F3CB8F723FCE58671002D75E769714387C7D0E35F456DE32FE5F1DCBA271F4E6780A6E8C64F922EAA884D0D5DE77965FA638DE4
Malicious:	false
Preview:	......................>.......................................................m...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-4110.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: programmer, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 3 14:49:58 2003, Create Time/Date: Tue Mar 25 14:35:37 2003, Last Saved Time/Date: Wed Sep 29 18:00:44 2004, Security: 0
Category:	dropped
Size (bytes):	109056
Entropy (8bit):	4.763335759409982
Encrypted:	false
SSDEEP:	768:xnbQqAqLbqr/Su9ySWOQLISXQv+ZN5Zxftt/LIEKjGn:txgLD9yNqSf5ZxV6EKj4
MD5:	65F9BEB9749339F9E44355A5C809AD4B
SHA1:	C9F242F2C6E3361F1ECB802984059CD7C911992C
SHA-256:	B4D9FCAE9C80A489BB0070B090F924B7B21DFAB7ECF45D06C8998287CB1082E3
SHA-512:	9CF7CEB35B63CBA41C3F3EB0C9104D82729531D9426BB8A27536F594CD96A690D4B05C3029A1A7021D417591475E7A8DA5BFA713E53438122A3738D0858CF39D
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................eld Definitions Only)....RD:\DEV\CR Code\Remote Filing App\Version 2004\CF_Remote\reports\2002\cro-4110.ttx..........cro-4110.ttx.............................................................0.........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-4200.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Mon Mar 8 13:38:49 2004, Create Time/Date: Tue Mar 18 18:49:06 2003, Last Saved Time/Date: Wed Sep 29 18:02:28 2004, Security: 0
Category:	dropped
Size (bytes):	156017
Entropy (8bit):	5.153834479799729
Encrypted:	false
SSDEEP:	768:R997ilTTQnZqWBCtvOL1HuQL3psNw8I7e+8xiZJSSZJTLenAjM:1fnUd8H0wt7pvLQqM
MD5:	85D19DDF6412ADC30E4582B09B12C81D
SHA1:	2A9E3E70365EDD7E63AF98CC928B1861AF149334
SHA-256:	0D4EA12E2607E86CC5C7F1052832331678005D9E8A64C818BF4D9BF2E131A71B
SHA-512:	2A8A070AD593871890BCF825836AF861F5CD6371C832B406E456F5B35D524E85D27DF5E7B4DA90998BFC890068D79252A353CE98AA3660E8E35FA405227250AA
Malicious:	false
Preview:	......................>.......................................................A...............................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.........................................................#...%...........................................B...........T.h.i.s.W.o.r.k.b.o.o.k.................................................&...........................................2..........._.V.B.A._.P.R.O.J.E.C.T.................................................................................................`.......E.m.b.e.d.d.i.n.g. .2.1.....................................................(..................F.....(

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-5200.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 4.10, Code page: 1252, Title: Media Complaint, Author: CRO, Template: Normal.dot, Last Saved By: programmer, Revision Number: 4, Name of Creating Application: Microsoft Word 9.0, Total Editing Time: 39:00, Last Printed: Mon Feb 11 16:23:00 2002, Create Time/Date: Mon Feb 11 14:32:00 2002, Last Saved Time/Date: Mon Feb 11 16:23:00 2002, Number of Pages: 1, Number of Words: 121, Number of Characters: 694, Security: 0
Category:	dropped
Size (bytes):	77312
Entropy (8bit):	5.1864279109289395
Encrypted:	false
SSDEEP:	768:WvRwuJIBchkLEFbzOew7A6irPH9Y2ZVwCFgDv6FoYsHSb:W4BA2SLpzj
MD5:	46278C5B8F40632A170C005DA9D59E16
SHA1:	3FF09C3EA468C6DDEAA8B70E780C1C23987A4B9C
SHA-256:	50D66013ADAEEC5730A46ADB656C69CE53CBA22AC905D6939198ABCD56E6190D
SHA-512:	12E5C6A70A0001AF370D1A82F8931E9F4F1CCD8728C3A7BB67F6D80E8247BCB5272D2C2C2A316D9C7A2C11125A3D747C2B2C0BC2B9895E58B772820A1C0D8B7B
Malicious:	false
Preview:	......................>.......................................................c...............................................................................................................................................................................................................................................................................................................................................................................................................................................S.a.v.e.d.R.e.c.o.r.d.s.S.t.r.e.a.m. .3.4.l.........................................................................>...........R.e.p.o.r.t.P.a.r.a.m.e.t.e.r.s.S.t.r.e.a.m. .0.l...............4...................................................l...H.......A.n.a.l.y.s.i.s.G.r.i.d.s.S.t.r.e.a.m. .3.5.l...................0...................................................n...........V.i.e.w.I.n.f.o.r.m.a.t.i.o.n.S.t.r.e.a.m. .0.l.................2.......................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-6000.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 16, Total Editing Time: 01:19:16, Last Saved Time/Date: Thu Apr 15 16:15:03 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	5.462546839098408
Encrypted:	false
SSDEEP:	768:+nYhxbQkQmhQ5NM9maf1iZxIHbWCc+nBn3IP3r8anGFfti:J0kQmsMRTNNMek
MD5:	3250FC4FD11C15C54822054C28780B01
SHA1:	215184E6327FE1AC1D273BADCCED85E782923AD9
SHA-256:	1E7672885014E6B7C146889E2220D70D08901E7C49208B651DD234936AB2A544
SHA-512:	4F73F3CF649EFCA18472C01B431646327F69DE1F5048427471344041BE5A721AE505A9B544BCA1DD1D9616EB098FA0DC1299C1652691AE217F5FFE9FA6CE69A7
Malicious:	false
Preview:	......................>.......................R...........N...................Z...............................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.2........................................................................F.....>lm."...>lm."................O.l.e.............................................................................................................2.............O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.4........................................................................F....`=.m

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-6100.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 19, Total Editing Time: 01:29:13, Last Saved Time/Date: Thu Apr 15 16:35:31 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	46080
Entropy (8bit):	5.043756431144704
Encrypted:	false
SSDEEP:	384:7VOicAD99Eq1HqIbOqWLgBe5lnq+jJqa+k9OdV9d:B9hD99CISbgBon
MD5:	26D7904E98C4826EC8C737C66BDCBC12
SHA1:	7CA4829A3E5F1BBFEDA5E3AEFBC156C39874DA4E
SHA-256:	8C347894CA7949613D31E39D033063A1AF4CF3FE757333C4F1BE2579CF920473
SHA-512:	F1B514950453EA4F92BC5103E0138A23ED6354780A4D29DE127A0E6056C888C320E248B1E2126013271BBC844D0DA8A20E84AD8E9BF757F5B36F75743C552E8B
Malicious:	false
Preview:	......................>.......................4...........1...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.3........................................................................F......I."....I."................O.l.e.............................................................................................................&.............O.l.e.P.r.e.s.0.0.0...................................................................................................l.......E.m.b.e.d.d.i.n.g. .1.2........................................................................F.....8.I

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-6200.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 21, Total Editing Time: 01:30:00, Last Saved Time/Date: Thu Apr 15 16:16:31 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	30720
Entropy (8bit):	5.045260314109269
Encrypted:	false
SSDEEP:	192:tL7OOnPkQ0hIdHb5xjvNOJMHCdrx38bW/9sn0A/qmDSAmeCDtF2MjTDIRzDwOaUe:tfOEB7n0tPRjTDJxUe8U5Ba2EBnUU
MD5:	452A7EB0E5D50CCA95CD8005C00F58B6
SHA1:	D28E656B06ED04270698665896266CED2D8864B2
SHA-256:	E9B38C68D490F2CDA0F40BBD13DCEFDB49E20954704AEBE1111068C97ECFBBB3
SHA-512:	3078578BC5CBA6866B27E0D8B4B63818D5A776867BD36859AE50B1D78EAED6EE45D68BC1D8FE2B7A12304E04977E53B30A5425409144293DA1FFF93969C2DF27
Malicious:	false
Preview:	......................>......................."...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.4........................................................................F......."....."................O.l.e.............................................................................................................".............O.l.e.P.r.e.s.0.0.0...................................................................................................n.......E.m.b.e.d.d.i.n.g. .1.3........................................................................F........

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\cro-6300.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 22, Total Editing Time: 01:42:27, Last Saved Time/Date: Thu Apr 15 16:17:09 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	261632
Entropy (8bit):	1.9491111808148631
Encrypted:	false
SSDEEP:	384:/meSOY8bNrkn5G4LLHPI7AroarCIC7eVl5nnm3PVbWkPTf:umkn5vnHoADnncPZ
MD5:	2BDAB01E7B8095BB8FDEBE7AF3926965
SHA1:	BA9DEB25822C3E374CC2B2E07FE661F4E9502282
SHA-256:	34B8F59F480FCAF32C09E1B8427FAF5E0CF80DC39918B8E1BBF0DAE220B9B386
SHA-512:	7D00C4F622E969B22416AD3C2C5C7A768CD3D95E61109DA061FACD98F7BBD43AA5EE0CA7C600F2FF7B26201ED341187F2DE4C7E2A587ACE2AE1458978F89022C
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.5........................................................................F......r.."....r.."................O.l.e.............................................................................................................#.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .1.6........................................................................F........

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\2007_Electioneering_Report.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Oct 15 14:21:07 2010, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Mon Feb 14 13:42:12 2011, Security: 0
Category:	dropped
Size (bytes):	607232
Entropy (8bit):	5.407342130384767
Encrypted:	false
SSDEEP:	6144:DPJo8DExbYmh3gZ+RwPONXoRjDhIcp0fDlavx+W/WEjGSZ+RwPONXoRjDhIcp0fe:DPJo8DExbuG6GA0
MD5:	B54AEDB3AEEA8EDEF964AB865229C237
SHA1:	D4037247E61D6ECE36F3534F38427E3F59B8B9B2
SHA-256:	9E3BC47402EFBF6F9E1217D2353B4ED2D633E4E0B889A8A14C4D1A2A5F48A67E
SHA-512:	99842D7DAFEB366E76004A6B5306ECCF6EC9AC92E76782F12B94DA6C37EE3552522DA3CE7B1381686B44BA210785959949AB0B2D363D2282F27E2906821C2B2D
Malicious:	false
Preview:	......................>.......................d.......................................}...\...[...Z...f.......o.................................................................................................................................................................................................................................................................................................................................................................................................................C.o.m.p.O.b.j.....................................................................................................~...r.........O.l.e.P.r.e.s.0.0.0...................................................................................................l ......S.u.b.d.o.c.u.m.e.n.t. .5.5.............................................@..............................:......:...............C.o.n.t.e.n.t.s.........................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\2007_FED_Disclosure.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Oct 16 21:17:12 2007, Create Time/Date: Tue Mar 18 18:48:47 2003, Last Saved Time/Date: Mon Oct 22 19:28:02 2007, Security: 0
Category:	dropped
Size (bytes):	625664
Entropy (8bit):	4.950657383336972
Encrypted:	false
SSDEEP:	3072:TQrFH2RZraHzLWTkjqEMONv9tKAd0oNhzwcAS66emLo4cOfpkcUd3MDwC6SaHfs5:TmqHeuZgz+OSXG/inxkDo
MD5:	740F31D396DCEF3D05BDED7BD483AFB1
SHA1:	F8F66D67B56C7033DEB75E51521F5A447AD34996
SHA-256:	FBED39F9C33EB26E82A9C20B6F90DE125D74D8168E596CD3D40D00ED7998CAB8
SHA-512:	7F4E86B98968760E6E7DF03FF65E4BDF99B961FB3768C7DB49DA5796302D6F711C3CAB22733FB2B20F84F9222F33E6B849BD6AABE51AB574954A34DC50E9C57A
Malicious:	false
Preview:	......................>...............................................................c.......~...............h...............................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.3.5.......................................................3...5...........................................\|...:.......T.h.i.s.W.o.r.k.b.o.o.k.................................................6...........................................l..........._.V.B.A._.P.R.O.J.E.C.T.............................................................................................>...O.......S.u.b.d.o.c.u.m.e.n.t. .6.8.................................................:...........................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\2007_Independent_Expenditure_Report.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 77, Total Editing Time: 03:30:42, Last Saved Time/Date: Tue Feb 15 18:26:50 2011, Create Time/Date: Mon Mar 22 15:03:08 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	488448
Entropy (8bit):	5.4462079439186635
Encrypted:	false
SSDEEP:	3072:dH3+Wiq7/cnF9G6Hlx/6uGUZdle9R/R1f4qzta896JboUEednkO8X7W:0rG6nSaZHQ4qJa896GsnkZ
MD5:	7AC4C6D7C7069B28B2EB439657BA0494
SHA1:	992D6D9DB36178139DBA882992E2D7ED9C175592
SHA-256:	87046ECB5B9DE39287DFDA261139352FAF81E8CF6A37FDF964A20BD9616FE732
SHA-512:	9716FC62672228B374FB537C8B02621DFAB592A2E8D757A474E001AF154214D1424A5AD9D1BFF70D77862F1F3BC4F681CF4B56DCA388E30B71809915BE0AD2BE
Malicious:	false
Preview:	......................>...............................................................................q.........................................................................................................................................................................................................................................................................................................................................................................................................................C.o.m.p.O.b.j.....................................................................................................D...r.........O.l.e.P.r.e.s.0.0.0...................................................................................................dB......S.u.b.d.o.c.u.m.e.n.t. .5............................................................................`..=....`..=...............C.o.n.t.e.n.t.s.........................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\2007_Muni_Voter-Owned_Election_Qualify_Report.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:51:41 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Wed Apr 29 22:15:36 2009, Security: 0
Category:	dropped
Size (bytes):	192512
Entropy (8bit):	5.007944223673486
Encrypted:	false
SSDEEP:	1536:RktWZ7Ut5HHsDYP8my+MXHwKY0/abtfiYIiVSfaSfV:r45HHsDSMXHwKY0/JtF
MD5:	A7F2BE0A9C76BEC9C49EB1373D5090D4
SHA1:	7369379F50FC341D466CC8A2B28EEDB854AB8C64
SHA-256:	FAA0526CA53536BEB1316741D680356DC81479982B2250C8798D0E6F91FD896E
SHA-512:	05AD1783BD4A2EE920C335CF2AB392C9DB856F15DA13EE7C509F59DB44900B17E93C901A862C540D6267CC75E322989D1C852F661D4E7BE2135D350DBC935EAE
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................V...........S.u.b.d.o.c.u.m.e.n.t. .6.2.................................................!...................................................C.o.n.t.e.n.t.s.........................................................#...............................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\2007_NC_Disclosure.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 12 20:34:40 2007, Create Time/Date: Tue Mar 18 18:36:59 2003, Last Saved Time/Date: Wed Dec 19 20:19:48 2007, Security: 0
Category:	dropped
Size (bytes):	4794368
Entropy (8bit):	5.157456740228194
Encrypted:	false
SSDEEP:	12288:m9v/Mkrk2keuK63GyEhFKT8Y6IOm8XqQEJj+8fZvR7S/z0Ie2tXK:m98GyR6NKSLt6
MD5:	544DA1BE09475C44146130A8FCB9B3BE
SHA1:	4513DFA718004166D674C9E6573FBBAF9C186B70
SHA-256:	09A127F8DD521F7E1D029B922EA63CB1BD6C75BFF74025C78758500DB481320D
SHA-512:	3DCC434E59EEFA896DBC4BDC97E13D06A4757804BB8EA04F17F7EEA86DB6B5F6C31E1C94867C177A4E84B4756A66678D93F54D4AC2126AFF42B24ED49504D95E
Malicious:	false
Preview:	......................>...................J...[#..............f...............Y...........2...........................).......v...........t.......................!.......S...........................P...\|...~...1...2...............M ..O ..............w..."...{...........v.......x.......z...y...............{.../.......}.......: ..K.......F...4....!...!..."..]#...#..U...............................................................................................................................................S.h.e.e.t.3.5.......................................................3...5...............................................A.......T.h.i.s.W.o.r.k.b.o.o.k.................................................6......................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................X...O.......S.u.b.d.o.c.u.m.e.n.t. .3.7.7................................... ...........:.......................P<d.

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\2007_Voter-Owned_Election_Qualify_Report.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:51:41 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Wed Apr 29 22:15:36 2009, Security: 0
Category:	dropped
Size (bytes):	188416
Entropy (8bit):	5.010132586463127
Encrypted:	false
SSDEEP:	1536:OO5mMgUei51+DbPc4MIwMXHwKY0/mbtPVYI9cSfaSfJ:ATi51+DanMXHwKY0/C3F
MD5:	A4F078FF359ADA243E48087C2CF00052
SHA1:	5E12458C8146DD365637A89B5B21930E48C108B2
SHA-256:	861FE0412A7C7BDBC203F4C8E70959F03DF97949DAD70E725CCD6B193E972A48
SHA-512:	250DF78987D7DCC9CD13B17EC00CA67AE5AE23FF0356F7D9096C9F948CEDB1EB334E818BEC3B3E945A5A6F575EDAF7EB42CD3FC2072F043B0797C6B0EAED6499
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.3.5...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................V..._.......S.u.b.d.o.c.u.m.e.n.t. .5.5.............................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1000.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Sep 29 22:25:01 2008, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Tue Sep 30 17:11:16 2008, Security: 0
Category:	dropped
Size (bytes):	277199
Entropy (8bit):	4.955204919765509
Encrypted:	false
SSDEEP:	3072:A83b1ABghpv/5/vR6xyPk3kHgC6tgd9bA3wOsWU7YoWIGLtXqSEB6Wrp9RdrW+Z+:AQABghpv/5/vR6xyPk3kj8fZvRwY
MD5:	C1C49AEF91B5BD6B09A0D16DE5B5A1A8
SHA1:	3BCEAFC0D57E4806D853E5CAFBDF83C58D9AD543
SHA-256:	68F186EB404BB675258B7A37F436EF8CAE0CE0C99CE99A3E7405AD73014FC213
SHA-512:	1DAD02580762635B05900A44F272F64AC084EEB913B904B9BA69A44E56A116D92B6E73EF4E1A2495441D1D1F6E6678DAA584B1D07116F2BAE0F04A7C3A83AD1A
Malicious:	false
Preview:	......................>....................................................... .......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1010.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Dec 10 15:09:59 2007, Create Time/Date: Tue Mar 18 18:32:55 2003, Last Saved Time/Date: Wed Dec 19 19:22:20 2007, Security: 0
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	4.729959959151051
Encrypted:	false
SSDEEP:	1536:yYQlKGozYa7z986/yv/C/vABgvp5RhnJvq:yYQlKGozYa7z9byv/C/vABgvp5RhnJv
MD5:	6106AD996499E23B00951728597CCFA9
SHA1:	2A0925E3FA17D899BEACA18C7FDA025CFC23594E
SHA-256:	39165D6F20199D558C3DD18966B64523636C0C9ADA65C4A1BA3A4E8DB9999B61
SHA-512:	6AC84F98E24B1BAF384BDAA7B7DB12BA7B427E895FD1B81EB2B8902820E606227FEC837BB0C2C3519E94F12B16D6E5601FD1EC89235C28CE024CE3C6EE6D361D
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1100.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Wed Sep 24 18:58:40 2008, Create Time/Date: Tue Mar 18 18:33:40 2003, Last Saved Time/Date: Wed Oct 8 17:43:19 2008, Security: 0
Category:	dropped
Size (bytes):	179642
Entropy (8bit):	5.166216624571424
Encrypted:	false
SSDEEP:	768:/pwcx63BOdZ8FNq+cqbVozkajO32K9E9vjwWR9OqQHuqXhoOunwXyRZL7W:6cx/dqFNEqhoA3XwvAF6xnwiRxW
MD5:	62F7E5138E3377191BA9809FD25E3052
SHA1:	AA896EECBB096365E52FC60D1D971EDCE8C45D73
SHA-256:	27BE3E35FBDED425853F321AA82115B85D4E9D03BDA9986F58ED78D174AE3259
SHA-512:	D015AE587566DDB0520C47021684C3F1B373B3A9647445F937B60A6BF1175A22DF4BF41E35CB140999BB58BEAF33D627589F3755AFB84FD04408407EEDE251BE
Malicious:	false
Preview:	......................>.......................................................k........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...%.......&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...].......................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1205.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 12 20:37:09 2007, Create Time/Date: Wed Mar 19 14:57:07 2003, Last Saved Time/Date: Mon Oct 22 14:25:42 2007, Security: 0
Category:	dropped
Size (bytes):	182784
Entropy (8bit):	4.952399645110275
Encrypted:	false
SSDEEP:	3072:TXrzxidmGZKpR/V1Z2gnM815Usm8oPKcz4JyKYFf4XgQLtIyumEk/np0aVfUOBGW:5SkIDk6Fk
MD5:	D4132237EB41C001172379B0CFBD2716
SHA1:	F650B72162CFE3C41FBC3BB060A1F7A61025E922
SHA-256:	B639182A4F1DD0297405DB3123413041F130C8358545AEBB8346132FEC5FBE1C
SHA-512:	4027D8DD1303EB2A2BF0274F4D62AA38553B2C2520F448BDCA49B0B84DB5E4CD80A5BC172E2FB77EEC0F6B47BFC3E24BD056EDA5154B5D6FCFC04030F40CB26D
Malicious:	false
Preview:	......................>.......................................................n...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1210.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 12 20:08:58 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Mon Oct 22 14:29:10 2007, Security: 0
Category:	dropped
Size (bytes):	185201
Entropy (8bit):	5.240949811968868
Encrypted:	false
SSDEEP:	3072:lZ4aXxE0IeiZAqCfBFANfkF/CamYMfXFpAaZ5mSAAmTvC8s7GopsOG+8F/I:a
MD5:	CDDFB8A098D01B326568A8934542E6FD
SHA1:	810056460BCD69778469E80499B1B8A5ABF10689
SHA-256:	23EFA47355AC238926FDD2F156959CB828F3B56F233B32B6191E590620D845DF
SHA-512:	17F5AAAB78AD19DA3B44260E3142E928558C1C28BD30DC0357D2E841072BC88AE9ADC08C0479F7D14C79190A4EDA814FE81D8DDD4AA802B1A77BCEAFD60675DE
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...[.......\...]...^..._...`...a...b...c...d...e...f...g...h...........................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1215.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Jan 3 14:48:09 2008, Create Time/Date: Tue Mar 18 18:37:23 2003, Last Saved Time/Date: Thu Jan 3 14:48:33 2008, Security: 0
Category:	dropped
Size (bytes):	168448
Entropy (8bit):	5.202527529762482
Encrypted:	false
SSDEEP:	3072:6urIsxEywEw+001sKJY0yNnQiawtVanTTWukckYPSKjggF0M61LIiOIE1zeG9GXn:+yp3
MD5:	921173462DF6CC5BE5AA6E7F1C9F19D0
SHA1:	64A7090A11E0DED04E3F13AA70C0AED377DB0EDF
SHA-256:	CCF9CC5D1E823E08443BE7ADCD00B20B2975B694226DE83CE4D66F8A2E7F985B
SHA-512:	BBF4A1E7380D727BA46223032CBBB8FEAB208C08291DCF5C588F205628FEC74672EFA2A61A03B9EE302E02811245C1A335D2D3E2D5A29E47EA6D2270AB519BC3
Malicious:	false
Preview:	......................>.......................................................H...[...........................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1220.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Apr 13 20:48:40 2007, Create Time/Date: Tue Mar 18 18:36:01 2003, Last Saved Time/Date: Mon Oct 22 14:45:49 2007, Security: 0
Category:	dropped
Size (bytes):	150016
Entropy (8bit):	5.205596829097363
Encrypted:	false
SSDEEP:	1536:2W6NZmGBWou83Gngj6uPMzsWT3fki8oaKo/M4iTuRR:2W6NZmGBWoBGngj6uPMzxB8oaKo/M
MD5:	A088F0800E0E423C554231B891E59390
SHA1:	C345820606D84BB6529876F4F02D82C25DE22707
SHA-256:	C7AB5E1C7436A1A4C405A77975716247FB177B19AF52DD58E8275B68A524E3B9
SHA-512:	CE0D4E040DC1426274E2BC96CC3F997866EEE53E8A6CF8E77246E38E9C2D537A32FBC2190657667E047994DA39A0033F75D2ADFE9BA1A29881B40D1DDDF98882
Malicious:	false
Preview:	......................>.......................w...............................y...H...........................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1230.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 12 20:12:11 2007, Create Time/Date: Tue Mar 18 18:36:29 2003, Last Saved Time/Date: Mon Oct 22 14:51:19 2007, Security: 0
Category:	dropped
Size (bytes):	206658
Entropy (8bit):	5.156970374644571
Encrypted:	false
SSDEEP:	3072:gMPxdYIMwBzRn3Y5LoGMicjtGTD8x/0LUdheW/zXni8yV5Gr920W8y8a50032gSs:EKhK
MD5:	B6C3CE1000718B8957385CAE877FAEE5
SHA1:	0725EA60150FBA6EC4D98719193AF6A7212B609C
SHA-256:	5D45D44FFDBEE1BDEAFD1082651EF382164B646F75C53720D0D37E1FEB9C1BEA
SHA-512:	0D29BBCF4DBBD8E1DB670D662BB3471E315DFA90DBF23D36E921B39F7A98E8A5DED836CD2E4AB643FEF9039D8F68A2D0C2EDF440967D494EFDF30E59EA29C0EB
Malicious:	false
Preview:	......................>.......................................................S.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1240.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 12 20:34:40 2007, Create Time/Date: Tue Mar 18 18:36:59 2003, Last Saved Time/Date: Wed Dec 19 20:19:59 2007, Security: 0
Category:	dropped
Size (bytes):	207407
Entropy (8bit):	5.130835054236678
Encrypted:	false
SSDEEP:	3072:6mmZR4NTY+fBFvgipoLoJtpu6ndNVE6JsjNNKuX4Nrr9fO0Ehz0tmlgkArzOQAI5:6b8tx
MD5:	83E657E047E43622F4BBCEAE2E3ED26C
SHA1:	6B57E3230F7EB72E477AEDB6E48414E756108C2B
SHA-256:	CBF8CC5001E9509BB035677C6106EF50B74AF9146FDBBD6CB1A2D273A59C7C93
SHA-512:	D6514F1D0BF39089B7DE336BFA0BAC1983E006373CFAC35BC8F03D6A656F8CE1A40499558F8289A1D0D1727C3D3662E9AA169ABE35E033C4DE814CAC37F8FD69
Malicious:	false
Preview:	......................>.......................................................H.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1250.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Wed Dec 12 20:36:55 2007, Create Time/Date: Tue Mar 18 18:37:23 2003, Last Saved Time/Date: Wed Dec 19 20:23:26 2007, Security: 0
Category:	dropped
Size (bytes):	165376
Entropy (8bit):	5.204630458042751
Encrypted:	false
SSDEEP:	3072:JQZ7yok/viUkLZqhZnQeGfJDLsPO46kG/B+:Ig
MD5:	6742E11F8276F6F9B4310F9A505922C6
SHA1:	B63BD30E24C7310953E5C93E24FD41E32E742902
SHA-256:	DF570C2774335D78B52FE6F814C2CC28EC7A550D779E1FBAC909BE924F319977
SHA-512:	76E07A69587EF15CF26071D0CE3FD7438182F779AEB85EDEEB8512EA81DFF949FBF6D49B1D83F5A7BD2F11C29C2686D5B01F75C7563E86D1971762CEACB5F75B
Malicious:	false
Preview:	......................>...........................................................U...........................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.................................................................................................7...................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1260.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 77, Total Editing Time: 13:19:08, Last Printed: Fri Nov 19 19:45:23 2004, Last Saved Time/Date: Fri Jan 21 14:19:25 2005, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	87552
Entropy (8bit):	5.292860622249849
Encrypted:	false
SSDEEP:	384:0IVAgpIDVV3pdY7J84+ZEHnUzmLmCnFJBPncQ5olvPmKgTQVbDpdTC0xIBpIlxyi:UBHpS64+ZEHn0CnVPncxcA
MD5:	D57ABF650F3A7C4ABAFE3A95464A576E
SHA1:	888CC2AB4F445D3C25F5030ABC91839D7A75F015
SHA-256:	4F11CC3F6D5DBA4EC2B1A05ABF3819BA081F21131B80F092F0E8A4EC0E8109A4
SHA-512:	C46831025A5856D9559A9EE045105931441F2EF813202FCA6DFD7E33D71CF63175103BAB94E4F0F07E98E66E21746B182C9F550942E3CECBCB655437FC48509C
Malicious:	false
Preview:	......................>.......................@...........0...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .3.2........................................................................F......5....`\|.5..................O.l.e.............................................................................................................8.............O.l.e.P.r.e.s.0.0.0....................................................................................................:......E.m.b.e.d.d.i.n.g. .3.4........................................................................F.... ..5

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1265.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Oct 2 21:58:32 2008, Create Time/Date: Tue Mar 18 18:38:43 2003, Last Saved Time/Date: Tue Oct 7 22:00:07 2008, Security: 0
Category:	dropped
Size (bytes):	179200
Entropy (8bit):	4.971791860235385
Encrypted:	false
SSDEEP:	3072:8gDFkCHwgaAaIpyGreKLZOpjlbu9yz1LCAcZ/8z5tSZOcOtuA8YLahxbRvaZJSCf:8Qcjwf
MD5:	C39EC68DC1C973913E5680996790FE4D
SHA1:	D9EB6D942E3F5F7901D9242F8C63A0982090544F
SHA-256:	2F1987D27D8BF22DAAC561C2C7A078BCC9EAFA35414ED36C624A6E72A1FED69B
SHA-512:	B97B290FF58EF29C3A29282FFAE0E878A3232BA2F6EAF7368BB5A75643E32BB7BA6F3BD2F756AFF772CDAAB0434211F61C1E1AC8C92098A8810034CA872C5264
Malicious:	false
Preview:	......................>.......................................................G...............................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.3.2.......................................................#...%...............................................Y.......T.h.i.s.W.o.r.k.b.o.o.k.................................................&......................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................U...y.......E.m.b.e.d.d.i.n.g. .3.4.............................................O......./... ..............F....`..y

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1270.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Nov 16 20:33:18 2009, Create Time/Date: Tue Mar 18 18:37:23 2003, Last Saved Time/Date: Mon Dec 21 15:58:40 2009, Security: 0
Category:	dropped
Size (bytes):	258048
Entropy (8bit):	4.950934717075591
Encrypted:	false
SSDEEP:	3072:1P1JR2biO95hFqzw8mFJjefgL/ezzrUt6rDTUVykn3T+sNdhKnJgHxXbyjQYmxFQ:Xu
MD5:	D46A8E06CF758CE784DAB6A346C18CC2
SHA1:	5FC8A9A21870F50138241F374A9EC4F81C308827
SHA-256:	EFB54DCAA6451E8820004655327485E7A9C76E57766819A3285B29536F0AD5B2
SHA-512:	1E2AC43866C5C3AB826955DAF76FEDD6C1DEACC48D208F28DF68E7DF46C7AF4D48A10F5298732B5AB8485F065F40542329C4CF93A77756E30E2325FFF01B49CE
Malicious:	false
Preview:	......................>.......................................................r...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................l...............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1305.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue May 8 15:48:55 2007, Create Time/Date: Wed Mar 19 14:57:07 2003, Last Saved Time/Date: Mon Oct 22 15:14:45 2007, Security: 0
Category:	dropped
Size (bytes):	186880
Entropy (8bit):	4.934801965469349
Encrypted:	false
SSDEEP:	3072:o87jT9+1SaVWBR7VFlScnEQVJIwqccjmUr0tGCMhH0bgkbVci2REk7EXX6lHMqVX:oMjkDkPHk
MD5:	3C139956F2E1AAAC4FBA589907644095
SHA1:	E1E86F73DAEA1EDD3B5C1361DCEC1DD2A7B42697
SHA-256:	F1638B572DF258D7BB77E2F4DA6CF00B30DCCB40A5B43DBB82B251673DB41559
SHA-512:	139BEB1D1FAEFBDE2EBB39909102444BF87A5A64E8AAF1269C3B7AF930FF5413FC5ED33AFE346ED40C26C955BA98C7AE9862F8A121E7476983835BE2D994CB9B
Malicious:	false
Preview:	......................>.......................................................n...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.................................................................................................\...................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1310.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Nov 17 16:11:09 2009, Create Time/Date: Tue Mar 18 18:39:02 2003, Last Saved Time/Date: Mon Dec 21 16:03:24 2009, Security: 0
Category:	dropped
Size (bytes):	253952
Entropy (8bit):	4.88787880649354
Encrypted:	false
SSDEEP:	3072:4OpY1fX4D+QYNyPyELBJ6s0HBp08DS/X/UMmoDX48jp+oUP1jRnx+Us/56AxRqm4:y02Zz
MD5:	BB8CEB43E879AFFC33789AB3A02C78FA
SHA1:	0C75F019D84546AF18C10B0CB4DA2F4F41D43DAA
SHA-256:	1A9EA3240F75F09A639DA23CADCB1523E6EA5C9D3E37DC3D1AEC8D309D29CE1C
SHA-512:	E64DA3919089C1F32CB9F53C7A1A0647D477D84AFE48621FE0318770DB17E324E6A782D50E85556F139D509D45A2EE1A7A7334C9E3E07A189A15B8FC9BCC9F1F
Malicious:	false
Preview:	......................>.......................................................]..............................................................................................................................................................................................................................................................................................................................................................................................................................................._._.S.R.P._.3.......................................................+...-.......................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................u...........E.m.b.e.d.d.i.n.g. .5.1.............................................[.......7... ..............F.....T0.

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1315.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: Template, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Wed Dec 23 13:23:38 2009, Create Time/Date: Fri Sep 18 14:41:55 2009, Last Saved Time/Date: Wed Dec 23 13:29:52 2009, Security: 0
Category:	dropped
Size (bytes):	221696
Entropy (8bit):	4.852220976251422
Encrypted:	false
SSDEEP:	3072:lyx6XPLzL0eeyD3xPNkzv5OLJYFRydDaQTD6lo5wUixc2CwfVzkFt4htDDXPUK+8:cxPk0v
MD5:	F75B99D5796990BA2E531D625E00FB2E
SHA1:	4CC6F255FB99858909B7CF37476F3822678C0F6D
SHA-256:	DE6274B458ABB143F4832E93E7BE4D8C13044204ADB442A235D8DCA18A06C860
SHA-512:	EB71CE8F3641C01551EB9AD28D6B746028D8A5786F3C055C9C7F6106318E0A10572C8A902AB080AE39EA8E33DAFA03AC55383039E05179B66271172D0AF8EA10
Malicious:	false
Preview:	......................>.......................................................r...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1320.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jul 6 16:30:49 2007, Create Time/Date: Tue Mar 18 18:39:25 2003, Last Saved Time/Date: Mon Oct 22 15:23:52 2007, Security: 0
Category:	dropped
Size (bytes):	209920
Entropy (8bit):	5.072464260495382
Encrypted:	false
SSDEEP:	3072:HLIBwkq9NAIoSzQ0S7SIZGBRA4R7BnRMbp9Rt7rG6+sdoaSYt9awFUYBaNERBAQU:r8t
MD5:	2FBD7AAF164C869883BEC2BCA05010A7
SHA1:	FE725E820949A2C5D065ECFE0DFA0E8AE7A69F5B
SHA-256:	3DDEDB67316FE565FFAD865ED2D6DD574C3D6AA230A35E20C7E1C01344C8E0F1
SHA-512:	7AB12BBC73486ABFB52D94C147B70981B90271609AAFE45BD25535F28B2A53179A389670758640D839A3A8EC67E6A615599008251887E3C9BFEF71AC13E421C9
Malicious:	false
Preview:	......................>.......................................................I.......l.......................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1330.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Dec 10 15:31:24 2007, Create Time/Date: Tue Mar 18 18:39:46 2003, Last Saved Time/Date: Thu Dec 20 12:45:54 2007, Security: 0
Category:	dropped
Size (bytes):	225792
Entropy (8bit):	4.958937507406109
Encrypted:	false
SSDEEP:	3072:HlrC1rCMbggED9nSChJ5BGPIrjTG2ldhg4Z0TlLFhd7pq753VLW3wLEdZGGS+F0y:UxV
MD5:	CD5E5B4E39ECA860862276250E7F25D2
SHA1:	531B5ABB29CEA928C9CCD01B0C721AA0188F342E
SHA-256:	908A0E47CF765F28A66ED79EC769792FA715CBBD3861EBAD833CFCE93375FCA6
SHA-512:	E9A2AFFB0DC8ACD871E13E777CD09A5C9E4BB912252AFC4AB4EF40E088536E5DFE54CE4DEDDF5BEB8B1ABC64CDB221BDF3F96DED417B191038EAA22184848B7E
Malicious:	false
Preview:	......................>...................................................W...Y...............................................................................................................................................................................................................................................................................................................................................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k.................................................9......................................................._.V.B.A._.P.R.O.J.E.C.T.................................................................................................q.......E.m.b.e.d.d.i.n.g. .5.0.............................................p.......J... ..............F....P.D..C...E..C................O.l.e.................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1410.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Apr 13 21:15:00 2007, Create Time/Date: Tue Mar 18 18:40:06 2003, Last Saved Time/Date: Mon Oct 22 15:34:20 2007, Security: 0
Category:	dropped
Size (bytes):	149504
Entropy (8bit):	5.15953513117498
Encrypted:	false
SSDEEP:	768:Ycv3JYOB0T8OEpgwJmvmEGcDKCwaEzJGmG1OnS6fJwaEPz54:YiO8OEp30vOcDKtPVGmGInS6fWPPC
MD5:	4C745F24AB6AD29C007BBCC4ACBD0192
SHA1:	5A40DFC1CE95AAFD3869E55A91250239A35A2944
SHA-256:	DBB69B1CCE9B73FAD9CE55FF4E340131AA3DFCCA7C641551E5CF6FCD586CD4EF
SHA-512:	9001287CF61BFDFF81B20F6864FAAA3A2EC7DA7D278D411130CE1C89086E38DE643FB9D402C09D3B203009E181B57013D6A9A3FC13C213DFE19DB0D653C09B4B
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1420.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Dec 10 15:45:28 2007, Create Time/Date: Tue Mar 18 18:40:26 2003, Last Saved Time/Date: Thu Dec 20 12:49:10 2007, Security: 0
Category:	dropped
Size (bytes):	146432
Entropy (8bit):	5.063673625152432
Encrypted:	false
SSDEEP:	1536:BGf37BCzwSJ43KyN3DEXrz4wn7KKgKLli1+49:Af37BCzwSWKyN3DEXfn7KKgKLli4
MD5:	16E2E8C47A83FA4CBA0EF9969DD3EAEA
SHA1:	7B9CF6EB74205A42A27166F24347F17433AAE122
SHA-256:	30D816129634F858170327E77DDD28C02F631FE76EAC00D28434CA167E635C57
SHA-512:	046C63E6135EC52EEEDA975A69BC159E004A5EF58D6729C6766E28AD56B5599AA5F3495F8AA0B9ACBC13D523B1F71B9DC0CD7F5A828DE1069879206A4287DE33
Malicious:	false
Preview:	......................>.......................{...............................}...J...........................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1430.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 11 21:22:12 2007, Create Time/Date: Tue Mar 18 18:40:48 2003, Last Saved Time/Date: Thu Dec 20 12:51:53 2007, Security: 0
Category:	dropped
Size (bytes):	143872
Entropy (8bit):	5.048937898720221
Encrypted:	false
SSDEEP:	3072:SEgHKAt1aapBgC9y3Nu/2eX76vUbBKYe/CTLlm1:SEgHKAt1aa1/HKF
MD5:	37BF265114AC548A613E0F811A4E14AA
SHA1:	7EEBD6C38835BC0E2561D3CCBFD0682E5C125889
SHA-256:	27ED2A6B9FE0961396D609EC771E13FB96AE8771BDD125AB45B0849224CA9A91
SHA-512:	D9C9F8EE1C66C2255C9A03057FA29563791A4309E6B299D91B83190EC06F173247DC2B6883C4C403AEA20C75774D567F7D1D07D09A4398FBDD2069CC6CD744BC
Malicious:	false
Preview:	......................>.......................x...............................}..............................................................................................................................................................................................................................................................................................................................................................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................U...........E.m.b.e.d.d.i.n.g. .5.8.............................................5.......!... ..............F.....hO.C...hO.C................O.l.e.........................................................................................................................C.t.l.s................................................................. ...............................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1440.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: sboetest, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 11 20:56:44 2007, Create Time/Date: Fri Apr 4 21:28:15 2003, Last Saved Time/Date: Thu Dec 20 12:55:10 2007, Security: 0
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	5.157600548856342
Encrypted:	false
SSDEEP:	768:2AuLeepR5sEeSGQk9dq7WEbZFFeQkhwX06timb2/WxDjVaj6gKQk2nuKQ:2AqbsEeEPbZFdYS0K2/Wx/Vaj6m7a
MD5:	1AB6467BB94BFA8E94830B2C7857ECEE
SHA1:	D0571B1EEEA6411F837FBF725F2365A8C52F022F
SHA-256:	14F8DEB2F3CA26B3B5890CA042D3BAE02080A105789EB05504DFE0B956285ABF
SHA-512:	FEDC72819025644B7CEBC93C1AF7008E2F4E05C5ECFDF2E62947705CD0B7F8CBF13C33CD27BBC68A50DFDE27AE08514D0E62125EBFD02BB9ED1A22C8FF76326D
Malicious:	false
Preview:	......................>.......................o...............................r...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1510.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Dec 10 15:57:10 2007, Create Time/Date: Tue Mar 18 18:41:35 2003, Last Saved Time/Date: Thu Dec 20 13:08:22 2007, Security: 0
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	5.043187868752451
Encrypted:	false
SSDEEP:	3072:OFoAmv0dDkBDZ5DolqUzTHvUmq7qAap18NCXxrJftxOqfUCfOWenNZwUq73aRYdH:0x7wkZ
MD5:	B3A51CE1A4426170A893BD555B37F02E
SHA1:	863DF9EB5D3CEBE077CBF887656E86B7E4D73397
SHA-256:	0924764EAABC8A2D479EB9DA07A9B03780F3382C8DE6B72BE6DFFFF346607A34
SHA-512:	D9A1FB8C6362B17494574D9C718C931FE7DEA85CD0420180B0A48196AF1568E6CCD9013D1E03339AA0E2D903EC57555314105B1EEAE5F4447707D6CB9EEE94D0
Malicious:	false
Preview:	......................>...................................................M...N...............................................................................................................................................................................................................................................................................................................................................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k.................................................-......................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................s...........E.m.b.e.d.d.i.n.g. .6.0.............................................X.......>... ..............F.... ..D.d.....D.d................O.l.e.................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1610.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 116, Total Editing Time: 1d+04:18:33, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 5 12:05:46 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	334424
Entropy (8bit):	5.342674465414266
Encrypted:	false
SSDEEP:	1536:7jO3+tEK0cDamfB2LkNBn0FVs3J0E43q0cmfB2LkNBn0ICGcLI4DMHdjuTEzrIIw:G32EKF6VEJ0EtKCGH9jGEz0IeSdq
MD5:	F17BF9315C6397B804496247421E8E24
SHA1:	3DF470B8684DAC414FF7D6AF3175AA35A14B84DC
SHA-256:	98605AEE454F9557B227622FB414270301E4F63B79947D766129DCE16CD17E66
SHA-512:	B45CACD79F16664A2923635F70083130AA9C6637B6A1AAACE52670DCE21D28064C682CDC751BBE188CBB0544AB6861587836435DABB6188DA865AB795AE2777D
Malicious:	false
Preview:	......................>...........................................................r...s.......M.................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .6.6.........................................................0..............F.....}.j.....}.j..................O.l.e.........................................................................................................................P.a.c.k.a.g.e...........................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1620.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 11 21:26:45 2007, Create Time/Date: Tue Mar 18 18:43:28 2003, Last Saved Time/Date: Thu Dec 20 13:16:27 2007, Security: 0
Category:	dropped
Size (bytes):	170496
Entropy (8bit):	5.077195832841005
Encrypted:	false
SSDEEP:	3072:lg6OZuzT6RBP01esKcdOPfsL2FVrm57oQ+a:7/k
MD5:	403056F1D56084DC1034682F28C069B2
SHA1:	552AED44B6D7CD1D691B4E519C89DFA37764FB5C
SHA-256:	EC17AC16E8F9F10D26357F53A3ECA16C2E3692B07D0A0B49F8618BC3C7F5595A
SHA-512:	30F5900C8777AED243911549BF7113F10722B74A303AA8D79B83BE9D59221E907307587CD4E2A0186BE3EE756F8259D786C58D6C2D95E80244C2E220E907FA0E
Malicious:	false
Preview:	......................>...........................................................P..........................................................................................................................................................................................................................................................................................................................................................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................(...........E.m.b.e.d.d.i.n.g. .6.6.....................................................1... ..............F.........C.......C................O.l.e.........................................................................................................................C.t.l.s.................................................................0...............................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1710.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 11 21:08:44 2007, Create Time/Date: Tue Mar 18 18:43:53 2003, Last Saved Time/Date: Thu Dec 20 13:19:54 2007, Security: 0
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	4.960800429743342
Encrypted:	false
SSDEEP:	768:54C7x0agTFz+OSXG/inAMXOFwPSZcP74zvD8QrqFrQDYB:5LEz+OSXG/inzXOFCSuD4zb8Q8r6YB
MD5:	909287CDC971C0D4B31C5D32B688A6BC
SHA1:	EFF5CE5BAC01F247903A402BBDBF409EFF9B725C
SHA-256:	31BD8F97745B70084DC405A219C9ACC90E0C22580CEAB06486EF13B3789EC639
SHA-512:	6D7D694DF5904D20C44195DCD9905A239BB1B8632EC03D7D90787F7D351A82EC56429DA6E22E8A2F9BBA74A2C2ACDA8A70D99F76C8E6BF01FD4604F159F07490
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.0.......................................................................................................\|...........T.h.i.s.W.o.r.k.b.o.o.k.............................................................................................l..........._.V.B.A._.P.R.O.J.E.C.T.............................................................................................?...=.......E.m.b.e.d.d.i.n.g. .7.4.............................................)........... ..............F.......6

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-1720.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Dec 10 15:38:38 2007, Create Time/Date: Tue Mar 18 18:44:11 2003, Last Saved Time/Date: Thu Dec 20 13:21:49 2007, Security: 0
Category:	dropped
Size (bytes):	181248
Entropy (8bit):	4.919450248953279
Encrypted:	false
SSDEEP:	3072:utTgm+uUSbiaPH82Yy1uK8PJRG33hD2Hutv+Ud1mXtNB61s+X2Kp5AKSFGAtjm3R:5Ha8Dm1
MD5:	1A1174381B327B0BE6AEA5AFD221DB4D
SHA1:	5E005EED30F08BCFDC2DC666DC2E54D4AE9E2BE7
SHA-256:	5EA0AC5B9592134749833BB0803ABC6BE782C7FD57CFD0971A7E2E9B80CFE20C
SHA-512:	AE7EEA2A39429B0EB694039026329F252B3ADEBC0DBB6E444E9319DEEAE0F6582D45F6F181DA25CE82634505AC075C49F2168EFF0B9BD46A57662AF042CD7FD5
Malicious:	false
Preview:	......................>.......................................................p...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2210A.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 55, Total Editing Time: 14:49:41, Last Saved Time/Date: Tue Feb 15 18:01:58 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	158720
Entropy (8bit):	5.268140724248468
Encrypted:	false
SSDEEP:	1536:HZLzpe9R/R1gGWx2oLnq0qwA1s3A85Yh:5Lle9R/R1fEqzt8
MD5:	4882CF47C2091D38AF98D8287394A284
SHA1:	0B4F8D02922F66C946ACBE312382E06245C8C040
SHA-256:	03C156AF47054845AB03DAC77350A3C34D013E332EDC8E6596978B46FEB05244
SHA-512:	9554817DB5026E3F4CC350FAFF41BC2C7DB39A452B1549B6E4184F1FD6FAE828C200FF684D2532BCFCDF5CB6D242E6577CAFA4006347140BE790E10885CD93B3
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................eld Definitions Only).....D:\VersionControl\SEIMS1.0\Development\2010 YearEnd\Applications\CR Code\CFRS Common\CF_Common\CF_Reports\2007 Forms\cro-2210A.ttx..........cro-2210A.ttx.............................................................0.......................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2210B.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 135, Total Editing Time: 1d+04:13:02, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Jan 3 19:00:05 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	103936
Entropy (8bit):	5.592327674224524
Encrypted:	false
SSDEEP:	768:zeHskQ4XJukQLWS6lZaqkbDdHkdxkBNox3XRXhTBPSWlPGRCAIIrZTretmXV8hBv:zuhX/6uGRCOX6HHFxGXF6DwNS
MD5:	2AB980981BB08FC87E4B8E885C775867
SHA1:	F72DF109611C6E5A83BA7282C9E8E9ED4E4D9B1E
SHA-256:	3A11440931E4AF31F03346CAF6DEB28AA9592A50B12126DD434D708D4EDB1C39
SHA-512:	B6FEC7CCFFE987A8C4A16A15714014565B6CB19F55ACEBA887336DF297706FE23AC0BA3148BCC7821CB4664187B614FCFB66E0A601BA08F1C049F4A4E0320A13
Malicious:	false
Preview:	......................>.......................}...........\|.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0...................................................................................................dB......E.m.b.e.d.d.i.n.g. .3.1.........................................................0..............F.....>.nx....>.nx.................O.l.e.............................................................................................................1...........P.a.c.k.a.g.e...........................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2210C.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 174, Total Editing Time: 1d+13:39:25, Last Printed: Tue Nov 2 15:30:29 2004, Last Saved Time/Date: Tue Feb 15 18:24:24 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	222452
Entropy (8bit):	5.4064762014400065
Encrypted:	false
SSDEEP:	1536:kp1HN2XddW26XOTh3B0Zld7gpi1ELoAdMLg6:kp1H87WtOL0j6pOmFWM6
MD5:	FADE02A6571C1E7B61F7D2912843299B
SHA1:	5B02062FD22BE8F768CE81B7F6500D0658DD6447
SHA-256:	CAECEBCE8CF9785948FC753AAD941939A8644C61DEEBC32DB66BD020FD60B219
SHA-512:	013E9CC58F5F0EC7C379777CFFA5D25A27EC1673F861A4A52F746E6AC63C8231B8969F7D03E3E63BCA6E531FA2B7657BF0E38B05429BEEF5BFF4D1F59E5BCE2F
Malicious:	false
Preview:	......................>.......................................................'.......v.........................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................+......E.m.b.e.d.d.i.n.g. .4.1.........................................................0..............F.......=......=.................O.l.e.............................................................................................................H...........P.a.c.k.a.g.e...........................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2310.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 56, Total Editing Time: 14:47:29, Last Saved Time/Date: Tue Feb 15 18:02:08 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	163840
Entropy (8bit):	5.228829883731787
Encrypted:	false
SSDEEP:	768:dg+RR+r9hPq0TcyUwDFOkZ8E7VFFyhufjMVok2HKrs0yhjtLvjMVokT6X4GyBBC5:dg+R+y6s6oagYnysA0VWeDm6iE43qf
MD5:	F51BEAB10802D8F46CD91524C29A78A9
SHA1:	825EC58150D825C5245F1FFA0AAE8A8E39EACD4B
SHA-256:	2D4E4ED8AC8175EAE07D880B467815C561E31410E75F33CABA41CD16534E71AE
SHA-512:	60B5ED2AA7DBEFEE444B6B12110A80104B5C6EBAD2F82B9CF73939857AD255F4EFC419766BFAF63B8AB8D1EC48C14996082C7E3F4309CFE151A82FC2B4C15D23
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................eld Definitions Only).....D:\VersionControl\SEIMS1.0\Development\2010 YearEnd\Applications\CR Code\CFRS Common\CF_Common\CF_Reports\2007 Forms\cro-2310.ttx..........cro-2310.ttx.............................................................0.........................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2320.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 122, Total Editing Time: 1d+03:59:21, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Jan 3 12:16:34 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	83456
Entropy (8bit):	5.617886733447368
Encrypted:	false
SSDEEP:	768:kLjO/+KGidgXJBPjjZTX4BPBPn5925VhljMVokLqhdXpBPNZXP8h:kHX/ZX85/5scqhdXfr
MD5:	E708CF7FC5A36DCFB21C4C71D3D3830E
SHA1:	524E043B77C72E1AF8DFE79029FF4843EC93693C
SHA-256:	E1D8DA0491FFE506F325D2FE0A0292A3FE1A3700CA1D8A2E780876E8E4964D7C
SHA-512:	C5A59C922BDE6E6BF36AEA1A6655E4A6743DE391721B233FA1BB54F8A82BA9066551F8815507CC01E25DE00D6800D4421071CEE65591D042FA9476ED04847BBE
Malicious:	false
Preview:	......................>.......................d...........c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0...................................................................................................l ......E.m.b.e.d.d.i.n.g. .2.8.........................................................0..............F........@.......@.................O.l.e.............................................................................................................j...........P.a.c.k.a.g.e...........................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2330.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 133, Total Editing Time: 1d+04:11:03, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Jan 3 13:05:25 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	104448
Entropy (8bit):	5.571042801433939
Encrypted:	false
SSDEEP:	768:hkvnrY8fsuk9LCS87Q4kh6+ubXbFiNExN2HXbdBP+VtzY1g5pL8lQM1KXVTBP657:XNyNOXbrctpUKXbuT4WhZXF6Bqn
MD5:	A0C044D33CB4F0DB844EC13C156BDF6F
SHA1:	9FC9F3526F3E9785B898BBC239590DED15AF9AE0
SHA-256:	82EDAF0D98E22A5BF59CB851687DDC0DE7B974DA2BC10AA528BEBA1BEB0F5064
SHA-512:	832F30833ABA02BEF0172AAC47175D9B9A16C3B50AEAC12DD8FF01F13D215DC18BB39A1113EE785C4C3A310B07886FCFD361F76A2A2447A1D77507B17471D34C
Malicious:	false
Preview:	......................>.......................~...........}.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................B......E.m.b.e.d.d.i.n.g. .2.9.........................................................0..............F.....$..F....$..F.................O.l.e.............................................................................................................1...........P.a.c.k.a.g.e...........................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2340.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Oct 15 14:21:07 2010, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Mon Feb 14 13:42:24 2011, Security: 0
Category:	dropped
Size (bytes):	252750
Entropy (8bit):	5.25060703850526
Encrypted:	false
SSDEEP:	6144:YZ+RwPONXoRjDhIcp0fDlavx+W/WEtZ+RwPONXoRjDhIcp0fDlavx+W/WEp3FZ+m:kGo
MD5:	D386DF49CA08E8BC94B632AE6BEF1DB1
SHA1:	4D236FB675BD56A0CCB979BB26809A6278B45C58
SHA-256:	6C7F2A579D4218ABF8375315255417A740D4964E9DE361B6B00E9F6BF1E4AB92
SHA-512:	44BEC47D9E91DED6E741D82FE4C0D98E73A109CD5A9E9543FE47DC1A28D0619E9CB20F607C30BD620918EEE34AA813253DE302A339435EC7835E7BD3081EAC92
Malicious:	false
Preview:	......................>...................................E.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................+........S.u.m.m.a.r.y.I.n.f.o.r.m.a.t.i.o.n...........................(...................................................D.............D.o.c.u.m.e.n.t.S.u.m.m.a.r.y.I.n.f.o.r.m.a.t.i.o.n...........8...................................................@...........E.m.b.e.d.d.i.n.g. .3.5......................................................... ..............F.....)

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2500.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:40:21 2007, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Mon Oct 22 19:22:13 2007, Security: 0
Category:	dropped
Size (bytes):	86528
Entropy (8bit):	4.881958494433561
Encrypted:	false
SSDEEP:	768:Fl8E2XX+tjZyfSiy947UelYPLVEr+HClN61P:OyjZyWEUelyEr+MN6
MD5:	E34AF91588EF52750B571461438523FC
SHA1:	060DAAD994AD9CA194CF2745B197524AF01E4981
SHA-256:	F05461F9C2DE1E0B19F4F2C4C44BCB9BFEF39586B18EB9D403497586DA5FE981
SHA-512:	0971601CC34A99B221F284D5865323FD060E5F3DAF95EECCB2C0F434A6AC6FB12E77C5E4544BEE59BEFAEA704814979A94C0DC9BA5AEBF510A8F9E177CE44E54
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2501.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:40:21 2007, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Tue Oct 23 14:18:36 2007, Security: 0
Category:	dropped
Size (bytes):	86528
Entropy (8bit):	4.88633501894969
Encrypted:	false
SSDEEP:	768:al8E2XBaqD5vSiyV7UeikdtZ81+D9FCl9w:V5OUei51+D969
MD5:	4C8430FEB6682068847DE23E43B28916
SHA1:	BBC51A81B9A85354CD567DC39EF69579D4320DA7
SHA-256:	C8BE4F958AA658009028FAAD99474AEE6E1834558AFC655BEE3F086E24EC394E
SHA-512:	4547A4CD0869296621E0684AAF030133250DB8E4335BCDBFAB924CE389AAA826C477486176199688719CE7FBB00D628E079BD89033D7D1B32F0B94144ED03155
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2502.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Apr 28 17:00:15 2009, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Wed Apr 29 22:24:07 2009, Security: 0
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	4.881150690200426
Encrypted:	false
SSDEEP:	768:O4l8E2XlCGZJgtiSCg5Ut5Zl8MlHsDllxW:O5ZMUt5HHsD1
MD5:	1A8B9BAB9A26DE6C4D078DE140FAEFAA
SHA1:	108F6E387FFA826F7E52BCD4CC9A01B7428FB809
SHA-256:	2FDEB8A9E37FB4B225AB55F317F06D00F280890466F03C0309EF76D577C29DE1
SHA-512:	95A587D23889964C05FD9AB1C90F189947526697C0060386EE8CDDB26152E758E3F1C3167341CBE13815B5907017820AC20A1B97C799C162EA99BA3CEEBD7CEF
Malicious:	false
Preview:	......................>.......................................................~................................................................................................................................................................................................................................................................................................................................................................................................................................................d.....gdldd.dddddedd........ddddddde.dcddddtdA..dd..ddd.dddddddddddddddddddddddddddddddddddddddddd$dddddddddle.f.....cfkfffffffffffd.fffffffgfgfgfffffffffgfffffefffffffffgfffff.fffffgfgffff.7affffl7776777777_4afffffgf...........................c....._..._....8....o..... ..hoooo}..................oooooo.s.....I..tssssQ.p......ppp~3........>...p{qppppqpc{sh...^AFCA,...]0........=...s.s.....K..tssssP.p......ppp.3........94>..p{pepppqpc{so...^AFCA,...]0........:7=..s.s.....A..tssssm.p..

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2510.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:51:41 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Mon Oct 22 19:25:35 2007, Security: 0
Category:	dropped
Size (bytes):	97280
Entropy (8bit):	4.977162636578716
Encrypted:	false
SSDEEP:	768:iR0jbfG0fYJfrpgAnVY7IfsUMXHwKY0/Oxlu7cimw:HbtfofTVxf/MXHwKY0/AuIi7
MD5:	896F8A0D7E194A0685F0955C6FCD724D
SHA1:	32AFD8CA6ADBFE20CB4D818F3C90FB4FD81BA04E
SHA-256:	9AA224A1B697BCC8292EA5FFDC9BAF52F81287B157EA48A230F60024631A4614
SHA-512:	BEC97B6CFF0656AC4F2AC8ABD20A4139C1B0E501AE69EF02840BD6DC9C0129D13BBBB19D2DCC19E41A342C18CC8726BE6BEB20A7BAB6391C95DA4310A0174026
Malicious:	false
Preview:	......................>.......................b...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.3.............................................................!.......................................................T.h.i.s.W.o.r.k.b.o.o.k................................................."......................................................._.V.B.A._.P.R.O.J.E.C.T.................................................................................................).......E.m.b.e.d.d.i.n.g. .2.2.....................................................%... ..............F.....P..

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2520.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 19:02:52 2007, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Fri May 16 18:49:41 2008, Security: 0
Category:	dropped
Size (bytes):	136704
Entropy (8bit):	5.122314043578528
Encrypted:	false
SSDEEP:	1536:xv1oKLyI9q8o4zTcb2UlgcWK+xTrz7axPzUsdiallTonTIn2:xv1oY3z7
MD5:	CEB12F669CCD7F4EECDA6E6526546E0F
SHA1:	0DD99622131222D076229E0F8C407F74625E1CAE
SHA-256:	9046CA568975FAD9DF681D3330D74EB9D0DA3649DD2D047E18578B91073B6F8A
SHA-512:	DCB2B77ABE0973ABC483B9248754E57CBBDBF9BA989B62CA4C200851B26C09B6C894C593FC14375E6FFEF93FE5A77B822FBC57A89E054A0866B4BB52508A9217
Malicious:	false
Preview:	......................>...........................................................P...........................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.4...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................U...........E.m.b.e.d.d.i.n.g. .3.1............................................."........... ..............F.......

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2600-1.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Certification of Inactive Status, Author: James Lell, Template: Normal.dot, Last Saved By: msteffens, Revision Number: 3, Name of Creating Application: Microsoft Word 10.0, Total Editing Time: 01:00, Last Printed: Wed Oct 15 21:58:00 2008, Create Time/Date: Thu Oct 16 12:01:00 2008, Last Saved Time/Date: Thu Oct 16 12:02:00 2008, Number of Pages: 1, Number of Words: 178, Number of Characters: 1019, Security: 0
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	5.3712177177850355
Encrypted:	false
SSDEEP:	1536:+fpOF0kQmsMRT9CrDc0QrilK3dQKDj2MQCFju:8py0kQm9RT9CrFQXDj2gA
MD5:	AA19D7736F3EF3BC68B25908B726999A
SHA1:	3E2A28FA79CD93F0D47CD8E6FA9F09E8A2F12ED9
SHA-256:	FB22AB8A19306CF0CBC659A6353A22880960907DD5182A83A713C94DA95DBFC9
SHA-512:	D4510269FC2294B89C4AC530F2684F596953BDE1F5585576D2659ABE657BE436D08C2965343FB0A0713FEB09BF941FA203536E26E2805200124A835FC30C5242
Malicious:	false
Preview:	......................>.......................................................:................................................................................................................................................................................................................................................................................................................................................................................................................................................d.....gdldd.dddddedddA..dd.fddddddde.dcddddtdA..dd.fddd<dddddddddddddddddddddddddddddddddddddddddd$dddddddddle.f.....cfkfffffffffffg.ffg.fffgfgfgfffffffffgfffffefffffffffgfffff.fffffgfgffff.7affffl7776777777_4afffffgf..........8....o..... ..hoooo}..."..............oooooo.s.....K..tssssQ.p......ppp~3........>...p{p.pppqpc{sn...^AECC^B,...]0........=...s.s.....O..tssssW.p......ppp` ...4..........p{p.pppqpc{sl...^AECC^B,...]#...7..........s.s.....K..tssssQ.p......ppp~$........>...p{p.p

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2600-2.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Certification of Inactive Status, Author: James Lell, Template: Normal.dot, Last Saved By: msteffens, Revision Number: 3, Name of Creating Application: Microsoft Word 10.0, Total Editing Time: 01:00, Last Printed: Wed Oct 15 21:58:00 2008, Create Time/Date: Thu Oct 16 12:02:00 2008, Last Saved Time/Date: Thu Oct 16 12:03:00 2008, Number of Pages: 1, Number of Words: 42, Number of Characters: 241, Security: 0
Category:	dropped
Size (bytes):	463360
Entropy (8bit):	4.580779504933828
Encrypted:	false
SSDEEP:	3072:Xx0kQm9RT0PhzfHiQ+z0kQm9RT0PhzfH7QKR50kQm9RT0PhzfHBQ:h4yRTAM4yRTAPr4yRTA
MD5:	3E283F1FD6FE821EF531355E09CD8FAC
SHA1:	DE14DF4F69EB7123F4CD2AFF72F093C6BBF7BDF5
SHA-256:	77EA4BF10E6EB2AB9F8C4A752D67A65F268C6D9F4501DABCEABD1B0E8236A714
SHA-512:	B256F3E0AC5282F399C7DDEC15E896FDEF25E73559A0630CC036EB3A849F9AEC22267776DA851E77B34950D0B6BAA0B273B72B63682D7D59EC24F88C853F2E1B
Malicious:	false
Preview:	......................>.......................7...........6...........................f...T...c.................................................................................................................................................................................................................................................................................................................................................................................................................................D.o.c.u.m.e.n.t.S.u.m.m.a.r.y.I.n.f.o.r.m.a.t.i.o.n...........8...............................................................E.m.b.e.d.d.i.n.g. .1.7........................................................................F......Nx./....Nx./................O.l.e.........................................................................................................................D.a.t.a.................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-2600.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Certification of Inactive Status, Author: James Lell, Template: Normal.dot, Last Saved By: msteffens, Revision Number: 3, Name of Creating Application: Microsoft Word 10.0, Total Editing Time: 01:00, Last Printed: Wed Oct 15 21:58:00 2008, Create Time/Date: Thu Oct 16 12:01:00 2008, Last Saved Time/Date: Thu Oct 16 12:02:00 2008, Number of Pages: 1, Number of Words: 178, Number of Characters: 1019, Security: 0
Category:	dropped
Size (bytes):	646656
Entropy (8bit):	4.870802515688482
Encrypted:	false
SSDEEP:	3072:9n0kQm9RT0PhzfHtQfl0kQm9RT0PhzfHFQ+l0kQm9RT0PhzfHyQuU5pD0kQm9RTC:J4yRTAc4yRTAD4yRTAyU5h4yRTwrdOi
MD5:	0AF05A4650FDF343A9C13262E16F986E
SHA1:	9D7EDAFFC85356249BCABCC8A25B556E8615B36E
SHA-256:	C87F73A359565D04941EB305AF7C9FE5B4818F577CA1319F8B578B69F2E4A947
SHA-512:	C8FC8A1C1E3EBEA9927D0ACCD8A0C27D6F60F4A13E642DF894CE7387097D76B1F557B184A18DB80EDC7D7E50EF47BBAC65D8B35ACC349F415B9707698ACA69D2
Malicious:	false
Preview:	......................>.......................................................a...............................%.................................................................................................................................................................................................................................................................................................................................................................................................................S.u.m.m.a.r.y.I.n.f.o.r.m.a.t.i.o.n...........................(.......!...........................................t.............D.o.c.u.m.e.n.t.S.u.m.m.a.r.y.I.n.f.o.r.m.a.t.i.o.n...........8...................................................l...........S.u.b.d.o.c.u.m.e.n.t. .7...................................................%..........................t./..@..t./..............C.o.n.t.e.n.t.s.........................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-4100.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Oct 16 21:17:12 2007, Create Time/Date: Tue Mar 18 18:48:47 2003, Last Saved Time/Date: Mon Oct 22 19:28:02 2007, Security: 0
Category:	dropped
Size (bytes):	162304
Entropy (8bit):	4.830184722169816
Encrypted:	false
SSDEEP:	768:HIVX+tXppv5JZp8scM0UET/5r9//PSfdNI46B4yGUbV2fiWwhgVQwq+1o:HIVX+IJafdNH6B4yZbV2fiWwIq+1o
MD5:	B1056B83A838C1A1050782D8DE2B86FA
SHA1:	A813E6A224949231A9B9AB4E7B7F675125D25D47
SHA-256:	19F4FDA329AF5201897E76EB13A18FF469BB6C1C90D63679182A0E631C943026
SHA-512:	DD3A5E08193527DF583206CBAA51B2AE0BE6A428A5FF37FA6BC37BD08601BDB24238D5C615FAE54B47136D154E49B503D9A100034BAEE40125F43B2BDE68DAB9
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................0.........................SQL.....PdSMON.DLL....%Active Data (Field Definitions Only)....RD:\DEV\CR Code\Remote Filing App\Version 2004\CF_Remote\reports\2002\cro-4100.ttx..........cro-4100.ttx.............................................................0.........................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-4110.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: programmer, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue May 29 15:40:58 2007, Create Time/Date: Tue Mar 25 14:35:37 2003, Last Saved Time/Date: Mon Oct 22 20:27:11 2007, Security: 0
Category:	dropped
Size (bytes):	116224
Entropy (8bit):	4.831635357966716
Encrypted:	false
SSDEEP:	768:FZMVR2jqTkOCsKswrOnHz9rm32Q3cpFHfuis3+nc:FVWTkOLKZraHzZmT3cpFHfur3+nc
MD5:	5379BC15FFA3C25789C420B782932967
SHA1:	E9C3245791ED044E567EA105AEBE066A3DD2DC66
SHA-256:	01B3854F730104522577E3BF28277EA5808DAE318690B7DF3F2934C382C957DC
SHA-512:	1E65192F90136EA88EFE3DD2F335FA5568538EA390DA7B1EAE50ACBCD4946590BD608AB4FF0D4A65BCBD2803AB6F3697CB966B09DA09433EF15E39017785696E
Malicious:	false
Preview:	......................>.......................v...............................y...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2007\cro-4200.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Oct 16 21:22:03 2007, Create Time/Date: Tue Mar 18 18:49:06 2003, Last Saved Time/Date: Mon Oct 22 20:31:02 2007, Security: 0
Category:	dropped
Size (bytes):	222577
Entropy (8bit):	4.92535757129126
Encrypted:	false
SSDEEP:	3072:IfsIsefpkcEtHsDwC6Sag1Lo4cOfpkcUd3MDwC6SaXaoONv9tKAd0oNhzwcAS66p:kn
MD5:	7770B0334CFBBE2CAF0B823D0D73024E
SHA1:	38152A320F374F5115C0E4C4A249C4484D194CAB
SHA-256:	F3CB0021FC58775DF1965E1AA682EDD8B228991ACBE3C7ECBBB50872CDAC5032
SHA-512:	AF64DBBEE6A881D6C024CDC63B5C63A9DC7FC378B95D1FC3ECC61B421F9B3EDCE2715D5EA2F8C8290D96AACE5910561A12E7B6E8E2A6DE759989D3B97A999705
Malicious:	false
Preview:	......................>.......................................................T.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\misc\contlist.rpt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Revision Number: 19, Total Editing Time: 04:03:46, Last Saved Time/Date: Wed Mar 18 14:37:02 2009, Create Time/Date: Wed Jan 4 17:35:48 2006, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	45568
Entropy (8bit):	5.362863051604835
Encrypted:	false
SSDEEP:	384:dOOtOnXLo80Y31Q7yrelcg6BfJnuewBc18:dftOilH
MD5:	F333AB5364641E71074B186AAB1753BD
SHA1:	BD37BB9C3814C0B6CAFD478DD317C19FB35BB81F
SHA-256:	ECEB4597F02DBAC4C570E53EEFAA40D45862058609DCFF34B4E612CB5CA8E165
SHA-512:	8E0BF47C1FC1A55D0EC0D9BD435235EA3D8F66235DC075F5C32EDD46D9D03088A4743607C96F12D5C3E298F384CC14BB8D8094B912AC0B69F24A4A8872698C5A
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...............................................................................................................................................

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\dbs\cf_data_empty.mdb

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Microsoft Access Database
Category:	dropped
Size (bytes):	4894720
Entropy (8bit):	2.4562849415129704
Encrypted:	false
SSDEEP:	6144:aduPCcaI/tlAIZ8Jo3Vw3QWjz3dwDQW8SypfZ3L1vLMqeFjFJJomc5S:xCF4tlAIK7IEEhOmcY
MD5:	FED4926EDE0F27BB72EFFFAC8FC55876
SHA1:	1136FC24FD788D3912F01B415A7A9CFD1A1C2E61
SHA-256:	EA2D8537CF76616D0EDA204F64E617A4989CC1AAF1C31B5F297400EFFADAB8E5
SHA-512:	162FB0823FC97AF70CDCB6CC0E617C2906D3EEF52440C5A76E577745407C0628D444FF7570ED9107DB1D632B356DAF7C3CE1BC9D86DD884D493BED311193684E
Malicious:	false
Preview:	....Standard Jet DB......n.b`..U.gr@?..~.....1.y..0...c...F...N.U.7g....(.)..`n:{6...MZ.C...3..y[..\|*..\|.........8..f_...$.g..'D...e....F.x....-b.T...4.0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Campaign Finance\CF Remote.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Dec 1 14:44:33 2023, mtime=Thu Aug 8 22:20:19 2024, atime=Fri Dec 1 14:44:33 2023, length=4243456, window=hide
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.6547790319853855
Encrypted:	false
SSDEEP:	24:8Z8ytjEydOE7lKvp1+KvNANsLy4A+WdIzoUUIuyfm:8Z8hydO3P+uGNz4TWdK9r
MD5:	834DE473AD98B3747B0FC0EFAB028D66
SHA1:	C7DC4E88D2C97FA624A49497C8459C49B9119B48
SHA-256:	385CA16A1361C4A28DC84539B9C4F45279BF79439BABA5B4F607FDDC4139C04D
SHA-512:	671A32A9FE8A94312E950B77813FF27489716F2F5E1134185A5896F1739641E433E0BA0EF352F685CE29944E347BCDA9A3B4FB627634433118E9FE8A662E64FB
Malicious:	false
Preview:	L..................F.... ......Gm$..Y.;........Gm$....@.....................C....P.O. .:i.....+00.../C:\.....................1......Y....PROGRA~2.........O.I.Y......................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....N.1......Y....SBoE..:.......Y...Y................................S.B.o.E.....j.1......Y....CAMPAI~1..R.......Y...Y...... .........................C.a.m.p.a.i.g.n. .F.i.n.a.n.c.e.....\.1......Y....CFREMO~1..D.......Y...Y......!.....................iP..C.F. .R.e.m.o.t.e.....h.2...@..W.} .CF_REM~1.EXE..L......W.}.Y.......I......................P.C.F._.R.e.m.o.t.e...e.x.e.......s...............-.......r...................C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\CF_Remote.exe..S.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.S.B.o.E.\.C.a.m.p.a.i.g.n. .F.i.n.a.n.c.e.\.C.F. .R.e.m.o.t.e.\.C.F._.R.e.m.o.t.e...e.x.e.........*................@Z\|...K.J.........`.......X.......

C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5675007
Entropy (8bit):	6.48705961905541
Encrypted:	false
SSDEEP:	98304:2hG63qsl7dEhYCHnWzXzLbVI9AB5dECNhc6ZzH2oYK13icjqsNTUjJG:2Jah2zXzL5IWB5JhnHfFIG
MD5:	3B2D532673D1567116105D04C621CDBA
SHA1:	F0892A2DCF772529C115C15E6B1A510B4DC214E1
SHA-256:	FD6D2298B1B5DD14A9F02207FAA4D7D7DC5F5B399E71F2F4EC3680C2DBC6DF0E
SHA-512:	15ABF21DCF9ABF346DDFB6B35F75C607B4E6CF4518B629C39ADCA5E4690955D70C46C5A842F73FE7373FA6A7F7860DB514D3815DD04D1280DAD7A7D1A315B672
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?..`.................z;..........e;.......;...@.......................... Y..................@............................?..Y... D.......................................................?.......................?......`?......................text.....:.......:................. ..`.itext.......;.......:............. ..`.data...(.....;......~;.............@....bss.....}....=......Z=..................idata...Y....?..Z...Z=.............@....didata......`?.......=.............@....tls.....A...p?.......=..................rdata........?.......=.............@..@.reloc...I....?.......=.............@..B.rsrc........ D.......=.............@..@.............pY......\W.............@..@........................................................

C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.msi

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Template: Intel;1033, Revision Number: {D529246B-78E5-4E65-A3A2-8E1040E91E59}, Number of Words: 0, Number of Pages: 200, Title: CF Remote, Subject: CF Remote, Keywords: Installer, MSI, Database, Author: NC SBoE, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0
Category:	dropped
Size (bytes):	868352
Entropy (8bit):	6.2772030756930395
Encrypted:	false
SSDEEP:	12288:gmLYSxeFmPBKXsbzlDSJjQ8guBoN2KA2wKc7wMz7:XLYSxHW5BqPA2fc7wMz7
MD5:	C42393B9643339D7F19EC2C717562646
SHA1:	2D6F6B8CE8DE076516095B9E35157055F530EF41
SHA-256:	2C3F9688DD4A7D3AFB3A28DDFA9A3A584C94E9029887DE5B3EF50F1DBB3D334E
SHA-512:	72BCBA2C66EBD01BDDF1490A65BB7E640D967B86AABE22C93E15C1EDF560C6C3E4A22D7601D2C085466E8E05F2129417DA2BBE21B4F342641741667BEF6E80E8
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.res

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	8694055
Entropy (8bit):	6.569101251424524
Encrypted:	false
SSDEEP:	98304:6bCyTWyZzxtJNL05f9tAYnA3U9XHsHcCXq8vXKEUo/wRZlV:Ia8KEUo/wdV
MD5:	FDC346FFDFDD1F15F1DBA95695960160
SHA1:	4983376DAB7201E8AF1728D2F6FD9AEE0CCAD376
SHA-256:	74924F08BD5817B532B441E57C5D9C7CB55AD001C410C038DE1F54427D1160E9
SHA-512:	AE7F0A4EC374A78816B7DDF3B90BD358729BC6E0C153C08CA4AC17741F6E72C0A3E43B822DD3A55FA15C603314B78B4D7E43D8F131ED60143CFB9B7C65E0B66E
Malicious:	false
Preview:	7z..'.....%........{........fX....TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..

C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\ADVPACK.DLL

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	74960
Entropy (8bit):	6.080943948881524
Encrypted:	false
SSDEEP:	1536:3TlRSuxQYyqUB9XzWqxGHVcIIX5ZDBZGscEvWlExtJl966CX6q0uE:FfUB9XamGHpw5ZDXXPOixtJz3CX6qQ
MD5:	81E5C8596A7E4E98117F5C5143293020
SHA1:	45B7FE0989E2DF1B4DFD227F8F3B73B6B7DF9081
SHA-256:	7D126ED85DF9705EC4F38BD52A73B621CF64DD87A3E8F9429A569F3F82F74004
SHA-512:	05B1E9EEF13F7C140EB21F6DCB705EE3AAAFABE94857AA86252AFA4844DE231815078A72E63D43725F6074AA5FEFE765FEB93A6B9CD510EE067291526BB95EC6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 8ue90oYkrv.exe, Detection: malicious, Browse Filename: 8ue90oYkrv.exe, Detection: malicious, Browse Filename: TextSpeaker.exe, Detection: malicious, Browse Filename: TextSpeaker.exe, Detection: malicious, Browse Filename: TextSpeaker.exe, Detection: malicious, Browse Filename: MXrpqIRV2z.exe, Detection: malicious, Browse Filename: MXrpqIRV2z.exe, Detection: malicious, Browse Filename: Bonzify.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~c.3...."......#.................3.............p................................g....................................................%.......................... ...8............................................................................text....................... ....... ..`.data...............................@....rsrc....%.......&..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\W95INF16.DLL

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	MS-DOS executable, NE for MS Windows 3.x (DLL or font)
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	5.626412274243338
Encrypted:	false
SSDEEP:	48:iuB0q8Z8LCQZ5U45owLkq10Ju1pwZbQP+DWmnDypKGDsQVG:NB0q7L35S22u1pwZC+ymnDmKGDsv
MD5:	7210D5407A2D2F52E851604666403024
SHA1:	242FDE2A7C6A3EFF245F06813A2E1BDCAA9F16D9
SHA-256:	337D2FB5252FC532B7BF67476B5979D158CA2AC589E49C6810E2E1AFEBE296AF
SHA-512:	1755A26FA018429AEA00EBCC786BB41B0D6C4D26D56CD3B88D886B0C0773D863094797334E72D770635ED29B98D4C8C7F0EC717A23A22ADEF705A1CCF46B3F68
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZR.....................@...............................................!..L.!This program requires Microsoft Windows...$.......NE.<............................1.@.P.\|.....M.............R.......r.P.r.`.r.q.r...........l...0...............p...0..........W95INF16...WEP...DLLENTRYPOINT...........KERNEL.USER.SETUPX....?.z...?.....?.!...INF Installation Library...W95THK_THUNKDATA16.....................................................................EU...WQ.V..j.j.Q......j....f..]M.EU....f..]M....2...v.2...6...:.XZh..h..h>.hV..RP.....w95thk_ThunkData32..U..F..p........U...h ..h...v.f.v..@.I.=....@.........V.^.&....f.v..F..P.........t....M.v...6L...6X......Ph...........u.....P..6d........t..v.......j....F..^.&..3.^.........WV.v..v.V......N.....N.;.v.QVQP........&.?\t..F.&..\G.^.&.? t.......F&.< t..v.W.V.....^_........WV..C.......f....3.........F..F.f.v..F..P............j......P.......u......P.......t..F...j.f.v......3.....~....f.~..u..F......F...3..F.F.F.f+.f.N.f.N.h..h...N..Q......

C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\W95INF32.DLL

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	2.9774207313950316
Encrypted:	false
SSDEEP:	48:6Z3Mi+h0U47yaE6akf1WbvgFfSBZW3IezfXNFk5WgF:VEyaVaVv+aPWJXNyWg
MD5:	4BE7661C89897EAA9B28DAE290C3922F
SHA1:	4C9D25195093FEA7C139167F0C5A40E13F3000F2
SHA-256:	E5E9F7C8DBD47134815E155ED1C7B261805EDA6FDDEA6FA4EA78E0E4FB4F7FB5
SHA-512:	2035B0D35A5B72F5EA5D5D0D959E8C36FC7AC37DEF40FA8653C45A49434CBE5E1C73AAF144CBFBEFC5F832E362B63D00FC3157CA8A1627C3C1494C13A308FC7F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....=2...........!......................... .....p.........................p...................................... .......@..<....P.......................`..0...................................................d@..(............................text............................... ..`.rdata....... ......................@..@.data........0......................@....idata..@....@......................@....rsrc........P......................@....reloc..\....`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\asycfilt.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	147728
Entropy (8bit):	5.909287934496192
Encrypted:	false
SSDEEP:	3072:h+qD1Cd/Oa5kXFlqkFGr3CAP7LCyInPEggen5Ez:hlCd/OaaFEjCAPKyOE6na
MD5:	C89E401800DE62E5702E085D898EED20
SHA1:	72FB4F088C6AC02097B55FB267C76FBF5E0FA1F7
SHA-256:	DE83C9D9203050B40C098E4143EF8F577AA90016C7A64D4F2931B57A4C43E566
SHA-512:	70006D70DCB47361FF43E4F7C458655AD2474B70CB917873AA77D2CC06465A68D375D36C494D154A03DBBFF891DF7DD6CAB3D2C7B08E8650B9FF170E30838070
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ru..ru..ru..mf..ru..ru..su.Rich.ru.........................PE..L....!.6...........#..................... ........<e.........................`... ..^q..................................n.......d....0.......................@..0...P!............................................... ..L............................text...n.... ....... .............. ..`.data....d.......P..................@....rsrc........0......................@..@.reloc..v....@... ... ..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\comcat.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	22288
Entropy (8bit):	4.814478820147639
Encrypted:	false
SSDEEP:	384:23Fob3slaN3oF1fHICOoMzMv/QTIBjDVquODJXsUW7ftWs6:Yo7s28JnOxzMv/QsBjRqugXspd
MD5:	3B180DA2B50B954A55FE37AFBA58D428
SHA1:	C2A409311853AD4608418E790621F04155E55000
SHA-256:	96D04CDFAF4F4D7B8722B139A15074975D4C244302F78034B7BE65DF1A92FD03
SHA-512:	CF94AD749D91169078B8829288A2FC8DE86EC2FE83D89DC27D54D03C73C0DECA66B5D83ABBEAA1FF09D0ACAC4C4352BE6502945B5187ECDE952CBB08037D07E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...rD.2....i......#.....2...................P.....w.................................................................?......*<..d....`.......................p..4...............................................X....................................text...#0.......2.......... V...... ..`.data........P.......B..............@....rsrc........`.......N..............@..@.reloc.......p.......R..............@..BkD.2(.....22...jD.2?....%.2J...........ole32.dll.KERNEL32.dll.USER32.dll.ADVAPI32.dll..........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\mVBExec.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1357600
Entropy (8bit):	6.676037472083791
Encrypted:	false
SSDEEP:	24576:BbQr0YK8Usasyc0ZP0rqqTKOdB4Ssab0IOb/Ng/r0GEj:13CaZzqrdSSfW/WTjEj
MD5:	7084D611F4646FD3652B1ED603A1F4CD
SHA1:	9CA06B546644D37A62F11F79B1463FEBD974EC74
SHA-256:	DEA658AA6156AD4C54BDD4BDE1883CA088D38CDD0E220946F3CE44767FF42BAE
SHA-512:	9D00AC1C77EFEABA6AD59E461C2E396B716D4B888DF8D0FC2CBB7D9D1572C3AF12B7DF4822E19CD73DDDCC346AC6C481B9D725A1E1B5994BCDF74EEC93E41981
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....;.b.....................x.....................Q................................[~..................................N.......\7.......Z...........`.. W... ......................................................,................................text............................... ..`.itext.............................. ..`.data....O.......P..................@....bss.....S...P.......8...................idata..\7.......8...8..............@....didata..............p..............@....edata..N............z..............@..@.rdata...............\|..............@..@.reloc....... .......~..............@..B.rsrc....Z.......Z..................@..@.....................`..............@..@........................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\msvbvm60.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1386496
Entropy (8bit):	6.507253562372704
Encrypted:	false
SSDEEP:	24576:jrWIEO0eDfcPOvCOpMEPJonhql5oHS+zh3JajtObuF+T+NUFRjUgIeX40sgdp:jrOuCQhJohq3oHrh3JajtObu2+NUF5Vd
MD5:	F28EB5CBC3CA6D8C787F09F047D1F9C8
SHA1:	70DB1FAC822974BC9B636A984BCC1DA2E67F8DE5
SHA-256:	3EF32E0152CC3FA07C417E6AADF9EAD83A17B5FDEE73799044E1BD7564725D6E
SHA-512:	84F811F75E9D5143898728D2109B349802A292D4EF2CCAE4B4421D20268A33C6DDEE9C70E8BDEB474A3AC70307B2554C00CE786CA1F446807610FA2717F3745F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....:@...........#.........v.....................f......................... .......N...............................0...Q..............L.................... .......................................................................................text.............................. ..`ENGINE.............................. ..`.data....n.......p..................@....rsrc...l...........................@..@.reloc....... ....... ..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\oleaut32.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	598288
Entropy (8bit):	6.644743270512807
Encrypted:	false
SSDEEP:	12288:HCKynQWKglDhrUtrvT/NInIk4NDXsR6lMlpGz:HGXqB8V6lMlMz
MD5:	7B156D230278B8C914EF3F4169FEC1CC
SHA1:	6B58E20B2538CB308091DA838710F6AAD933A301
SHA-256:	BAEB2F7C1B8BE56738D34E1D1DDF8E0EEBD3A633215DC1575E14656BE38B939D
SHA-512:	E4EC2BC714069E0A6B56D89B52AABAD92E5BA741DC6F26D2FC2D72AA9AD2EC465DEA523CCCD810331AB78B5FB8A1244B2B521303418EAD5BD6BE5A58B43794C5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ibW.-.9.-.9.-.9...7.(.9.{.*.,.9.-.9...9.Rich-.9.................PE..L....#.6...........#..... ...................p....4e......................... ......+................................6..%$.......................................g...................................................................................text............ ... .............. ..`.data....a...0...`...@..............@....rsrc...............................@..@.reloc...g.......p..................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\olepro32.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	164112
Entropy (8bit):	5.8462943829831575
Encrypted:	false
SSDEEP:	3072:+VrhrwLXcA2Ha/joWklbo/Acjwm4AaW7zozn/zgOh0Z76:fklbsqmyWnoz/P
MD5:	CE0155405EA902797E88B92A78443AEB
SHA1:	8ADFF69050D14A57D7F553CA8978439AF188C192
SHA-256:	789C3C45EDA1749BD939F4A96616E1E9EF1B7DCC62A2889F65088954C64D0938
SHA-512:	3FDE09067F9CA8D315DE07C8DB972F99723EA4C3F997DC58210F9D6565CAA9935C79F13E8B2D20ADC5609919A381E4C2A90A0B3123A35947997229D7C615E162
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.'r!.I!!.I!!.I!w.Z!*.I!!.I!\.I!Rich!.I!........PE..L....!.6...........#.................)... ........0_............................. ..>................................................0...3...................p...... #............................................... ...............................text...q.... ....... .............. ..`.data....X.......P..................@....rsrc....3...0...@... ..............@..@.reloc.......p... ...`..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\stdole2.tlb

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	4.083884450202126
Encrypted:	false
SSDEEP:	384:cogoEvM/uFrR+X6QNn1pcJIrWocDGWct:cogoEvM0rgqQNn3
MD5:	1B02577F0ADDEA32EB02A50D4A4CDD1E
SHA1:	36F701CCEC78A5D218FEA23FD05351890F14CF7D
SHA-256:	6EA525BFACE5467C1045C3708F339A4B92A3A273F70656E061C7F7322C56D667
SHA-512:	87FD4AA5158D09EB97B6131E651DB2A4761546907A960AF7792F8E95947C0A825E84F88ECCF42EC896FF5BB2BBC461488B898D5F1BD853847317493C44B330C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......eU!.!4O.!4O.!4O.!4O. 4O.Rich!4O.................PE..L....!.6...........!.........D...............................................p...........................................................@...................`.......................................................................................rsrc....@.......B..................@..@.reloc.......`.......D..............@..B.............!.6............ .......8........!.6............P........!.6............h........!.6.....................!.6....................@:...........J................T.Y.P.E.L.I.B.MSFT................A...........*................................... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...............h...........................................L...P.......

C:\ProgramData\miaE495.tmp\data\Microsoft Visual Basic Virtual Machine 6.0 with Service Pack 6\mVB.dll\vbrun60.inf

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Generic INItialization configuration [DestinationDirs]
Category:	dropped
Size (bytes):	1069
Entropy (8bit):	5.4959184158351215
Encrypted:	false
SSDEEP:	24:yuZq732XeLfX8IUy3k8exg5S3X8n2uNXVANXVMbNX9NXR/NXVuZZNXV0pT7:BJeL/8IhvFSn82CVoVMB/DViDV057
MD5:	F8854BDCD55ECCF24F077981ADFE6B9A
SHA1:	377FC226B1C10B244F1E32F6EA3A20B5D47D4777
SHA-256:	E5A9050E93487A1D296CEEC10B95BE9F92EB877AA2913296B5C31B9F74F7C788
SHA-512:	6331F337A1595D6F83281614E6A92AABA9D8B27FDA3B5CF4E85F1B49AC335E10F0F62CD147131D53C473B3ACC42BC27F2D02073F0CC60755CA10871EF2E7AC8E
Malicious:	false
Preview:	; INF file for Visual Basic 6.0 Run-time Redist Pack....[DefaultInstall]..CopyFiles=install.files..RegisterOCXs=RegisterFiles....[DestinationDirs]..install.files=11....[install.files]..OLEAUT32.DLL,,OLEAUT32.DLL,32;..OLEPRO32.DLL,,OLEPRO32.DLL,32;..ASYCFILT.DLL,,ASYCFILT.DLL,32;..STDOLE2.TLB,,STDOLE2.TLB,32;..MSVBVM60.DLL,,MSVBVM60.DLL,32;..COMCAT.DLL,,COMCAT.DLL,32;....[RegisterFiles]..%11%\OLEAUT32.DLL..%11%\OLEPRO32.DLL..%11%\MSVBVM60.DLL..%11%\COMCAT.DLL....[OLEAUT32.DLL]..file-win32-x86=thiscab..RegisterServer=Yes..FileVersion=2,40,4275,1....[OLEPRO32.DLL]..file-win32-x86=thiscab..RegisterServer=Yes..FileVersion=5,0,4275,1....[ASYCFILT.DLL]..file-win32-x86=thiscab..RegisterServer=No..FileVersion=2,40,4275,1....[STDOLE2.TLB]..file-win32-x86=thiscab..RegisterServer=No..FileVersion=2,40,4275,1....[MSVBVM60.DLL]..file-win32-x86=thiscab..RegisterServer=Yes..FileVersion=6,0,97,82....[COMCAT.DLL]..file-win32-x86=thiscab..RegisterServer=Yes..FileVersion=4,71,1460,1....[version]..signature

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\cabinet.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	56080
Entropy (8bit):	6.471892347922079
Encrypted:	false
SSDEEP:	1536:Je/7+7mzLZ9Q6uooPz0OQJ6hbaenpmju6xv50VK/kroRj:JeC7mzl9Q6w09J6hbaop0OK/kroRj
MD5:	267AB17A3526C6C46B2A1CF9A0A51280
SHA1:	A18DDA64D88228D0783D5FF24769FF0375DB1349
SHA-256:	CB535E27870708F94F46ECB75BF6A5DFF17422C28B9F21C2C80AB7B1FCF1F715
SHA-512:	DD462E0DD24940C39EBF843D21DECEDC2CA96FEC3848CDE25218EC9EA45B19A8D559251309240688E981C6915BEC664B6969280E157B00115F13003E60BE430A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{J...$...$...$...%...$..97...$..."...$...$...$.Rich..$.................PE..L...R.C8...........#.........2.....................u.........................0......N...........................................<............................ ......`.......................................`...D.......\............................text...M........................... ..`.data....(..........................@....rsrc...............................@..@.reloc....... ......................@..B4.D8 ...0[.8-...5.D87...........KERNEL32.dll.NTDLL.DLL.ole32.dll........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\imagehlp.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	106013
Entropy (8bit):	6.212455176025638
Encrypted:	false
SSDEEP:	1536:M82ThwpbJDIQp4J0O0oRPcHPsw7e2EoFtV6tF3x6WyglF3CT:yTh0bJDIQp4J0O08cHp75kH6pgX3CT
MD5:	0B783914A5BF8CE566C6F7BE36E50759
SHA1:	B72151196A33D73606D20B0265B2D039EF9D1CF2
SHA-256:	A01EA2839B8B9676631CC7D5A9E8D6D64C2CAE5CFBA8D7E74D6E9F4B0E122331
SHA-512:	E863B49D8B1681279D4083EC6AAFC8EE3BB91F81DF4428089219BE616FD66560CC8F97B674B208ABD0566763E27ED5546F9DF9EC7B85B82E17F0376D6B6A07ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....B/3...........!.....P...P.......S.......`.....v................................................................p.......k..(....................................`...............................................`...............................text....N.......P.......... ....... ..`.rdata.......`.......`..............@..@.data...4............x..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\instmsi.msi

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Windows Installer database, Author: Microsoft Corporation, Keywords: Installer,MSI,Database, Comments: Instala Windows Installer, Create Time/Date: Wed Apr 14 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 2, Template: Alpha,Intel;1033, Last Saved By: Alpha,Intel;3082, Revision Number: {CA04376B-A6BA-F246-20B1-EBD703D8F0D2}1.0.00.000;{CA04376B-A6BA-F246-20B1-EBD703D8F0D2}1.0.00.000, Number of Pages: 30, Number of Characters: 8
Category:	dropped
Size (bytes):	951808
Entropy (8bit):	6.02604379952541
Encrypted:	false
SSDEEP:	24576:T8aSNCmuikMvQVcboqTR/oNsBOozxEAnxEq6UEWtoDbC0snsTSOfWLkLIHt2xNq0:T8aSNCmuiXQVcV/oNsBOozxEAnQWto/l
MD5:	DACAD73CE0EF57276296E89A4F28710E
SHA1:	5E99C052B9D24C8C245632D0691B949F59E19D95
SHA-256:	61AD5E27FC7D0D39E7CBA51C3792F18E6FDC744921E6C416798D8179AACFC32A
SHA-512:	1268D7A180F95847DD0725633E87884D478EBACBF93D11CB7557BF58CDABCF487D8E2D4E36717335983AB81816CB713F04E91E722A4D74CDA7EE34554E4DFED9
Malicious:	false
Preview:	......................>.......................................................p.......j.......n.......v.......t.......k.......g.......................................................................................................................................................................................................................................................................................................................................................................................................................C.......................................................A.......D................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...i.......E...f...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e.......g...h...l...j...k.......m...n...o...........r...s...t...u...v...w...x...y...z...

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msi.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1927680
Entropy (8bit):	6.128521877107153
Encrypted:	false
SSDEEP:	49152:XCRTdYNHpRTrNHpRTfNHpRTRZzg5UYvn81oq24TVvnN6MatzkEs+qa3URcNoX:Tg5UYvaoq24TVv4MatzkEs+3xo
MD5:	1F4327678ED079D6FE37CBB2679F9B7E
SHA1:	1F5ECF24191E7E40C54354EFEFAC95A21AE91EA4
SHA-256:	56B289A74A0420E0D8BEFF631F1FC34C9F650E1876C2FE2BD7CC715CBAD04C49
SHA-512:	628359DD72B3684C08751E5890A79D11DBF9820A2F9DA706D92DEFDCE7942A09FDD7FC1634F85D99D312A068E05B3C166DD8D4A5F99A7DA6039A94B4A9653C7A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y...8..8..8....c.8..I.U.8..z.f.8..8~..9..z.?.8..z.@.8..Z.b.8..Z.c..8....:.8..z.B.8..Rich.8..........PE..L......;...........!.........z.......i.......0....@.............................................................................x.......0)...........................................................................................................text............................... ..`.orpc........ ...................... ..`.data....\|...0...d..................@....rsrc...0).......*...n..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiexec.exe

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83456
Entropy (8bit):	6.31626628635355
Encrypted:	false
SSDEEP:	1536:2eIGSoxLTd4LcE3AeweFR/L0thKAMkIOyMYozY0Cri+tg43wKcQvL6:jIGSoxLTd4LxAen0/Kbk5YozIeOwKcQu
MD5:	E6B975475B001A15B14AE6BDCDE58E45
SHA1:	78E98C30801D2E9FF3005F829B0574CD2B3C2F48
SHA-256:	175435FD486045310E8C393B9B151638756AD14C7C93232BBD9D6920F1268E46
SHA-512:	67957EB32D414E883EDF9D957D9A8783FFD5305E968A046245B79FB7677D5ABEB2651280C9D2117C097BBF53B2A4A10A6B40D5522C4A04F9A0F37D94548C620A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P2...S...S...S...p...S...S...S...p..S...p..XS...p..S...p...S...p...S..Rich.S..........................PE..L......;.....................P............... ..................................................................................x....`..X...............................................................................\|............................text............................... ..`.data...T3... ... ..................@....rsrc...X....`.......*..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msihnd.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	297472
Entropy (8bit):	6.293291033170778
Encrypted:	false
SSDEEP:	3072:QA/lZmzljpUKaEU6q+R91vlI2+a1Lnby+0K9RrqfXPQUwyf8gSXlTHM9u3cQKtTP:QA/XIUzEUonvlIrGT0MWfYdbzlbMIkz
MD5:	AB3A6F9B84D4B74F7811A99FB0314A9B
SHA1:	C26185396B46ED706C401A8605CE1BF946AE5CF1
SHA-256:	F7382C1B01B52ABFEF7BD5E7921C2D05E114584255FB1BC17119DBC035C8A008
SHA-512:	1C08854A4240C84913FD925968D838BE25978A58A2D0C59EF46636ED90105FF60CEE047CC58B5B7F555744461095A4CD854F4EB4670BE7870778D743E1D4281E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E-.Q$C,Q$C,Q$C,..Z,^$C,Q$B,.$C,...,G$C,..\|,P$C,...,P$C,..^,^$C,.._,/$C,..~,P$C,RichQ$C,........................PE..L.....;...........!..............................@..............................................................................................................+......................................................\............................text...c........................... ..`.data....4..........................@....rsrc...............................@..@.reloc...5.......6...T..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiinst.exe

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	6.126214350182879
Encrypted:	false
SSDEEP:	768:SSjhX67ianPrIQBpZE/vwsRcL1S2cETJXUl:SS1X67RnUQBXYIsOZS2c4JE
MD5:	47EB6C6EAAAE1544A50339A51A8AE481
SHA1:	7DF0BEB8F719174419D9421497F203D63290F8D6
SHA-256:	3C97927B8BF0BB1A54271D6F117E0E12B673122284B2E382D55237A3487960B2
SHA-512:	A675F471A8404830B114CEC2F0605EF18DCA203B74E2D5A26F3F3A9B0055FF3DAAD45E04AC11FC794E6DF90B9CE700CF39F85E2F2193AF1D13BDE776D3157FCC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.jir..:r..:r..:...:y..:r..:...:..D:\|..:...:I..:..A:s..:...:u..:..9:s..:Richr..:................PE..L.....;.................\|...........I......................................................................................$...x....................................................................................................................text...$z.......\|.................. ..`.data...x...........................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msimain.sdb

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Windows application compatibility Shim DataBase
Category:	dropped
Size (bytes):	134164
Entropy (8bit):	5.119567377291569
Encrypted:	false
SSDEEP:	3072:2vbOQXQtrj+jcAxeL9+9sw4vQoZv++lbuSOS+J:2vbOQmOgL9+YOj
MD5:	9A7CA59803DD20AC5C6B900E8665169B
SHA1:	247C0DC1C82F70E6E7F9CAFA9F7C8C69EC4C2648
SHA-256:	AEEC814144D4253D3167360EC6399F542D9123E4D5878808BAC279D6436B3C8D
SHA-512:	DADD8F6023F063F59C0F7703D706218F59F8D54EDFF3CB2CF8C71C67DF22CF6EE32C379DD65C2C69D3FFCF0D84C500737EA294C9CB1126656FB1D6E629F3058C
Malicious:	false
Preview:	....A..sdbf.xh....x.....8.p.8.`.@......x...VILEBODAf...02MOCUED~...OCHCNERF....OCOTOHPI....RT1002IP....IERUTCIP....VEZILAER....DACOBRUT......YAWNIW&...IUSSKROW>....x.....8.p.8.........F1R..'.r....c..........n...@............N...p{...4!....k.\o8a.&.........>.+......)...w/........=@i?........=@i?.........ED....q-...I.....qM...I.....q]...I:....q}...I.....g.tWc.L.......s3.`O4......~.'.Xl...Y0.50..YV.......3.i\.....7..AZd.f...K@}...F.....0i........?.3i....2...,.3.....j................\...6.l.....\...6.......Q. .d......8 ?..H...,....@N.........i%.B...P...>.......X6...........^^..^!......^^..^!.T....^^..^!.D....^^..^!.6.......L........x.....8.p.8...@...........p..-1..V...U.h.........u.......D.....8.........."a..N..D....H.`T.z........../'2...t=.'.o.+........M..0........9.W1j.......\|.GE....qO.2-:.H:...,....I.R....T.kI..SYF...;.Ek..Y......;..nw[d....8..O.f......'.fK.h4...c...I..q....J....z.y....n..g...\|......!Y\|p.......&Eo....r.......L........eS.....B...&.w........vI!$!E-.H.

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msimsg.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	5.7770113379561385
Encrypted:	false
SSDEEP:	24576:7FrZsyKWdbhmUXE9KIrufRO4t1YF6OWez17:VVhmUXE34t1YFp7
MD5:	1528B3892C7D02CD5BC58DB0736C069D
SHA1:	7B25B7DEC2448CD31D2D029FBB9177D68B0FA107
SHA-256:	AA5A8E2DFA32FD93E56B93F4EE57131EFCAB0C66E822D59DB187410D923EDB6B
SHA-512:	FF9CF44CEE136B5D9854C67F0F05740BBA915B58240F0A9A816DED4EEAE151B4A6C60D0BE650B9E28276DA582FBE1AC22149621CC2599270790E419609EE5CF5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........=.C.S.C.S.C.S.....B.S...n.B.S.RichC.S.................PE..L...U..;...........!....................................................................................................................x............................................................................................................rsrc...x...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msisip.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	6.0759855839723365
Encrypted:	false
SSDEEP:	768:DvNOtQ6P36XywYpWMbhK5CuInamzP0gEWm4C0HO:rNOK6/6zYpWM0C7namzPFEd0H
MD5:	B5BECF4BDAF9D68ABFFEA2E7F4747265
SHA1:	CCA2DF95690835604BC00E46F39DEA08810DF8EF
SHA-256:	325D9AEECB2E2607ECC43BFCE7E49C2561195158E8A38F366A33CCA5300876C4
SHA-512:	B0828B92849BB6A8E7CF5966C2930502F733C5F6D42787F8873FC1ADB1048A922DE786395BAEABBFE90E30365F29E1698ABEB156B34C3544B692921821DBECF3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k.c.8.c.8.c.88@.8.c.8.@.8.c.88@.8.c.8.c.8.c.88@.8.c.8U@.8.c.8.@.8.c.88@.8.c.8Rich.c.8........................PE..L......;...........!.....\|...&......Y<............@..................................=.............................. ...8......(...................................0................................................................................text...X{.......\|.................. ..`.data...\|...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msls31.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	167936
Entropy (8bit):	5.9814955021734715
Encrypted:	false
SSDEEP:	3072:sIvjlvPmGwB5RezjIN+vqjo/pFNrk3br+uubhokMD81s2pAFfqCF1hW4HgB/i:sSjpjwOjIN+v30vsVW2pK7F1hW4Hg
MD5:	2CAB9989FB957EFD98DBBBCB9B1946AB
SHA1:	0D01E4AC66D852730D8031A2BCAE215210EA7385
SHA-256:	841FDE9B24476A7ED364A3E4A1470AC9B7358BC92F29FCA4A06AAB557D140850
SHA-512:	92FA2DACE9589789FE2A84E4F561D1DDA32858AEEB4CD13EF73D94D6619A27F68988D653367D0CEB91FBFF8C427D6FF28E8ED0FE00FBA91B006F9FA13F3F9943
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........#..cp..cp..cph.ip..cp8.ep..cph.gp..cpRich..cp........................PE..L......6...........#.....0...@............... .....H.................................=...............................A..Y............`.......................p.......J...............................................................................text....#.......0... .............. ..`.rdata.......@.......P..............@..@.data...@....P.......`..............@....rsrc........`.......p..............@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\mspatcha.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28746
Entropy (8bit):	6.545540060601869
Encrypted:	false
SSDEEP:	768:hLCnlsA4wVor2lcvDd2nafVz7aGXdP6YMKdI6C6udCv:h2voo2p2naf9aediYMftdw
MD5:	60D88C0829FE1E16C32F76D71724807B
SHA1:	40FB4D13A643B6F8A7A7CABC2A3F9E48B9E0CC50
SHA-256:	6007DA6BB72FE138DD4AE622C78C5337E3EAF9E8020B748B4A6918563EC988F6
SHA-512:	A8D35023AA60C601B581847E8FA3A1B5E52D5A6515DE6C6EAF7AAFA64CDD6A3BFE6E17281C6870F39343D8D45E2460A8730E8BAA26C24296087BF37ACF55E414
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................................Rich...........................PE..L....aJ9...........!.....d.........................X..............a..................`...............................p.......n..(...............................X...`...................................................T............................text....b.......d.................. ..`.rsrc................j..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\riched20.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	431133
Entropy (8bit):	6.6536949023972145
Encrypted:	false
SSDEEP:	12288:xWNTGm1c2qUkM9nv2VOXRc5uynesaycwrt/cIC:xW8m3qUv9EeROxXcoJC
MD5:	AE5ABEC31518E015A9FB4EB196854291
SHA1:	DEB63ECB2CBC60A688797478A204A2A57F49D1E6
SHA-256:	1C2508FB55DDC459D0327F2017471545C87420443391567094E768FB34032DA1
SHA-512:	DFE3E803AB7940FE4811627832CD048ED872111C3AE6B4DFE3493CB14E7932AFF9B5ACA7E5F387F5B38A44CAFBB350540A4B41955A3D28F36953B01FABCAA2F9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.Gu...u...u...u...{...,......._...t...u...$...Richu...........PE..L...0.V8...........!...............................H................................................................`...=................w.......................(..<.......................................X...l...............`....................text............................... ..`.data...............................@....rsrc....w.......x..................@..@.reloc...(.......*...j..............@..B4.D80...0[.8=...4.D8G...4.D8T.....+8_...........KERNEL32.DLL.NTDLL.DLL.ADVAPI32.DLL.USER32.DLL.GDI32.DLL........................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\sdbapi.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63488
Entropy (8bit):	6.659673413793373
Encrypted:	false
SSDEEP:	1536:PETcumoD4VtSnCl2nMdzMdcITmPKhi1fKIaj1/VYcR83:PETcRVtSnUdzMZiFA/VYcR83
MD5:	F8FD9158C6C71F3494A1D469EF78EEA3
SHA1:	747C7D9AA94317B894A77EA903DF959F60282EC4
SHA-256:	68AEFE972833C881857B27BC28D3191234B3C0D73B0F538032DCB82BE3DC4A0E
SHA-512:	D0940A38711DEB93139469863A5B507BE246AFDEDE6195FDD0264490FA4A00A06BB223347316E877B38557FAD5275FFA4384FF58836F54394819800FB140B843
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N..O.h...h...h...K...h...h..Nh...K...h...K...h...K...h...K...h...K...h..Rich.h..........PE..L....};...........!...............................G......................... ......................................P...c.......P...........................................................................p...X....................................text............................... ..`.data...............................@....rsrc...............................@..@.reloc..............................@..B..};(.....};3.....};@.....};M...........msvcrt.dll.ADVAPI32.dll.KERNEL32.dll.NTDLL.DLL..................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\shfolder.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21021
Entropy (8bit):	4.8801661651868615
Encrypted:	false
SSDEEP:	384:L5yAJ3gXLVMYNcJhGCMcrXWpiWwH/sHHgH2nKwsHTWHi5AGsHW0HcHpLHP0oqQGI:0AJ3IMYNcJXMcyu/z
MD5:	B7993C10B9A8C3B9735D7696C7B9E8B6
SHA1:	AC2E765311380BFA502B3B7AED2E8D80C351E08B
SHA-256:	6F0443A62FD444C4254F902F668543B867A0577504915D22CD75328F73CD4472
SHA-512:	D17AE76467F5FAC056494A0FDEF445A5BBB1F633507DDEF9B2AFC12DD47EAA68096784D47E968383B207382850100EF1915378E74564E29CBE1C8E0D422DD679
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q{J...$...$...$...%.'.$.L97...$..."...$...$...$.Rich..$.................PE..L...q.^7...........!.........0...............0.....u.................................................................'..k....(..X....@...+...................p..P....,......................................`...4....................................text............................... ..`.data........0......."..............@....rsrc....+...@...,...$..............@..@.reloc..P....p.......P..............@..BM.^7....N.^7%...........KERNEL32.DLL.ADVAPI32.DLL.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\usp10.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	314906
Entropy (8bit):	6.170788306003831
Encrypted:	false
SSDEEP:	3072:10EvBHYN6cpZbdPYxDhjnYnMq182s8Vvh0VCPL2zHoytG5dHJZE5d8wfI:1LHYwcLdy9Ir6v8tS8ytG5dHL+pI
MD5:	4437B4E1EFC79C331070B9F481E3E97A
SHA1:	793B1D0839912679CB43E50B63C186205B8B7D44
SHA-256:	4D8FF1F53C3BABF9BFD11B2EBCD44E2698CFE3BC80C6F0CBC64C0D191EA1FC1B
SHA-512:	C82CEA06778426943958E47A8A3372731A3834C412F919E1E6C35B7FE41DD55E3E6D881CD489464A69FD65180A4B1632527C0B06E62700F5C66BF4867089A7CD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............................................Rich....................PE..L...0.C8...........!.........................@....ef.........................@....../^..............................@9.......1..d............................ ..p...`...........................................l.......`............................text...]-.......................... ..`.data........@...>...4..............@...Shared..P........0...r..............@..P.rsrc...............................@..P.reloc....... ......................@..B4.D80...0[.8=...4.D8G.....+8R...4.D8\...........KERNEL32.dll.NTDLL.DLL.USER32.dll.GDI32.dll.ADVAPI32.dll........................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\mWinRunExec.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1353504
Entropy (8bit):	6.674591083664776
Encrypted:	false
SSDEEP:	24576:sff3GymQgwTKYZe9YNTUPTBAS5m0WrSu/CScsOE:EmjtTT6S5ro/CzsOE
MD5:	F7FF3D6E5359DA5243D7889D3200E32B
SHA1:	6B4B02BBE68B09DF0D0CD680ECB56DF6C7F4463C
SHA-256:	69DD649F0D3A05149E048EE216F8F68D8B81AE32473EF511A144C99352FCA960
SHA-512:	9B11E90E0C50826EE571C3B6AA7D039AAD4B18481619404D3E578A41585214943FFC8C2A551E2B883C7C4F3544635A1BF5DF178F94B654C63F11E7ABF494B69E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....;.b.....................v.....................Q....................................................................R......."6.......Z...........P.. W... .........................................................\.......^....................text...H........................... ..`.itext.............................. ..`.data....O.......P..................@....bss....\|S...P..........................idata.."6.......8.................@....didata.^............b..............@....edata..R............l..............@..@.rdata...............n..............@..@.reloc...... .......p..............@..B.rsrc....Z.......Z..................@..@.....................P..............@..@........................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\cabinet.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	56080
Entropy (8bit):	6.471892347922079
Encrypted:	false
SSDEEP:	1536:Je/7+7mzLZ9Q6uooPz0OQJ6hbaenpmju6xv50VK/kroRj:JeC7mzl9Q6w09J6hbaop0OK/kroRj
MD5:	267AB17A3526C6C46B2A1CF9A0A51280
SHA1:	A18DDA64D88228D0783D5FF24769FF0375DB1349
SHA-256:	CB535E27870708F94F46ECB75BF6A5DFF17422C28B9F21C2C80AB7B1FCF1F715
SHA-512:	DD462E0DD24940C39EBF843D21DECEDC2CA96FEC3848CDE25218EC9EA45B19A8D559251309240688E981C6915BEC664B6969280E157B00115F13003E60BE430A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{J...$...$...$...%...$..97...$..."...$...$...$.Rich..$.................PE..L...R.C8...........#.........2.....................u.........................0......N...........................................<............................ ......`.......................................`...D.......\............................text...M........................... ..`.data....(..........................@....rsrc...............................@..@.reloc....... ......................@..B4.D8 ...0[.8-...5.D87...........KERNEL32.dll.NTDLL.DLL.ole32.dll........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\imagehlp.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	106013
Entropy (8bit):	6.212455176025638
Encrypted:	false
SSDEEP:	1536:M82ThwpbJDIQp4J0O0oRPcHPsw7e2EoFtV6tF3x6WyglF3CT:yTh0bJDIQp4J0O08cHp75kH6pgX3CT
MD5:	0B783914A5BF8CE566C6F7BE36E50759
SHA1:	B72151196A33D73606D20B0265B2D039EF9D1CF2
SHA-256:	A01EA2839B8B9676631CC7D5A9E8D6D64C2CAE5CFBA8D7E74D6E9F4B0E122331
SHA-512:	E863B49D8B1681279D4083EC6AAFC8EE3BB91F81DF4428089219BE616FD66560CC8F97B674B208ABD0566763E27ED5546F9DF9EC7B85B82E17F0376D6B6A07ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....B/3...........!.....P...P.......S.......`.....v................................................................p.......k..(....................................`...............................................`...............................text....N.......P.......... ....... ..`.rdata.......`.......`..............@..@.data...4............x..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\instmsi.msi

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Windows Installer database, Author: Microsoft Corporation, Keywords: Installer,MSI,Database, Comments: Instala Windows Installer, Create Time/Date: Wed Apr 14 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 2, Template: Alpha,Intel;1033, Last Saved By: Alpha,Intel;3082, Revision Number: {CA04376B-A6BA-F246-20B1-EBD703D8F0D2}1.0.00.000;{CA04376B-A6BA-F246-20B1-EBD703D8F0D2}1.0.00.000, Number of Pages: 30, Number of Characters: 8
Category:	dropped
Size (bytes):	951808
Entropy (8bit):	6.029627921240929
Encrypted:	false
SSDEEP:	24576:A8OSNZmfikMhQccboqT+/+NsBGozxEEnjEq6UEWtoDbC4snsTMOf2LkLIHtuxPqC:A8OSNZmfiZQcc6/+NsBGozxEEn+Wto/X
MD5:	2B4B94ABE5C6B89A47F212C2D696D618
SHA1:	15DF612410AC2D576D069DF94B306066D15D60F3
SHA-256:	3900B678DE6D24DB7ED9D7190517C60793B9B435EC58BBE46AAD044A49CAF636
SHA-512:	0311EAC11B1FE3A3AE6420F46534A420E70C3C8D2BF05D5E754DFDB480722D28E97732AF0E25890AF22C3FAC1CE01ED008886E22445C37E9894ED76FEA76850A
Malicious:	false
Preview:	......................>.......................................................p.......j.......n.......v.......t.......k.......g.......................................................................................................................................................................................................................................................................................................................................................................................................................C.......................................................A.......D................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@.......B...i.......E...f...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e.......g...h...l...j...k.......m...n...o...........r...s...t...u...v...w...x...y...z...

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.cat

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	data
Category:	dropped
Size (bytes):	9178
Entropy (8bit):	6.934013526787076
Encrypted:	false
SSDEEP:	192:nC1zR7DDb5qikTvpTKaErlnkTN2+goPKJ54Kn4dFR+4Db:ArAChe1nDj+Yb
MD5:	C74C5092222CA8B7C32B3423B22DE3A0
SHA1:	3EF6BE0BBF482EB3D026247B31B1A0DADBC1C71F
SHA-256:	4B3A1258638737EE338885DFF62256AA747A08BFC738C4A9850477B4AC7462EB
SHA-512:	3059D6BE46BFCBBAC148C5A6E20D9EF5512F2F5B5EC0BE5970C1E34FE73EC81D01D5D54F9CB6DBAECBD0ECC8F7A89D031E9D173D5A6925EC0FF89FFA1601B0AD
Malicious:	false
Preview:	0.#....H........#.0.#....1.0....H.......0.....+.....7......0...0...+.....7.....(..GN..F..*....W..010818054031Z0...+.....7.....0..j0..&.R0.2.4.8.2.9.8.3.6.D.D.0.C.B.1.0.9.8.0.F.E.E.E.C.1.E.1.D.C.1.A.C.6.3.A.0.B.0.8.4...1..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........H).m...........c...0....R2.4.7.C.0.D.C.1.C.8.2.F.7.0.E.6.E.7.F.9.C.A.F.A.9.F.7.C.8.C.6.9.E.C.4.C.2.6.4.8...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........$\|.../p......\|.i.L&H0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0..&.R3.7.0.F.D.A.0.E.C.9.4.3.3.B.2.6.E.4.A.B.3.C.8.5.C.0.4.3.0.4.0.7.A.5.3.4.A.2.E.8...1..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........7.

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1991168
Entropy (8bit):	5.8958492897713075
Encrypted:	false
SSDEEP:	24576:GB7Nqm40TSJvanFIrEegExvhiwtqeBf4QASo0u7kHRwuVkdLURWs:GB7dSJvanedlxEwtq+sr7KVyLURF
MD5:	5A6627C42F40199CABBF11391E141928
SHA1:	43D97D4DA87D15C7FD96D95F9BFC90C3CEBF8A91
SHA-256:	860E1B58DE5FCB3DBC7DCD9A16C5FAA56C748DA24C69A05417C75CD40E4432D3
SHA-512:	F63401AB3650EF3CB5DE8F419807E3C3825F3CF68DA39A13C084A3DFA562BA77E7993F99B2E83AE2CED4D95D763AA49BB3D3228C07048BDB2654CD3767A6EE8D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I....................................%.......%......%.......................H......%.......Rich............PE..L.....};...........!................\~.......0.....w........................................................................$...........H)..........................p............................................... ...............................orpc............................... ..`.text........ ...................... ..`.data........0...l..................@....rsrc...H)..........v..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.inf

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1116
Entropy (8bit):	5.322486389930819
Encrypted:	false
SSDEEP:	24:podajIZRTvvD6SxJre7OI+g/5xCYUf4QOSNWU4KugU5IvDGfjbIDSFSxJSbcexJJ:4aUTzSR5WvWNJgwIKbIDSY2bce2S
MD5:	FB6D53A80B79EEF39A6EE32DC35EF9EA
SHA1:	59A11A3EF985F9F776D5908F0A11910BB749CD5D
SHA-256:	95CC7C6E3797E544516B952442888D6A000FEF7B339997EC8ADDB7F180DF6D7E
SHA-512:	E29268033177E88693385847EEA2A2118943B3848A552E3A9B2629106F41644F82C78AE6CAD2CFEBE34D70D7F7212E3411687E32094E9D469EA74409C32346E1
Malicious:	false
Preview:	[Version]..signature = "$Windows NT$"..Class = %ExceptionClassDesc%..ClassGUID = {F5776D81-AE53-4935-8E84-B0B283D8BCEF}..Provider = %Microsoft%..CatalogFile = msi.cat..ComponentId = {2E742517-5D48-4DBD-BF93-48FDCF36E634} ; GUID assigned to the Windows Installer..DriverVer=03-13-2001, 2.0.2460.1....[SourceDisksNames]..1 = %msi_media%....[SourceDisksFiles]..msi.dll = 1..msihnd.dll = 1..msimsg.dll = 1..msiexec.exe = 1..msisip.dll = 1....[DestinationDirs]..Msi.SystemFiles = 11 ; %windir%\system32..Msi.DllCacheFiles = 11,dllcache ; %windir%\system32\dllcache....[DefaultInstall]..CopyFiles = Msi.SystemFiles,Msi.DllCacheFiles....;..; COPYFLG_REPLACE_BOOT_FILE flag (0x1000) not necessary for..; files in the dllcache..;....[Msi.DllCacheFiles]..msi.dll..msihnd.dll..msimsg.dll..msiexec.exe..msisip.dll....[Msi.SystemFiles]..msi.dll,,,0x1000..msihnd.dll,,,0x1000..msimsg.dll,,,0x1000..msiexec.exe,,,0x1000..msisip.dll,,,0x1000....[Strings]..Microsoft = "Microsoft Corporation"..msi_media

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiexec.exe

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63488
Entropy (8bit):	5.818017231218899
Encrypted:	false
SSDEEP:	768:rI4YSbqG4TY4LkR2Jcwuoc7NokgteLVyNlKludccVor3whUOyZWCTRpmaBVVG:x4TY4LCj+c7NIGVybKluS3YnyQCyaB+
MD5:	E7A49533944654EDD82D26338DF0FD05
SHA1:	573E88D79B4359D4314A3DB71928730BD018FDB5
SHA-256:	9E251671385941E2ADA9AA40811F1BA1E876E40A70C81AFAE1F88D18D80D0FEB
SHA-512:	5C7933E4F1D4329380F22C9FED907041295DBD9D91CDDAC20961924614AA944ED6641915D0777DB0BB0C55B6C097EC51C10A21096C6C098E2EFE6B84219A5BD9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........S[b..[b..[b...A.._b...A..Pb..[b...b...A..Tb...A..Zb...A..Yb...A..Zb..Rich[b..................PE..L.....};.....................H............................................... ......y9......................................<...........h...........................p.......................................P...........T............................text...^........................... ..`.data....*..........................@....rsrc...h...........................@..@..};H.....};S.....};`.....};m.....};w.....};m.....};......};............msvcrt.dll.ADVAPI32.dll.KERNEL32.dll.NTDLL.DLL.USER32.dll.ole32.dll.msi.dll.....................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msihnd.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	304640
Entropy (8bit):	6.29099735641058
Encrypted:	false
SSDEEP:	6144:NT/c7YrGE4VUDbJIFo4791yrsd4DtTnnhV7d:q7YrGEJqLzotTnh5
MD5:	E7F00952494BA4D9545242514614844A
SHA1:	8AC8A0228698E562C1B1592177662611ABEF144C
SHA-256:	DA4192B9B0A0C3A1BE1F1E52E2A4CC4BCF11B8436B04D0AE8118EF84FC4F6D34
SHA-512:	5FAA7518B5A4C33797C0D43D7C884D408351507B7223698DEF313AE23DAABE8B9B10DB58F86939D054CB5DADE6FCA525EBDC84E26D97FCFD42866D9EF9B179E2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6..W...W...W...W..ZW..Wt...W..Wt..W..Wt...W..:t..W..wt...W..wt..,W..Wt...W..Rich.W..........PE..L.....};...........!................]..............`........................................................................(....................................+..........................................x...........t............................text...c........................... ..`.data....8..........................@....rsrc...............................@..@.reloc...5.......6...p..............@..B..};P.....};Z.....};P.....};g.....};t.....};....2.};......};......};............ntdll.dll.KERNEL32.dll.ADVAPI32.dll.USER32.dll.GDI32.dll.COMCTL32.dll.IMM32.dll.SHELL32.dll.....................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiinst.exe

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	50688
Entropy (8bit):	5.935720802852158
Encrypted:	false
SSDEEP:	1536:NB9UO9nZK+ISiSoPSLljX1FEiZ3ZmcmIHv:NB9U0nZKQlNR7Z3gcmIHv
MD5:	41C714021C92086E80B0B57DD1E634FB
SHA1:	60F86C8CE8FA4BEA23D7CA4C4F01E33D63B5990C
SHA-256:	A6F1B26EEB1DE06F319BBE0F5E4BED4AF9C708A9D4F3E574EEA924B29EBD5001
SHA-512:	81C4D3B826F2F715E03EDF2C65DBB9F00990B5A8FA40EEF5531FE1B656CF5DBCF5A45A86E8A903980C07624B84841F34597C716067FE5CC662AD69ED5CBD09A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................l.............l.....L.............L......l......Rich............PE..L...m.};....................."......Cj..............................................j:..............................................................................0................................................................................text...h........................... ..`.data...8...........................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msimain.sdb

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Windows application compatibility Shim DataBase
Category:	dropped
Size (bytes):	134164
Entropy (8bit):	5.119567377291569
Encrypted:	false
SSDEEP:	3072:2vbOQXQtrj+jcAxeL9+9sw4vQoZv++lbuSOS+J:2vbOQmOgL9+YOj
MD5:	9A7CA59803DD20AC5C6B900E8665169B
SHA1:	247C0DC1C82F70E6E7F9CAFA9F7C8C69EC4C2648
SHA-256:	AEEC814144D4253D3167360EC6399F542D9123E4D5878808BAC279D6436B3C8D
SHA-512:	DADD8F6023F063F59C0F7703D706218F59F8D54EDFF3CB2CF8C71C67DF22CF6EE32C379DD65C2C69D3FFCF0D84C500737EA294C9CB1126656FB1D6E629F3058C
Malicious:	false
Preview:	....A..sdbf.xh....x.....8.p.8.`.@......x...VILEBODAf...02MOCUED~...OCHCNERF....OCOTOHPI....RT1002IP....IERUTCIP....VEZILAER....DACOBRUT......YAWNIW&...IUSSKROW>....x.....8.p.8.........F1R..'.r....c..........n...@............N...p{...4!....k.\o8a.&.........>.+......)...w/........=@i?........=@i?.........ED....q-...I.....qM...I.....q]...I:....q}...I.....g.tWc.L.......s3.`O4......~.'.Xl...Y0.50..YV.......3.i\.....7..AZd.f...K@}...F.....0i........?.3i....2...,.3.....j................\...6.l.....\...6.......Q. .d......8 ?..H...,....@N.........i%.B...P...>.......X6...........^^..^!......^^..^!.T....^^..^!.D....^^..^!.6.......L........x.....8.p.8...@...........p..-1..V...U.h.........u.......D.....8.........."a..N..D....H.`T.z........../'2...t=.'.o.+........M..0........9.W1j.......\|.GE....qO.2-:.H:...,....I.R....T.kI..SYF...;.Ek..Y......;..nw[d....8..O.f......'.fK.h4...c...I..q....J....z.y....n..g...\|......!Y\|p.......&Eo....r.......L........eS.....B...&.w........vI!$!E-.H.

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msimsg.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	847872
Entropy (8bit):	5.777004388495094
Encrypted:	false
SSDEEP:	24576:yFrNsyKWdbhmUXE9KIrufRO4t1YF6OWez17:KZhmUXE34t1YFp7
MD5:	0695F0F7008EB5F5B389ED0E57089BDF
SHA1:	16C1EFC321761DA9A082DA756ED9D1AADF9CA246
SHA-256:	FA4106578D9B3C425AB992B0877CBE1D60A05493CBF46FB21ECA89E5D468A0A8
SHA-512:	2F2AB3A4498ADED3E76A9DF0765E8390A9BB9F9D3E1500D1B8DD3679CA22E882C323492AC576DC185B9B6581FCBFFB1233A6E97CBB2BC33501A6C0C0E80725DE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........=.C.S.C.S.C.S.....B.S...n.B.S.RichC.S.................PE..L.....};...........!..............................q`...................................................................................x............................................................................................................rsrc...x...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msisip.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	6.201920535107619
Encrypted:	false
SSDEEP:	768:6Gxnz2TWfL8g3/2RVjoOPeHd4xKQ7m4d05hgl36:nxzdfLn3ug8eHd4R0fgl3
MD5:	91E27CBCEB6ADDCFDF0D1E7D1A3AD339
SHA1:	17D489C003355A34197C84BE37ED393BB9BFF2D3
SHA-256:	DEC5542F2A19FF58AF26B1E30A80D2628AC8FBA9D8569A867F1C8529EB209F8E
SHA-512:	58FC549A3953456F4149582288B35F98D72231FF06E34E633A3DFD77FCBBC5F9C2C8B864F02E32259B0D6AAEAE72F860CD3CD6739134424FB3447044F62E83F0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............c.,.c.,.c.,8@.,.c.,.@.,.c.,8@.,.c.,.c.,.c.,8@.,.c.,U@.,.c.,.@.,.c.,8@.,.c.,Rich.c.,........................PE..L.....};...........!.....z...&......(;............_`.................................c..................................8.......(................................... ...........................................0....................................text....y.......z.................. ..`.data................~..............@....rsrc...............................@..@.reloc..d...........................@..B..};......};%...........KERNEL32.dll.NTDLL.DLL..................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msls31.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	167936
Entropy (8bit):	5.9814955021734715
Encrypted:	false
SSDEEP:	3072:sIvjlvPmGwB5RezjIN+vqjo/pFNrk3br+uubhokMD81s2pAFfqCF1hW4HgB/i:sSjpjwOjIN+v30vsVW2pK7F1hW4Hg
MD5:	2CAB9989FB957EFD98DBBBCB9B1946AB
SHA1:	0D01E4AC66D852730D8031A2BCAE215210EA7385
SHA-256:	841FDE9B24476A7ED364A3E4A1470AC9B7358BC92F29FCA4A06AAB557D140850
SHA-512:	92FA2DACE9589789FE2A84E4F561D1DDA32858AEEB4CD13EF73D94D6619A27F68988D653367D0CEB91FBFF8C427D6FF28E8ED0FE00FBA91B006F9FA13F3F9943
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........#..cp..cp..cph.ip..cp8.ep..cph.gp..cpRich..cp........................PE..L......6...........#.....0...@............... .....H.................................=...............................A..Y............`.......................p.......J...............................................................................text....#.......0... .............. ..`.rdata.......@.......P..............@..@.data...@....P.......`..............@....rsrc........`.......p..............@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\mspatcha.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28746
Entropy (8bit):	6.545540060601869
Encrypted:	false
SSDEEP:	768:hLCnlsA4wVor2lcvDd2nafVz7aGXdP6YMKdI6C6udCv:h2voo2p2naf9aediYMftdw
MD5:	60D88C0829FE1E16C32F76D71724807B
SHA1:	40FB4D13A643B6F8A7A7CABC2A3F9E48B9E0CC50
SHA-256:	6007DA6BB72FE138DD4AE622C78C5337E3EAF9E8020B748B4A6918563EC988F6
SHA-512:	A8D35023AA60C601B581847E8FA3A1B5E52D5A6515DE6C6EAF7AAFA64CDD6A3BFE6E17281C6870F39343D8D45E2460A8730E8BAA26C24296087BF37ACF55E414
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................................Rich...........................PE..L....aJ9...........!.....d.........................X..............a..................`...............................p.......n..(...............................X...`...................................................T............................text....b.......d.................. ..`.rsrc................j..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\riched20.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	431133
Entropy (8bit):	6.6536949023972145
Encrypted:	false
SSDEEP:	12288:xWNTGm1c2qUkM9nv2VOXRc5uynesaycwrt/cIC:xW8m3qUv9EeROxXcoJC
MD5:	AE5ABEC31518E015A9FB4EB196854291
SHA1:	DEB63ECB2CBC60A688797478A204A2A57F49D1E6
SHA-256:	1C2508FB55DDC459D0327F2017471545C87420443391567094E768FB34032DA1
SHA-512:	DFE3E803AB7940FE4811627832CD048ED872111C3AE6B4DFE3493CB14E7932AFF9B5ACA7E5F387F5B38A44CAFBB350540A4B41955A3D28F36953B01FABCAA2F9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.Gu...u...u...u...{...,......._...t...u...$...Richu...........PE..L...0.V8...........!...............................H................................................................`...=................w.......................(..<.......................................X...l...............`....................text............................... ..`.data...............................@....rsrc....w.......x..................@..@.reloc...(.......*...j..............@..B4.D80...0[.8=...4.D8G...4.D8T.....+8_...........KERNEL32.DLL.NTDLL.DLL.ADVAPI32.DLL.USER32.DLL.GDI32.DLL........................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\sdbapiU.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	72192
Entropy (8bit):	6.449616021144991
Encrypted:	false
SSDEEP:	1536:R+XuzhVtdQKdeHAonHjKN7TtKIn+UT+eSIdzw2ah6lLd0O:R+XuzhVtdQKd9GOd/+eSm6h67F
MD5:	552F387180800CDEA023DC65E2F62416
SHA1:	E0E76E9D224157FA9D1B83A1533B049103EEEBBE
SHA-256:	55AA0917FD64607FEDC6AD71DEE75E333C23DC283342205880F8F66DEDA269E6
SHA-512:	144E4EB61E932BC33EBBA9DCCB5D3A450EA7E1B63C54B459F47CD1CC0A5178C545DE16FD5D3E3F1A3861BCE56C9FD7D4DB457DD4A1A744A06FD255C3E0DEA1F9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.5...[...[...[......[...Z.T.[..B...[..d...[.......[..G...[..f...[.Rich..[.........................PE..L....};...........!........."......^..............G.........................P......7...............................0...c.......P.... .......................0......P...........................................L.......P............................text............................... ..`.data...............................@....rsrc........ ......................@..@.reloc.......0......................@..B..};(.....};3.....};=.....};3...........msvcrt.dll.ntdll.dll.KERNEL32.dll...............................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\shfolder.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21021
Entropy (8bit):	4.8801661651868615
Encrypted:	false
SSDEEP:	384:L5yAJ3gXLVMYNcJhGCMcrXWpiWwH/sHHgH2nKwsHTWHi5AGsHW0HcHpLHP0oqQGI:0AJ3IMYNcJXMcyu/z
MD5:	B7993C10B9A8C3B9735D7696C7B9E8B6
SHA1:	AC2E765311380BFA502B3B7AED2E8D80C351E08B
SHA-256:	6F0443A62FD444C4254F902F668543B867A0577504915D22CD75328F73CD4472
SHA-512:	D17AE76467F5FAC056494A0FDEF445A5BBB1F633507DDEF9B2AFC12DD47EAA68096784D47E968383B207382850100EF1915378E74564E29CBE1C8E0D422DD679
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q{J...$...$...$...%.'.$.L97...$..."...$...$...$.Rich..$.................PE..L...q.^7...........!.........0...............0.....u.................................................................'..k....(..X....@...+...................p..P....,......................................`...4....................................text............................... ..`.data........0......."..............@....rsrc....+...@...,...$..............@..@.reloc..P....p.......P..............@..BM.^7....N.^7%...........KERNEL32.DLL.ADVAPI32.DLL.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\usp10.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	314906
Entropy (8bit):	6.170788306003831
Encrypted:	false
SSDEEP:	3072:10EvBHYN6cpZbdPYxDhjnYnMq182s8Vvh0VCPL2zHoytG5dHJZE5d8wfI:1LHYwcLdy9Ir6v8tS8ytG5dHL+pI
MD5:	4437B4E1EFC79C331070B9F481E3E97A
SHA1:	793B1D0839912679CB43E50B63C186205B8B7D44
SHA-256:	4D8FF1F53C3BABF9BFD11B2EBCD44E2698CFE3BC80C6F0CBC64C0D191EA1FC1B
SHA-512:	C82CEA06778426943958E47A8A3372731A3834C412F919E1E6C35B7FE41DD55E3E6D881CD489464A69FD65180A4B1632527C0B06E62700F5C66BF4867089A7CD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............................................Rich....................PE..L...0.C8...........!.........................@....ef.........................@....../^..............................@9.......1..d............................ ..p...`...........................................l.......`............................text...]-.......................... ..`.data........@...>...4..............@...Shared..P........0...r..............@..P.rsrc...............................@..P.reloc....... ......................@..B4.D80...0[.8=...4.D8G.....+8R...4.D8\...........KERNEL32.dll.NTDLL.DLL.USER32.dll.GDI32.dll.ADVAPI32.dll........................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\161F85F0\7204BF44\CRUTL15.DLL

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	290816
Entropy (8bit):	6.551645416298201
Encrypted:	false
SSDEEP:	6144:sP1hcYD9DDW+j8PPk/axspmqPugvLRyoVLNMIrZO:sPPZ9Dq+oPkwspm2+uO
MD5:	DFCEEBC9D6DBB3DB56B735C7020A35D1
SHA1:	189F681C860D15E997F3ED4502D747F25656BAC1
SHA-256:	09687C007B9D0C4047BC42C58C54E6DB62B9614306AC6DCBCD1B7532CF5ACF17
SHA-512:	15E73EFE925572ED9FDD11C316255880F7F131BEE084121B28B8507AB88E95FC22CDB9D606481CA499BD2BFDB61E871A2F026CEC56F5B747388237E3FB752351
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'"..cC.OcC.OcC.OcC.O.C.O.\.OkC.O.\.OeC.O.\.O.C.O._.OvC.OcC.OfC.O.c.O.C.O.E.ObC.O.c.ObC.O.c.ObC.ORichcC.O........PE..L...K.j9...........!................G0.....................................................................................`...x....@.......................P...8...................................................................................text...R........................... ..`.rdata..............................@..@.data...............................@....rsrc........@....... ..............@..@.reloc...?...P...@...0..............@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\184596D6\1517B7F7\CF_login_bus.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	4.387373720474639
Encrypted:	false
SSDEEP:	768:hMVuR2oP0u6XsofBidHI/X/K3amL0N8YEeRFJRLtt+5l+s:hM4vM9XSryD33t+is
MD5:	FA2FA874B44742422A3FF24C0B0FD197
SHA1:	7B6788715EC613A3C6BDE749FAB28CAB22C615A4
SHA-256:	269957304D54C9EAED58FC26DEEC3F0A3AB44A17D2291C1B3B252436A3A10080
SHA-512:	E3E29467903C41891023673FA7193F2ADCE59A79AB8A1C0819DEC7E71B8F4C3CC1357299B3762E376B76DAA6B53A5F34DFED69B7ADBEB37F10969BAF1EF123FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................N....................2......Rich...................PE..L.....)X...........!.....p...@......T................................................................................o.......j..(...........................................................................`... .......0............................text...Y`.......p.................. ..`.data...............................@....rsrc............ ..................@..@.reloc..6...........................@..Bl.[J............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\1A28DE63\34510A4\dao360.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	610304
Entropy (8bit):	6.2640254765203
Encrypted:	false
SSDEEP:	6144:WuvRsZJVIlB7FXdo6h4JOyXztOLVbC3ZtEVQ71L9UvsY42L/ZEmq79Hozkf:Wu5jn26hLLNCptjpS6ya
MD5:	FC877611E178FA17E23F99D9694590A0
SHA1:	5B9E15F716F4D32CA249E5A81D4739F20BBC276C
SHA-256:	A09132479BF9D6EC78448688986984C66973434FA0C92DC7406C0FBCBF522F33
SHA-512:	3D83907D60ACB074FA2DA454F4FA598E190F354804C4C7C8E2D5E54D03493BEFFCC31D8BBD8C2112B05A776D30B8DD7F92F0585704C3078040CA71EE0CE3968F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........%Ga.vGa.vGa.vGa.v5a.v`..vJa.v`..vBa.v`..vXa.v`..vha.v`..vFa.v`..vFa.v`..vFa.vRichGa.v................PE..L...In$I...........!................@.............{..........................`............@.....................................................................Tc..................................h...@............................................text............................... ..`.rdata..............................@..@.data....%....... ..................@....CRT................................@..@.rsrc...............................@..@.reloc..nd.......p..................@..Bo.[J@.....[JK.....[JX.../.[Jb...~.[Jm.....[Jz.....[J............msvcrt.dll.KERNEL32.dll.NTDLL.DLL.USER32.dll.ADVAPI32.dll.ole32.dll.OLEAUT32.dll........................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\1BF788A5\1517B7F7\CF_Name_bus.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	217088
Entropy (8bit):	5.770430998285837
Encrypted:	false
SSDEEP:	1536:1nV7hrLWSPhPXkkMuvcxIxqW6utdvM6M:DhXjJ0kpEysuz
MD5:	30BF99F06F5611B31C507271F9FF864D
SHA1:	1B3A0E066AA172E56C0D027152AF3030AB6F7F82
SHA-256:	AE7AD9EF03FC7BF37DAAFB0E36959C587533DF07808B7CC2B7970651F6B34394
SHA-512:	C2A0880802DF23B694D6A6219E5C0646C10339555930CF2A60E2B52E8DFA0AA2B7B835C2761B43D8D40256E44DBAA8DC53BA062229AC7E9D64B7C1E317E4BB9A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f..........&......%.....$....Z'....Rich...................PE..L....B.C...........!................t".......................................P.......n......................................d{..(........S......................`9..........................................`... .......\............................text...8r.......................... ..`.data...............................@....rsrc....S.......`..................@..@.reloc..N@.......P..................@..B.$.>............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\1D5631E8\1517B7F7\CF_Login.ocx

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	4.8812124598826285
Encrypted:	false
SSDEEP:	768:lU0gWrY5CAKGMsEcfUy5Nv0SNOHWRV0KqNukmdM2yxZyIJ56ZZnl:vMs8O2RV0i45m
MD5:	6A961C35752F5917B10E5A4390838F89
SHA1:	01F79863059372E76467100FFFDDB73A1E33C087
SHA-256:	A9D7EE5FBAD27EAAD0878F2C29A47EBE3D25E246E1758895E12179963146CF19
SHA-512:	FB6AB0EC85D0FD2DE6159F6CA1FE49B3B759D3142BFBCC78D236AD386307F6914D043825CDAD4E8E52EEBF0D578F5E8259F0EDCB90C50D4F1DFF2F3B9EDF8A1C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f..........&......%.....$....Z'....Rich...................PE..L....M.@...........!.........@......4...............................................#Z..........................................(...........................................................................`... .......p............................text....~.......................... ..`.data...H...........................@....rsrc............ ..................@..@.reloc..............................@..B'.};............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\1DF81C7A\34510A4\ImgXPrint61.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	132600
Entropy (8bit):	5.764106197379897
Encrypted:	false
SSDEEP:	1536:Vf/gAB2/w4M8BYaAVPwOC/1pT8D8gQ3hjjpCp788CuS2y29i8p5pX6SmFXn44:9o9//VBfOCtLfpCl2uLg8zpXp2nJ
MD5:	3484FD2B93B9720DE9E09E04630F6786
SHA1:	A538294DDA5314407434F421ED8DD9E22C4F052B
SHA-256:	C5491E88680F291F8BCE5F6CF3D0AAF05348AD6B041C1AEE390FA69C42071CE8
SHA-512:	8E98169B6C68ED0CECD094404D0D5909DC4AB2EA5F31C6A023048A2F29F28819BA32ABCE75C1DFE43E752E6C7979EB967DBF66A13CD3BD902159A51DA9222D05
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........AN. .. .. ..<... ...).. ...-.. .~.$.. .Rich. .................PE..L...+.zF...........!.....@..........L........P......................................=...............................@C......t;..(....`...k..........8.......................................................`... ....................................text....3.......@.................. ..`.data...\|....P.......P..............@....rsrc....k...`...p...`..............@..@.reloc..6........ ..................@..B..:@............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\1F62DE62\1517B7F7\CF_File_Import_bus.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	4.588173828979497
Encrypted:	false
SSDEEP:	768:hHmFNJBa5eAimsRsrf+y5cxSK8Vsdc6xUzKi:dmFnBa5sm5cxS3McKUOi
MD5:	C546CEC8F4C0EDE2F51EEDC7CE5DC564
SHA1:	A2C0D484E50ADB0B757CFD34CB12B678F4614986
SHA-256:	1B0B1848DC8EF5F60B812F405D4CDA43F67566155FB8F229A7B3E3EA1ECFBDBA
SHA-512:	62664E8A3A493A301E5D8DF250542EB8D5F23F8074814135D712AC9D8F7AA0BDE0A09505FD745C2F4EEB81EDB8159E57D15ED21B39A7541AE1F95CCD2A652930
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i~..i~..i~...b..h~..&\..k~..m]..h~...^..h~..Richi~..................PE..L....@.Q...........!.....p...@......(................................................o...............................v.......q..(...........................................................................`... .......(............................text..._g.......p.................. ..`.data...............................@....rsrc............ ..................@..@.reloc..............................@..B...E............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\205EBC50\34510A4\ImgXTwain61.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144888
Entropy (8bit):	5.640141676664818
Encrypted:	false
SSDEEP:	3072:9JshFryVlQMhtRu/O+NXGF1CRBgQYMWY7WnM:5lQMhPu2+wF1oaQYc
MD5:	E0458E23FA5B2852F1B88F487B0C916A
SHA1:	C71B9769E677434A473ADE1126D04E9CEFEBFBD8
SHA-256:	96D981A8269BFA3A183CD0963FEC841373C08A97C34E35A05123D50547DEB1A6
SHA-512:	8564BAD65232F7D2524417A5942C099C9A467AD86544EB6006D247B893F7AB9034A65C4059CD99C72466BE6E41AC5EAC0CBE96DCA77EE7919629D66D576BAC7A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q..Q..Q....P.....W..g..P.....P..RichQ..........................PE..L...+.zF...........!................H.............Bu......................... ......W8......................................$...(.... ..............8 ..............`.......................................h... .......T............................text...(........................... ..`.data...,...........................@....rsrc........ ....... ..............@..@.reloc........... ..................@..B..:@............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\2ADC2324\1835CB68\u25dts.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.5243719406147602
Encrypted:	false
SSDEEP:	96:R5XacropfVAbDWmqXUv+lzoY9W2+xiRfhDbRIQYcvEYmotqYC1hoa:NrCmbDBqXw+hbWM1aQDmYC1J
MD5:	6D669FC0192A4F685147B5C7BCF637CD
SHA1:	ED0FECDD48D49645C89CF23056F9310EEA0BB23C
SHA-256:	3F75A0AC5BECFB33C9CC0312B486D45BCD528992FD6EABA7FA7A1539FC7F4F49
SHA-512:	2E23EA333461FE9110E2FA6F83214BA9C83C002EB3CBFF53CB13A30E44619526D00A8ECD87089DEFCED83947D90726BE5687BC4A9B09C07CCC2333A8299C10DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........OD..........2$......+....~. ....~.!....F(,....~......Rich...................PE..L....Y.:...........!.........@......!........ .....@.........................`.......................................!......` ..(....@.......................P....................................................... .. ............................text............................... ..`.rdata....... ....... ..............@..@.data........0.......0..............@....rsrc........@.......@..............@..@.reloc.......P.......P..............@..B.$.>............MSVCRT.dll......................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\2D3E0D90\7204BF44\Crpe32.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5042233
Entropy (8bit):	6.348947882126544
Encrypted:	false
SSDEEP:	98304:WJdA7Kn4uYmR88wV1s8dxnve1RZ3BUE9nPdf9avG37EuY:WJy7OymLH8dhg3jPdWGLO
MD5:	2517D67C02B04B3D07FEF74501D6E303
SHA1:	8FE46EFC7F3810358F31AC45B87BB54F08C4FFFE
SHA-256:	A1B0116C01EFB841A263DF2A7BA261FB1B131169C0974E90383535F90C704C83
SHA-512:	3032B05A178BA384693A02AC221B394CA3FDA60D7A0EB2D4039A31C527721FF458A1E486CC0C32834E35A3A2D3F4EF0237368D7E5F084267327EB650239CD3E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.........."..q..q..q..q..q...q..q..q..q..q..q..q..q..q..qn..q..q..q..q..q..q...q..q...q..q..q..q...q..q...q..q...q..q...qb.q.q..q...q..qRich..q........................PE..L....t.?...........!......4.........#.2.......5...............................M......................................J<..j..l.<.......?......................I..^..`.5...............................................5.T.....<.@....................text...>.4.......4................. ..`.rdata..E.....5.......5.............@..@.data.........<.......<.............@..._CODE........>..0...@>.............@....rsrc........?......p>.............@..@.reloc..".....I...... I.............@..B................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\2E5B6414\1835CB68\u2fcr.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.6466214442096905
Encrypted:	false
SSDEEP:	192:soGk2GtWbZ97gEjWzhQEjIhNFeI59g2jQ66FupdS:soGk2LZ97qljIhNFeW9g2jQ66s
MD5:	B86749B441E49EBD58141871DA7F8DD7
SHA1:	83C1D25B2D2803CAB684ECB6F36F2FEAEB79EB4A
SHA-256:	492C644DBEBB7999EA02E2F2CB562C41D1BB10296BCC72900A59F2CA4D5090B4
SHA-512:	84DFF0CEA5E6239090AD3797F5062A1F54DA16FF2387998C415A01C175266F9127CC4A123ECBE98DADD4940E125DCD7A08FF9993DC4B671FF058BC251C6DA5FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.a./k../k../k...w...k..rI..+k..rI..-k../k...k..Mt..*k..pI..,k...m...k...K...k..Rich/k..........PE..L...B.\|:...........!..... ...@.......$.......0.....@.........................p.......)...............................3.......0..P....P.......................`..................................................D....0...............................text............ .................. ..`.rdata.......0.......0..............@..@.data........@.......@..............@....rsrc........P.......P..............@..@.reloc.......`.......`..............@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll......................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\2E81A74\34510A4\vbalColumnTreeView6.oca

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	54784
Entropy (8bit):	4.791159064203773
Encrypted:	false
SSDEEP:	768:7ZulXt12qM+Tgi3Y9iRJfeYIegQQmF6if4oQ:7ZulZTgio9e5eYIegQ1m
MD5:	C703D97D68033A2DD0B6EBE3CCD3C196
SHA1:	69E86AA066A0CA260D28149B151ACC4C318DF9B5
SHA-256:	8E61E4714BEEC40A5062023038B86B1258129EDDA39B73CDCA71916E0941CF56
SHA-512:	882B67E0B8F7A9F276D2430DE92E3C2811BC3D557FC07085F48D513B73B032EED02F0319B15A86BD8E83B3A99A70D24287860EF9CE848CC92F44684CBCA8948E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....B..................................... ....@..................................................................................0...............................................................................................................text............................... ..`.bss......... ...........................rsrc........0......................@..@.idata..............................@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\2EC6F5ED\34510A4\vbalColumnTreeView6.ocx

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	245760
Entropy (8bit):	5.1770781573052425
Encrypted:	false
SSDEEP:	3072:hzjb+IRc8dAzofC+Tuna7ac2SGumAN4nphB:hzjb+T5+B2Sqxh
MD5:	010CA532E3A09F1755500ACCCA93D966
SHA1:	641B201FE8871A5256607E2EFA4505FE3C43C468
SHA-256:	72FA78FC7B8E99726FF1B6B77E30A290750324FC50758A42DC50F48D8CB0CAE8
SHA-512:	5631B7DCEC43E32FF31F843B14B12A7F29E6530BD80240B87E5AB49180150B95CE57420028BC32BC3640A656AEA149846E41B7598AEF84889609CE4531B1606A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=...y.q.y.q.y.q..\|.x.q...u.x.q.Richy.q.........................PE..L...p.T@...........!................x.............GD................................................................p...........(....... .......................D2..........................................X... ....................................text... ........................... ..`.data...<...........................@....rsrc... ...........................@..@.reloc...2.......@..................@..B'.};............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\33BB160B\1835CB68\u2dapp.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.124598839033411
Encrypted:	false
SSDEEP:	192:LJ2lGLpG+9B8Rzg1auG+i3OeJrcTtWrgwx9r+jCNFeOp5m:LJ2l69Y4a6eJrUtWrgS9r+jCN3Y
MD5:	347E011F0164DB9CFAC6BB066BAADEC0
SHA1:	116E90AD2358FC31F0C9F86035895BFE9A55A8AE
SHA-256:	67263AF5AD1B9E0CD7A9088B8BA0CA2D05995E73F6E2ADBDDABD53E075BA9533
SHA-512:	707FA48E83BF497540A8D688975D8A885E005ABA321C179BDD95B123573786BBB29E4CB176D46291E945068D8EFE6047C393E6303F925ADC2F64F9CF551912B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1=..u\x.u\x.u\x..@t.w\x..@v.t\x.u\y.[\x..Ck.\|\x..\|s.w\x..\|r.p\x.Z~.t\x..\|\|.v\x.Richu\x.................PE..L....Y.:...........!..... ...@.......*.......0.....@.........................p.......<...............................4.......0..x....P.......................`..................................................l....0...............................text...0........ .................. ..`.rdata.......0.......0..............@..@.data...d....@.......@..............@....rsrc........P.......P..............@..@.reloc..,....`.......`..............@..B.$.>0....v1?=....$.>H....$.>U....$.>a...........KERNEL32.dll.USER32.dll.comdlg32.dll.SHELL32.dll.MSVCRT.dll.....................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\3B44007A\1835CB68\u252000.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.8691527276214883
Encrypted:	false
SSDEEP:	96:2IIUH5yvzjhJe5klNxxL3bU1ogumEoQTbbQBCxYmotqDNhoUN:2Ih5yc5klNxxL3boRumErQcDN
MD5:	9CECBCFF995CF75B752130D3137D39F1
SHA1:	6893B2B9F32E12E16F2F5C5D9CBEC3E603B4EEED
SHA-256:	3CCC9887261965B99EC0F2751D3D3096F2E31CBF281E7EA1A9902C814985DB9B
SHA-512:	DB464E70B3141248B3E63449F15D3CD9937F81207B6E32878AAF570FE7B027E1651061F808AA9670017A00B3694824061F06F03E3F446423A633C892AB08C638
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?...Q...Q...Q.j._...Q...P...Q...B...Q...Z...Q...[...Q...W...Q...U...Q.Rich..Q.................PE..L....Y.:...........!.........@............... .....@.........................`......................................."..6.... ..P....@.......................P..................................................D.... ..T............................text............................... ..`.rdata....... ....... ..............@..@.data...L....0.......0..............@....rsrc........@.......@..............@..@.reloc..b....P.......P..............@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll......................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\3D003E72\1835CB68\u2fxml.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	5.724903191036286
Encrypted:	false
SSDEEP:	3072:q54c1n/ypBau8j3dzRTGT2Idm2tbBu5Y6obbliT/mV:q54vaBtzRTf2Bgmb4TmV
MD5:	F122F3946E0C78A8782BA78153E0A4DB
SHA1:	2932A0217CF396C3EA1D0014E09D24BA7FD6DFD7
SHA-256:	33F3970E1C14EDC4962F8394CA7A30F619516EE6A89535DDDF31017EB084DB69
SHA-512:	15EC323EAA5B1D2863B4AC50A21BCB4647B08A776F7A3C981CCEFB4F0CB6E628A305C060721D0C5494BFDF557706D7415ADD88E5FF6C87B4F0E1F2C83F42B3F4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@ .w.A.$.A.$.A.$.^.$.A.$Yc.$.A.$.].$.A.$Yc.$xA.$f^.$.A.$.A.$wA.$[c.$.A.$[c.$.A.$.G.$.A.$.a.$.A.$Rich.A.$........................PE..L.....{:...........!..... ...`.......{.......0.......................................a...............................O......xF..d....@.......................`..................................................l....0...............................text............ .................. ..`.rdata..:$...0...0...0..............@..@.data...Q....`.......`..............@....rsrc........@... ... ..............@..@.reloc... ...`...0...@..............@..B.$.>0....$.>=....v1?G....$.>R....$.>\...........KERNEL32.dll.NTDLL.DLL.USER32.dll.GDI32.dll.comdlg32.dll................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\3E323407\1835CB68\u2fxls.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	221184
Entropy (8bit):	6.073107874518051
Encrypted:	false
SSDEEP:	3072:KegzPMHKTjDd/fW+uTASAnjAmqvgvks5eXIm2099RX9O+84IEo5lDNy:hAP0KbdXUAFgZsqImx9OGfo59
MD5:	E1DCB4C37FCCD79578F1B8E376D1B3F6
SHA1:	9351C62C6302F62049485E4C15BA909B8E902C08
SHA-256:	A3186DDE55B8F897C5D953F986B4F0A77797E9617609909C49DA6F3E285AE4B5
SHA-512:	F5D34E397B5075603384DA42A8617A46834C696720B8B71D3E1384EF6B368422E785127165F34F71A92413980DB510BDD72F24D89E7FAC7C65ED3CE251C36A7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P...1.R.1.R.1.R.-.R.1.R...R.1.RI-.R.1.R...R.1.R...R.1.R.1.R.1.R...R.1.R...R.1.R.7.R.1.R5..R.1.RRich.1.R........PE..L.....=...........!.........................................................`......................................`.......p........ .......................@.......................................................................................text...5........................... ..`.rdata..o........0..................@..@.data...............................@....rsrc........ ... ... ..............@..@.reloc.......@... ...@..............@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\416B4F42\1517B7F7\CF_org_history_bus.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.117727805431737
Encrypted:	false
SSDEEP:	768:ozUIYk6zTsTKPGfysb5s6fNFJRX6Esq10h:ozUft+asb+6flJA
MD5:	6357561041ACA8C2DDB47819F864D583
SHA1:	C487E183366C43C98623ED9BD6197C400CA6A231
SHA-256:	5882978A3CF04C47E7C1B81A55FDE27DEB45D6009F85BF318A97AA9D95D8686B
SHA-512:	DEDFB7C921473E3644D29F65BF1A7CE6EA9F2A6EE9B8C272645536278C24C79976EA8876FE3F1817C90DE18ED27BCF1999EA15E37507D11A41D7208C4425723F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i~..i~..i~...b..h~..&\..k~..m]..h~...^..h~..Richi~..................PE..L....flD...........!.........P......@................................................;.........................................(...........................................................................`... .......X............................text............................... ..`.data...P...........................@....rsrc............ ..................@..@.reloc........... ..................@..B.$.>............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\43981525\7204BF44\pg32conv.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	100352
Entropy (8bit):	6.01574608255945
Encrypted:	false
SSDEEP:	1536:W0/GIQTIfT9Q2qEB+Jk3gC7UfPnJQBJHl8UPif4xStOgkM:NGg98fC43nuBBGU+4
MD5:	59B610DF85409A13832B9B5B807DA4FE
SHA1:	FADFCE97D3D9F6935D5F6A4ACA53232D733AB4C6
SHA-256:	369C08452CE18AA2894442F63C524C4F8DB416F12D86E624099BE61DAD9F2F98
SHA-512:	117D144807C1BC38858859F8417CE69597FDF3B3FAF28D5567ECA58A84CBAC292C87EB54840E8DAC9A0F3CD66F755CE8CB31BC30D78B01A47B09FAA1C2C8B73C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Nb#P/.pP/.pP/.pP/.p./.p.).pQ/.p.3.pL/.pRichP/.p........................PE..L....V.7...........!.................$.......0.......................................[..............................p5..f....1..d...............................................................................X....0...............................text...P........................... ..`.rdata.......0......................@..@.data...xt...@...D...*..............@....rsrc................n..............@..@.reloc...............p..............@..BN_.P(.../.[J5.....[J@...4..NJ...........KERNEL32.dll.USER32.dll.GDI32.dll.MSVCRT.dll............................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\474E307D\1835CB68\u2lsamp1.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.965175828785223
Encrypted:	false
SSDEEP:	192:xGqtPxX4u8XuBxGkkUiRh8jJmmj2sucQgeh:xGqdSP4xPibOMm/Qgeh
MD5:	7BBBE3749D17CD539623C60F5E023992
SHA1:	E0769AEA1E7EC30DD33AC022E8C1D0F79983BE36
SHA-256:	D8F7E302FD89ACD8EE36FAA07214ED3B6039F91EC45F72FC954967C04FE906FF
SHA-512:	86AEC1D8FC59DD7B8F86815928196798FD6C0288B331B552298CDD157025B7BD3CD9ED84C0A07D4B3D5ED347AC0B2944931AEC9FA15D9ABA1DDFC8796619AE40
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...ir..ir..ir...n..hr..ir..Nr...m..lr...R..kr...R..nr...t..hr...R..jr..Richir..................PE..L....Y.:...........!.........@............... .....@.........................`.......!..............................."......h ..P....@..(....................P..................................................D.... ..h............................text...~........................... ..`.rdata....... ....... ..............@..@.data........0.......0..............@....rsrc...(....@.......@..............@..@.reloc.......P.......P..............@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll......................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\47C10F79\7204BF44\CRxmlx07r.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	3.5687827741608045
Encrypted:	false
SSDEEP:	1536:ZWJaaymHs15LBdFElh9aaaD+FdhaG9AFqg24CHgSz+Qar:ZWJaaymHs15LBdFElh9aaaD+PUG9AFqQ
MD5:	E8C7545574E4D9E9992CB5B9331271CC
SHA1:	CF271D3B4A88DA069E61D1269DC8EE412695C69D
SHA-256:	14A788E493779B3FD96C1F94D7154642E79F34594B978A6A7E39C97BEC5F7E5B
SHA-512:	F4A5E5D7F2D162260F150E4F3069F707E0D3C291E0766720E813F5A40D410A67AC18DC03ED5DC7B5DF579A8A3BFCA4F5EF667D16733B853D11104F0C7F165E90
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.hG]..A[.Rich.A[.................PE..L......:...........!.................................................................................................................................................................................................................................rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\487DDF\1835CB68\u2ddisk.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.744540447798788
Encrypted:	false
SSDEEP:	192:X/62KJlTcY9alIW9avJMdVxWH/Y9VP0QCKFYOpf:X/62EcY9JEavOdVxWHQ9VcQCOT
MD5:	7C94ECB0391127848A8F20AFA8FD63F6
SHA1:	53B7FC88913CAB7E4E030504E58DFDA87E395ED1
SHA-256:	BE4C2FE0AF5612C91EAE9AB4D67F5276C46963FACE2D5B734BE7E40B382B7332
SHA-512:	1AF94DE58B00BE9F49046A0EC5A326957B00550DF5E9F7359CF97FFAF219540C98EBEEA10EEF8CEE7388D4690C9B322624D48962F4628D4D65852D07AE9C1BDF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................@......<......................................<.......Rich...........PE..L...D.5<...........!..... ...@.......'.......0...............................p.......................................4.......0..x....P.......................`.......................................................0...............................text...`........ .................. ..`.rdata..X....0.......0..............@..@.data...T....@.......@..............@....rsrc........P.......P..............@..@.reloc.......`.......`..............@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\496179\1517B7F7\CF_rs_browse_bus.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.769486670952223
Encrypted:	false
SSDEEP:	384:6P8c5PrzxQK07hKTQhbXETATDluQXE8m:6Pz5PrzxQKYkUhb2AnluaE8
MD5:	6BA1EF4DB1C4430CEE386B60D38B7935
SHA1:	DF42C4E61714457EEDFEE488769B0983D3CD0865
SHA-256:	7E6234E69BF794F27A67B936911F4540A994673F5CB746F767F4CE0E4DB55A09
SHA-512:	A9AB00275E19299F3B44F1000F0AF3ACA009CD9D043D0236D3B05E15F66177DC56EBCABA45151D980D5B5A99F1A3542781A8BF809E90EB1399373315649CB7BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k!../@../@../@...\...@..`b...@...f...@...`...@..Rich/@..................PE..L......B...........!.....0...0...............@...............................p.......................................;.......8..(....P.......................`..............................................`... ....................................text...],.......0.................. ..`.data...\....@.......@..............@....rsrc........P.......P..............@..@.reloc.......`.......`..............@..B..:@............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\496C80D6\34510A4\MSCHRT20.OCX

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1009336
Entropy (8bit):	6.46634380726448
Encrypted:	false
SSDEEP:	24576:hlXNkkmkDgQPnYVGEDc9u3WiZZRUKTX44gDk:LXNBmkDgmnYVBDcoZ4a
MD5:	C80389E4872A0885CBB14FD3641166AB
SHA1:	B0B125C77E62FF50EE34896D4F11B3EB6E798D84
SHA-256:	A281C15CBDE263D4D0DA4A78FD29F861473B68464051E591E57DD693E2E68DD4
SHA-512:	9C4AF367AD39ED7D9E630367C0BDC163C61F0E1410645E0EF63198CE4AC5357EA28399C05B8489FD2E852AADA414BD883AFB2ABF859B79F2E6A802CE183E5A6A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...qy.8.....\|.....#.....B................... ....I(........................................................................@........ ..............Q..........X...@1...............................................................................text...p@.......B.................. ..`.rdata.. ....`.......H..............@..@.data...l....@......................@....idata..............................@....rsrc....... ......................@....reloc..X...........................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\4B371E22\34510A4\vbalFlBr6.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	4.057730216921513
Encrypted:	false
SSDEEP:	384:+Q80x006bw+FkZQ47Jx4j6uX6yzd54gEvtyFvb01ij2ZJQiz/AoN9s0KJb8:+QP6bw+GyOij6850Abj6/Qiz40KJ
MD5:	9FDB8A72D927888796A4E6A14560CC5F
SHA1:	ED49DCFE5FD16C658033373D816E61D8173368A3
SHA-256:	E692AB331FA5753D619B5FBE68BD5AC44C57AD13D046048414F75CFDE4065A19
SHA-512:	040358819A95AC368E1A67523B409E7E18C1D37444B03A14BF346F5C9183B8743D4F97011C0C5AE177B2BEC8AAACC687416B9A6ABBC2D692CC2307DD0B56C1C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=...y.q.y.q.y.q..\|.x.q...u.x.q.Richy.q.........................PE..L......=...........!.....P...P...............`.....4.................................................................U......tS..(....p...)..................................................................X... .......h............................text....E.......P.................. ..`.data........`......................@....rsrc....)...p...0...`..............@..@.reloc..............................@..B'.};............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\4D29780E\1835CB68\u2fsepv.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	4.1158608664095375
Encrypted:	false
SSDEEP:	384:o0a2aB9b6YzTIy2EdQicNtkjmxHSxb/SI9mviJ4zZ95ewFkK492/T:o0aBBMGMy2EdQicNpR2SiqzWQ/T
MD5:	1AF1B68553F1D5D59158727F6EB49DBB
SHA1:	7386BEAE5AC29E8240F7C1D651F1B0D09B535957
SHA-256:	006D43D8400DD964907D0797A9B9E29A8A8964C11BAD3E7A0E35DBE0DB0506D8
SHA-512:	336C996DDC17F8A7AB39486C6980C88F113B96A672D7243B2971850D3055DC767ED285457374D9B5CEBDAD3BFAA56F7D4774222C7B0CA5D2D63B079B9D354D80
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........cu......................................................!......H.......p"......Rich............................PE..L.....c>...........!.....P...@.......O.......`.......................................................................g.......b..d...............................d....................................................`...............................text....@.......P.................. ..`.rdata.......`.......`..............@..@.data........p.......p..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\4DD6AFDD\34510A4\ISHF_Ex.tlb

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	data
Category:	dropped
Size (bytes):	18728
Entropy (8bit):	4.5595763568254295
Encrypted:	false
SSDEEP:	384:lilrpyGufzrUBnv45HxA0wid3qiMmQ28C2:lilFylzrUBnA5Hw
MD5:	07934C956B971F10B7F73D55239AB976
SHA1:	50C8C3E4C01546B5A51D27BF780E1B3219C802CD
SHA-256:	4C63DD877BF263ED2AD5C2EFCF92FEECFAB1C7037583D3DD70C91A04BD30E506
SHA-512:	D439BE4AEBF674937B5512381D0BBBF1127D785B290DB4CD50DB3D667E9CEA6A1E4741610E3F7AA67C1927ED1F1B0CDC309602480461210B91B645D37F80E961
Malicious:	false
Preview:	MSFT................A........... ...................Q............... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...........................................................................D................... ...............................t...........X)..P............,..............h-..0............-..0...........................................................!!...-.............................................. ...............................................!...L...h...X.......................................0...............................................!.......4...,.......................................D............................................... !..................................................\...............................................!!.../..h...X.......................................p...............................................#!..\/..........................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\51868479\1517B7F7\CF_report_main_bus.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	409600
Entropy (8bit):	5.896273828906067
Encrypted:	false
SSDEEP:	6144:zUv6aVWzjnY5Cpbe1i3irndYi1PN2Ba1NQoy4ky:UVWzjnY5CpoprDsBa1Ntky
MD5:	E9214CA4A0BBDFC7CAAA8DF4E21DCA65
SHA1:	00CA85B3130278B4E9140DEF8E3F67BE445D8542
SHA-256:	264A1CC8D3C4852C9D2F09E22EAE30BF81C1D388F7CC7EF1CD46DA425BD642B1
SHA-512:	85EE59B8E54D8E1D884EE05F0ED77C4ABBA9AC476D5615FCD4E75AFDF0C93BA8F1C21FD1D0B68D075FE32B04A28283839078AABB0189921F9B7EEB6B76CFD41C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+..J...J...J...V...J...h...J...l...J..nj...J..Rich.J..........................PE..L...q..\...........!..... ...................0...............................@......?...............................@,.......$..(....@..8........................b..........................................h... ....................................text............ .................. ..`.data........0.......0..............@....rsrc...8....@.......@..............@..@.reloc...m.......p..................@..Bl.[J............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\526A560A\1835CB68\u2lcom.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.19516961379927
Encrypted:	false
SSDEEP:	1536:gw/iTp1rZP6UpbRfOdkWY+o9uLtOpaYlga+gi4+m6bnStQgc:A1lSUTf2YhatKJogi44nStU
MD5:	1EDC1124D987025B4539C6CCD86FE52C
SHA1:	76C6558A038714C0671BE517DC3FAA47A9804BCA
SHA-256:	54EC7365B4C8AF951C0447493D6D0A32CCBE9C1139CAE4D2252D44DC7B1B8E6F
SHA-512:	18EE07CBAA4A443AD8B61E89BA0E466C065B7BFBE5E14258F280E2C3DD266B0D9F78C0C5580C0F2E3EC3A502D9F7A4AE3A38543F0C8B8178E85EA3C9290CCA72
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............H...H...H`..H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H(..H...H...H$..H...H...H...HRich...H........PE..L...4.v=...........!................;................................................................................:..e....2.......P..@....................`.......................................................................................text............................... ..`.rdata.............................@..@.data...T....@.......@..............@....rsrc...@....P.......P..............@..@.reloc..x:...`...@...`..............@..B........................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\5A4D542C\7204BF44\CRUTL15R.DLL

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.807152052248964
Encrypted:	false
SSDEEP:	96:5qsN56E9EADBVzBDaZBcG6fyXmuY+eQ5TMbKGbMH7x6sTFw+YprWUUsmn+sWiNBg:5qP1ADhAZXmuY+LubKRc6smh7
MD5:	859751A660914A75FB9062E47B7111B5
SHA1:	741752CECE787A377987A3C329238E87B1AEBBAE
SHA-256:	7DDDB9C0D38C2BC47EA44B0B5F73A1A6411BC0069AFD4B42AECD79C92D1666FE
SHA-512:	8D8D3278111BCEA19781A3523F863B378BDA40D8AB580775CE6664F080777E5F83C4F0EAA42A98363A0842F6DE9FD47CEDB1AE5DD42AC5D04BB046A6213A4F94
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.hG]..A[.Rich.A[.................PE..L...E.j9...........!.........@...............................................P..........................................................X!...................@.......................................................................................rsrc...X!.......0..................@..@.reloc.......@.......@..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\600299E5\34510A4\OLEGUIDS.TLB

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	data
Category:	dropped
Size (bytes):	8096
Entropy (8bit):	4.112479782177178
Encrypted:	false
SSDEEP:	96:xZg7aPZBVJYko6ayMa4iBJAaiuPh+tefhFyr9YkheQWg8YilYb97PTwU26QLll2:xJGb6rx3JAAjZFyYIIg8tmR7r06QLll2
MD5:	21699843C3F8594D68263645ECE51DD3
SHA1:	5F6A4AE01CBC09A70C5A47F003E39A3B3C23544D
SHA-256:	4CAB84B86D92EA0807F436459E6F6B8F8834AC1013EB1004C3C88A5F57BF8B96
SHA-512:	72DF305F6D1D8D0FFBA24244485F2EA39EC76D3DEE7AA812A4FFB0DC0F2FE55E17E04D01A14270182B7F107524863D38342E68CAC1518ECCC1DE8861326DA0F2
Malicious:	false
Preview:	MSFT................A...........................c................... ...................d.......,...........X....... ...........L...........x.......@.......................<...........................................,................... ...........$...............$...`...............$...........................................................................................................!!..0...............................................................................................!!......h...X.......................................(...............................................!!......h...X.......................................<...............................................!!..<...............................................P...............................................&!..................................................`...............................................&!..................................................x...............................................!!......

C:\ProgramData\miaE495.tmp\data\OFFLINE\63200452\1835CB68\u2dpost.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.440036346891534
Encrypted:	false
SSDEEP:	1536:1rKnUevheUuLzGUT842VxV40Zi8ooiWC:QtZ6LzLgxhooiW
MD5:	D6AC6D930525ED743418E29802510BBB
SHA1:	F4AD2AE3E144F6BD1E103DF5E40654EEAC29A728
SHA-256:	06228AC38A5052A9430195B1D00546B05E23D0EBE4E93F6E0364D14282369DC4
SHA-512:	DE41F832F2EB4BDA0C158FEFAD0C0DB9170736A0DF916773286564FADC7E32F1713024CCD4EE8DEF3658F4612AF933DF1A8B6FA312B4B92B5F79E9670C864B05
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Xz.z...)...)...)...)...)...)...)A9.)u..)A9.)...)...)...)~..)...)...)...)...)...)C9.)...)...)...).;.)...)Rich...)........................PE..L...B.\|:...........!.................~.............@...............................................................`.......x...d....`..........................................................................l....................................text...z........................... ..`.rdata..8........ ..................@..@.data....N.......@..................@....rsrc........`... ...P..............@..@.reloc........... ...p..............@..B.$.>0....$.>=....$.>J....v1?T....$.>_...........COMCTL32.dll.KERNEL32.dll.NTDLL.DLL.USER32.dll.GDI32.dll........................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\679B857\34510A4\COMDLG32.OCX

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	152848
Entropy (8bit):	5.88912905338292
Encrypted:	false
SSDEEP:	3072:VCslb9HnH/GrQ/qCFyn7dWXSQeRDBIY/OR5JrNo2CocrJbNN6N2TRqEydc:VCsB9Hu9nweRD4JZoDxtRHj
MD5:	AB412429F1E5FB9708A8CDEA07479099
SHA1:	EB49323BE4384A0E7E36053F186B305636E82887
SHA-256:	E32D8BBE8E6985726742B496520FA47827F3B428648FA1BC34ECFFDD9BDAC240
SHA-512:	F3348DBC3B05D14482250D7C399C00533598973F8E9168B4082EE5CBB81089DFAEFCFDA5A6A3C9F05B4445D655051B7A5170C57EE32D7A783DC35A75FEE41AA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....:@...........#......................... ....z!.........................0......(I...............................q...............@...............:...............................................................................................text...L........ .................. ..`.data........0.......0..............@....rsrc........@.......@..............@....reloc........... ..................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\68965F3A\1835CB68\u2fhtml.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.954164176068831
Encrypted:	false
SSDEEP:	384:qi9tF0bg81ZrH7b34Fu2NFuYNFD5Gl8m369SLQJ9yuFpzDt:qiXKbgWrHH3KuIuYzol8m34yuTzD
MD5:	F61DC6C03816ED80201D25FBBB30FED1
SHA1:	3AA785941B1FF7A880228248F94148718FC47146
SHA-256:	5CDC8ADB1C10223A4C3AF25BB192E2FD47F8E83539714661AD4A6FCABB47F163
SHA-512:	E802DD73A1CA937004B3A47E00FF75B744BB2B00A962559684FA01AFBDFC40C3ED4755BC8B5ACA1C57B9A5075B0FB39B1FBB3DD875D5A4F2CB6A88B4CB4BFDEB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y........................W.....B.............Rich..................PE..L..../;...........!.....P...P.......O.......`......................................................................ph.......a.......................................................................................`..8............................text....@.......P.................. ..`.rdata..-....`.......`..............@..@.data........p.......p..............@....rsrc............ ..................@..@.reloc..<...........................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\6C6652B9\1517B7F7\CF_report_bus.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1032192
Entropy (8bit):	6.101428802921911
Encrypted:	false
SSDEEP:	6144:CtAHN82uQEooHGt5iJATXUyMTlyfkFvV7MRIdKfjidfGdpb4W:ssuQtHt8JAiFvV4RO9G7
MD5:	958010BB6090C998DBD84279C5A115EE
SHA1:	53295D5498C7BB60B285F86D327264E526CB8034
SHA-256:	D1936FB2D6D9F13DE68A423870931D1467BD6DC6115D55579DF84E6F9CC90FB8
SHA-512:	42A44A32F60A58CB45B8B05299A9EB2C0C945A248B59641ADA7396BB4C8C64D2D04130066CECEB51A23E2AD2A55971FC07766EAF9D281F5F87E438BE2E5E54B0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B............6.......................J.......Rich....................PE..L......\...........!.................Y..........................................................................................(.... ..`Z.......................#..........................................`... ....................................text............................... ..`.data...............................@....rsrc...`Z... ...`..................@..@.reloc..~@.......P...p..............@..Bl.[J............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\6D4D0E7\34510A4\ImgX61.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1213936
Entropy (8bit):	6.347694185622386
Encrypted:	false
SSDEEP:	24576:CjKrC6GOC5tmhsG3Ikjhd+guqUvM+EoOoSSWKWm3ld0Wd8P/b+M7nchgQNpo/4oe:y6GOC5tmhsG3Ikjhd+gu9EoOpm3kWdII
MD5:	ADCF2B08D824BFEE8E022403DA1B6351
SHA1:	7E675B66DAC9DE781AABFD7A5F24FF00832363B3
SHA-256:	89D6303A7725CE4A39417ECA498EEEAEDC286747004002853C6D49D4589B506F
SHA-512:	DE3E0A28D920FB5206DD86AFE0ABD02F835F04F73828CBE73B6D1B613B5ED565FE479CE3898CF56612E8457AE1F4ECC651B028000E0FE4F239C4BFFB0A15F430
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~.;...h...h...hY..h...h.=.h...h.9.h...h%?.h...hRich...h................PE..L...&.zF...........!.................\............R................................................................. .......t...(.... ..............0p......................................................`... ....................................text............................... ..`.data... 1..........................@....rsrc........ ......................@..@.reloc..............................@..B..:@............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\6DEA5FF3\7204BF44\CRXML15.DLL

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	167936
Entropy (8bit):	6.187995719559416
Encrypted:	false
SSDEEP:	3072:RiT9Mjz9fxT8ms8xHZaKV6AORqrkcNnVn6u7OtP:RvfxFHZdYOk4nVnf
MD5:	56A8FDC2477954D863C92D08675FFE57
SHA1:	00E91FC7856C20F05E7203CE3BA72F2F0F78BEB2
SHA-256:	B39FE18BFA62BA1A2F1D680B3505100448F3CB3ABE49B6D55B3DFFDF430E25BE
SHA-512:	233379A84A523A890E593C7550344CCA982E18A5F5A91B42209304279CD0F0798AEC67D9BC897769A537C2DB617E9A2210EB5A5E1A0E6C388AC0A70CE8A40FD6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................%....Y..........Y.....a....Y.....Rich...........................PE..L...E.=9...........!.............................n(.................................................................................`.......................p..X....................................................................................text...r........................... ..`.rdata..sf.......p..................@..@.data....+...0...0...0..............@....rsrc........`.......`..............@..@.reloc.......p... ...p..............@..B................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\701CB7F7\34510A4\mscomctl.ocx

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1077344
Entropy (8bit):	6.342928728513251
Encrypted:	false
SSDEEP:	24576:dnt4M/pL1wAEIqSBanK6CC33VTj+1R8xRFLqqmbD1kWIAqKU:dPL15EIqS1e6q3FmKbtL
MD5:	774A15583DB1AD44C5EE32309C840C96
SHA1:	B3F80B06AD6283FC021DE1682772C22DD6F2436B
SHA-256:	E1058530566AAEDF7D529A394F18E8540D8F6106F57381D2DD431AFF99951F8C
SHA-512:	01070B6DCB28E4AC8E1D2C3B44F882E85249D6F00DF58229ED938592CB7355613BD88F649664AC9E5EE2F8328F578BCA0C4A14B1F1904D372AAFD1F7464CBA86
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r..<.....@.....#.........j.......9.......p....X'.........................P....... ...............................E...............P...Z...........V..`............................................................................................text...H........................... ..`.data....s..........................@....rsrc....\...P...`...P..............@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\7A300D31\1835CB68\crxf_pdf.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	6.270731532321854
Encrypted:	false
SSDEEP:	6144:shwrCzCaYgTe2I3J1un3m6fdjR4vAkGh+:shwmPrI3u3pd9kAM
MD5:	A14947F6BA9E75C5E5C2263157E886CE
SHA1:	0E39F13BEC51D6CB2F1CFF3F35660B0A2E3C4F40
SHA-256:	E43F008E7E57BACDD29E02570C4728B720BA2D11D9D269FCFCA54C875715ABF8
SHA-512:	B7CA2D08D9D5C9D1374CF541BFFF5AC87C2D5C82857AEF1B84BA6307A5157B192AABA62BE399B2B25AAE5176D39E198625A1CBB109B494AEDDC33B4783C73401
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:Km.[%>.[%>.[%>yD/>.[%>yD.>.[%>.G)>.[%>.y.>.[%>.G+>.[%>.y/>.[%>.y/>.[%>.D6>.[%>.D6>.[%>.[$>![%>.y.>.[%>V]#>.[%>n{!>.[%>Rich.[%>........PE..L.....{:...........!......... .......=.......................................0.......................................x.......m..x.......x........................,..............................................\|....................................text...b........................... ..`.rdata...j.......p..................@..@.data....[.......P..................@....rsrc...x...........................@..@.reloc...=.......@..................@..B(.m=8......>E......=O....#.?Z...".m=d...'.m=q...........KERNEL32.dll.NTDLL.DLL.USER32.dll.ole32.dll.OLEAUT32.dll.GDI32.dll......................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\7CC1D691\34510A4\TABCTL32.OCX

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	209608
Entropy (8bit):	6.343103011256511
Encrypted:	false
SSDEEP:	3072:kBOrV7gwFcKneF9s2x+eDYIRXDc6VNeFjzBB9g3A/Vt8DbtUfREm/UmL/8zc8N9R:k0rVdCVrsEncIRXDdVNeFBIk2DgR4d
MD5:	908938D3BA2D870EE9FC6238A4C6AF95
SHA1:	E8648D6D69FD5CF900C4BF98B210F6921BED3EF5
SHA-256:	40CADBFB2EB5732F025D687664F34239DB7153A192BCA0287F9208852B201FB6
SHA-512:	F9433F48330F7DDC64EDB8A64229C1490FA31978E9F4FFDC5FA5FF8B18430317A39A07A559D560051BA195B730429ACFB18EDB38BF712507B00AC788FFCA0B74
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......:....f......#..... ..........X........0..../!.........................0.......i...............................................p...............................................................................................................text...f........ .................. ..`.data....7...0...8...&..............@....rsrc.......p.......^..............@....reloc........... ..................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\7CC4B206\7204BF44\QECR.LIC

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	data
Category:	dropped
Size (bytes):	796
Entropy (8bit):	2.1709395683364
Encrypted:	false
SSDEEP:	3:2Ao1ihaQDeFS4qs//l8AqjXF1WX0jpuqje2up1Y1p7vuV//14En:251peeFuE8Aqju0jFjenw7WVX1j
MD5:	892C3A800773081A9110542550B11EA4
SHA1:	A9D593E2FA8A59D4F4425DD7679B3D600B47D3F9
SHA-256:	03EEA05D4F15377229E49E38887D2B2BE57E80988FF9741F15F4A6C1EF377562
SHA-512:	68C3021FC86328473A45A56AAE1FF0207956C72392036DB6B4CD67803C701C61B686F925C527DFDAE1A1F98806C10C4A107949113E0306720B699844C97D6999
Malicious:	false
Preview:	........(.....Z`.O.K.$...?..-.{P./.;.T.x............`...................................DataDirect ODBC Driver Pack.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\7DB1D6B0\7204BF44\CRBAS15R.DLL

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	2.8457754129966433
Encrypted:	false
SSDEEP:	384:7GiZrKbKxGbk5MOqerr5iKVHHgEKZ2ajjH:tWbKxGbk5MOqirbngbj7
MD5:	2D9A1115B872258CFCD657E32A2955B8
SHA1:	23021F48D1F741BF04F79DB49202A0A3243F3D05
SHA-256:	5D137E1FE18A51D7A7AA6B5F67BA55E00ADB44155F771F81F56A22418FA8EB6F
SHA-512:	F08CEFE2F8D208CBD554B673300536C69C0F08B016B236293CAED0E62C7393CBABC4F8D377EC5BB05D902DAA96B3370648CF188C0B5A0989AFBEFCDFE0B3F205
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.hG]..A[.Rich.A[.................PE..L...M.t9...........!.........p...........................................................................................................]...................p.......................................................................................rsrc....].......`..................@..@.reloc.......p.......p..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\80B1517D\1835CB68\u2dvim.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.985155994169938
Encrypted:	false
SSDEEP:	768:r/LUjp/k9cBvKyKjvyalzmxzaoxz8VeqiX9WHFN1T8Oqm/TKFIJsa:8jp/kWBC0aR8nmLKFIf
MD5:	C57A3BFF1408C33DE5DA5BB1C62ECC5B
SHA1:	1A4DE7F1677689E71C2AC78080AE62687808FAB5
SHA-256:	83EFCAC4F78331E6F8F25ABBEBBC11667E11F46627AB188EC7E00BEB51B9DAC9
SHA-512:	D2E7B4FDF32E45B032823B7A515BB348DB63A1CD63A3EC7D286521FCCDD39870BABD4E82038FE8937CBC8C30F2FF6D2BFBD05F9CE34CFF2A153654B77AFED08E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^~..?...?...?...#...?..H#...?..4....?...?...?... ...?..4....?...9...?..4....?..Rich.?..........PE..L....Y.:...........!.........P.....................@.................................5..............................p...........P...............................................................................D....................................text...3........................... ..`.rdata..............................@..@.data...............................@....rsrc............ ..................@..@.reloc..............................@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll......................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\832FC268\1517B7F7\LogFile.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.485382050322971
Encrypted:	false
SSDEEP:	192:i9NOy89Skl9gzr3HUZTNzEOsrt/V8Rhfv67fSryIAuAhqLaPXGOS:i9NOGFH3HYTNzjsrt/V8vOSryShLaP/
MD5:	BB46C0B126E28AED97D3DDFC96BE0902
SHA1:	BAAA2A2CE2BA8563E4F6298A9EE2BF5D38D1AB2F
SHA-256:	BB2469FC8087D0CF223E2344525A8FC536CF2CCEBC213F43F765FFAFEE44729E
SHA-512:	747C578E3D44ACDF079693A8887EB898A6A213DD190AE98FECC348EAA371772F4BC98BE4C195F0C5A68BDB38EEB3D9F57B81189E46E284551B10F7F7664EA643
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k!../@../@../@...\...@..`b...@...f...@...`...@..Rich/@..................PE..L......B...........!.....0...0......l........@...............................p......&h..............................P8.......3..(....P..4....................`..............................................`... ....................................text....(.......0.................. ..`.data...H....@.......@..............@....rsrc...4....P.......P..............@..@.reloc.......`.......`..............@..B..:@............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\83C5D67\7204BF44\crtslv.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49223
Entropy (8bit):	4.109718425650408
Encrypted:	false
SSDEEP:	768:+ccYopyfE7saYHK54TbAG9sAiw6SlglrtA:ZcYop1gaYO4oG9sAu/rA
MD5:	9B7EB9FB8DF4F52965CBC4808EA5062D
SHA1:	5D516D6F766A1911C7F1AFCC9B71A2A90F426B02
SHA-256:	30BA60E53FACB1F6AB703108688CE281DFEBEAE01A203DE0D800EC6DE5089538
SHA-512:	C69D998736D2F6CCF515D35436EE0CCC32403F0A6A0E22F28CCCBAF837D65D027E5470DC5805A02ED599DFDC32B113CB394EACBBDBD4B5879EC2C30805D55304
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......uFq.1'..1'..1'...;..4'..0...3'..g8..9'..1'..)'..S8..4'..n...4'...!..0'......0'..Rich1'..................PE..L..._.{:...........!.....@...p.......1.......P......................................"...............................PV.......S..d....p...3......................0....P..........................................h....P...............................text...E1.......@.................. ..`.rdata.......P.......P..............@..@.data...l....`.......`..............@....rsrc....3...p...@...p..............@..@.reloc..............................@..BN_.P0......N=...V\|)LG....sXNQ...z.[J^...........KERNEL32.dll.NTDLL.DLL.ole32.dll.OLEAUT32.dll.ATL.DLL...........................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\83ED17B7\1517B7F7\CF_report_history_bus.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	4.898095142151349
Encrypted:	false
SSDEEP:	384:J+vR8H66UYH0zwqXI7sf1PipgoMpUIp5DVFnJZJbBi2wq2e/8B5DXbON3WyIaW5i:gCa+UzwqXw9GZ9Bi2ldClmJhWc2tIGS
MD5:	3160134FFCEE79CA0F64F305858F468B
SHA1:	ADD3DF032A94EDA0872F06003844480145906B4B
SHA-256:	F7CE6181546DFC6F72B012EB16ADDBFEEF2E1966455F4165E17287D87BCEB415
SHA-512:	DAD017DB58DED87008409094655B0B476FF8F3C639EEFA082D3513687FFA36B9214F46B4AB26B0DB9444A6B785A44786CDFEA4C5D09C86C4CB3BCFAF582D5851
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i~..i~..i~...b..h~..&\..k~..m]..h~...^..h~..Richi~..................PE..L.....aC...........!.........@......................................................9Y..............................P...........(...............................<...........................................`... .......X............................text....\|.......................... ..`.data...............................@....rsrc............ ..................@..@.reloc.. ...........................@..B.$.>............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\880D11DF\1835CB68\P2smon.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	192512
Entropy (8bit):	5.9642286021294835
Encrypted:	false
SSDEEP:	3072:068MaRFejZOvjqOTN9cWLBuQVNysFsfEz1vUgfK/vsIzx4yEo9:3cpAW9uQVUpMJvKMaxB
MD5:	D24020E137BD588D955ACEF0A8E389CF
SHA1:	7836AAA05532145E85C770EFA6B06398E5DDEF7B
SHA-256:	815F428668D75B9328ACA5199A601F1DADB949D50D29E510E73E260B76323852
SHA-512:	EC91F81F66B365D7C4C291D066F64D74A964D3535AFBC72A29C0B6F0DB1B7B260565F26A3CFFB5D4E48C63342B637A65B127019F58982C43593DC81FFD569852
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......'$.cE..cE..cE...Y..dE...Y..aE...Z..gE..=g..`E...Z..gE...Z..gE..Z..aE..e..bE..cE..`E..5Z..pE...Z..nE..cE...E..ef..@E..C..bE..e..bE..RichcE..........................PE..L....A>=...........!.................................................................................................@.......,.......p.. C...........................................................................................................text...%........................... ..`.rdata...J.......P..................@..@.data........P... ...P..............@....rsrc... C...p...P...p..............@..@.reloc...$.......0..................@..B................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\8BAE8D59\7204BF44\p2sodbc.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	307200
Entropy (8bit):	6.022609410600443
Encrypted:	false
SSDEEP:	6144:FpQDKIhkfJxWbuqzTZSDS03HSWAuV0W+td9x/LJL:FpQDKIhkfJxWiMTZSDS03yWAuV0BrH/R
MD5:	8394AF480C146EC7F7A554EA1FB8E9C4
SHA1:	C44B3BD7D524A0F37D1171F4066C7BD0AA7E3CF9
SHA-256:	73EE0E2B4822A03136B18AB32C951CFC5E7C68A40B046B82E68B1B156582FC18
SHA-512:	7E7BB50BFDDF3B69813F4A87DCBFC76A6A3DCCCD6CC9F459DCD56A222EF82C980B5B5A900293CE8A6DBDB1C68483443726D4834886AFB067A1A009B875D03E1C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........oa8...k...k...k...k...kP..k...k...k...k...k...k...k...k...k...k...k...k...k...k.-.k...k...k...k,..k...kRich...k........................PE..L....Q.>...........!.......................................................................................................p........ ...S......................4....................................................................................text...;........................... ..`.rdata........... ..................@..@.data....+.......0..................@....rsrc....S... ...`... ..............@..@.reloc..X .......0..................@..B................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\90E4D581\1517B7F7\CF_ref_report_bus.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	4.713712240941136
Encrypted:	false
SSDEEP:	384:4tkKyqTOaORsY855to5sNS0yGm3WyzKIN19xqgefE5sg+OjWgDpu:8kKkWt2sLyDJ+EnWg1
MD5:	BAF2D0717D304BE1C5A265FC01D92FF6
SHA1:	E02B63B69C92478B03D7F105F4A494F012E4F66A
SHA-256:	7E67EC445AA7B8C2915339514DC025C432C6253FDA8FC5463F5F704F5999E846
SHA-512:	CF51856162C34DCF373FAABDE89168EC63B9DC86F883867EDCDEE8D6BEAB09673BF4995D52E6A6C42EBDA820C6332D962E0ED3540EC747CED7398B2AD2BA3E76
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................N....................2......Rich...................PE..L......C...........!.........@......L.......................................................................................~..(...........................................................................`... ....................................text...Ns.......................... ..`.data...,...........................@....rsrc............ ..................@..@.reloc..............................@..B..:@............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\92CEEA92\34510A4\DAO350.DLL

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	570128
Entropy (8bit):	6.368068172894281
Encrypted:	false
SSDEEP:	6144:lO4zReIcAtVXrPsS3Syvqe4v2QeD8yCaDSCwBwAlvz6Bm2hf9QdHHtMMeOh4J7Wu:lO4zRe7AvBiyvqe4pe7wHlv1tO7VYFk
MD5:	8888BDBD4E118D915D40A11748282BCA
SHA1:	4E8822D2242D175CC3D708843E2CD71B7EE7033D
SHA-256:	A4B20735BE317A924D2E36707BAAF911FBAE890CA53C5044FB506F15D33BCB6D
SHA-512:	A96F5E72905571DE84F515DD8A19C87D5143EAD532BF01F0132DA8262974BFAF910F24B466D49CD4EE83845FC65F02C273A550786854AEC3E0F4FA713929B562
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....+5...........#.....(..........t.............G.................................Z........}...................... /.......0.......`..T........................P...0...............................................................................text....'.......(.................. ..`.data........@......................@....rsrc...T....`... ...@..............@..@.reloc...P.......R...`..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\9F0CE7B6\7204BF44\CRxmlx07.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	942080
Entropy (8bit):	6.65646975675861
Encrypted:	false
SSDEEP:	12288:c30LOWsXFbwAlSc96WPwYW0WxgERNUzD71h1PTMNy:vLOWsXiAlS86WPhOvNUANy
MD5:	4FCCBA7B1CDF3BC6EA31F1B0627AE8EC
SHA1:	770725AF1E58CA070AD3456D8572B3E04A70B7EA
SHA-256:	D97B3B00646FED52DF6855EFBA4269B63F1263EF32B3E477E1E2236A7F126F4E
SHA-512:	0786A923077CC4BA30E79C052590D571F54DF3E3B01BC6F9781B7E0ACF0E3F5D2549641C1CA11ABDCA064D88728F33B7E63C07DFE0D09D19AE339ECB6F86F6E3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^x4...Z...Z...Z.a.V...Z.G;Q...Z..T...Z.G;P..Z.L.I.c.Z.D;Q...Z...[...Z.x.I...Z...Z...Z..9Q..Z.E;Q.0.Z...\...Z..9^...Z.Rich..Z.........PE..L......:...........!................g................................................................(..............p...>........................................v...................................................................................text............................... ..`.rdata..............................@..@.data....>..........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\A157FA05\1835CB68\crxf_rtf.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180275
Entropy (8bit):	6.1633040175705185
Encrypted:	false
SSDEEP:	3072:nl3w8fl441BooG039ZYWI7ge5JC3t11WX3V0v4zSuoMZmbesm:nlrfZfAQ5efC911y3V0qZ2y
MD5:	A636F5E7FF78759D5F3C677A2875FA2D
SHA1:	DDCE4DC55DF00A4B6B92FBADDA6CF444B4D82F35
SHA-256:	7C33447829876F22FA5D5FD5EF2E67AE06B48BB2BA32840CF44F940F2F547DF7
SHA-512:	8C7A23B9B01075C0355E8889DE007D962E24E84EBA13B896FA8251EF2750D620CDCE74AD423003BFED70C39F7144803089B17C4D949DC9F71714BACC02668E15
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........lx..+..+..+...+...+...+...+p..+..+...+...+...+...+..+...+...+...+4..+..+...+..+Rich..+........................PE..L...M..;...........!.................B....... ...................................................................... ].......Q..x...................................0"............................................... ..0............................text............................... ..`.rdata...?... ...@... ..............@..@.data...08...`...0...`..............@....rsrc...............................@..@.reloc..l........ ..................@..B................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\A297C06E\1517B7F7\CF_audit_review_bus.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	4.965285395888949
Encrypted:	false
SSDEEP:	768:52il+An9+x/+RsLeXyQwyUi+75TQjwwMevLC8jRWExNNHRxb4PzI4aaD:52il+OamB5wPQ8ErpNVfOaa
MD5:	5E2CF9895D2D94D593139ADB77F68714
SHA1:	753FCCA7D9E6ABA17DAF198B4F3EFD096509DEA3
SHA-256:	3D80746EB136679B2139AF22A29C4917FEFFE08B986F55C2F224D61001C1F924
SHA-512:	AC2959EBDF0881A724912A77FBEB02D3B61888AAD96814B3B9A1FF4595DC081EBEEAC186A119D46B318D0141461B16F2B60D15E21F3181ED1E5ED242CBA06DEA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........AN. .. .. ..<... ...).. ...-.. .~.$.. .Rich. .................PE..L...S.:^...........!.........p......0........................................`..................................................(.......`0...................@..............................................`... .......D............................text...@........................... ..`.data...............................@....rsrc...`0.......@..................@..@.reloc..\....@... ...@..............@..Bl.[J............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\A52CA551\7204BF44\CRXML15S.DLL

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	4.673313433135478
Encrypted:	false
SSDEEP:	384:xEXQnim4w2xSKOJtcLFZdMQzf3M7TnSYkN9A/hqycPGSpzuE8d+chaz:xEcim4uUFgQzf4nSH9A/hqycesuac4z
MD5:	1783A2BC9AB938AD923D2040B4ABB243
SHA1:	CA6EABACF16E56723429F65CC5D592699015783A
SHA-256:	0D4B4BAE969E25267C54B367AC9760A718869ACB793CC1380D3A37767BC8E63C
SHA-512:	1A3790C55A7015F4D867C76CB6F4E2D483818A9534E5F4EAD73E44E19B876672EE4A9AEA9A4960E37F729B3C428C40755023FDA7D197064793002B2FFD5AFC20
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K..................5.....X6.....$............$.......,.....$......Rich...........................PE..L...].=9...........!.....0...`......j6.......@.......................................................................N...... C..................................@....................................................@...............................text....,.......0.................. ..`.rdata..d....@... ...@..............@..@.data........`... ...`..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\A8299B92\7204BF44\CRXML15R.DLL

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.452431739694398
Encrypted:	false
SSDEEP:	96:50f6X9EKZaMwah+RtQl9X8N5MMJigpFnUqmspl65z+muijdwMDRaaPp/MQaf:50CaKHwah1wF3TWd/Rama
MD5:	3243A8F5DB572EAE76FE2348B2E106C0
SHA1:	9DCEE517723C6B2206C83C065B4C0B889B69E0DD
SHA-256:	B7714239D578D588B1AECC55E89DC6327716F43A4CB68627ABFE30AB344AF460
SHA-512:	98F5F5BCACB3B86EA05E493883D62744E20351334A71D7E3066D177797BD132A51B647C60A485E05041E3A1F6003E0D093D267AEFD0AA5DD3008C44676426E05
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.hG]..A[.Rich.A[.................PE..L...G.=9...........!.........@...............................................P...........................................................+...................@.......................................................................................rsrc....+.......0..................@..@.reloc.......@.......@..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\A95AB0B4\34510A4\ImgX61.ocx

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	431600
Entropy (8bit):	6.217541423817009
Encrypted:	false
SSDEEP:	12288:pCPlz9HRXcktcvyk694AVvc8POXqgaLkS8xitZIM5y4w:pCtzao48c8mXqga4SoMkF
MD5:	C7082A0F831F2EE00AB907FC7B9EB040
SHA1:	3A145FDE8D84162E8C86999BCEDA0A2207D80BE4
SHA-256:	C33468445FD4CB01B701AFBC41ACF3422484B734A4490B8CC21E2ACEDAE35DC0
SHA-512:	AFEA29D84C9174539D32FE796F24ABAA134174366FFCB859F3B38BBEBF1780AA0BD0F882C97C8C769D11242E00945DDBFC9613FF1FCEA70D0DBA8B51FA61C6F9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#.}.#.}.#.}...s.".}.l.t.7.}...p.".}...y.".}.Rich#.}.........PE..L...).zF...........!................4............. V................................zR..............................P.......T...(....P..............0........P...F..........................................X... ....................................text............................... ..`.data....5..........................@....rsrc........P....... ..............@..@.reloc...S...P...`... ..............@..B..:@............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\A9695CDF\1517B7F7\CF_Rmt_DB4_Update.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	5.059200142599135
Encrypted:	false
SSDEEP:	1536:9lU/HEzdtrCTdqWlLZAGFrlDMkPXBiwBMeOYey6yJPkk84I8zEP5sM:vU/Hy25XttJlBXh84bwPiM
MD5:	FBB1A200C62241DBA86AA9A9EDB448D8
SHA1:	E6F5B758221D23F608780BF1203D684CB39DB8CA
SHA-256:	D7670874382FF3D458CC7B766127CE497B87D59C420DB5C4FD65D48693F6BB27
SHA-512:	6740B3EEB2D0A4903926F0614BD930DE67DBE3DDE757C17F514EA6C7A1337DB82497035B843FA1AF55C13656B4D88A719FE95FF52D709D5EC4C53E811C0C4553
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i~..i~..i~...b..h~..&\..k~..m]..h~...^..h~..Richi~..................PE..L.... .H...........!.........@......\........................................P......o...............................@...........(.... .......................0..............................................`... .......,............................text............................... ..`.data...............................@....rsrc........ ....... ..............@..@.reloc.......0... ...0..............@..B.$.>............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\AB3A15F4\34510A4\TABCTL32.OCX

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	209608
Entropy (8bit):	6.343103011256511
Encrypted:	false
SSDEEP:	3072:kBOrV7gwFcKneF9s2x+eDYIRXDc6VNeFjzBB9g3A/Vt8DbtUfREm/UmL/8zc8N9R:k0rVdCVrsEncIRXDdVNeFBIk2DgR4d
MD5:	908938D3BA2D870EE9FC6238A4C6AF95
SHA1:	E8648D6D69FD5CF900C4BF98B210F6921BED3EF5
SHA-256:	40CADBFB2EB5732F025D687664F34239DB7153A192BCA0287F9208852B201FB6
SHA-512:	F9433F48330F7DDC64EDB8A64229C1490FA31978E9F4FFDC5FA5FF8B18430317A39A07A559D560051BA195B730429ACFB18EDB38BF712507B00AC788FFCA0B74
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......:....f......#..... ..........X........0..../!.........................0.......i...............................................p...............................................................................................................text...f........ .................. ..`.data....7...0...8...&..............@....rsrc.......p.......^..............@....reloc........... ..................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B2966187\1517B7F7\CF_File_Data.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	368640
Entropy (8bit):	5.586081247688742
Encrypted:	false
SSDEEP:	3072:9NZEJpxaZlLOYMAp03rQycjxgM+FcMei/j:9jeraZlFxuK+FX
MD5:	3C1A0BD4BE7917D6AF874FEAE055E28D
SHA1:	EEF06485875C7FE0505FE54EE1346AF610421CF8
SHA-256:	AACF51731D19CCC4B2A01489C0210E5D9BD6EF8886D802BB83FB49DDA5F2C7F5
SHA-512:	6B7131F6223E055F2AA9A3618FC4BC2F4893C5E0C9708CBD0C6E5925D490A921FBC8E7BC48D8E6459738D163771CBB4D140385D590E111A6B97BF99B7DC59B31
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......fa`."..."...".......#...m"..5....&..#.... ..#...Rich"...........PE..L...QE._...........!.................B..............................................................................`...........(....0..$....................0..8d..........................................X... .......t............................text............................... ..`.data...............................@....rsrc...$....0....... ..............@..@.reloc...y...0....... ..............@..Bl.[J............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B3FFCC7F\1835CB68\u2dmapi.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	4.318216925570331
Encrypted:	false
SSDEEP:	384:6W2HDi9HjAqwwbEdrakQnfsm4taun3RICVM6Db9S6echEFROQk9D7:6WIDiJwuEN/3auBIKMcIHRED
MD5:	E09FEC233CCD2C6E9D390787D2F87DDA
SHA1:	264F65809115879521DAAD866792C92D9D3C6539
SHA-256:	709EFD24B655E782C423D2A73A7B6DB687ADA69FEDC8DED6A0C6081A416E8742
SHA-512:	E9388F6645A586BCCEE14C5DCABEC47F7B64505C6998C9100A19E32B8ED98BD058458859E2CD6D063CD61E90CD4D812FC47F42BEC54502DEAA31ED13F2F6A4B7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........a.....................h.......................................,...............Rich....................PE..L...7<.<...........!.....P...@......-S.......`......................................................................Pe......Ha..P...............................(....................................................`...............................text....C.......P.................. ..`.rdata.......`.......`..............@..@.data........p.......p..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\2003_Disclosure.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 62, Total Editing Time: 02:41:01, Last Saved Time/Date: Thu Jul 29 14:33:26 2004, Create Time/Date: Mon Mar 22 15:03:08 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	2074624
Entropy (8bit):	5.277108105692261
Encrypted:	false
SSDEEP:	3072:tAcGm88F/D6zksqVGpStaTbIfkI15eJWFNHXaPEOrZGERaot3n5fGeZlVE/hP5Zj:t5YksqVyStMwkTsFda/geZ3E/hP5Z
MD5:	3BF8C3B91E578461B194D6620D227F23
SHA1:	254D4D58E68F01DE591E9207898B0774499E98DC
SHA-256:	D38D74FBB7818D5E01251D91E290BDF2B8C0F2835F45E18039A4426FB536F20B
SHA-512:	8FF5177AC387B55FBD39712C3578FEA41F8447479B49C56FE6F66FDB31E12385D328867C3441C9A7DA2D100E38D14EB615D70D439F7DF3E38D5233381E8737C3
Malicious:	false
Preview:	......................>................... ...3.......................................{...L...4...N.......................(...........~...r...t...........Z...............}.......c...b.........../...y.........................................................................................................................................................................................................................................................................................................................O.l.e.............................................................................................................0.............O.l.e.P.r.e.s.0.0.0...................................................................................................d.......S.u.b.d.o.c.u.m.e.n.t. .5.5............................................."........................... ...pu.. ...pu..............C.o.n.t.e.n.t.s.........................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\2003_Electioneering_Report.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Thu Sep 2 16:11:52 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Wed Sep 29 20:57:07 2004, Security: 0
Category:	dropped
Size (bytes):	435712
Entropy (8bit):	5.210313030830372
Encrypted:	false
SSDEEP:	1536:DhRq0fBeerIhQVQ+3I+9gc9R6P7KUJSXCMxqAG1V4vS+Zq8veRNXncMEUR21HF:7ser/9WTPTJSXCMxqjevS+ZTveB21
MD5:	9953C4F01E97E2EAF6D408A9637954AA
SHA1:	C0CA83C8458AA1A569586CF343E7AC6ABDA51F32
SHA-256:	D64D4097CC36841AE5E105119E7BD9AF6E099E203C2B6625B5170CCB3AA9EE10
SHA-512:	43A445C46110992A37B40A9B3D73C89443024FEE6374C7B0AB8B3D047CF5888F0DC25C6FC6A11E8139AA5838907D7005BD11D2A58405679F3D14AF8022BFBA1D
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................\CFRS Common\CF_Common\cf_reports\2003 Forms\cro-2320.ttx..........cro-2320.ttx.......................SQL.....Pdsmon.dll....%Active Data (Field Definitions Only)....HC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\2003 Forms\cro-2340.ttx..........cro-2340.ttx.......................SQL.....Pdsmon.dll....%Active Data (Field Definitions Only)....HC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\2003 Forms\cro-2330.ttx..........cro-2330.ttx.......................SQL.....Pdsmon.dll....%Act

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\2003_FED_Disclosure.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 16 15:54:41 2003, Create Time/Date: Tue Mar 18 18:48:47 2003, Last Saved Time/Date: Wed Sep 29 17:56:45 2004, Security: 0
Category:	dropped
Size (bytes):	474624
Entropy (8bit):	5.097844904674963
Encrypted:	false
SSDEEP:	3072:mWnYtI5uI5ZzxgLD9yQl2FzHc6AsnkrRcycDCTCQd4iNbN:mG5uaml28/
MD5:	B27917F1EDBCF0193DD90615BEC558A9
SHA1:	6FD7536E2D2EDBA9F19AF0C38CEEEE77FA5FD524
SHA-256:	37162A3D98BBB39027C9E77394BE2928E22E50967213B9FCAA1B371E60B1B298
SHA-512:	293BB3097A5BEC7C6A757811C1B4F76247C93E39E3BEA5285F80EA31EC8267725B1BC811F2DCC5386B6A191D8C32B8303F18D3165418D740D17414272539ED04
Malicious:	false
Preview:	......................>...........................................................<...6.......}.......~......................................................................................................................................................................................................................................................................................................................................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................:...`.......S.u.b.d.o.c.u.m.e.n.t. .4.6.............................................g...0.......................p..,.1.....,.1..............C.o.n.t.e.n.t.s.....................................................................................................?...........D.a.t.a.b.a.s.e. .(.T.L.V.).............................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\2003_FED_Org_Statement.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 53, Total Editing Time: 02:01:06, Last Saved Time/Date: Wed Apr 14 12:43:38 2004, Create Time/Date: Mon Mar 22 15:03:08 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	200192
Entropy (8bit):	5.169152554231805
Encrypted:	false
SSDEEP:	768:gY1gd28LOecPd/HWE03kAoEl1FVledXN/bYNsnDnNH33wvuatdTuBaBn3Dn5E0fp:n1gd28LOecPVSkAPNyTx3wvuRBaNDVV
MD5:	A64029646B20A91508A70A4BD30D777A
SHA1:	53C5AAE52951DD3E493EF04295B345CD0A4A3828
SHA-256:	39BC863CDECC987002C7BDDBEE15FB0226C4640B795E11B6FDC12EF90F3AB48A
SHA-512:	A5F3EA125987F11157CFC76DA99A5D816C665CCDFE6D9FA141D5AF5D926F85504B8EECCE417570D413DEDDE8EA4CF2C3E4F2FDCC585A0F04FF343E83C1FB4347
Malicious:	false
Preview:	......................>.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...........................................................................................................S.u.b.d.o.c.u.m.e.n.t. .3.0..........................................................................?O.."...?O.."..............C.o.n.t.e.n.t.s.........................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\2003_Judicial_Qualify_Report.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:51:41 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Wed Apr 29 22:15:36 2009, Security: 0
Category:	dropped
Size (bytes):	160256
Entropy (8bit):	5.0388804598932895
Encrypted:	false
SSDEEP:	1536:P1eto9rC6gvneLbeMXHwKY0/Fb57GgYINSfUSfBg:Y6mMXHwKY0/KgSH
MD5:	4695DF6904EADF85F3BB5A039159BB20
SHA1:	BDB639C12D0ED8A8C0393169D51859282D5FA7EC
SHA-256:	0688E65C8A9DAFC70CBACEB99A5B9C97C15E8545149BD907D48F6CB4472EF896
SHA-512:	02C191C002D5D212ED30893EA8E561A1C07FE1E86B49D6A1F40E7960B95B28EA241EB7F953D00681B76AC5798532CDCFD1FAFDC3B46DF416C8D118C5A4D4C6A2
Malicious:	false
Preview:	......................>...................................z.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.............................................................................................................:.............O.l.e.P.r.e.s.0.0.0...............................................................................................A...Fe......S.u.b.d.o.c.u.m.e.n.t. .3.8......................................................................... .F......IH.................C.o.n.t.e.n.t.s.........................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\2003_NC_Disclosure.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Mar 5 20:19:07 2004, Create Time/Date: Tue Mar 18 18:33:40 2003, Last Saved Time/Date: Mon Nov 19 15:30:01 2007, Security: 0
Category:	dropped
Size (bytes):	2127872
Entropy (8bit):	5.298889348940432
Encrypted:	false
SSDEEP:	6144:nEd7toe+rgeeNPGd7crgEpc8mwE/hP5r8:nEdHiA9c2E/hP5
MD5:	74FDFC53C374A476FFDFABA9958F8D42
SHA1:	BFE8448D89E848DD7A14EEB8CC10DB0082B04198
SHA-256:	71D0000B9B8E8DF9F9E34B81F7BBDD0529C0B8D99BAB2DC83170628C34C33DF3
SHA-512:	1DE68F6ED46CF91F47110697F97058B7793794455EFCB73F57501FA683EBD004AA2285326E43D5264E12594973BDC49E8CBEE6A580B170D7E0F34EE312054412
Malicious:	false
Preview:	......................>...................!...................................d...m...o...........%...............L...............s.......D.......C...................W...............z...m...J.......t...u.....................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.1...........................................................................................................S.u.b.d.o.c.u.m.e.n.t. .2.7.6................................... ....................................>........................C.o.n.t.e.n.t.s.........................................................................................................x.......D.a.t.a.b.a.s.e. .(.T.L.V.).............................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\2003_NC_Informational.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: State, Name of Creating Application: Microsoft Excel, Last Printed: Thu Jun 15 19:07:57 2006, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Mon Jun 19 13:10:06 2006, Security: 0
Category:	dropped
Size (bytes):	2065408
Entropy (8bit):	5.312823323440365
Encrypted:	false
SSDEEP:	6144:8Ed1Xb0+PgeDeGGHERLAEgipEXZacZzl9zjBABgppv/5/vR6WOyx:8EdFEwMi9cZzl9z
MD5:	756B7BA54EC030397464A91A2CA8A8F0
SHA1:	46DBA88F3E7B08D7CC26F2A771E4C0D233140153
SHA-256:	6D27506B998E52767972E9BE275509AE1287640C3CABA0D850E21BE9D4E62844
SHA-512:	F35B723ED73D6BE222F402C6839E4E042949AAC33ED959CD82782672FF9AAE4695DC45F7D63317184267A07D085B2FE5001D528B70ADE57DAB68BFDA96BBCD1E
Malicious:	false
Preview:	......................>................... ...f...............................d...m...o...........%...............L...............s.......D.......C...................W...............m...J...h.......~.........................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.1...........................................................................................................S.u.b.d.o.c.u.m.e.n.t. .2.7.6................................... ...................................0".......................C.o.n.t.e.n.t.s.........................................................................................................x.......D.a.t.a.b.a.s.e. .(.T.L.V.).............................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\2003_NC_Org_Statement.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 52, Total Editing Time: 02:10:55, Last Saved Time/Date: Thu Apr 15 16:01:09 2004, Create Time/Date: Mon Mar 22 15:03:08 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	901120
Entropy (8bit):	5.196993760121088
Encrypted:	false
SSDEEP:	3072:C8q9+TeL0hZGnIillNma52eiBisyZm9aahAN:r6Jc
MD5:	B64E6E0CF32FC4A7CCB5C8D3BB92381D
SHA1:	427DBECB4E18B11CDC6EE54B4FCEA1231535DFDA
SHA-256:	5019F534DC87B51EDFB8DFF231118328587CCD3572C595E452E57AA7B84E74F3
SHA-512:	B87857D15D620FE3AE41B0B8761B67FD85ED48D65EB4D081FBC12A94C6ED2303972341B2B4C076C898FBB4063342E8A49DEA5357F0DE559FA6E59423B83B40A0
Malicious:	false
Preview:	......................>.......................*...............................................................3...........$...,.................................................................................................................................................................................................................................................................................................................................................................................................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...................................................................................................2.......S.u.b.d.o.c.u.m.e.n.t. .4.2............................................................................\|.".....\|."..............C.o.n.t.e.n.t.s.........................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1000.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 76, Total Editing Time: 06:03:59, Last Saved Time/Date: Mon Jul 28 15:25:51 2008, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	187399
Entropy (8bit):	4.9388946711249355
Encrypted:	false
SSDEEP:	768:hP25wAQghxgQwBRaKgQwAQBRhxBRRAgwAQCF1lS8Fgwfv/mTnFGZE/hP5Si6N+2/:huOjFuE/hP5Si6x62
MD5:	D09CD0BF633CD0605976F14AE87B35B9
SHA1:	6FDE766F4DB41383C067AB5179CE47D83413F5B2
SHA-256:	D63BEBE3FC83950403F69AFCEFAB59612F44B3D5817C419F3383D95A079BC025
SHA-512:	297F15C9315AB2159C8630C14DA3E9C25B1A0B200B51A64EF3EB2A82FEA4619D61A7024A07C166C17B6DE8440247193247F436CD1C8383C95B8F3C4D4E46583F
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m.......................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1010.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 53, Total Editing Time: 04:08:04, Last Saved Time/Date: Fri Dec 17 19:08:06 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	4.833909151781048
Encrypted:	false
SSDEEP:	384:G9NvsBioHfL2O1hhCncEnYeKnDslIADOrlBHYH3sVIc:JL2+hwnDnYeKn
MD5:	010437FD9249DE33A524028CB861559E
SHA1:	343EEE5E9C4F8CCDD3BA0962BE55238D58F3F448
SHA-256:	07E783E5242BFED746924B7678AADABC12C52E463EC0161778BDA98882073612
SHA-512:	DFD2E2E68ED5C8624EAC69EB559F45FE5F08A902745E400CF7AB1ACF3B8800B919CA74851783DD94CCE313027D5F9BFA69CFD9B88F4773151C24F5F0BB2C40DB
Malicious:	false
Preview:	......................>.......................E...........A...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .9..........................................................................F....`!F.k.....I.k.................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................*......E.m.b.e.d.d.i.n.g. .1.1........................................................................F......M.

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1100.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Mar 5 20:19:07 2004, Create Time/Date: Tue Mar 18 18:33:40 2003, Last Saved Time/Date: Mon Nov 19 15:30:01 2007, Security: 0
Category:	dropped
Size (bytes):	161356
Entropy (8bit):	5.177382724517874
Encrypted:	false
SSDEEP:	768:ep2c9joPH0MdlojY7vmW1EtujSD9DvcRwS+Ln9:9c9amGmWAujI9DvceS49
MD5:	38AE604FEB6ECCB8EF90ED989E95B55C
SHA1:	1B48DFDB4F3572758EF88460B29D03879620AC5D
SHA-256:	61E0E173791B801B023AF5987484487A59CF5FE19C0642BEC8BFBE49677451F9
SHA-512:	3C41155FDF0A2963C87F1272899C6E3A8C525E2C6982BB080624C8374970B02AD4BD36BFBC570975147BD3E73C3304D71960D48767C7172F45847B9011F28D40
Malicious:	false
Preview:	......................>.......................................................]........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1205.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 65, Total Editing Time: 14:30:00, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Wed Dec 22 20:39:36 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	65024
Entropy (8bit):	5.10343096382262
Encrypted:	false
SSDEEP:	384:wIyubiGxnps2q3/FanLN4oCYoBUXmfZn11DP5MN5GY3WqN1xYNifO8fda9C44CVD:wunpTq3/FaZFXmfZnj
MD5:	097E6B26FE7DD4437D8A343EF52EC517
SHA1:	BF9B400E4D56BD9D4D6E58CF07F5647428BDB03D
SHA-256:	79ACD4650E807D66454E0B6B935D3A7E7EFCB728C1DDF33DBA6F65CFA074BA58
SHA-512:	E6D13C7D55F6C803E530F6BC358ECC4282F32C06F5F75F45FFEE7E05CD1A29CA24E4E1799CBEF86A8325DD46FA6FB88451A4C487B6B642DCD80D710C695B4E8A
Malicious:	false
Preview:	......................>.......................;...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .2.0........................................................................F....@..Yf...@..Yf.................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...............................................................................................p...p.......E.m.b.e.d.d.i.n.g. .2.3........................................................................F.......Y

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1210.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 125, Total Editing Time: 1d+06:37:40, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Apr 2 15:23:54 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	108725
Entropy (8bit):	5.347342388943793
Encrypted:	false
SSDEEP:	768:Etuya2n71onFjEkEOnUD8hS2ktBmm8F/pm+g:Et5oLC8F/p1g
MD5:	24625381A4A79D98BB9D42D6B7F9A5FE
SHA1:	5D71A3C809D7DBE54A1D7D124C56471B419F1A7F
SHA-256:	391152A4E0F66892A48EF07066A845E346C749ED479501402C907BA3E4639677
SHA-512:	9263939EAB0EBD221D17F45A76AA0CF00F4A38E6204E25990B4C1226D06035D7856F3F6239BBCC86F81B9C4DDA1A46BD741FE9976AE50780B69BF078B38075BF
Malicious:	false
Preview:	......................>.......................E...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.8........................................................................F.....7..2u.. ...2u................O.l.e.............................................................................................................C.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .2.0........................................................................F......!.

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1220.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 60, Total Editing Time: 1d+02:34:48, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Apr 2 15:44:49 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	89600
Entropy (8bit):	5.324389651089383
Encrypted:	false
SSDEEP:	384:AUfKDNLa1NuYqe26TngjniVd9znZUAQ1FYRzJ8+m63q6dUyAyxjR4avUuVxV79eV:pR2OngjniVd9znfTRDU
MD5:	D4AF83ED906C7B634BB7988F5FC77D9E
SHA1:	2C473D306D0071F75D891A2F108677E4563D8609
SHA-256:	96D3F4B240FCAEEB80222FB2107C4D1274FA3E87E46CBE11F5465657B143C28A
SHA-512:	FA3B57EC70D34C33BAA41891FC2C8B4A34113027C9B1BE743F14E3EA823E6AAA9E296CEE1A3B1FE8E210DFB2A3A02BF2AAA777EE79642729D7E0813268F05074
Malicious:	false
Preview:	......................>.......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.9........................................................................F......)w5u...-.w5u................O.l.e.............................................................................................................=.............O.l.e.P.r.e.s.0.0.0...................................................................................................8.......E.m.b.e.d.d.i.n.g. .2.1........................................................................F......:w

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1230.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 56, Total Editing Time: 11:09:29, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Apr 2 15:46:24 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	112773
Entropy (8bit):	5.250973108086118
Encrypted:	false
SSDEEP:	768:EX82dynZ8nzdp1UQhrV6x0KvnPC5F3RnO:T4LLOPQF3RnO
MD5:	C776CCEA447F74098919D2CD84E21F27
SHA1:	39A2C1D292006A4EFF7572393DBF5534D835C95A
SHA-256:	EA699B7EA87FC4A1F48ABEDA29707D3991950ADD632B54E5CD82D6ED6E19E5A4
SHA-512:	E7A0001ABDABD65F597C77688A14291AC67FB993BFFEFAB98B35548832DA0823435D4C694CE26E2DDF8D91AA2A39EAE8A52A938463F70BA7074C6F879A7AD982
Malicious:	false
Preview:	......................>.......................O...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .2.2........................................................................F.... v}.5u..`...5u................O.l.e.............................................................................................................@.............O.l.e.P.r.e.s.0.0.0...................................................................................................8.......E.m.b.e.d.d.i.n.g. .2.4........................................................................F.....K..

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1240.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 65, Total Editing Time: 1d+15:03:26, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:13:15 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	108914
Entropy (8bit):	5.248018963968515
Encrypted:	false
SSDEEP:	768:U48gnilnzJ1HdBEXHHXiQtsCnm5KYiuqqmrRQ:UekzJb4sEEziuqVVQ
MD5:	12CB40DE811F5393136639186EFD472E
SHA1:	22AA2F1FFAEEA90D910E93EDA4DC1B042769DFD5
SHA-256:	EBD8E59E2EBBC54B139F101EDFDD4972A7466AE8836D956F78BE53258F960A93
SHA-512:	3DB9E9380DEAECE075B4F82D81E881B385191BC48517600AAB48428669CDF9F13E6D108EC26FF0B1B914E368E0A6B4E8F9D967132556C9A2A781D73844D711F3
Malicious:	false
Preview:	......................>.......................Q...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .2.5........................................................................F......r..u...<~..u................O.l.e.............................................................................................................:.............O.l.e.P.r.e.s.0.0.0...................................................................................................&.......E.m.b.e.d.d.i.n.g. .2.7........................................................................F........

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1250.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 69, Total Editing Time: 1d+06:12:29, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:18:06 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	5.336808297146148
Encrypted:	false
SSDEEP:	384:nZ3AqRFh9vx5LsU1WtnPMn3kB/lH8gUPVncL3heqR3TzGaQnQ1nXLuM3X3s3tkRh:5vx5LsUEtnPMnUB/lRUPVn7MHcM
MD5:	A38D6C5A69B882D02ECF73C0E5AFAAE1
SHA1:	0B8C51858A55123050184ACAA72D031C82B34968
SHA-256:	84EB99CD7F7F121443C559759B9E79DB0095F6001B304E343BEFB14876BE21E2
SHA-512:	2DFF4584EED803BDCF89F8B4764180B354E6A0A56A016303678643D1BBD6FD797006CD05044C03E880FC7B7489029ED3AD7EFF7179B0ED3AF2C07F078F9AE94B
Malicious:	false
Preview:	......................>.......................G...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .2.9........................................................................F........u..p....u................O.l.e.............................................................................................................:.............O.l.e.P.r.e.s.0.0.0...................................................................................................b'......E.m.b.e.d.d.i.n.g. .3.1........................................................................F........

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1260.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 77, Total Editing Time: 13:19:08, Last Printed: Fri Nov 19 19:45:23 2004, Last Saved Time/Date: Fri Jan 21 14:19:25 2005, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	87552
Entropy (8bit):	5.292860622249849
Encrypted:	false
SSDEEP:	384:0IVAgpIDVV3pdY7J84+ZEHnUzmLmCnFJBPncQ5olvPmKgTQVbDpdTC0xIBpIlxyi:UBHpS64+ZEHn0CnVPncxcA
MD5:	D57ABF650F3A7C4ABAFE3A95464A576E
SHA1:	888CC2AB4F445D3C25F5030ABC91839D7A75F015
SHA-256:	4F11CC3F6D5DBA4EC2B1A05ABF3819BA081F21131B80F092F0E8A4EC0E8109A4
SHA-512:	C46831025A5856D9559A9EE045105931441F2EF813202FCA6DFD7E33D71CF63175103BAB94E4F0F07E98E66E21746B182C9F550942E3CECBCB655437FC48509C
Malicious:	false
Preview:	......................>.......................@...........0...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .3.2........................................................................F......5....`\|.5..................O.l.e.............................................................................................................8.............O.l.e.P.r.e.s.0.0.0....................................................................................................:......E.m.b.e.d.d.i.n.g. .3.4........................................................................F.... ..5

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1310.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 81, Total Editing Time: 1d+08:19:54, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:20:08 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	107061
Entropy (8bit):	5.2458729633908385
Encrypted:	false
SSDEEP:	384:pGEVny+Or43UTn0jgysu+snyMQnf07AGfiEgwmrqnqMYF18r6q0fcdcClUvKPLjU:tZW10jgysu+snyMQnCAGfiEgwm+nqqDw
MD5:	0E08FBEEF0207A68F62D4B1D7DEF1C7A
SHA1:	D27D5D35A399A73F82025A1EDCABE1E2071681B8
SHA-256:	40E0F4AC3C8E326230535E4553AEC1B51F941A863417538E5EDF35A86F2B7F6F
SHA-512:	51B6660B2667AB4E6312BBD54765B15150D24C8E93A07F0755DF4733936323A8614F2F15EA6016D1CD1E69D2DDB398A6442B94F4F82C74E7154A86AFCF29E500
Malicious:	false
Preview:	......................>.......................P...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .3.5........................................................................F........u..@...u................O.l.e.............................................................................................................:.............O.l.e.P.r.e.s.0.0.0...................................................................................................,'......E.m.b.e.d.d.i.n.g. .3.7........................................................................F....Pr..

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1320.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 84, Total Editing Time: 1d+08:03:53, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:21:39 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	106941
Entropy (8bit):	5.190240409169272
Encrypted:	false
SSDEEP:	384:1/3D+TQ+w2k8nbrnHvqKbV9QhrVRxhBRUQ7ItnF+PQXj01JoRTqQVeOBGws9t8O7:Dh2k8nbrn5QhrVRxhBRUQ7ItnApbRz
MD5:	D5250C1D0DC2D60F86C6F3709FFD814D
SHA1:	2043CE28896350EE6382B3172C5766332B09D890
SHA-256:	36C9C8DDB2D33CABDE074D4D11E53CF22E41C822B0CB6C48FC64CE6036B9494B
SHA-512:	3C6B69E7FA422A1597F3C75F24163F7D75FD0E357F6060C610CB71AE1CE7777E01BFE58B0B4268AA1316F653BBE1DE34A001270C43322D1D4D577D899FC3F6F7
Malicious:	false
Preview:	......................>.......................Q...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .3.9........................................................................F....p.?.u..P..?.u................O.l.e.............................................................................................................9.............O.l.e.P.r.e.s.0.0.0...................................................................................................$.......E.m.b.e.d.d.i.n.g. .4.1........................................................................F....p#.?

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1330.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 96, Total Editing Time: 07:53:47, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:22:29 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	100864
Entropy (8bit):	5.165912085213481
Encrypted:	false
SSDEEP:	384:xMLqp7YPTQPy7qUDcNinkW1dlE31rlsI2nG9XdjnHjjIH2An0zuuNz8wcNAMULKM:q3BDwinkoCD6nG9XdjnHjjIH2AnsBPY
MD5:	41E08E237789E1CD4CA9D79EA0104A51
SHA1:	35822182ADD8504CBAD4F16E2A2709F1B79BB859
SHA-256:	4E5371E38A984141C2F9922C1A1FFAE659F0E33D86ECC0381F2F24595187634B
SHA-512:	EC7386B8FF167AC216B796B7FD684560B2D51E0C9452F94AA01BD6BC4EE9471ED019035744B464973E1E8C3B9B5D3741C15758678DE1D6D1A1E4AEBA79801E0C
Malicious:	false
Preview:	......................>.......................P...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .4.2........................................................................F......c.p.....f.p.................O.l.e.............................................................................................................3.............O.l.e.P.r.e.s.0.0.0...................................................................................................4.......E.m.b.e.d.d.i.n.g. .4.4........................................................................F.....Fr.

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1410.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 100, Total Editing Time: 10:28:55, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:23:03 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	5.351003521831334
Encrypted:	false
SSDEEP:	384:46cHcDWNkq1ED1vvdmnYGngnmJn6RsLDE/TIYDrUIMNevHA5/AXTeANq+cpAJx2h:cmD1vvdmn7gnmJn645t0
MD5:	820B972D957DB3C16FBDB57EFCBD5FED
SHA1:	7406A6C07D42F7F5B3FD1B6D566A7D301A25E99E
SHA-256:	49DBD73C4739A9BCF13D6D41850413DD22A60E0DF1AF880BAF2598DFEC818A54
SHA-512:	532EDECFDDA49275BAA849A3802B2A49156D4C0AD7E2423D1CADC81CAD132C0661F1FCBFA6173F5CE60D84D59C84C2B4159A525BE0374FBA236371D1A71DCD8F
Malicious:	false
Preview:	......................>.......................D...........2...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .4.6........................................................................F........p...p~..p.................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................;......E.m.b.e.d.d.i.n.g. .4.8........................................................................F....@...

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1420.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 95, Total Editing Time: 08:04:47, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:23:32 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	5.321035397652944
Encrypted:	false
SSDEEP:	384:u/qIV+qqnAtr6napq/7cen2cvUV9XjQscvbWFlgMFWpoNi7abqN3NE50o8KwBv2a:fqqnAtr6nJcen2cv8
MD5:	BE5B1FB3E899FABC3EB7401E12F6DAE5
SHA1:	F1A260B5E17D3FDAF84544CDE55F76F117C0B34A
SHA-256:	19BDDCBD575C3F844BF482ECF3ADA47DA84DFC0CB8F795E56E8657D16546078F
SHA-512:	9F8E821FFD7E88450CC8C0C0B9407B763A0EFD536B6DFABA80E6053E82492E83F2836D360D918427FD0A4716CC395462F5BEB6954A15C2C660A0EE8D3A617962
Malicious:	false
Preview:	......................>.......................<...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .4.6........................................................................F.......q.......q.................O.l.e.............................................................................................................7.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .4.8........................................................................F....P...

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1430.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 98, Total Editing Time: 08:25:46, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:23:51 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	79872
Entropy (8bit):	5.287604768176084
Encrypted:	false
SSDEEP:	384:UULRea+qwnUfPLUnihpE/Hdi17bNnnJGcI7G9R+ysRUlFtBCyAyx1dmLdJ1/UWmJ:OqwnU7UnrVS71nu8RtOO5
MD5:	27085F01DE4D3142E9E4B9BB211557EF
SHA1:	B2B45E3ADCB2E595633992C976C9A261AA6C6D8D
SHA-256:	CA9A355143C4A90E927BEFB8BBB313DACF45E6ABC5FD8C9395AAF2A1518F1254
SHA-512:	399AAB73C33F278E058B0506F9D056E99E2F39D62E73F611AF0C3E2A512647567A238F5B1DC1E2B4F0A7EDFCCE79688B130D1ACFCA154EC0E658E50ABA073AAC
Malicious:	false
Preview:	......................>.......................=...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .5.0........................................................................F....P.\|.q.......q.................O.l.e.............................................................................................................4.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .5.2........................................................................F.....w..

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1440.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 108, Total Editing Time: 1d+11:09:54, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:26:09 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	111586
Entropy (8bit):	5.367325742316195
Encrypted:	false
SSDEEP:	384:jzJFVv9kfjZNPWGeQY99TnjOaLhnniomsnnnzJX556HPipVqxzeixiIAkzk2tMfH:FvmfL+jQY99Tn/hnnLnzJaN9MT
MD5:	607F6373C804F27F8FDF44A67900FB2F
SHA1:	3B40ECB8AB64990E950052E75D7A1839F7157705
SHA-256:	7839AB6F8668346B93AD1A5FB2F6010E768F746C22746A3698A9F8CEFB2240FA
SHA-512:	B70530BBD70B79E3C2A4DA844CCA9666F79F2A2CE3E07578788A0B8CED4DC65829FF1090B98739E31DA96BAE32B7F94FC982E84C266293046D0F5094ACDF6C34
Malicious:	false
Preview:	......................>.......................W...........S...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .5.3........................................................................F.........u.......u................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...................................................................................................XO......E.m.b.e.d.d.i.n.g. .5.5........................................................................F....p...

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1510.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 100, Total Editing Time: 1d+10:02:03, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 3 12:23:06 2007, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	96768
Entropy (8bit):	5.253739160278084
Encrypted:	false
SSDEEP:	384:vKm+fLcKtI4w9+IZnT3vWAlrNcEBa75JL7s8+GtGP37Wufq63f4ZlUWDgnfO9U7E:Iw9+IZniArqka75JL7s8+Yi37
MD5:	DCAB179D3AD3ACFD7A7233C780C4535A
SHA1:	CAE2FA8660F933F310E00CE62EF0BE2EA3870873
SHA-256:	3C96A70007A1F72F740E2145478000E1B5AF48EC302B90B44362316C7F6483FF
SHA-512:	C3848B1E96E8C7AF5F163E0F0D182DCD86259A3DC66E90C872D82603687ED3D8C4904BE4B83D7A75242273629DDD91C7A4C6E9483291D27D7FC7A26ED8EC4D67
Malicious:	false
Preview:	......................>.......................H...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .5.2........................................................................F.......s.u..P..s.u................O.l.e.............................................................................................................6.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .5.4........................................................................F.......s

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1610.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 102, Total Editing Time: 12:46:54, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:25:56 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	97280
Entropy (8bit):	5.433407303868964
Encrypted:	false
SSDEEP:	768:Xv8TdJn1L9e/XR1njdFKaVgSoLUW2nE0QNjNH9//SxR2OfRuBtxVet0eYxeggQYv:Xv+kRRpAooLUWoE0F9
MD5:	172733484051DE3076D0A569F645045D
SHA1:	8BE5BB91E53AAD1EFBACC2C54AEE07FE1C1F164A
SHA-256:	E9BB1BA3289F596D025A5231320B03235BE5B816DC0F488EA01C515E4901E54E
SHA-512:	1252FA1225208BFAAFF9DC65A6825B795EF0909A9998978734615FE782595B3A8A816D08393D36694D02EAA7B292A8328274681CBC4005881F0D071FA08186B8
Malicious:	false
Preview:	......................>.......................I...........E...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .5.5........................................................................F.....}.]q...@..]q.................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...................................................................................................2.......E.m.b.e.d.d.i.n.g. .5.7........................................................................F....`..]

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1620.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 101, Total Editing Time: 10:20:22, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Dec 21 15:26:15 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	94720
Entropy (8bit):	5.272781101700666
Encrypted:	false
SSDEEP:	768:gNuIJnEBd9cuF8Un89429gapL8LbniyRbV:g5ETv8aNApL8LrzRbV
MD5:	1B37C2A8DEC9E777B46E116BA50A3563
SHA1:	A8898F875CBC592BC5E20CE53B6EF9F0BB78D7DF
SHA-256:	DF084AB74DF1D8A747C1249B49E6D8D59FBF0502605F32E441B197E8E2A93242
SHA-512:	189D4B233FC19C87796B2CBAA963C482E91DF34BBAB9A07EDAD432383C672FD283CB9A7E4D5A65330767F229357A460E77443E5A05DDD56209B72AD9CB444C0C
Malicious:	false
Preview:	......................>.......................E...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .5.9........................................................................F....P..iq...@A.iq.................O.l.e.............................................................................................................?.............O.l.e.P.r.e.s.0.0.0...................................................................................................T.......E.m.b.e.d.d.i.n.g. .6.1........................................................................F.....N.i

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1710.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 102, Total Editing Time: 13:13:55, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Fri Dec 17 19:22:29 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	61952
Entropy (8bit):	5.197538641051164
Encrypted:	false
SSDEEP:	384:Hed98gAdS0dfq8n4hwlnTntEU/19uS6cEa7NyxPRkgmKAKc4IEztItr7XLXjfM:C8gAddRq8n4unTntEU/oV
MD5:	36859ACF22527BC88FBFB9E37440A55F
SHA1:	18AF08920D3346871C714D7BD6FA9CE15EB1ACC5
SHA-256:	75FC4385FB8AD4B3D51363C5698ACB8282103660B6976247C2C2BF503D375A2E
SHA-512:	29FDB57A280EAE39C3F358601885953CB80361AD30390877DD4A1CAACFE1B3921D021FEA3FF9411642FB32BDBCAC486BCA413F834046E793BD304A51449C0F5B
Malicious:	false
Preview:	......................>.......................5...........$...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .6.2........................................................................F....p..m....q.m.................O.l.e.............................................................................................................$.............O.l.e.P.r.e.s.0.0.0....................................................................................................*......E.m.b.e.d.d.i.n.g. .6.4........................................................................F.....,.

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-1720.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 101, Total Editing Time: 10:00:19, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Fri Dec 17 19:22:46 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	59392
Entropy (8bit):	5.168408859847519
Encrypted:	false
SSDEEP:	384:+wfUNpSgv0nWjVnVdffnhzK8h4pJQK68JqYVyVSheqCizxT:OpSg8nWjVnVdffnhe
MD5:	97E1308BA3ADF310E6A2DB558CA9D4EE
SHA1:	3FEE31C76C8A7648B9019C07D20A20352906D10E
SHA-256:	4AA41550EC612F8F97BBB2FC015E81FD493DA6C463C4B6A2FE8BA1430BEB5AE9
SHA-512:	2DE6880192BFE2D4B79F6FCCF0E976B573FF3E0E4468BDBDA75C73E07541ECEA6CAA1D5A2345E103DFD40E68D5C1E5F8B91BE40513879AE87AA1384B4E7F2C2C
Malicious:	false
Preview:	......................>.......................1...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .6.5........................................................................F....P...m....,..m.................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .6.7........................................................................F.....9..

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2100A.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 37, Total Editing Time: 03:53:01, Last Saved Time/Date: Tue Apr 13 14:20:34 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	114962
Entropy (8bit):	5.261604527673691
Encrypted:	false
SSDEEP:	768:I2e2hGE0kS1gDYq3nly76JfvRtncMZC03Eew:IjqDJ/cMZC03Eew
MD5:	1FB07367EEE8E3F2FFA696DA778F9018
SHA1:	170EF1512BB373E4EC8FBCA5263B5A08F36B9512
SHA-256:	1D33DC7FF4AD1B4893E9DB4C72C5F6D8D0D86075D397B9186B2854854AB81939
SHA-512:	178EC58D64CD56BC646D86F86E1ACE92425133C10B7761F5049BD2C091464EC32A570B1E2473B5D0FC011119C74266AEF41B48A12E159F2A262A2F0FD9A2ABA3
Malicious:	false
Preview:	......................>.......................X...........T...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2100B.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 48, Total Editing Time: 05:04:50, Last Saved Time/Date: Tue Apr 13 14:21:45 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	146388
Entropy (8bit):	5.235020092891038
Encrypted:	false
SSDEEP:	768:lHhUlBYVEpjE0l/8ygiedZ/ZXA2GGWOnxviPNisAtk71j3/NhaWVh:cisyzxviJhaWVh
MD5:	47FE2ABB3C4266AA429CAAF719CF71BC
SHA1:	E4C54798A9BCCF3C701159269C45D7E100260917
SHA-256:	18FF6C961A1882DBD1F73D84F8FD8EC5B8C15D93216D070AB4B700D56F7D4DE7
SHA-512:	2C298236AC196DFE6D63D4C39E4E61E33657B6EB532E6C8997238555B8E9D4D0114AA0765B1CD1ED8335595A41BEED6021F80A25ACA9F1CA1F5B830352468DBC
Malicious:	false
Preview:	......................>.......................p...........l...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2100C.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 43, Total Editing Time: 04:21:42, Last Saved Time/Date: Thu Apr 8 20:48:13 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	107008
Entropy (8bit):	5.203668389142667
Encrypted:	false
SSDEEP:	768:z/e2h2SnE0VWT+1+CiQCQGWPn32nhLn9ltYpM:XlWTQGnhL9ltYpM
MD5:	EC5ED3BE771AF6005AFCAC6A4C51F499
SHA1:	CA5DB43D68B152900E6F53E8E612EC8797F2A3D9
SHA-256:	DF063F6FB7499AD1ED1A1119619EB53522AAE076943B44014F88D29C546256F8
SHA-512:	55AE15036ADE8A92BD83E18F5BC56164E2C591E28C8F27F2DD50EBF0510B2A9F5B593FE58967EBEF7BBD2A49B515E13D66435624A8ACCCB6D4C2ADF924F8B266
Malicious:	false
Preview:	......................>.......................T...........P...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2100D.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 51, Total Editing Time: 05:01:15, Last Saved Time/Date: Tue Apr 13 14:23:15 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	166675
Entropy (8bit):	5.129449327763986
Encrypted:	false
SSDEEP:	768:GM4hVe2h2WE0VSAcZ7qW5xp7XnWGHP/3HcMJMkcp8sbHVrtHXGnPr9swMnvUgFKG:GjqZGW52uPr9sxDNe6pwO
MD5:	304833086B629BFAF6693DA65E39EE77
SHA1:	F76E35DE8ECC14B02F43CA081BCA9564401A98ED
SHA-256:	7798FE0E09498A983A14564088513DCFF524A92B029E696FA7666E7D2F21CD52
SHA-512:	3B7BC1572975669F1F0C6C47A4DF4F1D790010432CB1B192A878E765135383937188B7A303804C0650AB95BBF3D49CDC86F1926098830880CF1CCBA01244385F
Malicious:	false
Preview:	......................>...................................~....................................................................................................................................................................................................................................................................................................................................................................................................................................................................d.....gdldd.dddddedd........ddddddde.dcddddtdA..dd.gddd.dddddddddddddddddddddddddddddddddddddddddd$dddddddddle.f.....cfkfffffffffffd.ffd.fffgfgfgfffffffffgfffffefffffffffgfffff.fffffgfgffff.7affffl7776777777_4afffffgf..........8....o..... ..hoooo}...;..............oooooo.s.....F..tssssS.p......ppp\|9.1........pxprpppqpc{si...^ABCC7,...]:.2........s.s.....@..tssssn.p......pppy94>.....p{pepppqpc{sd...^ABCC7,...]:7=.....s.s.....J..tssssQ.p......ppp~3........>...p{qppppqpc{so...^ABCC7,..

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2100E.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 50, Total Editing Time: 04:33:45, Last Saved Time/Date: Tue Apr 13 14:24:17 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	107008
Entropy (8bit):	5.212905544497119
Encrypted:	false
SSDEEP:	768:Ve2hrxPE0TNYWedi46AMWnX9KtpskNNf:lx7NmX9KtpskNNf
MD5:	0EDE1C44051050AC187DA8AE1A31C2F8
SHA1:	6727E18195931D9FFED15210436147C34CF1CC87
SHA-256:	8D79794DCE8E8102C720728292C6F6EBFA0001110DB7AFB4E02F82F3DC59CAC5
SHA-512:	AD0387D629DD90745A5566F5DBEFD2EC2F7EBAE6428AB89F0169F11D412B917359CE61DFCB47365CD0D0BFEF58DD57CB7991534B97CAED8778321480062F4842
Malicious:	false
Preview:	......................>.......................T...........P...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2110.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 49, Total Editing Time: 03:46:39, Last Saved Time/Date: Thu Apr 15 15:57:48 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	5.009447532664834
Encrypted:	false
SSDEEP:	384:TPJJ7E0hxrneCraahyLQnKwtdKqDnfpACZZkqelRmEChcbSfjSwHbSwT+4suZMs:VZE0hxrneCraah1nKwtdKqDnf6/uaT
MD5:	DFF552E4E496944479F953253BBD7351
SHA1:	C1B05DD86E65721096C510D61D58BD98ED6DF24A
SHA-256:	F694DB14FCF41F4AB49B0E78A5BB6013F5DBB3C98FE2419A8B4F31E9EC6C01E7
SHA-512:	C5C7C86701687A794F69CE62BA2283866641C2BC4DF06E81D2B82B13AFE19EE1F3DB98374CACB0BD10ECCAC55BECA350C074B53132878FF7F167B26104D8ED63
Malicious:	false
Preview:	......................>.......................I...........F...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.2........................................................................F....P(_.."..P(_.."................O.l.e.............................................................................................................(.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .1.4........................................................................F....@M\|.

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2120.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 51, Total Editing Time: 04:10:11, Last Saved Time/Date: Tue Apr 13 14:26:03 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	4.932281798856309
Encrypted:	false
SSDEEP:	384:my8vFCp9Baa2ei+8dnKS+Mn8ApHNbjjVkyCSiyCizjyfanlIz1c5Ok28Zfcu3HUJ:AFei+8dnXDnjN5ayCSiyCizjyfan
MD5:	CA9D0B00E917E157CC2408DD4DC2EA90
SHA1:	DC8EAF0340917B476C13C22392A923FC9FF2A544
SHA-256:	C08686BA7C85FE2046B9CDDC4A1DD01D46D46C2380097622D01BA26C7FEE2DA0
SHA-512:	17E3A6CD88BA189CB3661E5A297F208B1460B22920B3C49E2388C521694D6A9857AB388530E606F4672671934F7BF29DACD4526881A46427550EE2BCCCD59779
Malicious:	false
Preview:	......................>.......................X...........T...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.7........................................................................F....pn8.Z!..pn8.Z!................O.l.e.............................................................................................................".............O.l.e.P.r.e.s.0.0.0...................................................................................................H.......E.m.b.e.d.d.i.n.g. .1.9........................................................................F....0.U.

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2130.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 53, Total Editing Time: 04:44:01, Last Saved Time/Date: Thu Apr 15 16:32:30 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	91648
Entropy (8bit):	5.076995311538233
Encrypted:	false
SSDEEP:	384:IjZfGSJA38On49XQTyknFq8OgwWu1w8va5Eqbe8E7wtzwaxJbhA4zCeh5oORTJJA:IsaA38On4UnWgwWu17qbe8E7wtzLxJ
MD5:	5F1D64DB7229FEF2119003A2215D06C4
SHA1:	42A8A4F7B01CC3363741734F4B3191E835B745ED
SHA-256:	6DC59A6992E5543D655C584C7E969C76BE1B5E56A7472A89879FD5D78F94CFD7
SHA-512:	03DEBC9A70F6C3BE45DE952D959B8CD26C30DC1F08C8D1E9383C380592A2158A2209CBB9DB75275838BAB40CA6374609FA472E78EE67216168F322BA357EDBAC
Malicious:	false
Preview:	......................>.......................U...........Q...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.9........................................................................F....P...."..@...."................O.l.e.............................................................................................................4.............O.l.e.P.r.e.s.0.0.0...................................................................................................."......E.m.b.e.d.d.i.n.g. .2.1........................................................................F........

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2210.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 68, Total Editing Time: 06:54:28, Last Saved Time/Date: Wed Nov 3 19:31:39 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	175839
Entropy (8bit):	5.344109633971589
Encrypted:	false
SSDEEP:	768:rrFkQq5mlq6EppSEijiV6SArIbn+6UhUHMO5us0LNH:VAvUhUsLxH
MD5:	AA067548970C7B00CBD1AB3D163064DE
SHA1:	E72267289B4399F1F51979382060F3A4015D95EE
SHA-256:	7E38CC0B0BE481B16A64708EAB29064AAA1E7FC9603B479F3A1027C89599C443
SHA-512:	F9FD3F88F52846DD922F17555AF1E390EE1FEBEF38FE4A8633AC34E1E7B60BFBCD14240FBB1A9A006C6F937453961AB5846ACB6169678DE041EEDB811A450615
Malicious:	false
Preview:	......................>...................................~....................................................................................................................................................................................................................................................................................................................................................................................................................................................................d.....gdldd.dddddedd........ddddddde.dcddddtdA.$dd..ddd.dddddddddddddddddddddddddddddddddddddddddd$dddddddddle.f.....cfkfffffffffffd.ffd.fffgfgfgfffffffffgfffffbfffffffffgfffff.fffffgfgffff.7affffl7776777777_4afffffgf..........8....o..... ..hoooo}...\.)............oooooo.s.....?..tssssn.p......pppy3...4...p.pxpppqpc{se...^AABC,...]0...7...s.s.....E..tssssS.p......ppp\|9.1........pxprpppqpc{sj...^AABC,...]:.2........s.s.....=..tsssso.p......pppx=.. ...pvpxpppqpc{sf...^AABC,...]>..#...

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2220.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 64, Total Editing Time: 07:36:52, Last Saved Time/Date: Wed Nov 3 19:32:42 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	183665
Entropy (8bit):	5.227388050044036
Encrypted:	false
SSDEEP:	768:MVSBlBnqKOBlueO+O+u7yuLZJ5p5pZQgBx4Un5pFmWfN1pmSoNZl50Qa+OOKF/RI:M0BISTEWfQSoNZl50Qa+ONdu
MD5:	FBC80A0187F08266BE1BF548458C222B
SHA1:	407678E96CB6077C13DD905E4773B2EF1EC765BF
SHA-256:	5A5FC33AFE7368245E28A7713662C9BDA876F5AC927394A5A8A30836FE725DE5
SHA-512:	11F5E8D401D6FB0172B501776B6DEF21BD11B1081B602F1AC98E8F42D114CDE9EF8EE0728E1F0D509506FCEF5D7D27296290227AF513F4950C40E4F32FCDC8E3
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e.......................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2310.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Thu Sep 2 16:11:52 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Wed Sep 29 20:57:07 2004, Security: 0
Category:	dropped
Size (bytes):	97792
Entropy (8bit):	5.235321248671491
Encrypted:	false
SSDEEP:	384:h3FE+JrT1W4O7jhcWvL4LRNXncMEUYAkEUANCfn/+ckPJa0ihYpkeQd9H1tiADS5:ijh7vLqRNXncMEUYAs/fn7fOpiq
MD5:	343EF05BA42CEA68AF2C93D6A13D1DDA
SHA1:	48696E1A874EC0D9359750ED88AB9DD120556EE6
SHA-256:	1E7B03D67BDBDA7E22A68F91690B917B454A35B7797A67782DAA970E035E32BC
SHA-512:	7B2135F9A204F2D06C1AF46AA7E0822ADBDD3FA7D7642B759AA46C56966E864DA2D713C36193DE51F5C7148DF0D1961ED98A14D07A798165065F60CF0478B6F0
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f_reports\2003 Forms\cro-2310.ttx..........cro-2310.ttx.............................................................0...................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2320.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Wed Sep 1 18:17:24 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Thu Sep 30 13:20:19 2004, Security: 0
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	4.878667838414998
Encrypted:	false
SSDEEP:	384:jaLie5bHqeAsUpQZE0CoYnSmrWJKQa0CoY2SirQ8Oa0CoPp7ft7wMvWwdmhWwSY/:gx6hQA1vWg1SQ8bepLtH8h
MD5:	5708195C58E3C42049C1B39A69A778CB
SHA1:	A7B8E652A3719B0495FF8BD553E01518F3D3E6C5
SHA-256:	7192672E01BE235F4AEE589F8C89AB98CA3937B0E578E707D2C80104EA658F3D
SHA-512:	9BE7F2BEDB67C1BCB57C713FBE99483F2F59576458FFF2979BD09BB56669AC19A42A5A32B03398163BE93D7011C39C807831901CF90BEEE3A97EF754B32C0F17
Malicious:	false
Preview:	......................>.......................J...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.4...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................[...........E.m.b.e.d.d.i.n.g. .2.3............................................."........... ..............F....p...

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2330.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Wed Sep 1 18:30:22 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Thu Sep 30 14:12:24 2004, Security: 0
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	5.016829721181625
Encrypted:	false
SSDEEP:	384:Sf1lCrJRyG5G0aAYCMKiOqvsgyLfH0aAYxB3UoggtX20aAYpo0/6wMvWwdmhWwS6:1yGy9ygA9XEogIQ9pxM8hqO
MD5:	F5CDAB6A4DF5F715194C5DB56D5BC3D7
SHA1:	6C4A37A491B552AA28294D9B739CACD9738B0C0F
SHA-256:	702F5AB1C9D04BE301A38CAA092D2D77E3A572DF40D08FFC11F4CF875D2E0C9B
SHA-512:	E35E47012B974896F0904C276EB9BDB9587ABDD8A6891B06BDE60CC14E6D73448FBA3C6E3B536B30BDBE279D6729B2C227D626D7F058BD38C16342405B52E8E0
Malicious:	false
Preview:	......................>.......................V...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.4...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................t...........E.m.b.e.d.d.i.n.g. .2.3............................................."........... ..............F........

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2340.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Thu Sep 2 15:18:00 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Tue Nov 2 15:55:18 2004, Security: 0
Category:	dropped
Size (bytes):	172330
Entropy (8bit):	5.203209297538331
Encrypted:	false
SSDEEP:	768:ZMvUSXCbLRXY+OXLTgcbRRdUKuPkBLpYf78hhxhDhmVhShQhdh5vOG+6z:3SXCbg/gc9R6Pot9hQVQ+3h+G
MD5:	63F5FF7C2D7205CB2E4D97A709C8BC33
SHA1:	4E24825E5143987872329001C92F111290F14E84
SHA-256:	BCD7C0FCE94BA92252B53248F5A7720E9D05EDC5B509B6F5D05640F27C07513B
SHA-512:	C501643907DE3CB3F96C0B9EA6F8871DAA01DF15D6BE2951DD16E97CB346E19A55E12D58D9D2F71F703D42FEE5C8EA830D1657DFD77AF1C00907F73621ADBD84
Malicious:	false
Preview:	......................>.......................m...............................p...............................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.4...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................z...........E.m.b.e.d.d.i.n.g. .2.6............................................."........... ..............F....@o..

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2500.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 43, Total Editing Time: 05:27:46, Last Saved Time/Date: Wed Nov 3 19:33:51 2004, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	4.912226439854232
Encrypted:	false
SSDEEP:	384:PWFml8E2XE848Qu9rC6gpbtne38GvfPVmPZn8IYpT0QCp3MaQRbx3eCWQ:1l8E2XEwQu9rC6gvnezvfPVmPZn43
MD5:	3CA49EB0F57DA94C615276F113798BBC
SHA1:	BF7BC7157F202F78272F8E523A3A79064BE0F9AF
SHA-256:	8D5E5F0BDA98BDD948625BD559E1E75E8D6409809A0527678156F602D7CCF44D
SHA-512:	E59A06824B6B995BE87054A7A43A09CDFE033177EEB2E1C2C21465F97C2C2D96CD919202836D23FBC21AF3DCFCCD22507E725E8BD8B9843B4FE08F6B0ADBDEC3
Malicious:	false
Preview:	......................>.......................B...........?...................................................................................................................................................................................................................................................................................................................................................................................................................................................................eld Definitions Only)....HC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\2003 Forms\cro-2500.ttx..........cro-2500.ttx.............................................................0...................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2510.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:51:41 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Mon Oct 22 19:25:35 2007, Security: 0
Category:	dropped
Size (bytes):	97280
Entropy (8bit):	4.976430970520775
Encrypted:	false
SSDEEP:	768:B0jbfG0HYJffpgAnVY7PfsUMXHwKY0/Oxlu7cimw:0btHofHVCf/MXHwKY0/AuIi7
MD5:	8EAC4565C5C68E1989A9FF7987815CB2
SHA1:	0EB3FB50AEF02C35F85F65F5857A716C8AEFA682
SHA-256:	9EC7029D0766167D10E4D46F032B5B108B3B31B3A3237DE100D87E77D2B51386
SHA-512:	C70D33774D966A4E48970C1C3CECDF47F688603A7D50B707A61C4D8EF045C40997ED14CCE9784C08D05A2503BAAC36394E8E2BF1F137BB9CA21D646C73A27874
Malicious:	false
Preview:	......................>.......................b...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.3.............................................................!.......................................................T.h.i.s.W.o.r.k.b.o.o.k................................................."......................................................._.V.B.A._.P.R.O.J.E.C.T.................................................................................................).......E.m.b.e.d.d.i.n.g. .2.2.....................................................%... ..............F.......w

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2520.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Thu Sep 2 15:25:10 2004, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Thu Sep 30 16:30:55 2004, Security: 0
Category:	dropped
Size (bytes):	135680
Entropy (8bit):	5.128156286632356
Encrypted:	false
SSDEEP:	1536:mV49P3yLKq8o4zLcb2UlUc4K+xTPNRPzUsdiallTonTIn2:1PQyN
MD5:	DA29DAC0A434ABC27100A3A4A367E110
SHA1:	C221D94A7BE299E5E14EBEC92A6DE9BF94480A15
SHA-256:	20D3D0DD26709E180F54668AB6C3699C1868925626FC6B1423D497605E7AD68E
SHA-512:	1472086D61EB119431EEFA82F285077CADAE6E242F704EE586A792E1D47FC241DDA2EE294FAF059CB172093929EBCAB6FFDFF067D1565F99DEF8C99FCB3E6C6D
Malicious:	false
Preview:	......................>...........................................................N...........................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.4...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................V...........E.m.b.e.d.d.i.n.g. .2.8............................................."........... ..............F.......

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2530.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: State, Name of Creating Application: Microsoft Excel, Last Printed: Thu Jun 15 19:07:57 2006, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Mon Jun 19 13:10:06 2006, Security: 0
Category:	dropped
Size (bytes):	163871
Entropy (8bit):	5.0807907373790036
Encrypted:	false
SSDEEP:	3072:BaoO2BABgppv/5/vR6WOyALYaHueLJJz9nZMEaGzI096cZzl9Q:BaqBABgppv/5/vR6WOyxcZzl9Q
MD5:	1305898D36FFA9B7F2588B4A1500E83A
SHA1:	401DFD86A8927D1CB5E22A6AC704398721C28943
SHA-256:	B1A4B2167F40F9CB5FF128CD49F194334D730ADC6C0B5C71DA91F0AEC41FB573
SHA-512:	E27CE2D9EB5A541E24F690D6951AB133DB81D9BEE17AEAD2A9FE0A562007F24D522FC9A920F0687BE12BCC3CA357760319D70C077992B2885FD8DED3FE36F5A4
Malicious:	false
Preview:	......................>.......................................................z........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...>.......?...............................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-2540.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: State, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 16 19:02:54 2006, Create Time/Date: Tue Mar 18 18:33:40 2003, Last Saved Time/Date: Fri Jun 16 19:04:24 2006, Security: 0
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	5.031239289107367
Encrypted:	false
SSDEEP:	768:FB9CHpBpB5GOLJTJBEb/1EMAsxv5JQUM0FKmoDd:ZApt1LdEb/nAEv5JQX0Fw5
MD5:	47FFCCC46A2FC77F5FE6538F2BBDAA65
SHA1:	B99466E07ACEBAECC9444EDE30769BE9DF08F5B9
SHA-256:	967BEAFE2035D7AD942A8DEF6BA82D5BD8ABE196A2DF615C7C39F9E6CC27B796
SHA-512:	3829104E23319091FF92652912E9AC6F7AD2812EDDC625599A8B41D4D855F619A46F61FFE797D0243FB3774F49B34C47E42D79B55AB9A53A0D650E4858766D75
Malicious:	false
Preview:	......................>.......................................................~...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-3100.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 11, Total Editing Time: 01:13:31, Last Saved Time/Date: Thu Apr 15 16:10:09 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	59392
Entropy (8bit):	5.20548689364493
Encrypted:	false
SSDEEP:	768:Xu/JhxbQkQmhQ5NM9maf1iZxIHbWCAnBHszjGBAX1mrx7SympaenjKC:eR0kQmsMRTu9sPCQ1
MD5:	F06A082EE26DC7A9FC9AF75EA78CF04B
SHA1:	6FA744D6397EE27FAD957FD2E835003CE0928D2A
SHA-256:	E0B846D5CA7F4D42E7801DA32552585399C441E3D3E3B7C209A1EE94603CBF2A
SHA-512:	0FB7785CE7713382D67CC5FA8E41D0C7371DF9536A0E23A2FCE3A1E9DEDD6A0AEE155B2A0ED95366966CF7A71545B4476A323DCC438615C51A7E70E75DDF4AA9
Malicious:	false
Preview:	......................>.......................O...........L...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .4..........................................................................F....0.H.."..0.H.."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .6..........................................................................F.....Mj.

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-3200.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 11, Total Editing Time: 59:12, Last Saved Time/Date: Thu Apr 15 16:10:40 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	58880
Entropy (8bit):	5.202598797564419
Encrypted:	false
SSDEEP:	768:9x/p8JhxbQkQmhQ5NM9maf1iZxIHbWC8nJfBna/KEn2:9Jpe0kQmsMRTabu
MD5:	F0C67D5BE0C6C23069A98FC9C42B21F0
SHA1:	3664DAC584F65485BDFDD03FC215D817B9DFC30B
SHA-256:	EF0E4EA896076843CCAAD02933AEDBE79482D8AA94CC7E42102E4138D665F274
SHA-512:	3EE740535B59E33A29D9B8B323DEC0B96E6C8552BC38D9C9FD344D91B85AB7284052F6D5968FB2094FC262EFB2F5D80842D9C42392FF1D51BD7169A8F441F0BD
Malicious:	false
Preview:	......................>.......................N...........K...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .6..........................................................................F....pP..."..pP..."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .7..........................................................................F....@..

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-3300.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 11, Total Editing Time: 53:27, Last Saved Time/Date: Thu Apr 15 16:11:02 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	59904
Entropy (8bit):	5.210459280768143
Encrypted:	false
SSDEEP:	768:LCRojJhxbQkQmhQ5NM9maf1iZxIHbWCnnkrnCIHWnJE:LEoF0kQmsMRTP62
MD5:	B511926EF1002CB1F4AAA6E2071672E3
SHA1:	3C1D20F9223C2CE424D6B906D9789C493576EC55
SHA-256:	4F495EC0387E14EE0F211F0A53C133D0362A75DFAD14315A9DAB42A7E6D7F6A0
SHA-512:	1958C9CFE296090A6407AB032CC2E160982942AAB6A5B1CDB466547E6503A612632764471AB7EC80546F960C7CB2E69C115CD7B82FEA90ED0D58BEB818BBD8E3
Malicious:	false
Preview:	......................>.......................P...........M...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .8..........................................................................F....pO..."..pO..."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.0........................................................................F.... ...

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-3400.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 14, Total Editing Time: 47:00, Last Saved Time/Date: Thu Apr 15 16:11:40 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	60928
Entropy (8bit):	5.198727350702287
Encrypted:	false
SSDEEP:	768:DQ+bXJhxbQkQmhQ5NM9maf1iZxIHbWCsnThHnRKqn8:DZb50kQmsMRTa9P
MD5:	F3E96121EF1FE4575C5112E52619A9DA
SHA1:	A308DD12F2DB9F5863631ABFBE97554C76E32C9C
SHA-256:	742D520C233C61433A794AB11DB5FBCD236565CFC63A82D2715241BABDEF4041
SHA-512:	94935A8F87744BBA7FEBCC8A5FEA0F3273CB558D7A385ABBB9CEA94DECD2BC247BB934D472D4136FB431C58956355D7DF9252A849D9731F0C546345C056EB6B2
Malicious:	false
Preview:	......................>.......................R...........O...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .9..........................................................................F......+.."....+.."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.1........................................................................F....@tO.

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-3500-add.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 15, Total Editing Time: 01:14:19, Last Saved Time/Date: Thu Apr 15 16:46:43 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	5.0872204368180025
Encrypted:	false
SSDEEP:	1536:KCrycGESg0kQmsMRTiGlrfSBaEEP4VpAH9fxFS:d0kQm9RT
MD5:	E6DBE6558E05030B529A9F71B1944DE0
SHA1:	EBB835D973C152D757845AD9E4EDE7A2DE5D4CB1
SHA-256:	C52F450DFAD410C2C177A91DB8C070BF63D3068A52C81092AE60D66AFE88F0A3
SHA-512:	49D6612314178EE866503856AE3E3079C858CA4375F827505BD40423429C120AA388C0CAFA63C4FFE7B36A81BF804AFEB87CDD8739E8F3BAF1E5FDDB533D29D2
Malicious:	false
Preview:	......................>.......................]...........;...............:...................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.2........................................................................F....._#..#..._#..#................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.4........................................................................F....@gN.

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-3500-main.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 17, Total Editing Time: 01:43:07, Last Saved Time/Date: Thu Apr 15 16:13:09 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	5.388710930708643
Encrypted:	false
SSDEEP:	768:+nVHYhxbQkQmhQ5NM9maf1iZxIHbWCFnjDnaUoqrnc94RHexedO:+i0kQmsMRTJPjpHA
MD5:	5A6E41E293A03AEBC93266499DA11B7C
SHA1:	6400957B493FED5E571912DB972EBABA94636FF5
SHA-256:	646174976696BE16DE2AE3D451EF356F83D4DE085329301AC5295F7C61342A4F
SHA-512:	1E0159E6EBAAFA8AD8BFC8FA7F000B813DC836A344B6112BCA751D0246196F5D9A0FC094842BFB53FD836CC9B7543FFC23656585E1F00BD09A79CAF4B0A6B84B
Malicious:	false
Preview:	......................>.......................c...........=...................]...............................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.3........................................................................F.....S>)."...S>)."................O.l.e.............................................................................................................7.............O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.4........................................................................F....P.b)

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-3500.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 55, Total Editing Time: 02:10:00, Last Saved Time/Date: Thu Apr 15 16:46:51 2004, Create Time/Date: Mon Mar 22 15:03:08 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	158208
Entropy (8bit):	5.340858554251574
Encrypted:	false
SSDEEP:	1536:oNe2HASmU0kQmsMRTXTcDCrycGES5orfSBaEE2pAH9fxWK0mU0kQmsMRTg:F+0kQm9RTY0kQm9RT
MD5:	0393A9F38F3AD7C4A34189358C9754F8
SHA1:	8622DE3DB6B32284333F4A63BD90B3F8F962CD31
SHA-256:	93B0F789471FEF00B74DD158933D1E8F9C5AE045183F89910C9472E91E66DA50
SHA-512:	9322F7A00928E023CE9C9EEC6CD94F338F7661AC2AB2A59BC71DC5B329A873817ABE91CA5788C2B1A6D2966B75DE76588FD57B3EFFC1C5378377DCDE6CD92C56
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................eld Definitions Only)....MC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\crystal version\cro-3500.ttx..........cro-3500.ttx.......................SQL.....Pdsmon.dll....%Active Data (Field Definitions Only)....RC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\crystal version\cro-3500-main.ttx..........cro-3500-main.ttx.......................SQL.....Pdsmon.dll....%Active Data (Field Definitions Only)....QC:\DEV\CR Code\CFRS Common\CF_Common\cf_reports\crystal version\cro-3500-add.ttx..

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-3600.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 13, Total Editing Time: 41:36, Last Saved Time/Date: Thu Apr 15 16:13:59 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	60416
Entropy (8bit):	5.20599462556192
Encrypted:	false
SSDEEP:	768:wTlmibYhxbQkQmhQ5NM9maf1iZxIHbWCjnH1I6nd6NbqnQF:glmiU0kQmsMRTLVSM
MD5:	9E7D6F992148FC5550D5DEA0932E7F24
SHA1:	EBA62B123B5CA75C49DC41FE142BF5589E88C2A8
SHA-256:	C09556C17C14E2286977FFB12BE987425EEE0803D607D7446057B55620A2F9D3
SHA-512:	F8B0EA0B0AFE0125E3662C5FF2145F0A25348FD0F8051E010ED7527AB3BA6AC47FF3207281340E73B47644DE3725C040BF2DADCC506C61DBD32AB1FF31F0E66D
Malicious:	false
Preview:	......................>.......................Q...........N...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .8..........................................................................F.......G.".....G."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.0........................................................................F.......G

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-3700.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 16, Total Editing Time: 01:16:19, Last Saved Time/Date: Thu Apr 15 16:14:26 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	59904
Entropy (8bit):	5.201214682908714
Encrypted:	false
SSDEEP:	768:Mm80tYhxbQkQmhQ5NM9maf1iZxIHbWCInu+lnxhvnK:M5020kQmsMRT2hj
MD5:	AA8902D4CD33C667E28AE4BB9A6CADE1
SHA1:	334D99391F65F36D54A444DAFC31572766E66039
SHA-256:	ED8FDE84B287084F0C961C7198ADAEEA4024DDB69A6613B893E0A3AF160A10EA
SHA-512:	1503E493ED48ED1132A7B3001CC7CB15AEB1F553C14163355A7529285393495C464325EC0EB9EE0D1E313C1B8B7573D7022838B301BD3865B443764EC6C241BB
Malicious:	false
Preview:	......................>.......................P...........M...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.0........................................................................F......\W."....\W."................O.l.e...........................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.2........................................................................F......W

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-3800.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 16, Total Editing Time: 55:25, Last Saved Time/Date: Thu Apr 15 16:08:54 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	5.222279462324983
Encrypted:	false
SSDEEP:	768:3QvYhxbQkQmhQ5NM9maf1iZxIHbWCLnWnJ8nOvuquin:3r0kQmsMRTDWn8sak
MD5:	881CE3142335B809B9C88D3BAF0F1AC5
SHA1:	54316525510D401A686BA152A69E658C74F73481
SHA-256:	373BA0BB70D83F47E9F15967318379C42FC4FCDA8C1FF8CD3F7EE4AF47DBF6B7
SHA-512:	6F3C6088109D4FE2331A0DDC5A23B4894D0A9709209B042934794CAF72C05FC79187407D199476D7DD5BBABC2D95834097F194BAD3FCC8A211EF9F1B76C8AB14
Malicious:	false
Preview:	......................>.......................Y...........V...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.1........................................................................F........."......."................O.l.e............................................................................................................. .............O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.3........................................................................F........

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-4000.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Wed Jul 23 21:08:46 2003, Create Time/Date: Tue Mar 18 18:48:23 2003, Last Saved Time/Date: Wed Sep 29 16:09:05 2004, Security: 0
Category:	dropped
Size (bytes):	160055
Entropy (8bit):	5.274194490059007
Encrypted:	false
SSDEEP:	1536:LXM5UzLaFCbFD8UlI7wLS4s63a2EPo5FGyy:LXMiLaEbFD8UlI7wLS4s62
MD5:	37EB610A634C1DDFC81FFB4990591935
SHA1:	84E81DAED249A25AA2AEB41F15B57DE8867CC93C
SHA-256:	5D15551981C1099F202823541E981A577372E458BA345752B9B3B0E0E0E2D059
SHA-512:	72DCAA38E5BA795C56F2E5076064BCD683570FBC8ED4DBA83E88CFEC04AD7B30DBA6A78D7D92F8B8AC16BC5671E0D4359D1AEC1500CEC29D99EF68EAD158C17D
Malicious:	false
Preview:	......................>.......................................................g........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...............................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-4010.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: programmer, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Mon Mar 8 13:36:18 2004, Create Time/Date: Tue Mar 25 14:52:47 2003, Last Saved Time/Date: Wed Sep 29 17:55:29 2004, Security: 0
Category:	dropped
Size (bytes):	143872
Entropy (8bit):	4.929485413721053
Encrypted:	false
SSDEEP:	3072:/im9jlbEsrtvnwTDCI/dIj8yI5Fik6ulE69OsccKy5:
MD5:	4B55DAB27519155A12B873F1D7D44498
SHA1:	8B9BE194A8DAAECAD472660DB008326326A1C63B
SHA-256:	87BC25D6D57B23CE6CA2E6DB3E7FAB777FA5DE415B7347723EDBA7BF7FA43ED6
SHA-512:	F66495BD44022833DE875DC3788E45CED74D595A8099EB2938B6D2BD2B15DE156FD20557991E946D0CC17D14050A583E7AA3AEF823469C4BAFB805386069431B
Malicious:	false
Preview:	......................>.......................................................Q.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-4100.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 16 15:54:41 2003, Create Time/Date: Tue Mar 18 18:48:47 2003, Last Saved Time/Date: Wed Sep 29 17:56:45 2004, Security: 0
Category:	dropped
Size (bytes):	145920
Entropy (8bit):	4.9925301432159035
Encrypted:	false
SSDEEP:	1536:wHgr56AinkrRcycDCTCQd4iNbBm5+q+zG2F:wHc6AinkrRcycDCTCQd4iNbEN2F
MD5:	FC038A5D0FD1B115F67ABE16A2B997EE
SHA1:	F385AC3E5FBD3C5C7E463EA55714797FBA3D3FC1
SHA-256:	B4E8D00C75260301D54369D88E0EEEEF0D83FD4FB7D8D845D927738453497CD6
SHA-512:	85F600ABC3EFB7D782396F347F3CB8F723FCE58671002D75E769714387C7D0E35F456DE32FE5F1DCBA271F4E6780A6E8C64F922EAA884D0D5DE77965FA638DE4
Malicious:	false
Preview:	......................>.......................................................m...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-4110.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: programmer, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 3 14:49:58 2003, Create Time/Date: Tue Mar 25 14:35:37 2003, Last Saved Time/Date: Wed Sep 29 18:00:44 2004, Security: 0
Category:	dropped
Size (bytes):	109056
Entropy (8bit):	4.763335759409982
Encrypted:	false
SSDEEP:	768:xnbQqAqLbqr/Su9ySWOQLISXQv+ZN5Zxftt/LIEKjGn:txgLD9yNqSf5ZxV6EKj4
MD5:	65F9BEB9749339F9E44355A5C809AD4B
SHA1:	C9F242F2C6E3361F1ECB802984059CD7C911992C
SHA-256:	B4D9FCAE9C80A489BB0070B090F924B7B21DFAB7ECF45D06C8998287CB1082E3
SHA-512:	9CF7CEB35B63CBA41C3F3EB0C9104D82729531D9426BB8A27536F594CD96A690D4B05C3029A1A7021D417591475E7A8DA5BFA713E53438122A3738D0858CF39D
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................eld Definitions Only)....RD:\DEV\CR Code\Remote Filing App\Version 2004\CF_Remote\reports\2002\cro-4110.ttx..........cro-4110.ttx.............................................................0.........................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-4200.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: State Board of Elections, Last Saved By: N.C. State Board of Elections, Name of Creating Application: Microsoft Excel, Last Printed: Mon Mar 8 13:38:49 2004, Create Time/Date: Tue Mar 18 18:49:06 2003, Last Saved Time/Date: Wed Sep 29 18:02:28 2004, Security: 0
Category:	dropped
Size (bytes):	156017
Entropy (8bit):	5.153834479799729
Encrypted:	false
SSDEEP:	768:R997ilTTQnZqWBCtvOL1HuQL3psNw8I7e+8xiZJSSZJTLenAjM:1fnUd8H0wt7pvLQqM
MD5:	85D19DDF6412ADC30E4582B09B12C81D
SHA1:	2A9E3E70365EDD7E63AF98CC928B1861AF149334
SHA-256:	0D4EA12E2607E86CC5C7F1052832331678005D9E8A64C818BF4D9BF2E131A71B
SHA-512:	2A8A070AD593871890BCF825836AF861F5CD6371C832B406E456F5B35D524E85D27DF5E7B4DA90998BFC890068D79252A353CE98AA3660E8E35FA405227250AA
Malicious:	false
Preview:	......................>.......................................................A...............................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.........................................................#...%...........................................B...........T.h.i.s.W.o.r.k.b.o.o.k.................................................&...........................................2..........._.V.B.A._.P.R.O.J.E.C.T.................................................................................................`.......E.m.b.e.d.d.i.n.g. .2.1.....................................................(..................F.....(

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-5200.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 4.10, Code page: 1252, Title: Media Complaint, Author: CRO, Template: Normal.dot, Last Saved By: programmer, Revision Number: 4, Name of Creating Application: Microsoft Word 9.0, Total Editing Time: 39:00, Last Printed: Mon Feb 11 16:23:00 2002, Create Time/Date: Mon Feb 11 14:32:00 2002, Last Saved Time/Date: Mon Feb 11 16:23:00 2002, Number of Pages: 1, Number of Words: 121, Number of Characters: 694, Security: 0
Category:	dropped
Size (bytes):	77312
Entropy (8bit):	5.1864279109289395
Encrypted:	false
SSDEEP:	768:WvRwuJIBchkLEFbzOew7A6irPH9Y2ZVwCFgDv6FoYsHSb:W4BA2SLpzj
MD5:	46278C5B8F40632A170C005DA9D59E16
SHA1:	3FF09C3EA468C6DDEAA8B70E780C1C23987A4B9C
SHA-256:	50D66013ADAEEC5730A46ADB656C69CE53CBA22AC905D6939198ABCD56E6190D
SHA-512:	12E5C6A70A0001AF370D1A82F8931E9F4F1CCD8728C3A7BB67F6D80E8247BCB5272D2C2C2A316D9C7A2C11125A3D747C2B2C0BC2B9895E58B772820A1C0D8B7B
Malicious:	false
Preview:	......................>.......................................................c...............................................................................................................................................................................................................................................................................................................................................................................................................................................S.a.v.e.d.R.e.c.o.r.d.s.S.t.r.e.a.m. .3.4.l.........................................................................>...........R.e.p.o.r.t.P.a.r.a.m.e.t.e.r.s.S.t.r.e.a.m. .0.l...............4...................................................l...H.......A.n.a.l.y.s.i.s.G.r.i.d.s.S.t.r.e.a.m. .3.5.l...................0...................................................n...........V.i.e.w.I.n.f.o.r.m.a.t.i.o.n.S.t.r.e.a.m. .0.l.................2.......................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-6000.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 16, Total Editing Time: 01:19:16, Last Saved Time/Date: Thu Apr 15 16:15:03 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	5.462546839098408
Encrypted:	false
SSDEEP:	768:+nYhxbQkQmhQ5NM9maf1iZxIHbWCc+nBn3IP3r8anGFfti:J0kQmsMRTNNMek
MD5:	3250FC4FD11C15C54822054C28780B01
SHA1:	215184E6327FE1AC1D273BADCCED85E782923AD9
SHA-256:	1E7672885014E6B7C146889E2220D70D08901E7C49208B651DD234936AB2A544
SHA-512:	4F73F3CF649EFCA18472C01B431646327F69DE1F5048427471344041BE5A721AE505A9B544BCA1DD1D9616EB098FA0DC1299C1652691AE217F5FFE9FA6CE69A7
Malicious:	false
Preview:	......................>.......................R...........N...................Z...............................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.2........................................................................F.....>lm."...>lm."................O.l.e.............................................................................................................2.............O.l.e.P.r.e.s.0.0.0....................................................................................................X......E.m.b.e.d.d.i.n.g. .1.4........................................................................F....`=.m

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-6100.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 19, Total Editing Time: 01:29:13, Last Saved Time/Date: Thu Apr 15 16:35:31 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	46080
Entropy (8bit):	5.043756431144704
Encrypted:	false
SSDEEP:	384:7VOicAD99Eq1HqIbOqWLgBe5lnq+jJqa+k9OdV9d:B9hD99CISbgBon
MD5:	26D7904E98C4826EC8C737C66BDCBC12
SHA1:	7CA4829A3E5F1BBFEDA5E3AEFBC156C39874DA4E
SHA-256:	8C347894CA7949613D31E39D033063A1AF4CF3FE757333C4F1BE2579CF920473
SHA-512:	F1B514950453EA4F92BC5103E0138A23ED6354780A4D29DE127A0E6056C888C320E248B1E2126013271BBC844D0DA8A20E84AD8E9BF757F5B36F75743C552E8B
Malicious:	false
Preview:	......................>.......................4...........1...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.3........................................................................F......I."....I."................O.l.e.............................................................................................................&.............O.l.e.P.r.e.s.0.0.0...................................................................................................l.......E.m.b.e.d.d.i.n.g. .1.2........................................................................F.....8.I

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-6200.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 21, Total Editing Time: 01:30:00, Last Saved Time/Date: Thu Apr 15 16:16:31 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	30720
Entropy (8bit):	5.045260314109269
Encrypted:	false
SSDEEP:	192:tL7OOnPkQ0hIdHb5xjvNOJMHCdrx38bW/9sn0A/qmDSAmeCDtF2MjTDIRzDwOaUe:tfOEB7n0tPRjTDJxUe8U5Ba2EBnUU
MD5:	452A7EB0E5D50CCA95CD8005C00F58B6
SHA1:	D28E656B06ED04270698665896266CED2D8864B2
SHA-256:	E9B38C68D490F2CDA0F40BBD13DCEFDB49E20954704AEBE1111068C97ECFBBB3
SHA-512:	3078578BC5CBA6866B27E0D8B4B63818D5A776867BD36859AE50B1D78EAED6EE45D68BC1D8FE2B7A12304E04977E53B30A5425409144293DA1FFF93969C2DF27
Malicious:	false
Preview:	......................>......................."...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.4........................................................................F......."....."................O.l.e.............................................................................................................".............O.l.e.P.r.e.s.0.0.0...................................................................................................n.......E.m.b.e.d.d.i.n.g. .1.3........................................................................F........

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\228DEDB0\cro-6300.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 22, Total Editing Time: 01:42:27, Last Saved Time/Date: Thu Apr 15 16:17:09 2004, Create Time/Date: Wed Feb 25 15:55:28 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	261632
Entropy (8bit):	1.9491111808148631
Encrypted:	false
SSDEEP:	384:/meSOY8bNrkn5G4LLHPI7AroarCIC7eVl5nnm3PVbWkPTf:umkn5vnHoADnncPZ
MD5:	2BDAB01E7B8095BB8FDEBE7AF3926965
SHA1:	BA9DEB25822C3E374CC2B2E07FE661F4E9502282
SHA-256:	34B8F59F480FCAF32C09E1B8427FAF5E0CF80DC39918B8E1BBF0DAE220B9B386
SHA-512:	7D00C4F622E969B22416AD3C2C5C7A768CD3D95E61109DA061FACD98F7BBD43AA5EE0CA7C600F2FF7B26201ED341187F2DE4C7E2A587ACE2AE1458978F89022C
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .1.5........................................................................F......r.."....r.."................O.l.e.............................................................................................................#.............O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .1.6........................................................................F........

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\5531FB74\1998_NC_Disclosure.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: 1998 Discloure Report, Subject: 1998 Discloure Report, Author: James Lell, Last Saved By: James Lell, Revision Number: 101, Total Editing Time: 08:02:50, Last Printed: Sun Jun 27 21:04:02 1999, Last Saved Time/Date: Tue Feb 22 13:39:32 2005, Create Time/Date: Tue Jun 15 22:03:11 1999, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	442368
Entropy (8bit):	5.764291489711934
Encrypted:	false
SSDEEP:	1536:gqriKCi4JCS0DlTzwKg3Vj/I+HJL9uEXueM5g2ggLR4BZG3OF6OIIKE85+DN:gq0I5cJXXuQ4
MD5:	4623BE2BABA8AF4A48897E14029EE29F
SHA1:	12F217A06B3ADD4A579D6E6F4BFF0D60D44F256D
SHA-256:	24A472D4FD42007DE58116171D84B77906C90D6781C835CCFFF1F3DD704A074B
SHA-512:	423FD6ECC7F377CAC0EECB7F5B173171E6545FFBAE2964CC33A85114D9D62F783D0ABB6B83C3E00C127A58E74ABDD3CD28B420E503EDAA78B0BF485C22CF7235
Malicious:	false
Preview:	......................>...................................................~...............0...................................................................................................................................................................................................................................................................................................................................................................................................................................S.u.b.d.o.c.u.m.e.n.t. .8.9.....................................................................................................C.o.n.t.e.n.t.s..........................................................................................................L......D.a.t.a.b.a.s.e. .(.T.L.V.).............................................................................................t.......S.u.b.d.o.c.u.m.e.n.t. .1.0.1................................... ...................................0...

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\5531FB74\Accounts.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Account List, Subject: Account List, Author: James Lell, Last Saved By: James Lell, Revision Number: 47, Total Editing Time: 07:03:51, Last Printed: Sun Jun 27 21:04:02 1999, Last Saved Time/Date: Tue Feb 22 13:38:30 2005, Create Time/Date: Tue Jun 15 22:03:11 1999, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	17408
Entropy (8bit):	5.353280867175744
Encrypted:	false
SSDEEP:	192:en+EcA/aGyp318p8x3Wb5vNxjOJMHCdrYvQqFvAi1mnYuA8Z7Bu7P7Z7b7gUSA7Q:BjASGyp3uNhJ73O
MD5:	1A6030B5072235B0965869D19E08A9BB
SHA1:	BB3A30F534C655B1E2726219CA5BF49B817A2C58
SHA-256:	17098538A0A0EB865ECBAA17D00CFD09AB83400DA70BC9AE467C506E0F05CBA7
SHA-512:	2313A99DA787F451009A3BEC94BD4BFECA8A9FCBCAED3954F2923918B0DC1BBEE9E69E82AC978E864E1291692020F246D22F30D5FEF1EB8BBE78901B516EB3F9
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\5531FB74\Contributions.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Contributions List, Subject: Contributions List, Author: James Lell, Last Saved By: James Lell, Revision Number: 113, Total Editing Time: 12:36:42, Last Printed: Tue Aug 18 20:22:57 1998, Last Saved Time/Date: Tue Feb 22 13:33:52 2005, Create Time/Date: Sun Feb 9 18:04:38 1997, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional
Category:	dropped
Size (bytes):	47104
Entropy (8bit):	5.729017991338511
Encrypted:	false
SSDEEP:	384:gYbjI9PoSInCZuHqSTMRHXu+I3PWoCYnp:gYXGoB
MD5:	A02E3ED15993B8B8CF631068941EFDFA
SHA1:	68609F9F0CCBF698D602F15DF2783ED919B48DE3
SHA-256:	19EEE76FD82EC48C325BC696D85989C20BA39DC4D9903C440ECC8A3A91A9E2CC
SHA-512:	997B08C754A5D0625F39311971BB6113C44EE69F9DB7C3B6D1EC676C9591FCFFD40E428A042A677CB2237DCBE1AD7CDCB463BF721365C9541BD2CEFEB27EDC29
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\5531FB74\Cover.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Disclosure Report Cover, Subject: Disclosure Report Cover, Author: James Lell, Last Saved By: James Lell, Revision Number: 71, Total Editing Time: 09:09:36, Last Printed: Sun Jun 27 21:04:02 1999, Last Saved Time/Date: Mon Feb 21 14:12:42 2005, Create Time/Date: Tue Jun 15 22:03:11 1999, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	102993
Entropy (8bit):	5.775513240751137
Encrypted:	false
SSDEEP:	384:8iPllYflrU4GTGvsz057kQz5xACSYwp3m6MgqGFSIU5DmQ6rfmsduaaahWpQCcxI:ZllI+DQzXAgg3cDtjpM3a
MD5:	D6C23BB2D2B74DE1C9C452C58ECB7477
SHA1:	63409B79C746B01C0F12A76BB511849D77B709A2
SHA-256:	956C888758279B814FEDD7F48D76DFD49F5DF7C75A3FD23FDE0F97BAF0D710AE
SHA-512:	A43BEACAD2716DF068C68F5FEEB529BBBB2D89706ECC9604BF86F422F26558C98C304387CE134408E329D550E0978F385E0825ED15F4ACD88B94095EB0473A96
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\5531FB74\Debts.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Debts and Obligations List, Subject: Debts and Obligations List, Author: James Lell, Last Saved By: James Lell, Revision Number: 74, Total Editing Time: 05:41:49, Last Printed: Wed Dec 18 13:51:44 1996, Last Saved Time/Date: Tue Feb 22 13:38:41 2005, Create Time/Date: Sun Feb 9 19:12:49 1997, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional
Category:	dropped
Size (bytes):	52224
Entropy (8bit):	5.638520545168639
Encrypted:	false
SSDEEP:	384:VA3VCHSQW4z84Bd9CGLVJkhzWRajCIFaydsm4GM:VA3VCyVR4BRyK
MD5:	C5B71EFA6AFA72802DFD0D8055D128D8
SHA1:	77DA5148A255488EB4BD30493D2D3BD6DF11735C
SHA-256:	8F16CC0CB03D6406F4C6A7612F4C9D94D43DA774FC1C6662D76329B177B91F19
SHA-512:	5C8F634210E3E75F0EFF3975112E7C30AD166B1F8067AFBA65155F6339D198F10E5B5CC2D89CBD2422C32E0AA44EE75F4B00E5F3D936C03C360A3DBA1F0F45EE
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...........................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\5531FB74\Expenditures.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Expenditures List, Subject: Expenditures List, Author: James Lell, Last Saved By: James Lell, Revision Number: 74, Total Editing Time: 09:02:18, Last Printed: Wed Dec 18 13:51:44 1996, Last Saved Time/Date: Tue Feb 22 13:38:47 2005, Create Time/Date: Sun Feb 9 19:12:49 1997, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	5.681619568331793
Encrypted:	false
SSDEEP:	192:DNBaBX0B2BUz5jTRE8gxgdPk4tHze8yYWU8M1lt/EsrAmbaplydwDyTgzIF8WPka:ohmNx/zLbkuMC9OqjHWN/VYQBSSu/p
MD5:	761DBD0A2426A34D51F3362C051B37F9
SHA1:	5CC1CC3206398C6D7C121EBD2F676C36E9833A94
SHA-256:	1C0FC5BD6548947A189BED1A0EC51661528A725202E35792D9699C73C095B796
SHA-512:	D437D6041EC1A412415AE1F99EFB040D8E137378A53CCD9B03F26B1CE38C32ED1294C23D7264C6D8FF59CF39D26B9FF86747AFE7AC99EC7CB50DAB89F5F13C70
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\5531FB74\LoanEndorsers.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Endorsers List, Subject: Endorsers List, Author: James Lell, Last Saved By: James Lell, Revision Number: 45, Total Editing Time: 03:21:14, Last Saved Time/Date: Tue Feb 22 13:38:54 2005, Create Time/Date: Thu Dec 19 13:29:16 1996, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional, Security: 0
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.421908987486584
Encrypted:	false
SSDEEP:	192:2LAHPNxk0i2OLPU8GV8BErS8x3Wb5vNxjOJMHCdr5w7lqm9AmAYm9quAm97ZyPbF:W47k33/MrM4A
MD5:	BFCC78606337F1ADD7B87FC8E1C8C734
SHA1:	99B2673556D8A8730DDF60BA15A58BDAAFC9FC4A
SHA-256:	85CE8C392A2E7FEEE7FABE7A1F3E0F70C7F61F0EF20203EA343F025017803EEA
SHA-512:	7CC684AE706896B4D4C624941C7D71E6CF8D4C388FC02ABA50DAA23FDE8F9A145C0E998788FF01A9902AF469103281FC8B378F902BCD5E9DBB21DF2C6FADA27A
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!.......................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\5531FB74\LoanProceeds.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Loan Proceeds List, Subject: Loan Proceeds List, Author: James Lell, Last Saved By: James Lell, Revision Number: 71, Total Editing Time: 05:07:43, Last Saved Time/Date: Tue Feb 22 13:39:05 2005, Create Time/Date: Thu Dec 19 13:29:16 1996, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional, Security: 0
Category:	dropped
Size (bytes):	59904
Entropy (8bit):	5.764839915499194
Encrypted:	false
SSDEEP:	384:2VsucDl8+hn7iszAu1YYDJP99qdKjHFCvCiZ/sHxz/JJ2afOj:isu+uu1YY1Pb
MD5:	DEF0B47C2A857A3380C7DD9FC55BD7AA
SHA1:	A42C01237FCEB20AF3C679ACAE403EE64FF0A080
SHA-256:	AC75DAC13D2DA4BB0AA279C8FB4C45EB2235111F30C76602861768147D61ED98
SHA-512:	CBA2B92BEA3EEA5E8ACC866AEE856BEEEC8DFCFF7470E5CDB22C7DA5E0AB48682EBD9966D00B11EAF750533FDFB0409145671FAABA93FEDC1EFAFA6386B7234D
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...............................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\5531FB74\LoanRepayments.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Loan Repayments List, Subject: Loan Repayments List, Author: James Lell, Last Saved By: James Lell, Revision Number: 33, Total Editing Time: 02:32:42, Last Saved Time/Date: Tue Feb 22 13:39:11 2005, Create Time/Date: Fri Dec 20 15:00:22 1996, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports Professional, Security: 0
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6245741985399995
Encrypted:	false
SSDEEP:	192:22EQNdickudiauN8dEZEQcAmbUipjatZkLWkC6lnU/c5HhW8x3b5vNxjOJMHCdru:0QN3ub55LOnz1BNdZSkw4fjjfnWX2R
MD5:	D96F0BFA34C620CB0904A5C7CD652D76
SHA1:	8848F994A2873BFA2BC73DFF35A8D1C617575DFF
SHA-256:	367CC798B9F28285A257274083D43D9CA34822AFBD0026BD7A6B407651AF5F38
SHA-512:	5207ACF7F10F23DB57FAB85126A7BE970C104088562128B2D982F9CF23C5177558DAAD6063E3A1897C0A1AE65A46D313FE9C32F4B394434455F00BB0E650D97E
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...............................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\5531FB74\Summary.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 3.10, Code page: 1252, Title: Summary, Subject: Summary, Author: James Lell, Last Saved By: James Lell, Revision Number: 50, Total Editing Time: 06:54:28, Last Printed: Sun Jun 27 21:04:02 1999, Last Saved Time/Date: Fri Jul 9 19:49:26 2004, Create Time/Date: Tue Jun 15 22:03:11 1999, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	93814
Entropy (8bit):	5.439847807690734
Encrypted:	false
SSDEEP:	384:SGmlkmzysH867TSqxdEjuPCPN2ScQ12ScrOgVzRDoYsg7VSclhhy6gGhJA1zfcOy:gtc67TSqtPCV2S0/
MD5:	AE82C60145B9DB14E62CFFEDCFDA30E6
SHA1:	8853BB15A95A0C0BAA23AFC99EC7CDB9303D4974
SHA-256:	164E5BD41A118A0075260EF11CC157C3AE23D6EC287E1C0F6C56AC0D97CBB627
SHA-512:	9189A0A9FD15A60BB293F3DDC9D9DBA1AA4EFBF23C70DB81E6A0CA12528F541ED09CB8B9359CEF9F7367BA05D22FF1C46DE8504154F41147CA00F9B462E74EAB
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\2007_Electioneering_Report.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Oct 15 14:21:07 2010, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Mon Feb 14 13:42:12 2011, Security: 0
Category:	dropped
Size (bytes):	607232
Entropy (8bit):	5.407342130384767
Encrypted:	false
SSDEEP:	6144:DPJo8DExbYmh3gZ+RwPONXoRjDhIcp0fDlavx+W/WEjGSZ+RwPONXoRjDhIcp0fe:DPJo8DExbuG6GA0
MD5:	B54AEDB3AEEA8EDEF964AB865229C237
SHA1:	D4037247E61D6ECE36F3534F38427E3F59B8B9B2
SHA-256:	9E3BC47402EFBF6F9E1217D2353B4ED2D633E4E0B889A8A14C4D1A2A5F48A67E
SHA-512:	99842D7DAFEB366E76004A6B5306ECCF6EC9AC92E76782F12B94DA6C37EE3552522DA3CE7B1381686B44BA210785959949AB0B2D363D2282F27E2906821C2B2D
Malicious:	false
Preview:	......................>.......................d.......................................}...\...[...Z...f.......o.................................................................................................................................................................................................................................................................................................................................................................................................................C.o.m.p.O.b.j.....................................................................................................~...r.........O.l.e.P.r.e.s.0.0.0...................................................................................................l ......S.u.b.d.o.c.u.m.e.n.t. .5.5.............................................@..............................:......:...............C.o.n.t.e.n.t.s.........................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\2007_FED_Disclosure.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Oct 16 21:17:12 2007, Create Time/Date: Tue Mar 18 18:48:47 2003, Last Saved Time/Date: Mon Oct 22 19:28:02 2007, Security: 0
Category:	dropped
Size (bytes):	625664
Entropy (8bit):	4.950657383336972
Encrypted:	false
SSDEEP:	3072:TQrFH2RZraHzLWTkjqEMONv9tKAd0oNhzwcAS66emLo4cOfpkcUd3MDwC6SaHfs5:TmqHeuZgz+OSXG/inxkDo
MD5:	740F31D396DCEF3D05BDED7BD483AFB1
SHA1:	F8F66D67B56C7033DEB75E51521F5A447AD34996
SHA-256:	FBED39F9C33EB26E82A9C20B6F90DE125D74D8168E596CD3D40D00ED7998CAB8
SHA-512:	7F4E86B98968760E6E7DF03FF65E4BDF99B961FB3768C7DB49DA5796302D6F711C3CAB22733FB2B20F84F9222F33E6B849BD6AABE51AB574954A34DC50E9C57A
Malicious:	false
Preview:	......................>...............................................................c.......~...............h...............................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.3.5.......................................................3...5...........................................\|...:.......T.h.i.s.W.o.r.k.b.o.o.k.................................................6...........................................l..........._.V.B.A._.P.R.O.J.E.C.T.............................................................................................>...O.......S.u.b.d.o.c.u.m.e.n.t. .6.8.................................................:...........................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\2007_Independent_Expenditure_Report.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 77, Total Editing Time: 03:30:42, Last Saved Time/Date: Tue Feb 15 18:26:50 2011, Create Time/Date: Mon Mar 22 15:03:08 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	488448
Entropy (8bit):	5.4462079439186635
Encrypted:	false
SSDEEP:	3072:dH3+Wiq7/cnF9G6Hlx/6uGUZdle9R/R1f4qzta896JboUEednkO8X7W:0rG6nSaZHQ4qJa896GsnkZ
MD5:	7AC4C6D7C7069B28B2EB439657BA0494
SHA1:	992D6D9DB36178139DBA882992E2D7ED9C175592
SHA-256:	87046ECB5B9DE39287DFDA261139352FAF81E8CF6A37FDF964A20BD9616FE732
SHA-512:	9716FC62672228B374FB537C8B02621DFAB592A2E8D757A474E001AF154214D1424A5AD9D1BFF70D77862F1F3BC4F681CF4B56DCA388E30B71809915BE0AD2BE
Malicious:	false
Preview:	......................>...............................................................................q.........................................................................................................................................................................................................................................................................................................................................................................................................................C.o.m.p.O.b.j.....................................................................................................D...r.........O.l.e.P.r.e.s.0.0.0...................................................................................................dB......S.u.b.d.o.c.u.m.e.n.t. .5............................................................................`..=....`..=...............C.o.n.t.e.n.t.s.........................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\2007_Muni_Voter-Owned_Election_Qualify_Report.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:51:41 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Wed Apr 29 22:15:36 2009, Security: 0
Category:	dropped
Size (bytes):	192512
Entropy (8bit):	5.007944223673486
Encrypted:	false
SSDEEP:	1536:RktWZ7Ut5HHsDYP8my+MXHwKY0/abtfiYIiVSfaSfV:r45HHsDSMXHwKY0/JtF
MD5:	A7F2BE0A9C76BEC9C49EB1373D5090D4
SHA1:	7369379F50FC341D466CC8A2B28EEDB854AB8C64
SHA-256:	FAA0526CA53536BEB1316741D680356DC81479982B2250C8798D0E6F91FD896E
SHA-512:	05AD1783BD4A2EE920C335CF2AB392C9DB856F15DA13EE7C509F59DB44900B17E93C901A862C540D6267CC75E322989D1C852F661D4E7BE2135D350DBC935EAE
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................V...........S.u.b.d.o.c.u.m.e.n.t. .6.2.................................................!...................................................C.o.n.t.e.n.t.s.........................................................#...............................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\2007_NC_Disclosure.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 12 20:34:40 2007, Create Time/Date: Tue Mar 18 18:36:59 2003, Last Saved Time/Date: Wed Dec 19 20:19:48 2007, Security: 0
Category:	dropped
Size (bytes):	4794368
Entropy (8bit):	5.157456740228194
Encrypted:	false
SSDEEP:	12288:m9v/Mkrk2keuK63GyEhFKT8Y6IOm8XqQEJj+8fZvR7S/z0Ie2tXK:m98GyR6NKSLt6
MD5:	544DA1BE09475C44146130A8FCB9B3BE
SHA1:	4513DFA718004166D674C9E6573FBBAF9C186B70
SHA-256:	09A127F8DD521F7E1D029B922EA63CB1BD6C75BFF74025C78758500DB481320D
SHA-512:	3DCC434E59EEFA896DBC4BDC97E13D06A4757804BB8EA04F17F7EEA86DB6B5F6C31E1C94867C177A4E84B4756A66678D93F54D4AC2126AFF42B24ED49504D95E
Malicious:	false
Preview:	......................>...................J...[#..............f...............Y...........2...........................).......v...........t.......................!.......S...........................P...\|...~...1...2...............M ..O ..............w..."...{...........v.......x.......z...y...............{.../.......}.......: ..K.......F...4....!...!..."..]#...#..U...............................................................................................................................................S.h.e.e.t.3.5.......................................................3...5...............................................A.......T.h.i.s.W.o.r.k.b.o.o.k.................................................6......................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................X...O.......S.u.b.d.o.c.u.m.e.n.t. .3.7.7................................... ...........:.......................P<d.

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\2007_Voter-Owned_Election_Qualify_Report.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:51:41 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Wed Apr 29 22:15:36 2009, Security: 0
Category:	dropped
Size (bytes):	188416
Entropy (8bit):	5.010132586463127
Encrypted:	false
SSDEEP:	1536:OO5mMgUei51+DbPc4MIwMXHwKY0/mbtPVYI9cSfaSfJ:ATi51+DanMXHwKY0/C3F
MD5:	A4F078FF359ADA243E48087C2CF00052
SHA1:	5E12458C8146DD365637A89B5B21930E48C108B2
SHA-256:	861FE0412A7C7BDBC203F4C8E70959F03DF97949DAD70E725CCD6B193E972A48
SHA-512:	250DF78987D7DCC9CD13B17EC00CA67AE5AE23FF0356F7D9096C9F948CEDB1EB334E818BEC3B3E945A5A6F575EDAF7EB42CD3FC2072F043B0797C6B0EAED6499
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.3.5...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................V..._.......S.u.b.d.o.c.u.m.e.n.t. .5.5.............................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1000.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Sep 29 22:25:01 2008, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Tue Sep 30 17:11:16 2008, Security: 0
Category:	dropped
Size (bytes):	277199
Entropy (8bit):	4.955204919765509
Encrypted:	false
SSDEEP:	3072:A83b1ABghpv/5/vR6xyPk3kHgC6tgd9bA3wOsWU7YoWIGLtXqSEB6Wrp9RdrW+Z+:AQABghpv/5/vR6xyPk3kj8fZvRwY
MD5:	C1C49AEF91B5BD6B09A0D16DE5B5A1A8
SHA1:	3BCEAFC0D57E4806D853E5CAFBDF83C58D9AD543
SHA-256:	68F186EB404BB675258B7A37F436EF8CAE0CE0C99CE99A3E7405AD73014FC213
SHA-512:	1DAD02580762635B05900A44F272F64AC084EEB913B904B9BA69A44E56A116D92B6E73EF4E1A2495441D1D1F6E6678DAA584B1D07116F2BAE0F04A7C3A83AD1A
Malicious:	false
Preview:	......................>....................................................... .......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1010.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Dec 10 15:09:59 2007, Create Time/Date: Tue Mar 18 18:32:55 2003, Last Saved Time/Date: Wed Dec 19 19:22:20 2007, Security: 0
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	4.729959959151051
Encrypted:	false
SSDEEP:	1536:yYQlKGozYa7z986/yv/C/vABgvp5RhnJvq:yYQlKGozYa7z9byv/C/vABgvp5RhnJv
MD5:	6106AD996499E23B00951728597CCFA9
SHA1:	2A0925E3FA17D899BEACA18C7FDA025CFC23594E
SHA-256:	39165D6F20199D558C3DD18966B64523636C0C9ADA65C4A1BA3A4E8DB9999B61
SHA-512:	6AC84F98E24B1BAF384BDAA7B7DB12BA7B427E895FD1B81EB2B8902820E606227FEC837BB0C2C3519E94F12B16D6E5601FD1EC89235C28CE024CE3C6EE6D361D
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1100.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Wed Sep 24 18:58:40 2008, Create Time/Date: Tue Mar 18 18:33:40 2003, Last Saved Time/Date: Wed Oct 8 17:43:19 2008, Security: 0
Category:	dropped
Size (bytes):	179642
Entropy (8bit):	5.166216624571424
Encrypted:	false
SSDEEP:	768:/pwcx63BOdZ8FNq+cqbVozkajO32K9E9vjwWR9OqQHuqXhoOunwXyRZL7W:6cx/dqFNEqhoA3XwvAF6xnwiRxW
MD5:	62F7E5138E3377191BA9809FD25E3052
SHA1:	AA896EECBB096365E52FC60D1D971EDCE8C45D73
SHA-256:	27BE3E35FBDED425853F321AA82115B85D4E9D03BDA9986F58ED78D174AE3259
SHA-512:	D015AE587566DDB0520C47021684C3F1B373B3A9647445F937B60A6BF1175A22DF4BF41E35CB140999BB58BEAF33D627589F3755AFB84FD04408407EEDE251BE
Malicious:	false
Preview:	......................>.......................................................k........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...%.......&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...].......................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1205.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 12 20:37:09 2007, Create Time/Date: Wed Mar 19 14:57:07 2003, Last Saved Time/Date: Mon Oct 22 14:25:42 2007, Security: 0
Category:	dropped
Size (bytes):	182784
Entropy (8bit):	4.952399645110275
Encrypted:	false
SSDEEP:	3072:TXrzxidmGZKpR/V1Z2gnM815Usm8oPKcz4JyKYFf4XgQLtIyumEk/np0aVfUOBGW:5SkIDk6Fk
MD5:	D4132237EB41C001172379B0CFBD2716
SHA1:	F650B72162CFE3C41FBC3BB060A1F7A61025E922
SHA-256:	B639182A4F1DD0297405DB3123413041F130C8358545AEBB8346132FEC5FBE1C
SHA-512:	4027D8DD1303EB2A2BF0274F4D62AA38553B2C2520F448BDCA49B0B84DB5E4CD80A5BC172E2FB77EEC0F6B47BFC3E24BD056EDA5154B5D6FCFC04030F40CB26D
Malicious:	false
Preview:	......................>.......................................................n...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1210.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 12 20:08:58 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Mon Oct 22 14:29:10 2007, Security: 0
Category:	dropped
Size (bytes):	185201
Entropy (8bit):	5.240949811968868
Encrypted:	false
SSDEEP:	3072:lZ4aXxE0IeiZAqCfBFANfkF/CamYMfXFpAaZ5mSAAmTvC8s7GopsOG+8F/I:a
MD5:	CDDFB8A098D01B326568A8934542E6FD
SHA1:	810056460BCD69778469E80499B1B8A5ABF10689
SHA-256:	23EFA47355AC238926FDD2F156959CB828F3B56F233B32B6191E590620D845DF
SHA-512:	17F5AAAB78AD19DA3B44260E3142E928558C1C28BD30DC0357D2E841072BC88AE9ADC08C0479F7D14C79190A4EDA814FE81D8DDD4AA802B1A77BCEAFD60675DE
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...[.......\...]...^..._...`...a...b...c...d...e...f...g...h...........................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1215.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Jan 3 14:48:09 2008, Create Time/Date: Tue Mar 18 18:37:23 2003, Last Saved Time/Date: Thu Jan 3 14:48:33 2008, Security: 0
Category:	dropped
Size (bytes):	168448
Entropy (8bit):	5.202527529762482
Encrypted:	false
SSDEEP:	3072:6urIsxEywEw+001sKJY0yNnQiawtVanTTWukckYPSKjggF0M61LIiOIE1zeG9GXn:+yp3
MD5:	921173462DF6CC5BE5AA6E7F1C9F19D0
SHA1:	64A7090A11E0DED04E3F13AA70C0AED377DB0EDF
SHA-256:	CCF9CC5D1E823E08443BE7ADCD00B20B2975B694226DE83CE4D66F8A2E7F985B
SHA-512:	BBF4A1E7380D727BA46223032CBBB8FEAB208C08291DCF5C588F205628FEC74672EFA2A61A03B9EE302E02811245C1A335D2D3E2D5A29E47EA6D2270AB519BC3
Malicious:	false
Preview:	......................>.......................................................H...[...........................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1220.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Apr 13 20:48:40 2007, Create Time/Date: Tue Mar 18 18:36:01 2003, Last Saved Time/Date: Mon Oct 22 14:45:49 2007, Security: 0
Category:	dropped
Size (bytes):	150016
Entropy (8bit):	5.205596829097363
Encrypted:	false
SSDEEP:	1536:2W6NZmGBWou83Gngj6uPMzsWT3fki8oaKo/M4iTuRR:2W6NZmGBWoBGngj6uPMzxB8oaKo/M
MD5:	A088F0800E0E423C554231B891E59390
SHA1:	C345820606D84BB6529876F4F02D82C25DE22707
SHA-256:	C7AB5E1C7436A1A4C405A77975716247FB177B19AF52DD58E8275B68A524E3B9
SHA-512:	CE0D4E040DC1426274E2BC96CC3F997866EEE53E8A6CF8E77246E38E9C2D537A32FBC2190657667E047994DA39A0033F75D2ADFE9BA1A29881B40D1DDDF98882
Malicious:	false
Preview:	......................>.......................w...............................y...H...........................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1230.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 12 20:12:11 2007, Create Time/Date: Tue Mar 18 18:36:29 2003, Last Saved Time/Date: Mon Oct 22 14:51:19 2007, Security: 0
Category:	dropped
Size (bytes):	206658
Entropy (8bit):	5.156970374644571
Encrypted:	false
SSDEEP:	3072:gMPxdYIMwBzRn3Y5LoGMicjtGTD8x/0LUdheW/zXni8yV5Gr920W8y8a50032gSs:EKhK
MD5:	B6C3CE1000718B8957385CAE877FAEE5
SHA1:	0725EA60150FBA6EC4D98719193AF6A7212B609C
SHA-256:	5D45D44FFDBEE1BDEAFD1082651EF382164B646F75C53720D0D37E1FEB9C1BEA
SHA-512:	0D29BBCF4DBBD8E1DB670D662BB3471E315DFA90DBF23D36E921B39F7A98E8A5DED836CD2E4AB643FEF9039D8F68A2D0C2EDF440967D494EFDF30E59EA29C0EB
Malicious:	false
Preview:	......................>.......................................................S.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1240.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Apr 12 20:34:40 2007, Create Time/Date: Tue Mar 18 18:36:59 2003, Last Saved Time/Date: Wed Dec 19 20:19:59 2007, Security: 0
Category:	dropped
Size (bytes):	207407
Entropy (8bit):	5.130835054236678
Encrypted:	false
SSDEEP:	3072:6mmZR4NTY+fBFvgipoLoJtpu6ndNVE6JsjNNKuX4Nrr9fO0Ehz0tmlgkArzOQAI5:6b8tx
MD5:	83E657E047E43622F4BBCEAE2E3ED26C
SHA1:	6B57E3230F7EB72E477AEDB6E48414E756108C2B
SHA-256:	CBF8CC5001E9509BB035677C6106EF50B74AF9146FDBBD6CB1A2D273A59C7C93
SHA-512:	D6514F1D0BF39089B7DE336BFA0BAC1983E006373CFAC35BC8F03D6A656F8CE1A40499558F8289A1D0D1727C3D3662E9AA169ABE35E033C4DE814CAC37F8FD69
Malicious:	false
Preview:	......................>.......................................................H.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1250.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Wed Dec 12 20:36:55 2007, Create Time/Date: Tue Mar 18 18:37:23 2003, Last Saved Time/Date: Wed Dec 19 20:23:26 2007, Security: 0
Category:	dropped
Size (bytes):	165376
Entropy (8bit):	5.204630458042751
Encrypted:	false
SSDEEP:	3072:JQZ7yok/viUkLZqhZnQeGfJDLsPO46kG/B+:Ig
MD5:	6742E11F8276F6F9B4310F9A505922C6
SHA1:	B63BD30E24C7310953E5C93E24FD41E32E742902
SHA-256:	DF570C2774335D78B52FE6F814C2CC28EC7A550D779E1FBAC909BE924F319977
SHA-512:	76E07A69587EF15CF26071D0CE3FD7438182F779AEB85EDEEB8512EA81DFF949FBF6D49B1D83F5A7BD2F11C29C2686D5B01F75C7563E86D1971762CEACB5F75B
Malicious:	false
Preview:	......................>...........................................................U...........................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.................................................................................................7...................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1260.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 77, Total Editing Time: 13:19:08, Last Printed: Fri Nov 19 19:45:23 2004, Last Saved Time/Date: Fri Jan 21 14:19:25 2005, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	87552
Entropy (8bit):	5.292860622249849
Encrypted:	false
SSDEEP:	384:0IVAgpIDVV3pdY7J84+ZEHnUzmLmCnFJBPncQ5olvPmKgTQVbDpdTC0xIBpIlxyi:UBHpS64+ZEHn0CnVPncxcA
MD5:	D57ABF650F3A7C4ABAFE3A95464A576E
SHA1:	888CC2AB4F445D3C25F5030ABC91839D7A75F015
SHA-256:	4F11CC3F6D5DBA4EC2B1A05ABF3819BA081F21131B80F092F0E8A4EC0E8109A4
SHA-512:	C46831025A5856D9559A9EE045105931441F2EF813202FCA6DFD7E33D71CF63175103BAB94E4F0F07E98E66E21746B182C9F550942E3CECBCB655437FC48509C
Malicious:	false
Preview:	......................>.......................@...........0...................................................................................................................................................................................................................................................................................................................................................................................................................................................................E.m.b.e.d.d.i.n.g. .3.2........................................................................F......5....`\|.5..................O.l.e.............................................................................................................8.............O.l.e.P.r.e.s.0.0.0....................................................................................................:......E.m.b.e.d.d.i.n.g. .3.4........................................................................F.... ..5

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1265.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Thu Oct 2 21:58:32 2008, Create Time/Date: Tue Mar 18 18:38:43 2003, Last Saved Time/Date: Tue Oct 7 22:00:07 2008, Security: 0
Category:	dropped
Size (bytes):	179200
Entropy (8bit):	4.971791860235385
Encrypted:	false
SSDEEP:	3072:8gDFkCHwgaAaIpyGreKLZOpjlbu9yz1LCAcZ/8z5tSZOcOtuA8YLahxbRvaZJSCf:8Qcjwf
MD5:	C39EC68DC1C973913E5680996790FE4D
SHA1:	D9EB6D942E3F5F7901D9242F8C63A0982090544F
SHA-256:	2F1987D27D8BF22DAAC561C2C7A078BCC9EAFA35414ED36C624A6E72A1FED69B
SHA-512:	B97B290FF58EF29C3A29282FFAE0E878A3232BA2F6EAF7368BB5A75643E32BB7BA6F3BD2F756AFF772CDAAB0434211F61C1E1AC8C92098A8810034CA872C5264
Malicious:	false
Preview:	......................>.......................................................G...............................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.3.2.......................................................#...%...............................................Y.......T.h.i.s.W.o.r.k.b.o.o.k.................................................&......................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................U...y.......E.m.b.e.d.d.i.n.g. .3.4.............................................O......./... ..............F....`..y

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1270.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Nov 16 20:33:18 2009, Create Time/Date: Tue Mar 18 18:37:23 2003, Last Saved Time/Date: Mon Dec 21 15:58:40 2009, Security: 0
Category:	dropped
Size (bytes):	258048
Entropy (8bit):	4.950934717075591
Encrypted:	false
SSDEEP:	3072:1P1JR2biO95hFqzw8mFJjefgL/ezzrUt6rDTUVykn3T+sNdhKnJgHxXbyjQYmxFQ:Xu
MD5:	D46A8E06CF758CE784DAB6A346C18CC2
SHA1:	5FC8A9A21870F50138241F374A9EC4F81C308827
SHA-256:	EFB54DCAA6451E8820004655327485E7A9C76E57766819A3285B29536F0AD5B2
SHA-512:	1E2AC43866C5C3AB826955DAF76FEDD6C1DEACC48D208F28DF68E7DF46C7AF4D48A10F5298732B5AB8485F065F40542329C4CF93A77756E30E2325FFF01B49CE
Malicious:	false
Preview:	......................>.......................................................r...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................l...............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1305.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue May 8 15:48:55 2007, Create Time/Date: Wed Mar 19 14:57:07 2003, Last Saved Time/Date: Mon Oct 22 15:14:45 2007, Security: 0
Category:	dropped
Size (bytes):	186880
Entropy (8bit):	4.934801965469349
Encrypted:	false
SSDEEP:	3072:o87jT9+1SaVWBR7VFlScnEQVJIwqccjmUr0tGCMhH0bgkbVci2REk7EXX6lHMqVX:oMjkDkPHk
MD5:	3C139956F2E1AAAC4FBA589907644095
SHA1:	E1E86F73DAEA1EDD3B5C1361DCEC1DD2A7B42697
SHA-256:	F1638B572DF258D7BB77E2F4DA6CF00B30DCCB40A5B43DBB82B251673DB41559
SHA-512:	139BEB1D1FAEFBDE2EBB39909102444BF87A5A64E8AAF1269C3B7AF930FF5413FC5ED33AFE346ED40C26C955BA98C7AE9862F8A121E7476983835BE2D994CB9B
Malicious:	false
Preview:	......................>.......................................................n...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.................................................................................................\...................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1310.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Nov 17 16:11:09 2009, Create Time/Date: Tue Mar 18 18:39:02 2003, Last Saved Time/Date: Mon Dec 21 16:03:24 2009, Security: 0
Category:	dropped
Size (bytes):	253952
Entropy (8bit):	4.88787880649354
Encrypted:	false
SSDEEP:	3072:4OpY1fX4D+QYNyPyELBJ6s0HBp08DS/X/UMmoDX48jp+oUP1jRnx+Us/56AxRqm4:y02Zz
MD5:	BB8CEB43E879AFFC33789AB3A02C78FA
SHA1:	0C75F019D84546AF18C10B0CB4DA2F4F41D43DAA
SHA-256:	1A9EA3240F75F09A639DA23CADCB1523E6EA5C9D3E37DC3D1AEC8D309D29CE1C
SHA-512:	E64DA3919089C1F32CB9F53C7A1A0647D477D84AFE48621FE0318770DB17E324E6A782D50E85556F139D509D45A2EE1A7A7334C9E3E07A189A15B8FC9BCC9F1F
Malicious:	false
Preview:	......................>.......................................................]..............................................................................................................................................................................................................................................................................................................................................................................................................................................._._.S.R.P._.3.......................................................+...-.......................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................u...........E.m.b.e.d.d.i.n.g. .5.1.............................................[.......7... ..............F.....T0.

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1315.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: Template, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Wed Dec 23 13:23:38 2009, Create Time/Date: Fri Sep 18 14:41:55 2009, Last Saved Time/Date: Wed Dec 23 13:29:52 2009, Security: 0
Category:	dropped
Size (bytes):	221696
Entropy (8bit):	4.852220976251422
Encrypted:	false
SSDEEP:	3072:lyx6XPLzL0eeyD3xPNkzv5OLJYFRydDaQTD6lo5wUixc2CwfVzkFt4htDDXPUK+8:cxPk0v
MD5:	F75B99D5796990BA2E531D625E00FB2E
SHA1:	4CC6F255FB99858909B7CF37476F3822678C0F6D
SHA-256:	DE6274B458ABB143F4832E93E7BE4D8C13044204ADB442A235D8DCA18A06C860
SHA-512:	EB71CE8F3641C01551EB9AD28D6B746028D8A5786F3C055C9C7F6106318E0A10572C8A902AB080AE39EA8E33DAFA03AC55383039E05179B66271172D0AF8EA10
Malicious:	false
Preview:	......................>.......................................................r...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1320.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jul 6 16:30:49 2007, Create Time/Date: Tue Mar 18 18:39:25 2003, Last Saved Time/Date: Mon Oct 22 15:23:52 2007, Security: 0
Category:	dropped
Size (bytes):	209920
Entropy (8bit):	5.072464260495382
Encrypted:	false
SSDEEP:	3072:HLIBwkq9NAIoSzQ0S7SIZGBRA4R7BnRMbp9Rt7rG6+sdoaSYt9awFUYBaNERBAQU:r8t
MD5:	2FBD7AAF164C869883BEC2BCA05010A7
SHA1:	FE725E820949A2C5D065ECFE0DFA0E8AE7A69F5B
SHA-256:	3DDEDB67316FE565FFAD865ED2D6DD574C3D6AA230A35E20C7E1C01344C8E0F1
SHA-512:	7AB12BBC73486ABFB52D94C147B70981B90271609AAFE45BD25535F28B2A53179A389670758640D839A3A8EC67E6A615599008251887E3C9BFEF71AC13E421C9
Malicious:	false
Preview:	......................>.......................................................I.......l.......................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1330.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Dec 10 15:31:24 2007, Create Time/Date: Tue Mar 18 18:39:46 2003, Last Saved Time/Date: Thu Dec 20 12:45:54 2007, Security: 0
Category:	dropped
Size (bytes):	225792
Entropy (8bit):	4.958937507406109
Encrypted:	false
SSDEEP:	3072:HlrC1rCMbggED9nSChJ5BGPIrjTG2ldhg4Z0TlLFhd7pq753VLW3wLEdZGGS+F0y:UxV
MD5:	CD5E5B4E39ECA860862276250E7F25D2
SHA1:	531B5ABB29CEA928C9CCD01B0C721AA0188F342E
SHA-256:	908A0E47CF765F28A66ED79EC769792FA715CBBD3861EBAD833CFCE93375FCA6
SHA-512:	E9A2AFFB0DC8ACD871E13E777CD09A5C9E4BB912252AFC4AB4EF40E088536E5DFE54CE4DEDDF5BEB8B1ABC64CDB221BDF3F96DED417B191038EAA22184848B7E
Malicious:	false
Preview:	......................>...................................................W...Y...............................................................................................................................................................................................................................................................................................................................................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k.................................................9......................................................._.V.B.A._.P.R.O.J.E.C.T.................................................................................................q.......E.m.b.e.d.d.i.n.g. .5.0.............................................p.......J... ..............F....P.D..C...E..C................O.l.e.................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1410.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Apr 13 21:15:00 2007, Create Time/Date: Tue Mar 18 18:40:06 2003, Last Saved Time/Date: Mon Oct 22 15:34:20 2007, Security: 0
Category:	dropped
Size (bytes):	149504
Entropy (8bit):	5.15953513117498
Encrypted:	false
SSDEEP:	768:Ycv3JYOB0T8OEpgwJmvmEGcDKCwaEzJGmG1OnS6fJwaEPz54:YiO8OEp30vOcDKtPVGmGInS6fWPPC
MD5:	4C745F24AB6AD29C007BBCC4ACBD0192
SHA1:	5A40DFC1CE95AAFD3869E55A91250239A35A2944
SHA-256:	DBB69B1CCE9B73FAD9CE55FF4E340131AA3DFCCA7C641551E5CF6FCD586CD4EF
SHA-512:	9001287CF61BFDFF81B20F6864FAAA3A2EC7DA7D278D411130CE1C89086E38DE643FB9D402C09D3B203009E181B57013D6A9A3FC13C213DFE19DB0D653C09B4B
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1420.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Dec 10 15:45:28 2007, Create Time/Date: Tue Mar 18 18:40:26 2003, Last Saved Time/Date: Thu Dec 20 12:49:10 2007, Security: 0
Category:	dropped
Size (bytes):	146432
Entropy (8bit):	5.063673625152432
Encrypted:	false
SSDEEP:	1536:BGf37BCzwSJ43KyN3DEXrz4wn7KKgKLli1+49:Af37BCzwSWKyN3DEXfn7KKgKLli4
MD5:	16E2E8C47A83FA4CBA0EF9969DD3EAEA
SHA1:	7B9CF6EB74205A42A27166F24347F17433AAE122
SHA-256:	30D816129634F858170327E77DDD28C02F631FE76EAC00D28434CA167E635C57
SHA-512:	046C63E6135EC52EEEDA975A69BC159E004A5EF58D6729C6766E28AD56B5599AA5F3495F8AA0B9ACBC13D523B1F71B9DC0CD7F5A828DE1069879206A4287DE33
Malicious:	false
Preview:	......................>.......................{...............................}...J...........................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1430.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 11 21:22:12 2007, Create Time/Date: Tue Mar 18 18:40:48 2003, Last Saved Time/Date: Thu Dec 20 12:51:53 2007, Security: 0
Category:	dropped
Size (bytes):	143872
Entropy (8bit):	5.048937898720221
Encrypted:	false
SSDEEP:	3072:SEgHKAt1aapBgC9y3Nu/2eX76vUbBKYe/CTLlm1:SEgHKAt1aa1/HKF
MD5:	37BF265114AC548A613E0F811A4E14AA
SHA1:	7EEBD6C38835BC0E2561D3CCBFD0682E5C125889
SHA-256:	27ED2A6B9FE0961396D609EC771E13FB96AE8771BDD125AB45B0849224CA9A91
SHA-512:	D9C9F8EE1C66C2255C9A03057FA29563791A4309E6B299D91B83190EC06F173247DC2B6883C4C403AEA20C75774D567F7D1D07D09A4398FBDD2069CC6CD744BC
Malicious:	false
Preview:	......................>.......................x...............................}..............................................................................................................................................................................................................................................................................................................................................................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................U...........E.m.b.e.d.d.i.n.g. .5.8.............................................5.......!... ..............F.....hO.C...hO.C................O.l.e.........................................................................................................................C.t.l.s................................................................. ...............................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1440.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: sboetest, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 11 20:56:44 2007, Create Time/Date: Fri Apr 4 21:28:15 2003, Last Saved Time/Date: Thu Dec 20 12:55:10 2007, Security: 0
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	5.157600548856342
Encrypted:	false
SSDEEP:	768:2AuLeepR5sEeSGQk9dq7WEbZFFeQkhwX06timb2/WxDjVaj6gKQk2nuKQ:2AqbsEeEPbZFdYS0K2/Wx/Vaj6m7a
MD5:	1AB6467BB94BFA8E94830B2C7857ECEE
SHA1:	D0571B1EEEA6411F837FBF725F2365A8C52F022F
SHA-256:	14F8DEB2F3CA26B3B5890CA042D3BAE02080A105789EB05504DFE0B956285ABF
SHA-512:	FEDC72819025644B7CEBC93C1AF7008E2F4E05C5ECFDF2E62947705CD0B7F8CBF13C33CD27BBC68A50DFDE27AE08514D0E62125EBFD02BB9ED1A22C8FF76326D
Malicious:	false
Preview:	......................>.......................o...............................r...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1510.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Dec 10 15:57:10 2007, Create Time/Date: Tue Mar 18 18:41:35 2003, Last Saved Time/Date: Thu Dec 20 13:08:22 2007, Security: 0
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	5.043187868752451
Encrypted:	false
SSDEEP:	3072:OFoAmv0dDkBDZ5DolqUzTHvUmq7qAap18NCXxrJftxOqfUCfOWenNZwUq73aRYdH:0x7wkZ
MD5:	B3A51CE1A4426170A893BD555B37F02E
SHA1:	863DF9EB5D3CEBE077CBF887656E86B7E4D73397
SHA-256:	0924764EAABC8A2D479EB9DA07A9B03780F3382C8DE6B72BE6DFFFF346607A34
SHA-512:	D9A1FB8C6362B17494574D9C718C931FE7DEA85CD0420180B0A48196AF1568E6CCD9013D1E03339AA0E2D903EC57555314105B1EEAE5F4447707D6CB9EEE94D0
Malicious:	false
Preview:	......................>...................................................M...N...............................................................................................................................................................................................................................................................................................................................................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k.................................................-......................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................s...........E.m.b.e.d.d.i.n.g. .6.0.............................................X.......>... ..............F.... ..D.d.....D.d................O.l.e.................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1610.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 116, Total Editing Time: 1d+04:18:33, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Tue Apr 5 12:05:46 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	334424
Entropy (8bit):	5.342674465414266
Encrypted:	false
SSDEEP:	1536:7jO3+tEK0cDamfB2LkNBn0FVs3J0E43q0cmfB2LkNBn0ICGcLI4DMHdjuTEzrIIw:G32EKF6VEJ0EtKCGH9jGEz0IeSdq
MD5:	F17BF9315C6397B804496247421E8E24
SHA1:	3DF470B8684DAC414FF7D6AF3175AA35A14B84DC
SHA-256:	98605AEE454F9557B227622FB414270301E4F63B79947D766129DCE16CD17E66
SHA-512:	B45CACD79F16664A2923635F70083130AA9C6637B6A1AAACE52670DCE21D28064C682CDC751BBE188CBB0544AB6861587836435DABB6188DA865AB795AE2777D
Malicious:	false
Preview:	......................>...........................................................r...s.......M.................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0...........................................................................................................E.m.b.e.d.d.i.n.g. .6.6.........................................................0..............F.....}.j.....}.j..................O.l.e.........................................................................................................................P.a.c.k.a.g.e...........................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1620.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 11 21:26:45 2007, Create Time/Date: Tue Mar 18 18:43:28 2003, Last Saved Time/Date: Thu Dec 20 13:16:27 2007, Security: 0
Category:	dropped
Size (bytes):	170496
Entropy (8bit):	5.077195832841005
Encrypted:	false
SSDEEP:	3072:lg6OZuzT6RBP01esKcdOPfsL2FVrm57oQ+a:7/k
MD5:	403056F1D56084DC1034682F28C069B2
SHA1:	552AED44B6D7CD1D691B4E519C89DFA37764FB5C
SHA-256:	EC17AC16E8F9F10D26357F53A3ECA16C2E3692B07D0A0B49F8618BC3C7F5595A
SHA-512:	30F5900C8777AED243911549BF7113F10722B74A303AA8D79B83BE9D59221E907307587CD4E2A0186BE3EE756F8259D786C58D6C2D95E80244C2E220E907FA0E
Malicious:	false
Preview:	......................>...........................................................P..........................................................................................................................................................................................................................................................................................................................................................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................(...........E.m.b.e.d.d.i.n.g. .6.6.....................................................1... ..............F.........C.......C................O.l.e.........................................................................................................................C.t.l.s.................................................................0...............................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1710.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Dec 11 21:08:44 2007, Create Time/Date: Tue Mar 18 18:43:53 2003, Last Saved Time/Date: Thu Dec 20 13:19:54 2007, Security: 0
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	4.960800429743342
Encrypted:	false
SSDEEP:	768:54C7x0agTFz+OSXG/inAMXOFwPSZcP74zvD8QrqFrQDYB:5LEz+OSXG/inzXOFCSuD4zb8Q8r6YB
MD5:	909287CDC971C0D4B31C5D32B688A6BC
SHA1:	EFF5CE5BAC01F247903A402BBDBF409EFF9B725C
SHA-256:	31BD8F97745B70084DC405A219C9ACC90E0C22580CEAB06486EF13B3789EC639
SHA-512:	6D7D694DF5904D20C44195DCD9905A239BB1B8632EC03D7D90787F7D351A82EC56429DA6E22E8A2F9BBA74A2C2ACDA8A70D99F76C8E6BF01FD4604F159F07490
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.0.......................................................................................................\|...........T.h.i.s.W.o.r.k.b.o.o.k.............................................................................................l..........._.V.B.A._.P.R.O.J.E.C.T.............................................................................................?...=.......E.m.b.e.d.d.i.n.g. .7.4.............................................)........... ..............F.......6

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-1720.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Mon Dec 10 15:38:38 2007, Create Time/Date: Tue Mar 18 18:44:11 2003, Last Saved Time/Date: Thu Dec 20 13:21:49 2007, Security: 0
Category:	dropped
Size (bytes):	181248
Entropy (8bit):	4.919450248953279
Encrypted:	false
SSDEEP:	3072:utTgm+uUSbiaPH82Yy1uK8PJRG33hD2Hutv+Ud1mXtNB61s+X2Kp5AKSFGAtjm3R:5Ha8Dm1
MD5:	1A1174381B327B0BE6AEA5AFD221DB4D
SHA1:	5E005EED30F08BCFDC2DC666DC2E54D4AE9E2BE7
SHA-256:	5EA0AC5B9592134749833BB0803ABC6BE782C7FD57CFD0971A7E2E9B80CFE20C
SHA-512:	AE7EEA2A39429B0EB694039026329F252B3ADEBC0DBB6E444E9319DEEAE0F6582D45F6F181DA25CE82634505AC075C49F2168EFF0B9BD46A57662AF042CD7FD5
Malicious:	false
Preview:	......................>.......................................................p...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2210A.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 55, Total Editing Time: 14:49:41, Last Saved Time/Date: Tue Feb 15 18:01:58 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	158720
Entropy (8bit):	5.268140724248468
Encrypted:	false
SSDEEP:	1536:HZLzpe9R/R1gGWx2oLnq0qwA1s3A85Yh:5Lle9R/R1fEqzt8
MD5:	4882CF47C2091D38AF98D8287394A284
SHA1:	0B4F8D02922F66C946ACBE312382E06245C8C040
SHA-256:	03C156AF47054845AB03DAC77350A3C34D013E332EDC8E6596978B46FEB05244
SHA-512:	9554817DB5026E3F4CC350FAFF41BC2C7DB39A452B1549B6E4184F1FD6FAE828C200FF684D2532BCFCDF5CB6D242E6577CAFA4006347140BE790E10885CD93B3
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................eld Definitions Only).....D:\VersionControl\SEIMS1.0\Development\2010 YearEnd\Applications\CR Code\CFRS Common\CF_Common\CF_Reports\2007 Forms\cro-2210A.ttx..........cro-2210A.ttx.............................................................0.......................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2210B.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 135, Total Editing Time: 1d+04:13:02, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Jan 3 19:00:05 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	103936
Entropy (8bit):	5.592327674224524
Encrypted:	false
SSDEEP:	768:zeHskQ4XJukQLWS6lZaqkbDdHkdxkBNox3XRXhTBPSWlPGRCAIIrZTretmXV8hBv:zuhX/6uGRCOX6HHFxGXF6DwNS
MD5:	2AB980981BB08FC87E4B8E885C775867
SHA1:	F72DF109611C6E5A83BA7282C9E8E9ED4E4D9B1E
SHA-256:	3A11440931E4AF31F03346CAF6DEB28AA9592A50B12126DD434D708D4EDB1C39
SHA-512:	B6FEC7CCFFE987A8C4A16A15714014565B6CB19F55ACEBA887336DF297706FE23AC0BA3148BCC7821CB4664187B614FCFB66E0A601BA08F1C049F4A4E0320A13
Malicious:	false
Preview:	......................>.......................}...........\|.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0...................................................................................................dB......E.m.b.e.d.d.i.n.g. .3.1.........................................................0..............F.....>.nx....>.nx.................O.l.e.............................................................................................................1...........P.a.c.k.a.g.e...........................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2210C.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 174, Total Editing Time: 1d+13:39:25, Last Printed: Tue Nov 2 15:30:29 2004, Last Saved Time/Date: Tue Feb 15 18:24:24 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	222452
Entropy (8bit):	5.4064762014400065
Encrypted:	false
SSDEEP:	1536:kp1HN2XddW26XOTh3B0Zld7gpi1ELoAdMLg6:kp1H87WtOL0j6pOmFWM6
MD5:	FADE02A6571C1E7B61F7D2912843299B
SHA1:	5B02062FD22BE8F768CE81B7F6500D0658DD6447
SHA-256:	CAECEBCE8CF9785948FC753AAD941939A8644C61DEEBC32DB66BD020FD60B219
SHA-512:	013E9CC58F5F0EC7C379777CFFA5D25A27EC1673F861A4A52F746E6AC63C8231B8969F7D03E3E63BCA6E531FA2B7657BF0E38B05429BEEF5BFF4D1F59E5BCE2F
Malicious:	false
Preview:	......................>.......................................................'.......v.........................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................+......E.m.b.e.d.d.i.n.g. .4.1.........................................................0..............F.......=......=.................O.l.e.............................................................................................................H...........P.a.c.k.a.g.e...........................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2310.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 56, Total Editing Time: 14:47:29, Last Saved Time/Date: Tue Feb 15 18:02:08 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	163840
Entropy (8bit):	5.228829883731787
Encrypted:	false
SSDEEP:	768:dg+RR+r9hPq0TcyUwDFOkZ8E7VFFyhufjMVok2HKrs0yhjtLvjMVokT6X4GyBBC5:dg+R+y6s6oagYnysA0VWeDm6iE43qf
MD5:	F51BEAB10802D8F46CD91524C29A78A9
SHA1:	825EC58150D825C5245F1FFA0AAE8A8E39EACD4B
SHA-256:	2D4E4ED8AC8175EAE07D880B467815C561E31410E75F33CABA41CD16534E71AE
SHA-512:	60B5ED2AA7DBEFEE444B6B12110A80104B5C6EBAD2F82B9CF73939857AD255F4EFC419766BFAF63B8AB8D1EC48C14996082C7E3F4309CFE151A82FC2B4C15D23
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................eld Definitions Only).....D:\VersionControl\SEIMS1.0\Development\2010 YearEnd\Applications\CR Code\CFRS Common\CF_Common\CF_Reports\2007 Forms\cro-2310.ttx..........cro-2310.ttx.............................................................0.........................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2320.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 122, Total Editing Time: 1d+03:59:21, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Jan 3 12:16:34 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	83456
Entropy (8bit):	5.617886733447368
Encrypted:	false
SSDEEP:	768:kLjO/+KGidgXJBPjjZTX4BPBPn5925VhljMVokLqhdXpBPNZXP8h:kHX/ZX85/5scqhdXfr
MD5:	E708CF7FC5A36DCFB21C4C71D3D3830E
SHA1:	524E043B77C72E1AF8DFE79029FF4843EC93693C
SHA-256:	E1D8DA0491FFE506F325D2FE0A0292A3FE1A3700CA1D8A2E780876E8E4964D7C
SHA-512:	C5A59C922BDE6E6BF36AEA1A6655E4A6743DE391721B233FA1BB54F8A82BA9066551F8815507CC01E25DE00D6800D4421071CEE65591D042FA9476ED04847BBE
Malicious:	false
Preview:	......................>.......................d...........c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0...................................................................................................l ......E.m.b.e.d.d.i.n.g. .2.8.........................................................0..............F........@.......@.................O.l.e.............................................................................................................j...........P.a.c.k.a.g.e...........................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2330.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Revision Number: 133, Total Editing Time: 1d+04:11:03, Last Printed: Wed Feb 18 17:48:15 2004, Last Saved Time/Date: Mon Jan 3 13:05:25 2011, Create Time/Date: Tue Feb 17 16:19:41 2004, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	104448
Entropy (8bit):	5.571042801433939
Encrypted:	false
SSDEEP:	768:hkvnrY8fsuk9LCS87Q4kh6+ubXbFiNExN2HXbdBP+VtzY1g5pL8lQM1KXVTBP657:XNyNOXbrctpUKXbuT4WhZXF6Bqn
MD5:	A0C044D33CB4F0DB844EC13C156BDF6F
SHA1:	9FC9F3526F3E9785B898BBC239590DED15AF9AE0
SHA-256:	82EDAF0D98E22A5BF59CB851687DDC0DE7B974DA2BC10AA528BEBA1BEB0F5064
SHA-512:	832F30833ABA02BEF0172AAC47175D9B9A16C3B50AEAC12DD8FF01F13D215DC18BB39A1113EE785C4C3A310B07886FCFD361F76A2A2447A1D77507B17471D34C
Malicious:	false
Preview:	......................>.......................~...........}.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................B......E.m.b.e.d.d.i.n.g. .2.9.........................................................0..............F.....$..F....$..F.................O.l.e.............................................................................................................1...........P.a.c.k.a.g.e...........................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2340.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Oct 15 14:21:07 2010, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Mon Feb 14 13:42:24 2011, Security: 0
Category:	dropped
Size (bytes):	252750
Entropy (8bit):	5.25060703850526
Encrypted:	false
SSDEEP:	6144:YZ+RwPONXoRjDhIcp0fDlavx+W/WEtZ+RwPONXoRjDhIcp0fDlavx+W/WEp3FZ+m:kGo
MD5:	D386DF49CA08E8BC94B632AE6BEF1DB1
SHA1:	4D236FB675BD56A0CCB979BB26809A6278B45C58
SHA-256:	6C7F2A579D4218ABF8375315255417A740D4964E9DE361B6B00E9F6BF1E4AB92
SHA-512:	44BEC47D9E91DED6E741D82FE4C0D98E73A109CD5A9E9543FE47DC1A28D0619E9CB20F607C30BD620918EEE34AA813253DE302A339435EC7835E7BD3081EAC92
Malicious:	false
Preview:	......................>...................................E.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................O.l.e.P.r.e.s.0.0.0....................................................................................................+........S.u.m.m.a.r.y.I.n.f.o.r.m.a.t.i.o.n...........................(...................................................D.............D.o.c.u.m.e.n.t.S.u.m.m.a.r.y.I.n.f.o.r.m.a.t.i.o.n...........8...................................................@...........E.m.b.e.d.d.i.n.g. .3.5......................................................... ..............F.....)

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2500.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:40:21 2007, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Mon Oct 22 19:22:13 2007, Security: 0
Category:	dropped
Size (bytes):	86528
Entropy (8bit):	4.881958494433561
Encrypted:	false
SSDEEP:	768:Fl8E2XX+tjZyfSiy947UelYPLVEr+HClN61P:OyjZyWEUelyEr+MN6
MD5:	E34AF91588EF52750B571461438523FC
SHA1:	060DAAD994AD9CA194CF2745B197524AF01E4981
SHA-256:	F05461F9C2DE1E0B19F4F2C4C44BCB9BFEF39586B18EB9D403497586DA5FE981
SHA-512:	0971601CC34A99B221F284D5865323FD060E5F3DAF95EECCB2C0F434A6AC6FB12E77C5E4544BEE59BEFAEA704814979A94C0DC9BA5AEBF510A8F9E177CE44E54
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2501.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:40:21 2007, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Tue Oct 23 14:18:36 2007, Security: 0
Category:	dropped
Size (bytes):	86528
Entropy (8bit):	4.88633501894969
Encrypted:	false
SSDEEP:	768:al8E2XBaqD5vSiyV7UeikdtZ81+D9FCl9w:V5OUei51+D969
MD5:	4C8430FEB6682068847DE23E43B28916
SHA1:	BBC51A81B9A85354CD567DC39EF69579D4320DA7
SHA-256:	C8BE4F958AA658009028FAAD99474AEE6E1834558AFC655BEE3F086E24EC394E
SHA-512:	4547A4CD0869296621E0684AAF030133250DB8E4335BCDBFAB924CE389AAA826C477486176199688719CE7FBB00D628E079BD89033D7D1B32F0B94144ED03155
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2502.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Apr 28 17:00:15 2009, Create Time/Date: Tue Mar 18 18:34:07 2003, Last Saved Time/Date: Wed Apr 29 22:24:07 2009, Security: 0
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	4.881150690200426
Encrypted:	false
SSDEEP:	768:O4l8E2XlCGZJgtiSCg5Ut5Zl8MlHsDllxW:O5ZMUt5HHsD1
MD5:	1A8B9BAB9A26DE6C4D078DE140FAEFAA
SHA1:	108F6E387FFA826F7E52BCD4CC9A01B7428FB809
SHA-256:	2FDEB8A9E37FB4B225AB55F317F06D00F280890466F03C0309EF76D577C29DE1
SHA-512:	95A587D23889964C05FD9AB1C90F189947526697C0060386EE8CDDB26152E758E3F1C3167341CBE13815B5907017820AC20A1B97C799C162EA99BA3CEEBD7CEF
Malicious:	false
Preview:	......................>.......................................................~................................................................................................................................................................................................................................................................................................................................................................................................................................................d.....gdldd.dddddedd........ddddddde.dcddddtdA..dd..ddd.dddddddddddddddddddddddddddddddddddddddddd$dddddddddle.f.....cfkfffffffffffd.fffffffgfgfgfffffffffgfffffefffffffffgfffff.fffffgfgffff.7affffl7776777777_4afffffgf...........................c....._..._....8....o..... ..hoooo}..................oooooo.s.....I..tssssQ.p......ppp~3........>...p{qppppqpc{sh...^AFCA,...]0........=...s.s.....K..tssssP.p......ppp.3........94>..p{pepppqpc{so...^AFCA,...]0........:7=..s.s.....A..tssssm.p..

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2510.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 17:51:41 2007, Create Time/Date: Tue Mar 18 18:35:27 2003, Last Saved Time/Date: Mon Oct 22 19:25:35 2007, Security: 0
Category:	dropped
Size (bytes):	97280
Entropy (8bit):	4.977162636578716
Encrypted:	false
SSDEEP:	768:iR0jbfG0fYJfrpgAnVY7IfsUMXHwKY0/Oxlu7cimw:HbtfofTVxf/MXHwKY0/AuIi7
MD5:	896F8A0D7E194A0685F0955C6FCD724D
SHA1:	32AFD8CA6ADBFE20CB4D818F3C90FB4FD81BA04E
SHA-256:	9AA224A1B697BCC8292EA5FFDC9BAF52F81287B157EA48A230F60024631A4614
SHA-512:	BEC97B6CFF0656AC4F2AC8ABD20A4139C1B0E501AE69EF02840BD6DC9C0129D13BBBB19D2DCC19E41A342C18CC8726BE6BEB20A7BAB6391C95DA4310A0174026
Malicious:	false
Preview:	......................>.......................b...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.3.............................................................!.......................................................T.h.i.s.W.o.r.k.b.o.o.k................................................."......................................................._.V.B.A._.P.R.O.J.E.C.T.................................................................................................).......E.m.b.e.d.d.i.n.g. .2.2.....................................................%... ..............F.....P..

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2520.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Fri Jun 15 19:02:52 2007, Create Time/Date: Tue Mar 18 18:47:03 2003, Last Saved Time/Date: Fri May 16 18:49:41 2008, Security: 0
Category:	dropped
Size (bytes):	136704
Entropy (8bit):	5.122314043578528
Encrypted:	false
SSDEEP:	1536:xv1oKLyI9q8o4zTcb2UlgcWK+xTrz7axPzUsdiallTonTIn2:xv1oY3z7
MD5:	CEB12F669CCD7F4EECDA6E6526546E0F
SHA1:	0DD99622131222D076229E0F8C407F74625E1CAE
SHA-256:	9046CA568975FAD9DF681D3330D74EB9D0DA3649DD2D047E18578B91073B6F8A
SHA-512:	DCB2B77ABE0973ABC483B9248754E57CBBDBF9BA989B62CA4C200851B26C09B6C894C593FC14375E6FFEF93FE5A77B822FBC57A89E054A0866B4BB52508A9217
Malicious:	false
Preview:	......................>...........................................................P...........................................................................................................................................................................................................................................................................................................................................................................................................................................S.h.e.e.t.2.4...................................................................................................................T.h.i.s.W.o.r.k.b.o.o.k........................................................................................................._.V.B.A._.P.R.O.J.E.C.T.............................................................................................U...........E.m.b.e.d.d.i.n.g. .3.1............................................."........... ..............F.......

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2600-1.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Certification of Inactive Status, Author: James Lell, Template: Normal.dot, Last Saved By: msteffens, Revision Number: 3, Name of Creating Application: Microsoft Word 10.0, Total Editing Time: 01:00, Last Printed: Wed Oct 15 21:58:00 2008, Create Time/Date: Thu Oct 16 12:01:00 2008, Last Saved Time/Date: Thu Oct 16 12:02:00 2008, Number of Pages: 1, Number of Words: 178, Number of Characters: 1019, Security: 0
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	5.3712177177850355
Encrypted:	false
SSDEEP:	1536:+fpOF0kQmsMRT9CrDc0QrilK3dQKDj2MQCFju:8py0kQm9RT9CrFQXDj2gA
MD5:	AA19D7736F3EF3BC68B25908B726999A
SHA1:	3E2A28FA79CD93F0D47CD8E6FA9F09E8A2F12ED9
SHA-256:	FB22AB8A19306CF0CBC659A6353A22880960907DD5182A83A713C94DA95DBFC9
SHA-512:	D4510269FC2294B89C4AC530F2684F596953BDE1F5585576D2659ABE657BE436D08C2965343FB0A0713FEB09BF941FA203536E26E2805200124A835FC30C5242
Malicious:	false
Preview:	......................>.......................................................:................................................................................................................................................................................................................................................................................................................................................................................................................................................d.....gdldd.dddddedddA..dd.fddddddde.dcddddtdA..dd.fddd<dddddddddddddddddddddddddddddddddddddddddd$dddddddddle.f.....cfkfffffffffffg.ffg.fffgfgfgfffffffffgfffffefffffffffgfffff.fffffgfgffff.7affffl7776777777_4afffffgf..........8....o..... ..hoooo}..."..............oooooo.s.....K..tssssQ.p......ppp~3........>...p{p.pppqpc{sn...^AECC^B,...]0........=...s.s.....O..tssssW.p......ppp` ...4..........p{p.pppqpc{sl...^AECC^B,...]#...7..........s.s.....K..tssssQ.p......ppp~$........>...p{p.p

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2600-2.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Certification of Inactive Status, Author: James Lell, Template: Normal.dot, Last Saved By: msteffens, Revision Number: 3, Name of Creating Application: Microsoft Word 10.0, Total Editing Time: 01:00, Last Printed: Wed Oct 15 21:58:00 2008, Create Time/Date: Thu Oct 16 12:02:00 2008, Last Saved Time/Date: Thu Oct 16 12:03:00 2008, Number of Pages: 1, Number of Words: 42, Number of Characters: 241, Security: 0
Category:	dropped
Size (bytes):	463360
Entropy (8bit):	4.580779504933828
Encrypted:	false
SSDEEP:	3072:Xx0kQm9RT0PhzfHiQ+z0kQm9RT0PhzfH7QKR50kQm9RT0PhzfHBQ:h4yRTAM4yRTAPr4yRTA
MD5:	3E283F1FD6FE821EF531355E09CD8FAC
SHA1:	DE14DF4F69EB7123F4CD2AFF72F093C6BBF7BDF5
SHA-256:	77EA4BF10E6EB2AB9F8C4A752D67A65F268C6D9F4501DABCEABD1B0E8236A714
SHA-512:	B256F3E0AC5282F399C7DDEC15E896FDEF25E73559A0630CC036EB3A849F9AEC22267776DA851E77B34950D0B6BAA0B273B72B63682D7D59EC24F88C853F2E1B
Malicious:	false
Preview:	......................>.......................7...........6...........................f...T...c.................................................................................................................................................................................................................................................................................................................................................................................................................................D.o.c.u.m.e.n.t.S.u.m.m.a.r.y.I.n.f.o.r.m.a.t.i.o.n...........8...............................................................E.m.b.e.d.d.i.n.g. .1.7........................................................................F......Nx./....Nx./................O.l.e.........................................................................................................................D.a.t.a.................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-2600.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Title: Certification of Inactive Status, Author: James Lell, Template: Normal.dot, Last Saved By: msteffens, Revision Number: 3, Name of Creating Application: Microsoft Word 10.0, Total Editing Time: 01:00, Last Printed: Wed Oct 15 21:58:00 2008, Create Time/Date: Thu Oct 16 12:01:00 2008, Last Saved Time/Date: Thu Oct 16 12:02:00 2008, Number of Pages: 1, Number of Words: 178, Number of Characters: 1019, Security: 0
Category:	dropped
Size (bytes):	646656
Entropy (8bit):	4.870802515688482
Encrypted:	false
SSDEEP:	3072:9n0kQm9RT0PhzfHtQfl0kQm9RT0PhzfHFQ+l0kQm9RT0PhzfHyQuU5pD0kQm9RTC:J4yRTAc4yRTAD4yRTAyU5h4yRTwrdOi
MD5:	0AF05A4650FDF343A9C13262E16F986E
SHA1:	9D7EDAFFC85356249BCABCC8A25B556E8615B36E
SHA-256:	C87F73A359565D04941EB305AF7C9FE5B4818F577CA1319F8B578B69F2E4A947
SHA-512:	C8FC8A1C1E3EBEA9927D0ACCD8A0C27D6F60F4A13E642DF894CE7387097D76B1F557B184A18DB80EDC7D7E50EF47BBAC65D8B35ACC349F415B9707698ACA69D2
Malicious:	false
Preview:	......................>.......................................................a...............................%.................................................................................................................................................................................................................................................................................................................................................................................................................S.u.m.m.a.r.y.I.n.f.o.r.m.a.t.i.o.n...........................(.......!...........................................t.............D.o.c.u.m.e.n.t.S.u.m.m.a.r.y.I.n.f.o.r.m.a.t.i.o.n...........8...................................................l...........S.u.b.d.o.c.u.m.e.n.t. .7...................................................%..........................t./..@..t./..............C.o.n.t.e.n.t.s.........................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-4100.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Oct 16 21:17:12 2007, Create Time/Date: Tue Mar 18 18:48:47 2003, Last Saved Time/Date: Mon Oct 22 19:28:02 2007, Security: 0
Category:	dropped
Size (bytes):	162304
Entropy (8bit):	4.830184722169816
Encrypted:	false
SSDEEP:	768:HIVX+tXppv5JZp8scM0UET/5r9//PSfdNI46B4yGUbV2fiWwhgVQwq+1o:HIVX+IJafdNH6B4yZbV2fiWwIq+1o
MD5:	B1056B83A838C1A1050782D8DE2B86FA
SHA1:	A813E6A224949231A9B9AB4E7B7F675125D25D47
SHA-256:	19F4FDA329AF5201897E76EB13A18FF469BB6C1C90D63679182A0E631C943026
SHA-512:	DD3A5E08193527DF583206CBAA51B2AE0BE6A428A5FF37FA6BC37BD08601BDB24238D5C615FAE54B47136D154E49B503D9A100034BAEE40125F43B2BDE68DAB9
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................0.........................SQL.....PdSMON.DLL....%Active Data (Field Definitions Only)....RD:\DEV\CR Code\Remote Filing App\Version 2004\CF_Remote\reports\2002\cro-4100.ttx..........cro-4100.ttx.............................................................0.........................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-4110.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: programmer, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue May 29 15:40:58 2007, Create Time/Date: Tue Mar 25 14:35:37 2003, Last Saved Time/Date: Mon Oct 22 20:27:11 2007, Security: 0
Category:	dropped
Size (bytes):	116224
Entropy (8bit):	4.831635357966716
Encrypted:	false
SSDEEP:	768:FZMVR2jqTkOCsKswrOnHz9rm32Q3cpFHfuis3+nc:FVWTkOLKZraHzZmT3cpFHfur3+nc
MD5:	5379BC15FFA3C25789C420B782932967
SHA1:	E9C3245791ED044E567EA105AEBE066A3DD2DC66
SHA-256:	01B3854F730104522577E3BF28277EA5808DAE318690B7DF3F2934C382C957DC
SHA-512:	1E65192F90136EA88EFE3DD2F335FA5568538EA390DA7B1EAE50ACBCD4946590BD608AB4FF0D4A65BCBD2803AB6F3697CB966B09DA09433EF15E39017785696E
Malicious:	false
Preview:	......................>.......................v...............................y...............................................................................................................................................................................................................................................................................................................................................................................................................................................R.e.p.o.r.t.I.n.f.o.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\58B5DC3D\cro-4200.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: State Board of Elections, Last Saved By: msteffens, Name of Creating Application: Microsoft Excel, Last Printed: Tue Oct 16 21:22:03 2007, Create Time/Date: Tue Mar 18 18:49:06 2003, Last Saved Time/Date: Mon Oct 22 20:31:02 2007, Security: 0
Category:	dropped
Size (bytes):	222577
Entropy (8bit):	4.92535757129126
Encrypted:	false
SSDEEP:	3072:IfsIsefpkcEtHsDwC6Sag1Lo4cOfpkcUd3MDwC6SaXaoONv9tKAd0oNhzwcAS66p:kn
MD5:	7770B0334CFBBE2CAF0B823D0D73024E
SHA1:	38152A320F374F5115C0E4C4A249C4484D194CAB
SHA-256:	F3CB0021FC58775DF1965E1AA682EDD8B228991ACBE3C7ECBBB50872CDAC5032
SHA-512:	AF64DBBEE6A881D6C024CDC63B5C63A9DC7FC378B95D1FC3ECC61B421F9B3EDCE2715D5EA2F8C8290D96AACE5910561A12E7B6E8E2A6DE759989D3B97A999705
Malicious:	false
Preview:	......................>.......................................................T.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\7C02DA3A\CF_Remote.exe

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4243456
Entropy (8bit):	5.904631501447873
Encrypted:	false
SSDEEP:	98304:j24cB0pukTqkRXBpPw0l3mpkaL8vmN0sPVYaCKlOO5BRBwqyPQbgZ5WEVMRJT3VB:fcB0pukTqkRXBpPw0l3mpkaL8vmN0sPn
MD5:	8963AF52B51008AA64C0DFC38978E561
SHA1:	C76A9A66AFDB305791674B365B078B48343B7C98
SHA-256:	F8D68F5A2685B78B8AD9B7FF3C1BD720AFC1F337EAE521AB8AAB6ACB5E5337BE
SHA-512:	C2EF66D6AB3D075C706DCFC85B67DDDA7261A052B037B0E1854B64A9D58054503EB25214B62AFE565A9A7EDE8A981B280F4CCBCF253336000A7D42C3F6E19C06
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y....................................Rich............PE..L...a.ie..................@......... .........@...@...........................B.....{.@......................................{@.(.....A.~...................................................................(... .......d............................text....z@.......@................. ..`.data...`T....@.......@.............@....rsrc...~.....A.. ....@.............@..@..^............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\7C02DA3A\CF_Remote.exe.manifest

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.0713464478909565
Encrypted:	false
SSDEEP:	12:MMHdt4N5SgVQ9TNRRgAhxAQkrEHUi95Jz:Jdt4XSgOTNRyADAQkrEHUiDt
MD5:	E9CECB1E5CFDDF82CE102D096FC6DB92
SHA1:	EEA233E02455050A95B7AD30FA42E077ED473293
SHA-256:	499E0178C9C74ACC9DED7E9F66A99C2915C6ADEBF08D33907538180466D1535B
SHA-512:	B61B1B718B9FF3F84174E3BA8CC2B6F1135659AADDA8C0FE1CFE3561F206A1746C48F16DD669C7E36AC960B0A4B1404739DADED074956A7454B738E37E1D6F47
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">...<assemblyIdentity version="1.0.0.0".processorArchitecture="X86".name="ExeName".type="win32"/>...<description>elevate execution level</description>...<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">....<security>.....<requestedPrivileges>......<requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>.....</requestedPrivileges>....</security>...</trustInfo>..</assembly>

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\7C02DA3A\Campaign Finance Remote.chm

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	302779
Entropy (8bit):	7.927639628283951
Encrypted:	false
SSDEEP:	6144:SVRZVBdxgL1ART/Q+4Ghr6qUeaLAOw6cxf8JYxjv029IDuuj7Y79d/wq5fgSk:SVXVBzWAtQDGtnUxAfx0JEtGDR/Yj/dU
MD5:	286D69BB312003FA01ECBCAF6587C7D5
SHA1:	C611D2D743FC45A5BC419D0A255DB4A174100F77
SHA-256:	F7EDE38A17EC24C0AFA54815DBEA222E17452C4A9A872B7FE462741B70199B6A
SHA-512:	07A9D2C6F327873C4B2836FD6F434B1012C13CEE3816594C43430B0CA356814AAF0CAE4B490FEF8D89ED51112C3BF2FC240A2AA03B7183D135903B7E9B03F384
Malicious:	false
Preview:	ITSF....`..................\|.{.......".....\|.{......."..`...............x.......T@.......@..............................ITSP....T...........................................j..].!......."..T...............PMGLV................/..../#BSSC...7../#IDXHDR....../#ITBITS..../#STRINGS..B..q./#SYSTEM..n.+./#TOPICS.....P./#URLSTR.....*./#URLTBL..P.H./#WINDOWS....L./$FIftiMain.....g./$OBJINST......./$WWAssociativeLinks/..../$WWAssociativeLinks/Property....../$WWKeywordLinks/..../$WWKeywordLinks/BTree..[..L./$WWKeywordLinks/Data...'.(./$WWKeywordLinks/Map...O.../$WWKeywordLinks/Property...i ./AccountTransferAdd.htm...B.~./AccountTransferDelete.htm...@.7./AccountTransferEdit.htm...m.+./AddingACandidateCommittee.htm..._.C,/AddingAElectioneeringCommunicationFiler.htm......'/AddingAIndependentExpenditureFiler.htm...".0%/AddingAIndependentExpenditurePAC.htm...7..#/AddingAJointCandidateCommittee.htm.....`&/AddingAJudicialCandidateCommittee.htm...".w./AddingALegalExpenseFund.htm...U.D./AddingAPAC

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\89A86E6C\contlist.rpt

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Revision Number: 19, Total Editing Time: 04:03:46, Last Saved Time/Date: Wed Mar 18 14:37:02 2009, Create Time/Date: Wed Jan 4 17:35:48 2006, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Crystal Reports
Category:	dropped
Size (bytes):	45568
Entropy (8bit):	5.362863051604835
Encrypted:	false
SSDEEP:	384:dOOtOnXLo80Y31Q7yrelcg6BfJnuewBc18:dftOilH
MD5:	F333AB5364641E71074B186AAB1753BD
SHA1:	BD37BB9C3814C0B6CAFD478DD317C19FB35BB81F
SHA-256:	ECEB4597F02DBAC4C570E53EEFAA40D45862058609DCFF34B4E612CB5CA8E165
SHA-512:	8E0BF47C1FC1A55D0EC0D9BD435235EA3D8F66235DC075F5C32EDD46D9D03088A4743607C96F12D5C3E298F384CC14BB8D8094B912AC0B69F24A4A8872698C5A
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...............................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\B70202BD\EE5448BA\cf_data_empty.mdb

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Microsoft Access Database
Category:	dropped
Size (bytes):	4894720
Entropy (8bit):	2.4562849415129704
Encrypted:	false
SSDEEP:	6144:aduPCcaI/tlAIZ8Jo3Vw3QWjz3dwDQW8SypfZ3L1vLMqeFjFJJomc5S:xCF4tlAIK7IEEhOmcY
MD5:	FED4926EDE0F27BB72EFFFAC8FC55876
SHA1:	1136FC24FD788D3912F01B415A7A9CFD1A1C2E61
SHA-256:	EA2D8537CF76616D0EDA204F64E617A4989CC1AAF1C31B5F297400EFFADAB8E5
SHA-512:	162FB0823FC97AF70CDCB6CC0E617C2906D3EEF52440C5A76E577745407C0628D444FF7570ED9107DB1D632B356DAF7C3CE1BC9D86DD884D493BED311193684E
Malicious:	false
Preview:	....Standard Jet DB......n.b`..U.gr@?..~.....1.y..0...c...F...N.U.7g....(.)..`n:{6...MZ.C...3..y[..\|*..\|.........8..f_...$.g..'D...e....F.x....-b.T...4.0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\BA3E37E4\1517B7F7\CF_CR_control.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	4.697011427073727
Encrypted:	false
SSDEEP:	768:O2D7zfksOUes48TUcv89F3/RtZ1i/I4496Ix5:O2Dffks8F3/N1i/IrN5
MD5:	6F1FABBAA954167A7EE0804799566C44
SHA1:	5FEF159646BA7E9027791F7A884D1171D2D7F306
SHA-256:	B366327146822DF33AE1ABF77EC056F5F93C51CF02AEAA538CDD693276E7CB8C
SHA-512:	C2EAC10E3D10DBCAB8F4F62E3CEA4D2D55A75DB9BAAC68B476BF4C7F25E31830D34879E759569E81C6FE3D42DDF1218E9E050FC6E1962DCA1B9F844780D91C6E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f..........&......%.....$....Z'....Rich...................PE..L......C...........!.....p...P.......................................................3..............................0x.......r..(........"..................................................................`... .......4............................text....h.......p.................. ..`.data...............................@....rsrc....".......0..................@..@.reloc..............................@..B.$.>............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\BB709D56\1517B7F7\CF_Trans_bus.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	5.145978013039395
Encrypted:	false
SSDEEP:	768:vuOmIzS+LDqxem3lIYd8f6Wt8JFyFqhH0:vuO5S+3qxemVY6WCFyK
MD5:	E457039B3F64986B7EC9CEE4B5E54ED1
SHA1:	6D102676A531F2E6735EFDC8709C2E8017850205
SHA-256:	DE69AE859C578FA7D9DB1C675A650573CF2B81B4E4292CD0E1CFC49435CB1371
SHA-512:	778329349FD3D97F3E6CCD4C3A4F3250DA76DE97435080E23363F905326B7ADF79B0C7F4899B5C393879875A3D8AC1245CD7E0218B44546758E7AA078F85730D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................N....................2......Rich...................PE..L......C...........!.........@......................................................................................@...........(...........................................................................`... .......\............................text.............................. ..`.data...4...........................@....rsrc............ ..................@..@.reloc..............................@..B..:@............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\BED664EA\7204BF44\Crpaig80.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	622592
Entropy (8bit):	6.077970194897055
Encrypted:	false
SSDEEP:	12288:H31fVUPM+u1u6RS/olZNeQ1d6JjH/bldq8CMKtBBxSftKaXnDsju:7UP3u17xJ1cHrqTxGt9Xg
MD5:	48713A483F2C48ECE4AF4F098A13469F
SHA1:	D8F6BEDF737C52DA16B560E96DCE45889162D50B
SHA-256:	D6E26D47CC578B701FBB9491D8DC5B3CAB317FE92F447387905755AB8F2DC991
SHA-512:	2F01361C7B3D5326B2BC9D86DA47F49E98380DFA967C33E4DBB446C02278F412EDE5D9088F431E2E3EF3960E7F6F858C94F53F576CE3C87C2356FA7919758849
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X..c...c...c..o...c.,.m...c...i...c...g...c..p...c...b.=.c...S...c...R...c.h.e...c.P.g...c.Rich..c.........PE..L...8Y.<...........!.........p......U...............................................................................@...........d....`..\|....................p..L.......................................................P............................text...V........................... ..`.rdata........... ..................@..@.data...<"...0... ...0..............@....rsrc...\|....`.......P..............@..@.reloc.......p... ...`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\C2C59FBE\1517B7F7\CF_File_Export.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	208896
Entropy (8bit):	5.44595307121718
Encrypted:	false
SSDEEP:	6144:LrsfggETxTPkLjo5OzzJ6ZrkTkFkwyVbKBJZZOp//:Re/
MD5:	C701584A3CE8290E70D71BD1B61A65D8
SHA1:	E33B28B6A41117E04F45A6A99B7C201DBBECA243
SHA-256:	696F40AF1C271E0D721F0F0E6223020051A5FCABF79C02E7BEA1193F55DAAA2D
SHA-512:	C0041AE2311F56D4C6868C30C2A190C1575B16DE94D12DFBAB439F03A138FC987845253B64621D6C7ADD23D7DDFFE2028354C45DC88A8C649B15946CD3CF49B2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f..........&......%.....$....Z'....Rich...................PE..L.....M...........!.........P...............................................0.......c.............................. ...........(.......T.......................@...........................................`... ....................................text............................... ..`.data...............................@....rsrc...T........ ..................@..@.reloc........... ..................@..B...E............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\C4A3B122\34510A4\DAO2535.TLB

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	data
Category:	dropped
Size (bytes):	73184
Entropy (8bit):	5.1031501057723725
Encrypted:	false
SSDEEP:	768:qBTk6x6X4jwg6QttykgHGj+7RgazewxdgQlLZ6f152H/smzMGbRmHYGQSupZWye0:q/XjcegHbjEve/4e
MD5:	87A2ADF125BE51CDD5D8D3843E0F0B7E
SHA1:	F86F98587DC8193E197979714574AC127FDFB250
SHA-256:	6C6CFB4E9A8DC9A0E65630A6718A87D6E3F962D87F4836845D8023FBF87F640C
SHA-512:	7C9B5B1D3883D540E1A7A6CAB7C36509C59EC4766F91B79632B842269CE2349104F40B5E1D508A7D0AA713D8BD8C9F6797C82D2A73E0CFE0AABF1193E87D2ED8
Malicious:	false
Preview:	MSFT................Q...........L...............D...........0....... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...........h.......0...........\.......$...........P...........\|.......D...........p.......8...........d.......,...........X....... ...........L...t................&.............. &...............%..............$ ............... ..............<&..............<(...6...........^...:..............H..............................h........................................................... !..D............................................................................................... !..................................................0............................................... !.....@...........................................H............................................... !.................................................h...................

C:\ProgramData\miaE495.tmp\data\OFFLINE\C7D8D83E\34510A4\SSubTmr6.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	4.345293075550214
Encrypted:	false
SSDEEP:	768:vjBzwlSCIuAXEDsyPFHhOlLA57EkcAZnhtyFmNj:vLuAUocFHMlL07fRZPH
MD5:	DC7A3BC0FC185CD68848DC6F7D7B026B
SHA1:	C661CB1198F5E3927A67884E71CA95FF33026224
SHA-256:	6618B3AB331642449F0B07E4F39ABF9FC3BB90AE90B298F1B9FFD58CA5397399
SHA-512:	22C9B2B7930E9E442699E37F43944F7CB4CD2562ED8319B4341C59475FA8071B501F4908227378B7883930F14C3059F66531BF876B386DEA0027151B08006577
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.._>.._>.._>..."..^>......Z>......^>......^>..Rich_>..........PE..L.....3>...........!.....P...@...............`......................................_................................W.......S..(....p......................................................................X... ....................................text....H.......P.................. ..`.data........`.......`..............@....rsrc........p... ...p..............@..@.reloc..z...........................@..B'.};............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\C847D812\1835CB68\Cdo32.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	5.118134691683147
Encrypted:	false
SSDEEP:	768:SbaGLiyxVx9+qtwWRnqZk0ca8lKLRT7vGUsbONP0B4s6r1BW:iLlx79+qtwWFqzrlT7vGUqONsFUO
MD5:	81C8142EED021D18D4ACCEEA8D950068
SHA1:	435173BAFE04157D0EC140B4F77E1C174A304911
SHA-256:	C86E55610D35F87CBB29A89ECD0B838C2710BADE0E772977FCEA336FDCFF6451
SHA-512:	4F169BC6011F8A23C6A71A6C6469EFB26A0ED24BBAA022FF153FC975E762C1FBBDB24D144E1A186ECF1792C353BB7B29E8970687DD333697CC19839B6B13E9D7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H.3O..]...]...]...S...].Q.V...].Q.W...].Q.Y...]...V...]...Y...]...]...].Z.N...]...\.V.].n.N...].S.V...]...[...]...Y...].Rich..].........................PE..L....`l:...........!.....`...`....../k.......p.....A................................{8.......................................y.......................................................................................p...............................text....^.......`.................. ..`.rdata..R....p... ...p..............@..@.data...............................@....rsrc............ ..................@..@.reloc..2...........................@..B.$.>H....$.>U....v1?_....$.>j.....G?w....$.>....UA.<.....$.>............KERNEL32.dll.NTDLL.DLL.USER32.dll.ADVAPI32.dll.ole32.dll.OLEAUT32.dll.MSVCP60.dll.MSVCRT.dll............................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\C8E76B1B\1835CB68\u2lexch.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.267042919287219
Encrypted:	false
SSDEEP:	384:KXcrE+FLvbmBhm1xgv/89aZ8EDQgeNQnKkG:KXc4+hvbehU2v/PZ8zQnKkG
MD5:	BBBC65FDFBE05CF8D64602D96D1CC73C
SHA1:	3AEDB477B3FCFE064998627DEC3F3E40F11C60D3
SHA-256:	6A0255417D2197E016BBCA41E3C8849CDE951F30C2168225D550B19A7C3C5DBF
SHA-512:	66526FBFC157984334C83C42B13DE2DD56C610DFA513637A5B4A9298B4F05AA4015C8532D640FD4A9524080D92B56A7D847575E0E48AB0513B1B66413F276FB1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...ir..ir..ir...n..hr..ir..Nr...m..lr...R..kr...R..nr...t..hr...R..jr..Richir..................PE..L....Y.:...........!..... ...@.......).......0.....@.........................p.......6...............................3.......0..P....P.......................`..................................................D....0...............................text............ .................. ..`.rdata..^....0.......0..............@..@.data...,....@.......@..............@....rsrc........P.......P..............@..@.reloc..p....`.......`..............@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll......................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\C964AC44\1835CB68\u2lfinra.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.717620044022021
Encrypted:	false
SSDEEP:	768:TuiZXiv6x2/PBTx30WGdoxJ3jiB9WQgK1JJ+Fo7YIi8E1u:Tupv6EZTx3CoxJRQDUoGE
MD5:	EEACE14739B3E836F44D661C0042F223
SHA1:	24F5967B7B12DA1ED343A73D723FE6FDFEA7F301
SHA-256:	11DF90CC11DFEA9D9D7F2DA22CFFEF805CE658F6AB3E2150861EEBF03D690CA1
SHA-512:	912FBB92B92A3A0BE65514FF13BEB6195A4631EFCDDE4231D48AA516DD59BAEC8D6FD125525B991A95D78B93EB0D6CE75C59D32A2463A83928ECEA8D1BDA5894
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........<...o...o...o9.o...o9.o...oR.o...o..o...o...o...o..o...o..o...o...o...o..o...oRich...o................PE..L....Y.:...........!.....`...p......y .......p.....@................................_g...............................\|..[....v..<...............................................................................D....p...............................text...._.......`.................. ..`.rdata..[....p.......p..............@..@.data....<....... ..................@....rsrc...............................@..@.reloc..L...........................@..B.$.> ....$.>-....v1?7...........KERNEL32.dll.NTDLL.DLL.USER32.dll.......................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\CBB1E6D9\1517B7F7\CF_Transaction.ocx

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	4.429834468814966
Encrypted:	false
SSDEEP:	768:slkL9UsJCrigg6oh+D4w/yYTfRRCe0FR:saavE+j/yeffL0v
MD5:	EB4C26E80D3B38124E657E309F266670
SHA1:	B99894894AB502473975E72FD18EAFCE0E9D710C
SHA-256:	E5C8A078A4820D2DD959BE32FD0DF50F82522F8DF1C8558DC90C5AF1EAB84409
SHA-512:	D53B79D792DF4109DD0D45691F4B646109D72C84C0E6732A2431C112B47FA892124C37B4A6E7D1776189DD88CCAA683CA33A42BA246E0E73C1B18F35A667CD26
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y{N... ... ... ....... .R8)... ..9-... ..:$... .Rich.. .........PE..L....?`@...........!.....p...P.......................................................e...............................w.......q..(.......8...................................................................X... .......\|............................text....h.......p.................. ..`.data...\|...........................@....rsrc...8........ ..................@..@.reloc..h...........................@..B'.};............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\CE1E931F\7204BF44\sscsdk80.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1179648
Entropy (8bit):	6.521473588938597
Encrypted:	false
SSDEEP:	24576:Xm2hiJswkzSpq5Z3jVecFRe+2x3sK6Ms203zviblO8kqO5NnibsBfhUy:X8kQsIOvfhUy
MD5:	D2D3AB42E0FB3AFA8FF6AA9E965D9595
SHA1:	34F244003EF1D43209823CDD946F801AE7A85466
SHA-256:	5AC379FCFBDA3F8DB51CA02BE2C509BD057F17690359F09D4CBB292A67572D6A
SHA-512:	80D468D7495C44988FB655E824575C0DA5ED38FD8A88141FDED106029057E66609CA2E1FF3BA55B0D429FFD737E401F32857A3C92EBCC2ADF97D0B8C49EFEC76
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w..q3.r"3.r"3.r"n.y"0.r"..\|"..r"n.x"..r"Q.a"?.r"3.s"5.r"3.r"5.r"..p"7.r"l.y"#.r"l.x"..r"..t"2.r".v"2.r"Rich3.r"........PE..L...R(i>...........!.........@......<......................................................................................$........P..`$.......................b...................................................................................text............................... ..`.rdata..............................@..@.data..............................@....rsrc...`$...P...0...`..............@..@.reloc..^o.......p..................@..B................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\D25B4F4E\7204BF44\CRBAS15.DLL

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	307200
Entropy (8bit):	6.383146474711384
Encrypted:	false
SSDEEP:	6144:mzdLJkXstL6iKvwzVLb34armOHi7+m463cG/CzQYQ8rk4TCmiSippnec:mxJkXWL6iKvwzVLb34armOHi7+oXzff6
MD5:	FD64262820E74C63BB0D97061776C234
SHA1:	28FC641E0154BCFDF383EDB9D28245F2873E4A12
SHA-256:	2AE2BC42BC655010F11C2686EE4C318F07D6C1CF3EBC79A8E1FBDB57A49A2CC4
SHA-512:	C26D4400EB99A425C886C1707D00A87018D4B0375FCFF39F127DC8CD26DA5114D73233868B99317C7415366D9B26D861DE321110F0F14E31623560A7F0F66826
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?..l{.{?{.{?{.{?..w?z.{?{.{?z.{?..h?..{?..u?z.{?..q?..{?{.z?..{?..p?W.{?..}?z.{?...?}.{?Rich{.{?................PE..L... .t9...........!.....@...`......./.......P.....(....................................................................\......d....`.......................p...4...................................................P..4............................text....4.......@.................. ..`.rdata......P.......P..............@..@.data....V.......`..................@....rsrc........`.......`..............@..@.reloc..N8...p...@...p..............@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\D4B1A979\1835CB68\u2l2000.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	2.0998953021911198
Encrypted:	false
SSDEEP:	96:rIzc50xqjhJtVyhbHxXoCcRXTTpQidqDJpAmJq+QGCGYmotqDMhoDp0LNf:rB5DXwVxXRc9TpQikDDAmJ5QcDMz
MD5:	3DEE1017263C8973FB882989858A5C2F
SHA1:	819B77196B265FE25E12BC26B8298C2B20DFF5A7
SHA-256:	5D64F25968DD379EC2E4C463D0F181463AD7EF476B03D7BA4C730A08FCF8ACD8
SHA-512:	4557B400B2D8E29B6F82D1F32F74A71E64FC21C45CD9B42BD8976C5BF4811A272FFDC703A7C213DF84EAE0C81239EEFD0EFACFC35392A51D47BF1F7FC49ECABE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................j................................Rich..........................PE..L....Y.:...........!.........@............... .....@.........................`......................................."..F.... ..P....@..0....................P..................................................D.... ..d............................text...T........................... ..`.rdata..&.... ....... ..............@..@.data........0.......0..............@....rsrc...0....@.......@..............@..@.reloc..~....P.......P..............@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll..............................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\D63D429\1517B7F7\CF_document_bus.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	5.864729781432924
Encrypted:	false
SSDEEP:	3072:Nu9TYaMJzIOmFRfnCQuNtybMx8j0vZNSv:49fMJOFR+3ybMxE0hNSv
MD5:	962A83A511ECDB73EA9AC8B00036B898
SHA1:	5DA22EBDA48F16D2A77B778F4672CD94B924D198
SHA-256:	CA7EFD83EF71B00F9203490309278A7EABFA019DA955DB35A5DF7DF203B91BE4
SHA-512:	93547C27A4ECB1DB99C5AF0C48911D7F1D9246F72A9E395FD2EEFC25EFDA109B873E17DCD4A12542CFC5211F7BB25BEBB93135434BBF6A6F5892E9F4A71F943E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Vy..7...7...7...+...7.......7.......7..n....7..Rich.7..........................PE..L...t.Nc...........!..... ..........h'.......0...................................................................... +.......#..(....@...f.......................D..........................................h... ....................................text............ .................. ..`.data...p....0.......0..............@....rsrc....f...@...p...@..............@..@.reloc...L.......P..................@..B..^............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\D71275EF\1517B7F7\CF_org_bus.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970752
Entropy (8bit):	6.069974860037566
Encrypted:	false
SSDEEP:	6144:cOF/1nEiJcDvsRjMEunILaC1rdodjiSLYOxxe1AUVrTc:FrnEieDExDLaC5dQBLYOxxXUxc
MD5:	F4C3228B8EFF49592EE2B8C303CD2E40
SHA1:	A343B1278B73D8EE635A76872FE83928CC29CC5E
SHA-256:	1CF1C86CCC0DC864EACDA1481C85CD8D75F2EFF58BAE04C4A1DE2ED1BA8BF133
SHA-512:	89CC58E9039C13EB6CEA1E775ECB40E828DEEFDD3B94BE9CD15BFE21B4FC8428EE3FD6EA772976B76AD78551DFCEDF6D624E1A49D6C31A97CC310B5EF748B00E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#O..M...M...M.Z.C...M...D...M...@...M.&.I...M.Rich..M.........................PE..L.....]...........!..... ..........Ta.......0......................................t_..............................p'..........(....`...Z..................................................................h... ....................................text............ .................. ..`.data.... ...0.......0..............@....rsrc....Z...`...`...@..............@..@.reloc..B+.......0..................@..Bl.[J............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\D77E7C08\7204BF44\crwrap32.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	5.764637632023211
Encrypted:	false
SSDEEP:	1536:5a/5Ni0La7Q4JpxsxrkVE55QbK/kglgp8P7M:k/580La7jJpqxrk4/LlgKPo
MD5:	6AF7E771B815A4CEBCB57214B049CE52
SHA1:	99935155D7C4E5693884F1E46955180437070296
SHA-256:	F87575DB6FFCBE1C170A803EA3979D9885A4F13665BCE5DA44FEF5199A9C82B7
SHA-512:	F7765C85F2A5517B2974F26B06794D154F75E8F66589045C6DEEFA99CFF65C6406630A45F057CA1A696AA65B40463E137338C2F1CB4AA047099C3B1B2D7D9F7D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............`..O.....L.....Rich...........PE..L....T.8...........!................`:............nB.................................M.................................._...p...P....`.......................p..........................................................4............................text.............................. ..`.rdata..?...........................@..@.data...........:..................@....rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\DAE69E8\7204BF44\craxdrt.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5206077
Entropy (8bit):	6.315774370780597
Encrypted:	false
SSDEEP:	98304:LSZEWBxyRHvEK6Y/aZ8HhzAhCpmwks9XiyINsv:8zoRHvE8/i0wzwlssv
MD5:	557903CB9179A5A8CFA6B852049E3884
SHA1:	CDB5AEDA1D9E08E9A3AEE6CA58E0542571050680
SHA-256:	F4E3E3B0699A3F80B7911C64AB17A74F8018B456DCA94A4F5F936B7A7F268466
SHA-512:	77537EACF5D8204C998FA3731FB345C2439DE5672D5C256520BC731F8A8C4937E7F7D7E3A42BFD79E7E401375083F7E5706A24AB97B1D3E1FCEFD9F252AC39FF
Malicious:	false
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.............C...C...C..C...C..C...C..C...C...C...C..C...C...C...C...C...C...C...C...C...C..C...C..C...C...C3..Cl..C...Cl..C..C...C...C...C...CT..C...Cl..C...CRich...C........................PE..L.....g>...........!......4..@......cS1.......4...............................O......................................=.....p.=.......?.......................K..w....4...............................................4.\|............................text.....4.......4................. ..`.rdata........4.......4.............@..@.data........@=.. ...@=.............@..._CODE...P....>..0...`>.............@....rsrc.........?.......>.............@..@.reloc..2.....K......pK.............@..B................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\DC878553\34510A4\AtalaImaging.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1224704
Entropy (8bit):	6.559778036335788
Encrypted:	false
SSDEEP:	24576:wN1DzA5ePgWwS2zmQjyO2M/U1uW0PysgrG00mvwREQhi7VxT1ZOSw:yDz3PgYnQjXFKrk/EQujTXOSw
MD5:	9AD69E823BBB916012E6188E4A3FCA98
SHA1:	A21BC401A64B503639581DBC493660E00BCB3F64
SHA-256:	1F54E088CE730AC08B7DF8C28DEBBC89F354713602ED9E7C260252167588E940
SHA-512:	1E8D8F27DAE11ED4068B3E8F6EB1E842EEA38CF58964E0559E9B5020709891C67A5B40BD5A3A2C6A5A41CCFE1C70B2755B1C6A5284BA8ECB77251D8FEC112919
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S...2...2...2...:...2...>...2...:...2..H:...2...2..\2...>...3...>...2...>...2..'9...2...>...2..Rich.2..........PE..L....@B...........!.....0...................@.......................................................@..............p...\|A......d....0.......................@...m......................................H............@..@............................text...j).......0.................. ..`.rdata......@.......@..............@..@.data....H.......0..................@....rsrc........0......................@..@.reloc......@....... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\DCDC5FB4\1517B7F7\CF_File_Import.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.455894620968054
Encrypted:	false
SSDEEP:	3072:FsIW2IQ7o+58dXtUaBFgl2LMxCq14vzVsjkwg3j+KsOpDdaX4GwXHnCTzAbgRunW:FsFQ7o+58TUaPgl2LMxCq14vzVsjkwgD
MD5:	D3EB6533ABBC9ED6EBB4CE6357610C49
SHA1:	F5FF9C94094B7521507F0A982BC85C417D7B0CB8
SHA-256:	B50E896328C2C432FE8E1F03A55FEDE9DE4A83616B3A3256A2476945BE6C3F12
SHA-512:	D17D4EA44645FE1F9B46F6770AAA6B6E22277702EF00D3C57C1A09F98EADCB72A5BFDC1078DA88C41042A5B9B90E2385DB63CC16B70DA74BD22911493D0246E7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Mo.................F,....?(..........Rich...................PE..L..."r.V...........!.....0...P...............@.......................................................................0.......*..(....P..P....................p..<...........................................`... .......L............................text...+!.......0.................. ..`.data........@.......@..............@....rsrc...P....P... ...P..............@..@.reloc..`....p... ...p..............@..Bl.[J............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\DD3D7189\34510A4\COMCT332.OCX

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	415176
Entropy (8bit):	5.974954032052747
Encrypted:	false
SSDEEP:	6144:dLIXG/SBt0iiVoY/pWEKDzPJxPPUIK1qDqNw:gG/vCY/M5hM8q6
MD5:	821AB1F1CF9904CB9026C686F13F0F05
SHA1:	398F64C00B026D1C6D94A6EFD180F20C010F5EE9
SHA-256:	332E6A1CB4BF722092F9E774ECC14ACDDBF95A9655BEA021681B11AAC37AC716
SHA-512:	D63C0FACD14ADFCA4E7E1E6D99D1FD1C2BE89C2C03E9835C506418A6A3FACB745888062BDF97CDAB0AD67CC8BCCB385AE10955F58150D9C4AC4A7C61E5C1E559
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r...6..6..6.....7..y..&..2..7.....7..Rich6..........................PE..L....D.9...........!.....`...........L.......p.....(.........................p......................................pn.......c..(.......Xg...........@....... ..\|C..........................................h... .......X............................text...._.......`.................. ..`.data....7...p.......p..............@....rsrc...Xg.......p..................@..@.reloc..4L... ...P..................@..B.A.9............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\DF17326D\1835CB68\Crxlat32.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.7494209933404663
Encrypted:	false
SSDEEP:	96:ejTU6VrXNd5zIrxKnlPJvBCaWNWpUi8par5VqxQDhoK/+YiyhotqG0hoN:ejTU6pP8rYTvCu8pcSQDxwyjG0
MD5:	449045FAE688D76B18624FE566E32A54
SHA1:	EA98B0853BA3A310362C43FA9F619238E7CAF947
SHA-256:	5343CCFE98B12E0D9B064A9AC7291E17086C5853D40E8BC2AEFAADAA09113F67
SHA-512:	7C366DA72221E9FB01D9927970B7539F89232CD77CD0C3C5C8ADEFF0203D68DD811AFFCA3E198941F28121B0ACEB212459EA8077CF7F5D65D5AC9D2F4BE647EA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@..!...!...!..*=...!..V....!...>...!...!...!..V....!..n'...!..V....!..Rich.!..........................PE..L...7..9...........!.........@............... ....V@.........................`.......G..............................0"..U.... ..<....@.......................P..................................................0.... ..P............................text...v........................... ..`.rdata....... ....... ..............@..@.data...h....0.......0..............@....rsrc........@.......@..............@..@.reloc..&....P.......P..............@..B.$.>.....$.>%...........KERNEL32.dll.MSVCRT.dll.................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\E04462E5\1517B7F7\CF_Report_Verify_bus.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	5.428325754445499
Encrypted:	false
SSDEEP:	1536:WsF6hjb3IfW+SSzXFc+20WTCWADW0C90Qpi3UMDhHyj1oVU:7SjDcRSSzXFc+20GC9C90ki3vDUgU
MD5:	AF80415CDC8AD1D8304FE8E1645743D2
SHA1:	89F256E9280AF6159D89D0CC0289C7509C0AE735
SHA-256:	AAB949FF5B13E7FFD8DD89D6DCAA491320DCBCFAD42B044D6988868304538DA1
SHA-512:	41DF6C4F76373588873B230A9BA63D5DE0624D14F1CE970ED30B3E6C1FBE153A32A171BB520FC4DF042DDA011F23CEF648EFB9F916D01E30E81C09F11CEE3E1D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........AN. .. .. ..<... ...).. ...-.. .~.$.. .Rich. .................PE..L......`...........!.....`...................p.....................................................................0c......d\..(........@..................................................................`... ....................................text....S.......`.................. ..`.data...x....p.......p..............@....rsrc....@.......P..................@..@.reloc........... ..................@..B..^............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\E2BBEE13\1835CB68\p2ixbse.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	245760
Entropy (8bit):	6.5511171261787196
Encrypted:	false
SSDEEP:	3072:awe+BmVTUODP/IcpBxWeZlHEphpV9K8yKD4PtBeGiXdMj5Cn:tHBmdUODP/IcpBcCNEphLK5k
MD5:	B4748AEEB6EDF8C05123B6542A2BE350
SHA1:	F7165A96833C5ED0A30D15492499FC9DCFD998AF
SHA-256:	527093225D1B40925B19A3100E305513AD94D1461ECA862B6D4D9642EA0B6885
SHA-512:	380C9EE7DC5F32563BDBB0D66A25BD7249F91902299B6CECAA4DCBB04564FCA98B95132E9154CE6082A183A1116094120A7325754A9F5EFCB08866FB05C58303
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s..7...7...7...L...2......4..............C..........n..2...7...S......?.....6.....6...Rich7...........................PE..L....Y.:...........!.........`....................h@................................I...........................................<.......`$.......................8..............................................D.......d............................text...T~.......................... ..`.rdata..S........ ..................@..@.data...p...........................@....rsrc...`$.......0...P..............@..@.reloc...?.......@..................@..B.$.> ....$.>-....v1?7...........KERNEL32.dll.NTDLL.DLL.USER32.dll.......................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\E3BD0475\1517B7F7\LogFile.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.485382050322971
Encrypted:	false
SSDEEP:	192:i9NOy89Skl9gzr3HUZTNzEOsrt/V8Rhfv67fSryIAuAhqLaPXGOS:i9NOGFH3HYTNzjsrt/V8vOSryShLaP/
MD5:	BB46C0B126E28AED97D3DDFC96BE0902
SHA1:	BAAA2A2CE2BA8563E4F6298A9EE2BF5D38D1AB2F
SHA-256:	BB2469FC8087D0CF223E2344525A8FC536CF2CCEBC213F43F765FFAFEE44729E
SHA-512:	747C578E3D44ACDF079693A8887EB898A6A213DD190AE98FECC348EAA371772F4BC98BE4C195F0C5A68BDB38EEB3D9F57B81189E46E284551B10F7F7664EA643
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k!../@../@../@...\...@..`b...@...f...@...`...@..Rich/@..................PE..L......B...........!.....0...0......l........@...............................p......&h..............................P8.......3..(....P..4....................`..............................................`... ....................................text....(.......0.................. ..`.data...H....@.......@..............@....rsrc...4....P.......P..............@..@.reloc.......`.......`..............@..B..:@............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\E76BBEDE\7204BF44\crviewer.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	734504
Entropy (8bit):	6.288077088983874
Encrypted:	false
SSDEEP:	12288:nLC3ZqLXl9ZZVvBMISsHHGg17SnXR2HKg/AggAVKBHFEWl:nLIZKXfVvGaGg1mnX8agDy2Wl
MD5:	7AADDC7C334AE959674073439FA92FE3
SHA1:	ABFD7C6ACCE89009D85C619E91010C307E2C06FA
SHA-256:	C0DB8920AC1E460EE34313829245D2F05F2D71617C69F6B568C5C921747E62F2
SHA-512:	FB0BDC3B495C3541AA5DF5D50C020A377F7C024727C95953984B2DA184091AD0FDE9D2B03D7E5AA2D86C8F454EA484ED16741353123E23CC8D9A35624139A277
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O.u...&...&...&.2.&...&^2.&...&.1.&...&.1.&J..&...&...&.1.&...&51.&...&...&...&...&./.&.1.&...&...&...&.(.&...&"..&...&Rich...&................PE..L...'.G>...........!................Q..............`.........................P.......\|..............................P.......$........`..pE..........@ ...........v.......................................................... ........................text............................... ..`.rdata..............................@..@.data............p..................@....rsrc...pE...`...P...0..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\EABD308B\1835CB68\u2dnotes.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	5.320336268402508
Encrypted:	false
SSDEEP:	1536:MnYrP/rZDN5Cz6y9LUXlnsiUG3eJ/TdY9G:tXrZDazf0lsLY
MD5:	FE8A13548CB544D484496B67D7D6589B
SHA1:	933C66BA98D6090E14E04DB3264D674D4C14921D
SHA-256:	B351DCFBFE03D00A688C488046830D1178A06E6CA86D581388250259098C0C11
SHA-512:	73FEB19916CC5E25B591D5B197AA38E9DEABBCA71A559A5AEA47DB73E9461E720F0674D2A757026E2076B5A0E67F8460B42278084C614E7EA7918023EEDAC785
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\.Y.=...=...=..Z!...=..&....=...=...=..."...=...!...=.......=.......=...;...=..&....=..Rich.=..........PE..L.....`;...........!.........P............................................................................................h...P.......................................................................................8............................text....x.......................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc..d...........................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\ED7284FA\1517B7F7\CF_report_export_bus.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.181324418041009
Encrypted:	false
SSDEEP:	1536:0azJfbOWDflv3L92tgdvy3SGBQESCI1IzpISZ6Vz6wQ/WN5kNM:08pCWD5+GvsSvCI1IuSMpVQ4k
MD5:	D11EE0F19F05D867D8A2D8B5AA4EA94C
SHA1:	2300ED6EF1859D0ECACFB5B0D8020BB4098563F2
SHA-256:	2558BB08A4AACE37A4FDB667766F0D93D368BD0100C429854CA40AC7DBECD3BE
SHA-512:	6009BBCC8B25C9F4CDA822905051B7B6F037625E04559FD8E2CCE1CBA33579D8600A5A8921A9FA560F15CCB086292D89C6DC5B5D2C5045EC58AA4469886AC39D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k!../@../@../@...\...@..`b...@...f...@...`...@..Rich/@..................PE..L.....ET...........!.........P......0........................................0......lD..........................................(...........................................................................`... .......d............................text............................... ..`.data...X...........................@....rsrc............ ..................@..@.reloc..n........ ..................@..Bl.[J............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\EEBF1E87\7204BF44\exlate32.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	675897
Entropy (8bit):	6.33183612141127
Encrypted:	false
SSDEEP:	6144:szNfL5Tx1o6Ky/9vCgchDAhy6Q0KQ7a3spjQ91fsu6UyepsMtt2+cH9ofSNXczFw:sDR5y0hy6aOa3spjQ9lmMEoqxchYIo
MD5:	CD98432FDB8E13C7C5A940C01D3CCE77
SHA1:	B4C5C3979883252DDBD4534CBB09F2D80F82F3D3
SHA-256:	86C6FFBC5463F3A3410BA18B192556BE39ACC1D99CEC94783A5A9A38610B3CC4
SHA-512:	1AC21A31E613C6D3D0518B3A497364BBEFFB33439F21A8D83A62D25123F4EBCA3A8D3BEF371B09187027BD5D84BBB9DEF7942FDB6B1A51A91F7F426BF1009A54
Malicious:	false
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$........=Y.V\7.V\7.V\7.C<.U\7.-@;.T\7..C$.U\7.V\7.Q\7.9C<.U\7..@9.U\7.9C=.R\7.9C3.T\7./}<.U\7./}3.T\7.\|<.Z\7.\|=..\7.V\6.^7.4C$.E\7.P.=.T\7.P.<.y\7.Z1.W\7.\|3.W\7.RichV\7.........................PE..L...e6.?...........!.........`...............................................`.......................................D......$6...................................T...........................................................5..@....................text...N........................... ..`.rdata...U.......`..................@..@.data........P.......P..............@..._CODE...p...........................@....rsrc...............................@..@.reloc..p...........................@..B................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\F0E0F85C\1517B7F7\cf_rpt_link_bus.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	204800
Entropy (8bit):	5.6625050399442545
Encrypted:	false
SSDEEP:	1536:WFBHOaDV8SWAqRfU4R1PEgItQQN6sVB0TfJaoEGzAfNuyxPAhX6ORnKNmvzcrGjn:WpVZ8F+xuJ3AF5mnKNawrGjn
MD5:	79381368BC9D996F6F4722D85FEC175F
SHA1:	C28C7738636FF10DE781A6C87137F48335EE9F1C
SHA-256:	618FF68ED9141B5A17506B08EF1378B29E5A14D7ECBD98577236139A521D7C62
SHA-512:	4F1B94F62E63968DFB83BA77047868851BF6F8F48FBC6CA5850AC8077FC7D4F00F733816EC04B3DCA4D9C3E9755B49C51AB7EABAECBF9F230EAFDFE7C2B2413A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......i..-..-..-.....,..b..$..)..,....,..Rich-..........PE..L......M...........!.....p........... ....................................... ......................................`q.......k..(.......8L......................T0..........................................X... .......h............................text....b.......p.................. ..`.data...............................@....rsrc...8L.......P..................@..@.reloc..07.......@..................@..B...E............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\F7CFC206\7204BF44\Implode.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	6.082251537771566
Encrypted:	false
SSDEEP:	192:Isp6yEkGeVt7mdxy6BhUDwDBEKhixWPGqLukwRWxlRYlRXwHV1UBoN4GI6slUx:Vp6yGeVABrKcb7hjYjXwHHU04GJso
MD5:	0A0324A4282DF0F2C3129E5BD84077BC
SHA1:	5A4FB357AD6A245F75213C5F5593AB8F57E613DF
SHA-256:	11B4C417769C5C4729165C8CA0567F7D3B06D4B82998AB297D59ADBAD9F74D5F
SHA-512:	6074AE20F520449B5F3842F866BB8455B16E488C6D81BFBF898844C821D35EFC036B4DEEB9600502A54287050FE392BDA533FEB112B8A593F30CE779D1045646
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...-..2...........!...2.$...".......".......@....(%...................................................................h....p.......................................................................................................................text...?#.......$.................. ..`.bss....$....@...........................data........P.......(..............@....idata.......p.......>..............@....edata..h............@..............@..@.rsrc................B..............@....reloc.. ............F..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\FAAEA181\7204BF44\ExportModeller.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.112628297874781
Encrypted:	false
SSDEEP:	3072:I5BjEZYf0mpCQWkmQFkC7SmmNLT1uEfhuVQA6nBgvWKwnvOtzC/8gfPACQ1pH2pE:zYf0mpC3kdFkC7SLLsmA6ESubhD+TU
MD5:	70B34D924E4DBA93BDB051C50B76A935
SHA1:	F3E1B375A577585F89482A78ACBCD92D3CC37796
SHA-256:	80E70DFB52DF7F6DEE86C1DC174799FAC4E189550ED9E0B07AEB26F29E072F40
SHA-512:	124584D8857A604C6B4026C36150074AFB3760893E464A5B2323551BD1E385D763A7FF2E5F5ACAA265AEEB766C08F486673BC9C13ADB53F9EBC03C380AF5C7D5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=..uy..&y..&y..&...&...&...&l..&...&v..&x..&{..&y..&x..&/..&s..&...&p..&y..&...&&..&_..&...&x..&...&x..&Richy..&................PE..L...y.R;...........!.................................................................................................3.......+..........p....................@..$9...................................................................................text............................... ..`.rdata..[...........................@..@.data....O...@...@...@..............@....rsrc...p...........................@..@.reloc...H...@...P...0..............@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\FBA4A636\1835CB68\p2lodbc.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	135168
Entropy (8bit):	5.712557269847559
Encrypted:	false
SSDEEP:	1536:yOHs9nZRvH2PP034ynzO8i9smTlTrHi1w9rDQtztKZChBohB1DcXvvhdBJ1Q:1WPvH2P7yzOJ9zTrHi1w9nQBzKWXvz5
MD5:	23D3B53421DB2010647BB2379292863E
SHA1:	49220E4A10E20876CB896DB389345C7B6A9333CE
SHA-256:	B8CBBA9370F4011891B8DAEF34438DC3E3EF2EE9297D3C207FFE3F5ED380A024
SHA-512:	8DF554AB0509BFD7B755342E6C78DC4DB7CFAA9D5C42439052EAFECF8853D5753B8975E8B214B75A46DE2C4FF973F8C93F5C358C29158D707F2544FF3901148D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x@....................,.......P.......,.......T.......................................,.......Rich............................PE..L......<...........!.........p......................................................................................@.......`...x....................................................................................................................text...H........................... ..`.rdata..............................@..@.data............ ..................@....rsrc............ ..................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\FCE647BF\1835CB68\u2ldts.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.3865196823068335
Encrypted:	false
SSDEEP:	96:pvhwqwhJhOjVYee/c5T3mqlh+RIQYcHYmotqYnhoajt5:AqwhJhOBYZ/Q6qT+aQbYnJjt
MD5:	965D0761E6321DB219C4DA55DE285278
SHA1:	D36E872C3D44FE152B1707A57D6165F09275C800
SHA-256:	B61529675C236BE1824D6779C8ECE1363A9BA5470B6F171ACFFBF7009ECEC83F
SHA-512:	5B321F47D03919C5B77853E8BFFF4BC4D5627FD40E069B693EA259048331BB62A14D9D457A1782E208D0692EEDAC34CB72EA118B6A158DAC7E3D74DDBE159841
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y./.=.A.=.A.=.A...O.<.A.=.@.1.A._.R.>.A...K.:.A...G.<.A...E.>.A.Rich=.A.........................PE..L....Y.:...........!.........@............... .....@.........................`.......N..............................P!..Y...` ..<....@.......................P..................................................0.... ..0............................text...T........................... ..`.rdata....... ....... ..............@..@.data........0.......0..............@....rsrc........@.......@..............@..@.reloc.......P.......P..............@..B.v1?.....$.>#...........USER32.dll.MSVCRT.dll...........................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\FE57A718\1517B7F7\CF_DB_Connect.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	5.0754106893091615
Encrypted:	false
SSDEEP:	768:L8YJkGS97VlcvFGHstC7jrJQR8fT+VoiAz+Gyzkza0+CH8BC+JoEJo:L8iWRy4cKfae3+NzkW0dcBFJxJ
MD5:	68D168F9E83DFAB14AA6D907290E2E15
SHA1:	5E3328C43E765C5C272014189ACF996C8ADA1652
SHA-256:	9866348EE2B19557194C357C57D9766B0628E4F15126510FD5D405962D42A575
SHA-512:	E439C92A317338A87B682839F3F313117FB4667E149586B0636E00833BF79EE9D5E3720B0F5D485D7B2A3BABCE3F38870B533CD24281185AC603BFF8372CB7F8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Mo.................F,....?(..........Rich...................PE..L...7..C...........!.........P............................................... .................................................(...............................X...........................................`... ....................................text...Z........................... ..`.data...`...........................@....rsrc............ ..................@..@.reloc..>........ ..................@..B..:@............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\mDown.dll\mDownExec.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1608992
Entropy (8bit):	6.641020171993679
Encrypted:	false
SSDEEP:	24576:9RuZ5AUvWT9hg3EXGxpkrBoSO6rmsj96CWWc9lyg6+nsq:m5eERkrKSjWCdcjCBq
MD5:	B3E42EA6551FD32F4B95E004186CD87B
SHA1:	66A6F070E7029526BCC0280E3D428BE4B6247139
SHA-256:	EF558752377ECE9E6ABF2F8CB31F4AA90D93D2DA513B2F674B810FA3F3F63EF0
SHA-512:	979E63CA3E6D659A63CA9523670DE5CBB4C3520AAEAAD55848082DC0D22D12ED2446361EF008F97CDF14F38326EBF5662C82E84BB92292352727EFEA03C0AFFF
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....;.b.................H..........4U.......`.....Q................................)................................p..P.... ...8...`...............6.. W..........................................................L*.......`..^....................text............0.................. ..`.itext.......@.......4.............. ..`.data...DV...`...X...L..............@....bss.....V...............................idata...8... ...:..................@....didata.^....`......................@....edata..P....p......................@..@.rdata..............................@..@.reloc..............................@..B.rsrc........`......................@..@.....................6..............@..@........................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1402144
Entropy (8bit):	6.695361468175675
Encrypted:	false
SSDEEP:	24576:WPm3mUFHlLsBXTZGZQ2crKYAKRBaSTGkvwIAsJlpC1IMXVZ:WPm2goth0KR0STGkvZlg1IMXL
MD5:	EAD95E71017BCC7D5A75B508C82997C7
SHA1:	0FEA2F23EA969EC134684CFCB4F7DA279F2F7C15
SHA-256:	BA4DBCF376957742C83E9D82322C46D68BBED301458D876F7A6D5A7333B8414D
SHA-512:	B675C6269B730A50433653CB92C7339910B45DAE6CC826628B3546A88570E82B46E6437A59284CF6AAFB43AD51B80119AE37D4B93CB309CC3B4A008196C6D2A9
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....;.b.................~.........................Q....................................................................O....P..@=...`...Z.............. W..........................................................d[..\............................text....i.......j.................. ..`.itext...............n.............. ..`.data....O.......P..................@....bss....(T...............................idata..@=...P...>..................@....didata.............................@....edata..O...........................@..@.rdata..............................@..@.reloc..............................@..B.rsrc....Z...`...Z..................@..@....................................@..@........................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\mVB.dll\mVBExec.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1357600
Entropy (8bit):	6.676037472083791
Encrypted:	false
SSDEEP:	24576:BbQr0YK8Usasyc0ZP0rqqTKOdB4Ssab0IOb/Ng/r0GEj:13CaZzqrdSSfW/WTjEj
MD5:	7084D611F4646FD3652B1ED603A1F4CD
SHA1:	9CA06B546644D37A62F11F79B1463FEBD974EC74
SHA-256:	DEA658AA6156AD4C54BDD4BDE1883CA088D38CDD0E220946F3CE44767FF42BAE
SHA-512:	9D00AC1C77EFEABA6AD59E461C2E396B716D4B888DF8D0FC2CBB7D9D1572C3AF12B7DF4822E19CD73DDDCC346AC6C481B9D725A1E1B5994BCDF74EEC93E41981
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....;.b.....................x.....................Q................................[~..................................N.......\7.......Z...........`.. W... ......................................................,................................text............................... ..`.itext.............................. ..`.data....O.......P..................@....bss.....S...P.......8...................idata..\7.......8...8..............@....didata..............p..............@....edata..N............z..............@..@.rdata...............\|..............@..@.reloc....... .......~..............@..B.rsrc....Z.......Z..................@..@.....................`..............@..@........................................................

C:\ProgramData\miaE495.tmp\data\OFFLINE\mWinRun.dll\mWinRunExec.dll

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1353504
Entropy (8bit):	6.674591083664776
Encrypted:	false
SSDEEP:	24576:sff3GymQgwTKYZe9YNTUPTBAS5m0WrSu/CScsOE:EmjtTT6S5ro/CzsOE
MD5:	F7FF3D6E5359DA5243D7889D3200E32B
SHA1:	6B4B02BBE68B09DF0D0CD680ECB56DF6C7F4463C
SHA-256:	69DD649F0D3A05149E048EE216F8F68D8B81AE32473EF511A144C99352FCA960
SHA-512:	9B11E90E0C50826EE571C3B6AA7D039AAD4B18481619404D3E578A41585214943FFC8C2A551E2B883C7C4F3544635A1BF5DF178F94B654C63F11E7ABF494B69E
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....;.b.....................v.....................Q....................................................................R......."6.......Z...........P.. W... .........................................................\.......^....................text...H........................... ..`.itext.............................. ..`.data....O.......P..................@....bss....\|S...P..........................idata.."6.......8.................@....didata.^............b..............@....edata..R............l..............@..@.rdata...............n..............@..@.reloc...... .......p..............@..B.rsrc....Z.......Z..................@..@.....................P..............@..@........................................................

C:\ProgramData\miaE495.tmp\data\cfrv_4_0_setup_ALL.msi

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Template: Intel;1033, Revision Number: {D529246B-78E5-4E65-A3A2-8E1040E91E59}, Number of Words: 0, Number of Pages: 200, Title: CF Remote, Subject: CF Remote, Keywords: Installer, MSI, Database, Author: NC SBoE, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0
Category:	dropped
Size (bytes):	868352
Entropy (8bit):	6.2772030756930395
Encrypted:	false
SSDEEP:	12288:gmLYSxeFmPBKXsbzlDSJjQ8guBoN2KA2wKc7wMz7:XLYSxHW5BqPA2fc7wMz7
MD5:	C42393B9643339D7F19EC2C717562646
SHA1:	2D6F6B8CE8DE076516095B9E35157055F530EF41
SHA-256:	2C3F9688DD4A7D3AFB3A28DDFA9A3A584C94E9029887DE5B3EF50F1DBB3D334E
SHA-512:	72BCBA2C66EBD01BDDF1490A65BB7E640D967B86AABE22C93E15C1EDF560C6C3E4A22D7601D2C085466E8E05F2129417DA2BBE21B4F342641741667BEF6E80E8
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE495.tmp\mia.lib

Download File

Process:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	606266
Entropy (8bit):	6.509399522017653
Encrypted:	false
SSDEEP:	6144:77mkzB4Do4JUqptRCwCzae0LYPpeBnVZ8w4toZAcLrJa/liSVHUPk:nmkzB+dtRRReCYRo38KLg/lIk
MD5:	6017C5F8EA6382684DEF62597535B277
SHA1:	1ED79B319B3B0E47BD3B08C194B4CFE1A06F12A8
SHA-256:	F4BB9CF2E03832F23B407D4BDEF1D44D4DFD6A510F2FDC1A6BE263241914B55B
SHA-512:	65A0E4505294C621C031F64051017C9BEE36EF4B5F793C39010A516E84443CD85DBF092A1B4D6526ABEFD499994739326E0B55B2480523DE7C8189B6DD3FF0F6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).n.m...m...m...d.......d...@...J.m.l...J.{.d...m.......d...y...d...%...d...l...s...l...d...l...Richm...........................PE..L....QkT...........!.................e.......0...............................0............@.........................`...........d....0...............................................................................0...............................text............................... ..`.rdata......0......................@..@.data....^......."..................@....rsrc........0......................@..@.reloc...C.......D..................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.dat

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.320734060433074
Encrypted:	false
SSDEEP:	6:SzgSDBk2r5ezoYLpyX5w3eLpy9kfyNrnTzAz7jM41wb8AkV:S0SDBk2teztpyXuEpyefy5f8MXbS
MD5:	195AB65C9A142856797306DA29E6122C
SHA1:	03D66B5D6EA9DA7E3202A641676303C3F0DDF3E8
SHA-256:	8847253FDC4403D0A7418543A304F0DC13F6A8D05BF76042AC04793AF84D9A21
SHA-512:	FD8ECBF629D1CE0607C2160C29C6A6E54E0837DF4FEABD252E9F28193B305F524ACC30259518193550FE7CBDF894A93A1B93B5794E67406D2EAA6E410FA24517
Malicious:	false
Preview:	MYAH-PREDEF-COMPONENT..New Project..$..TRUE..TRUE..$..$..$..$..MYAH-PREDEF-COMPONENT..73649591..NEW PROJECT..0..$..C:\Program Files (x86)\\SBoE\Campaign Finance\CF Remote..TRUE..Campaign Finance..C:\PROGRA~3\miaE495.tmp\data\..MYAH64WOW..Win32..OVERRIDECACHE....NATIVE_ENGINE..FALSE..ANAPPLYINSTALLWASCALLED..TRUE..

C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.exe

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5675007
Entropy (8bit):	6.48705961905541
Encrypted:	false
SSDEEP:	98304:2hG63qsl7dEhYCHnWzXzLbVI9AB5dECNhc6ZzH2oYK13icjqsNTUjJG:2Jah2zXzL5IWB5JhnHfFIG
MD5:	3B2D532673D1567116105D04C621CDBA
SHA1:	F0892A2DCF772529C115C15E6B1A510B4DC214E1
SHA-256:	FD6D2298B1B5DD14A9F02207FAA4D7D7DC5F5B399E71F2F4EC3680C2DBC6DF0E
SHA-512:	15ABF21DCF9ABF346DDFB6B35F75C607B4E6CF4518B629C39ADCA5E4690955D70C46C5A842F73FE7373FA6A7F7860DB514D3815DD04D1280DAD7A7D1A315B672
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.exe, Author: Joe Security
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?..`.................z;..........e;.......;...@.......................... Y..................@............................?..Y... D.......................................................?.......................?......`?......................text.....:.......:................. ..`.itext.......;.......:............. ..`.data...(.....;......~;.............@....bss.....}....=......Z=..................idata...Y....?..Z...Z=.............@....didata......`?.......=.............@....tls.....A...p?.......=..................rdata........?.......=.............@..@.reloc...I....?.......=.............@..B.rsrc........ D.......=.............@..@.............pY......\W.............@..@........................................................

C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.lnk

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	159
Entropy (8bit):	4.892774327669993
Encrypted:	false
SSDEEP:	3:PXZkRErG+fyM1K/RFofD6GeLpyXjF3A39q1Jj4I52toYLpyXjF3A3OmGw3mkAy:vWaH1MUmGeLpyX5w4t52toYLpyX5w+jq
MD5:	21D22691174AA25728C4CD7F7D5A85CA
SHA1:	994695A289A7861C4040B602AEA778EAFB440771
SHA-256:	D25F005EEE9EF910E5E4BDF0CE76F6FFB904A004FC9A401ED75AD4078D6F5DF8
SHA-512:	483CCF0669E6820E300F2FC785A413C46A2D5A340784237E0F8BFE3DC997D8C9DCC7E1369DF9D9A2BA99C740C271ACA9FC5549F52D35501DE21B184982AE0A8F
Malicious:	false
Preview:	.C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Campaign Finance\CF Remote.lnk\|8\|C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\CF_Remote.exe..

C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.msi

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Template: Intel;1033, Revision Number: {D529246B-78E5-4E65-A3A2-8E1040E91E59}, Number of Words: 0, Number of Pages: 200, Title: CF Remote, Subject: CF Remote, Keywords: Installer, MSI, Database, Author: NC SBoE, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0
Category:	dropped
Size (bytes):	868352
Entropy (8bit):	6.2772030756930395
Encrypted:	false
SSDEEP:	12288:gmLYSxeFmPBKXsbzlDSJjQ8guBoN2KA2wKc7wMz7:XLYSxHW5BqPA2fc7wMz7
MD5:	C42393B9643339D7F19EC2C717562646
SHA1:	2D6F6B8CE8DE076516095B9E35157055F530EF41
SHA-256:	2C3F9688DD4A7D3AFB3A28DDFA9A3A584C94E9029887DE5B3EF50F1DBB3D334E
SHA-512:	72BCBA2C66EBD01BDDF1490A65BB7E640D967B86AABE22C93E15C1EDF560C6C3E4A22D7601D2C085466E8E05F2129417DA2BBE21B4F342641741667BEF6E80E8
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.par

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	7513
Entropy (8bit):	4.985112886613449
Encrypted:	false
SSDEEP:	192:nqm9BigrTDd/WdZRH3HyrvM0cusqyaKVCci2AoIhmgmidS02Y8eUZFIqD3+It0KK:qm9BigPDd/2PHijM0CqyaCCci2Ao+mgX
MD5:	3DC48DDC37E2D4A5D2FB89D46B7D9CD8
SHA1:	6AF19AAAC4181F7A2D1D32919885BD9EE8A93107
SHA-256:	AB1681AFC18A4DB43F1CBB6B8A7CD354F35D0290FFB11F2C3E94326D90850F54
SHA-512:	95398449F09F5BFA6A561C9C5E800056505629F1CCC3998480B934F96378C08A03E8171EC05A38B2F65D96B5F38BCE6F4144073BC5BAA8DC6E415D7E3D1F2BFE
Malicious:	false
Preview:	.AAE4ED6BA..FALSE..AAE68B5EB..FALSE..A2AFAD2D7..FALSE..A47890F43..FALSE..AABF0EABC..FALSE..A5303394E..FALSE..A36C4273F..FALSE..ABEFE417A..FALSE..A2AFAD2D7..FALSE..A1AAFDCA9..FALSE..A4D583000..FALSE..A47890F43..FALSE..A392822E1..FALSE..A9202CBED..FALSE..A2AFAD2D7..FALSE..A5B95B812..FALSE..A1983855A..FALSE..A392822E1..FALSE..A6C969A31..FALSE..A86FEDFFB..FALSE..A280378AD..FALSE..A895B52CC..FALSE..A96D781B4..FALSE..A303D489..FALSE..A36C4273F..FALSE..A4D583000..FALSE..A47890F43..FALSE..A9EDFEF92..FALSE..A33529D6E..FALSE..AD400EB86..FALSE..A9202CBED..FALSE..A2AFAD2D7..FALSE..A5B95B812..FALSE..A1983855A..FALSE..A392822E1..FALSE..A96D781B4..FALSE..A4D583000..FALSE..A47890F43..FALSE..A759968E7..FALSE..A705D4320..FALSE..A108A6B0C..FALSE..A9202CBED..FALSE..A747EDAC0..FALSE..A31A38C9B..FALSE..AF2139E01..FALSE..ABAD9EF7A..FALSE..ACA4B8A8B..FALSE..A832FC268..FALSE..A2D3E0D90..FALSE..ABED664EA..FALSE..AF7CFC206..FALSE..AD77E7C08..FALSE..ADAE69E8..FALSE..AE76BBEDE..FALSE..ACE1E931F..FALSE..A43981525

C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\cfrv_4_0_setup_ALL.res

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	8694055
Entropy (8bit):	6.569101251424524
Encrypted:	false
SSDEEP:	98304:6bCyTWyZzxtJNL05f9tAYnA3U9XHsHcCXq8vXKEUo/wRZlV:Ia8KEUo/wdV
MD5:	FDC346FFDFDD1F15F1DBA95695960160
SHA1:	4983376DAB7201E8AF1728D2F6FD9AEE0CCAD376
SHA-256:	74924F08BD5817B532B441E57C5D9C7CB55AD001C410C038DE1F54427D1160E9
SHA-512:	AE7F0A4EC374A78816B7DDF3B90BD358729BC6E0C153C08CA4AC17741F6E72C0A3E43B822DD3A55FA15C603314B78B4D7E43D8F131ED60143CFB9B7C65E0B66E
Malicious:	false
Preview:	7z..'.....%........{........fX....TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..

C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\instance.dat

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.482202581850587
Encrypted:	false
SSDEEP:	3:LibnEUsuISYov+ZjYXIkjwrQ4UNA3fvn:+bnSuvYo2WJwrQ4US3
MD5:	78D8E6169CFDB028A983F4DB3CAF4EF2
SHA1:	E75A4F0D2B4A080C94FA698F216EEEDBC34025F8
SHA-256:	8D1F063948F245FD9E7D7B65A76D1CA274AC40199A0DD4D75C01640BED392B24
SHA-512:	4AE130200E4D2C926DBEAF7042D662FB52E67974B3E08702221BE8FCE607FF0AEA696D0A0B1372567E27AB6148E050EEEFFFB12C1393769F12BD2D0D56D37A14
Malicious:	false
Preview:	{152D390A-DD7B-4E57-B3A5-14CADE7E1207}..{D529246B-78E5-4E65-A3A2-8E1040E91E59}..CF Remote..

C:\ProgramData\{D529246B-78E5-4E65-A3A2-8E1040E91E59}\mia.lib

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	606266
Entropy (8bit):	6.509399522017653
Encrypted:	false
SSDEEP:	6144:77mkzB4Do4JUqptRCwCzae0LYPpeBnVZ8w4toZAcLrJa/liSVHUPk:nmkzB+dtRRReCYRo38KLg/lIk
MD5:	6017C5F8EA6382684DEF62597535B277
SHA1:	1ED79B319B3B0E47BD3B08C194B4CFE1A06F12A8
SHA-256:	F4BB9CF2E03832F23B407D4BDEF1D44D4DFD6A510F2FDC1A6BE263241914B55B
SHA-512:	65A0E4505294C621C031F64051017C9BEE36EF4B5F793C39010A516E84443CD85DBF092A1B4D6526ABEFD499994739326E0B55B2480523DE7C8189B6DD3FF0F6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).n.m...m...m...d.......d...@...J.m.l...J.{.d...m.......d...y...d...%...d...l...s...l...d...l...Richm...........................PE..L....QkT...........!.................e.......0...............................0............@.........................`...........d....0...............................................................................0...............................text............................... ..`.rdata......0......................@..@.data....^......."..................@....rsrc........0......................@..@.reloc...C.......D..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\Desktop\CF Remote.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Dec 1 14:44:33 2023, mtime=Thu Aug 8 22:20:20 2024, atime=Fri Dec 1 14:44:33 2023, length=4243456, window=hide
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.687027848958547
Encrypted:	false
SSDEEP:	24:8QmytjEydOE7lKvp1+Kv6oANsLy4ACdIzoUUIuyfm:8BhydO3P+u6PNz43dK9r
MD5:	B789A8317F63A93F356BF84DFBF235E1
SHA1:	2A4C7A71EDA0C8F04B955E1536230EA18A5CA2AE
SHA-256:	86FF700B8EF6AF8EB195BF01C45B0A834848745FEB5E475DC23A38A1C052B7A5
SHA-512:	3BD6FEFE37FDFFADA1A4058067A7DC24EC2911855983F9446011A2CBD3794A13D493CECAD296C1A602C3D693FB523902D06C62E788D955C787EAF9D1B9B74FDF
Malicious:	false
Preview:	L..................F.... ......Gm$...vQ........Gm$....@.....................C....P.O. .:i.....+00.../C:\.....................1......Y....PROGRA~2.........O.I.Y......................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....N.1......Y....SBoE..:.......Y...Y................................S.B.o.E.....j.1......Y....CAMPAI~1..R.......Y...Y...... .........................C.a.m.p.a.i.g.n. .F.i.n.a.n.c.e.....\.1......Y....CFREMO~1..D.......Y...Y......!.......................!.C.F. .R.e.m.o.t.e.....h.2...@..W.} .CF_REM~1.EXE..L......W.}.Y.......I......................P.C.F._.R.e.m.o.t.e...e.x.e.......s...............-.......r...................C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\CF_Remote.exe..J.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.S.B.o.E.\.C.a.m.p.a.i.g.n. .F.i.n.a.n.c.e.\.C.F. .R.e.m.o.t.e.\.C.F._.R.e.m.o.t.e...e.x.e.........*................@Z\|...K.J.........`.......X.......936905...........h

C:\Users\user\AppData\Local\IIIQF\7z.dll

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	174080
Entropy (8bit):	6.279217790646268
Encrypted:	false
SSDEEP:	3072:xyljBP/VZjAISqyTFjoZAO1h7BTF1rJa//diUTTBXJxO8hlIhb0:xeBnVZ8w4toZAcLrJa/liSVHU
MD5:	31CAD6A3EDD1C32981AD6B565CBEAC94
SHA1:	9338978C85A9423EE2A38CBA027F79192D684F1B
SHA-256:	B8521ABDA09EC17DDAD36528C1BC50395DC8C5F7C11C026A5B3FF23110C54182
SHA-512:	02E198B8EF192DE55DB35AE00A16A80B3309A9373A596C20D617B43DD7159A635BC303F371859E704375521A1242D02754807E2E9DFEF63FFD06993B24C17D3D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D..P....................6...>..............._...........6...P...o.^.....o.j....................Rich............................PE..L....S.L...........!........................................................@.......................................@.......9..P...............................@.......................................................,............................text............................... ..`.rdata...@.......B..................@..@.data.......P...4...4..............@....sxdata..............h..............@....rsrc................j..............@..@.reloc...%.......&..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lang.loc

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	161850
Entropy (8bit):	4.662047306059787
Encrypted:	false
SSDEEP:	3072:VmLCDQ9xl64bNmso7f4vqp/Mp+WD7UB4/YQfl:s
MD5:	6D2EA67B5892DC26D5ABD01608BC086A
SHA1:	14BC24724509E44918252D155FA3E7152FE232F3
SHA-256:	76AA59963903F0299CDA780A1DA7583227CB4C84F4EFF213A101841CE02C39C7
SHA-512:	1842D801325A1FD6F479A42A98A1C5A49EE7707B682E45BC95AE23C0E073288E9C4889710F6D925B6E852540355CB66565E2B745CFA7C76F34BF26FDDAAD9D7E
Malicious:	false
Preview:	Please install the common controls update from Microsoft before attempting to install this product...Setup resource not found..Setup resource decompression failure..Setup database not found..Runtime error in install: ..bytes..KB..MB..Attempting to get value of undefined variable ..Attempting to set value of undefined variable ..Copying: ..Unable to copy installation data to local folders..Downloading Web Media: ..Unable to download installation data from the web..Extracting Web Media: ..Unable to extract installation data downloaded from the web..Please locate your original setup sources to continue operation..Original setup sources required to complete operation, sources not found..General setup failure..Runtime error in setup script:..% complete..bytes received..InstallAware Wizard..InstallAware is preparing the InstallAware Wizard which will install this application. Please wait...Retry Download?..Downloading of installation data from the web has failed. Would you like to try again?

C:\Users\user\AppData\Local\Temp\mia.tmp

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	252415
Entropy (8bit):	5.5406407126482025
Encrypted:	false
SSDEEP:	3072:+XjjjjNOJUu/4UHSteLixAkrQitNfyvobIAGrnj6VywfGMCz8OlsAI:+XjjjjNOZfSSk3Qow0f2I
MD5:	44F77F1BBD46DEC6862CE4FB1DC89234
SHA1:	0DE617D1E836141E31CCE8BB248FF21CCA5620E3
SHA-256:	EF6C4F89F829BE9B225AF46788BD5D1ACEA2D0B665FDA4FBED1960E66B8A155C
SHA-512:	C99DE199196F5B901CD2F584D79F5EBF4E2ED0827E861725D154E28098B440A82B87FB560EC49CD8DECD9A509DB4F450403CCD032811E855DC635F8493D2ABB2
Malicious:	false
Preview:	.Comment..Comment..Code Folding Region..Code Folding Region..Comment..Set Variable..Set Variable..Set Variable..Set Variable..Create Folder..Set Access Control..Set Variable..Comment..Code Folding Region..Get System Settings..If..Write to Text File..MessageBox..Terminate Install..End..Get System Settings..If..Write to Text File..MessageBox..Terminate Install..End..Comment..If..If..If..If..Does File/Folder Exist..If..Write to Text File..MessageBox..Terminate Install..End..End..End..End..End..Code Folding Region..Comment..Code Folding Region..Comment..Code Folding Region..Comment..Set Variable..Set Variable..Comment..If..Set Variable..Set Variable..End..If..Write to Text File..Set Variable..Windows Installer..If..Set Variable..Set Variable..End..Comment..End..Write to Text File..Set Variable..Visual Basic VM..If..Set Variable..Set Variable..End..Comment..Comment..Code Folding Region..Comment..Code Folding Region..Comment..If..Comment..If..Terminate Install..End..Display Dialog..Comment

C:\Users\user\AppData\Local\Temp\mia1\cfrv_4_0_setup_ALL.msi

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Revision Number: {D529246B-78E5-4E65-A3A2-8E1040E91E59}, Number of Pages: 200, Title: CF Remote, Subject: CF Remote, Keywords: Installer, MSI, Database, Author: NC SBoE, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0, Template: Intel;1033, Number of Words: 8
Category:	dropped
Size (bytes):	868352
Entropy (8bit):	6.27478169655376
Encrypted:	false
SSDEEP:	12288:8vLiSxEFm3BKXsbzlDSJjQ8guBoN2KA2wKc7wMz7:CLiSxdW5BqPA2fc7wMz7
MD5:	07B84F29BDE3DA6F007CB92808F95C72
SHA1:	4B3FE13A83BCDC68960132FB426E040289A14DE1
SHA-256:	BA6852A7F0F0711ADB1F6FC1A32177E7ABBEB8CFC2A62A778252AC3B1EE0B485
SHA-512:	1921A4ECE8E9155A3E8CBC73223940F7DEE796379D3CF6FAD4ACB6F53E449A38AE816B590B40EE4C911E7C69B1B95648482243132174C9A3022F1E7BBFC1BB13
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mia1\componentstree.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	33309
Entropy (8bit):	3.3772470427001995
Encrypted:	false
SSDEEP:	768:pJHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfTE:phXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Dt
MD5:	F1BA2D0A20CF4290FCDB45B3CF54840C
SHA1:	EC808EBC2563D3D00866BDE0AFF4059C3C995C03
SHA-256:	F27A9B4D468632780547E3FC26A59993B3108A18CB096852A302577BFA4C6F2F
SHA-512:	C4073CE6F58447B858901389D52BD479C888370CD6328499B516B9C919A728C4099F00DFA19005AC65BC986A79FF2A9A0E4CAAE9BCC0A5E3A72747696B4BC126
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z..

C:\Users\user\AppData\Local\Temp\mia1\componentstree.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	374
Entropy (8bit):	4.773773154848379
Encrypted:	false
SSDEEP:	6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82dukT:7INIkU3lkimkU3MIkT
MD5:	8101E0CC3186C05F85B2CD484D26AE9D
SHA1:	B3CF33E0784E3A6F3B3FEB2B2501E0BDA5932EFA
SHA-256:	A0E750466327E92E2DCC96D72A19A7738A65AB765262DF4801E6677528F14D6C
SHA-512:	DF3692D29CDF0434806A0BCF034AFE6869B0BF5C0BE24F18637D373374C1E1803AC5B6D1F671CCD6E89B313E26F85657EA487A2EBAEAE0B99359A66F21DF910B
Malicious:	false
Preview:	IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia1\destination.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	15242
Entropy (8bit):	7.84777952977126
Encrypted:	false
SSDEEP:	384:50OxsRBdY8cwyJ+Ic+GJQrSAhn37QpYaGwrCR:5kbdY8To+G7kY3
MD5:	66B51FD9D148F40B906CDF17F206475C
SHA1:	2A1C8284B6919C9527DBC386DBD58DCC6D245675
SHA-256:	DF3404C11235C94FAB877B0474F5FA4020DAD0109F4AE309FA046A0618599896
SHA-512:	D9AC3B86ED42EF6F74D0B6A65220FA652338A545B9B9C46EA45155480929B38119E6A78867E26E46F998B133E37DE24BDAAE98BBE7EF9C6067B891775BC45C70
Malicious:	false
Preview:	...TFRMDESIGN.0.v;..TPF0.TfrmDesign.frmDesign.Left....Top.\|.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.DoubleBuffered..Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...GlassFrame.Bottom./.OldCreateOrder..Position..poDesigned.Touch.ParentTabletOptions..Touch.TabletOptions..toPressAndHold.toPenTapFeedback.toPenBarrelFeedback.toFlicks.toFlickFallbackKeys..PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data../...TPngImage.PNG........IHDR.......;......T$L....sRGB.........gAMA......a.....pHYs..........o.d../.IDATx..gx...?....{..".n.m....Kh.$.Z ......B..C.!.@......Kl.eK.%Y.m...5........\...m.=.{...p...Yk.. .C6666...ZoM.../.#4.........Q4!A_..?o..........2.....).D$.Aq...WB..hM...i$.;q...l".... M6H.5Q....*....,..QN4..ep..5..A1.P.A_.p.<.g.f4W...>Y...&.....Q.#...../....

C:\Users\user\AppData\Local\Temp\mia1\destination.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	377
Entropy (8bit):	4.815324246200539
Encrypted:	false
SSDEEP:	6:s82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82dukT:IINIkU3lkimkU3MIkT
MD5:	F7956EFDD257F64C607FC35CE295D625
SHA1:	6AB4DB64B18631E2CD9C8234E9C31B4238CF4FDD
SHA-256:	F25B4D0DE61024212EA4E18135EE9A4D6F145A92AC32C73746CB2619A6E1EC8D
SHA-512:	94243359CED16C96E7DBF886912E1A68A1896DF13384CFFB5617AD48E5ECFAEA5EF076EB6D8C6F8126314656281B49F09450C82ADA8764FF481DC10113197BD3
Malicious:	false
Preview:	.IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia1\finish.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	48434
Entropy (8bit):	7.966771896841437
Encrypted:	false
SSDEEP:	768:D+2E2XFXd2pbhliaeVSCqLgle/miee9GIqeK7+72g4krhh:D+R2XbaewCsX2eLc+72gbrhh
MD5:	978E3FBC366DFAE2E799E0D7CA673E01
SHA1:	C312BBF3FDFEC3E2E97DE481732E2FD9D0282F20
SHA-256:	995C3C9E62AEE9C2C35488D6ECC656459E3D43F0E9CF0066DA736AF6E3F87F57
SHA-512:	5E41808A2C0BD825AF6E7ACFA7DA8EB818E294BDCA6AB336AAF253260D1A8B06E994E313DE90AC8D1A620DAA0A386484F5A62E790F4BED1609D2194EF5537332
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.:..Picture.Data......TPngImage.PNG........IHDR.......:........]....sRGB.........gAMA......a.....pHYs..........o.d....IDATx.........d.....9.s8t."E.X..T....."z.k.+z..*.T.D@...4A.Io.r..:.M.I2.L... ....z...e....L.ik=...7>..1 :x!........^ppz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x.

C:\Users\user\AppData\Local\Temp\mia1\finish.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1600
Entropy (8bit):	5.007774942158045
Encrypted:	false
SSDEEP:	24:UuikSi+nfi0Zi5ai/pZSruicvSi+pipUiOsIi/pEai/fi/pTvSgREii/p51i/p56:U56AGHbR1ZRMfkf3faWYxVh
MD5:	75A2E981E48B4697263548CB79B523CD
SHA1:	52A5958B06D0B064420E7B882AAD64ADA14906FE
SHA-256:	D65470903C956152C8BC2788F0E9689C52E2FA44B0A193E0F686854383A7519B
SHA-512:	23D92DFF49399745EDBFADE604B1ED54115A7ED7BDE513381B66C4B46222525419E4EE2320BA2F10B6F80EF185F41340CDB8A93B655BE080D19111D2F669D2DA
Malicious:	false
Preview:	IF (checkSuccess.Caption = COMPLETE) THEN textComplete.Visible := True;..IF (checkSuccess.Caption = REBOOT) THEN textReboot.Visible := True;..IF (checkSuccess.Caption = CANCEL) THEN textCancelled.Visible := True;..IF (checkSuccess.Caption = ERROR) THEN textError.Visible := True;..IF (checkRemove.Caption = TRUE) THEN textRemove.Visible := True;..IF (checkSuccess.Caption = REBOOT) THEN RebootNow.Visible := True;..IF (checkSuccess.Caption <> COMPLETE) THEN textComplete.Visible := False;..IF (checkSuccess.Caption <> REBOOT) THEN textReboot.Visible := False;..IF (checkSuccess.Caption <> CANCEL) THEN textCancelled.Visible := False;..IF (checkSuccess.Caption <> ERROR) THEN textError.Visible := False;..IF (checkRemove.Caption <> TRUE) THEN textRemove.Visible := False;..IF (checkRemove.Caption = TRUE) THEN textComplete.Visible := False;..IF (checkSuccess.Caption = CANCEL) THEN textRemove.Visible := False;..IF (checkSuccess.Caption <> REBOOT) THEN RebootNow.Visible :=

C:\Users\user\AppData\Local\Temp\mia1\icon.ico

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	MS Windows icon resource - 2 icons, 32x32, 16 colors, 16x16, 16 colors
Category:	dropped
Size (bytes):	1078
Entropy (8bit):	3.8897554644986423
Encrypted:	false
SSDEEP:	24:hEi/gV/XZhmF6VBY6+yat7liXoj1NQCSj/:pOW0Y6+3Y6E/
MD5:	D22667C1806E0F83E9247F7AA9BD17A9
SHA1:	24DFB34D17D06D32DDB7C269CD0975DC4EBB459B
SHA-256:	00055DDFD7AA9E48E8ABA6593F4167E0F3CD5C0E0F2A14FEF6F10CFE68D1E318
SHA-512:	CE6F94B6B58870D439EC4AD4CC6852BB0A031F6670749B6B470C7745FB33897B7059A778816D16D170D6A571F17054A11089D316D58C2ADDC820F6D9B83A78E8
Malicious:	false
Preview:	...... ..........&...........(.......(... ...@.................................................................................................................wx.......................wz.......x.....wwz.......w.....wwz.......wx.....wz.......wx...w.w..wp....wx...ww...wp.L..wx...ww..wwp.L..Gx...wz..wwp.L..Dx...w..w.wp.L..DH.ww...w.w......D.ww..ww......pD.wwx.wwp..x..........wx....w..............xwp..........p........wwwwwx.....p.........x.........DDDDDOx..........vfl.Ox..........wff.Ox...........vflOx...........wffOx............vfOx.........~..wfOx.........w...vOx.........w~..wOx.........DDDDDOx.........................wwwwwww............................?.....................................................................................................................(....... ......................................................................................................p.....wz...p.......w..p.p..w...wp..w....p......w........x............www.....Gf.....Nvg.....G.g.....DDG...

C:\Users\user\AppData\Local\Temp\mia1\installaware.png

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1597
Entropy (8bit):	7.871063017224323
Encrypted:	false
SSDEEP:	24:X93kpZjQLmEcxtIwWXPAGpKpkZcks41xdrqUaBdJbYfxpJgx7YWg/uLwdCnq:N3Yj8mEcxywiPrpKpNMdr07SxgSt
MD5:	B7225A16DAF9DE1D514AEFE567FDF2F5
SHA1:	D6A00C526C425FCD5EF49B0C87814F2CF476CB59
SHA-256:	0E2DEFC9B470D3F9BD184D254493EFAD94EA0273C1FE17FC8FC651D47B01734E
SHA-512:	31412603AE87F2B9C9DAD2D0BA64868105586D1778846DE5F1C14667C4292DE36FC193B54670BDF130019B0B42AB59EEF2C2D8672226BA755181FEA894BD9246
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.W.L.W...!..dl.'.@.10.a.....2.T'.....SD..-PK@t.....:53.... :#F.......\|"...L....6 m)Lw........9...K.+.b...z.x........=...J.V....n3[.B..v[m..../....o0.L....Q...&...$~?%%?PG..S<..]...$.Z......O.3".k....m]..2S9..4,.k+.xf..k.F...V..4[Ec'K.2.2..PK.....H$..H.....kA...M..>.zs.....^...K"...j..:..Hu.T..Q.....N...y'.+9.dR.{..Xn....w.f...R.KQB.]z........6>..,.......q.%........;.,......U{.i....Z.....)._I..7..J.q..d)...CM....;...,R~.B.S...E...p[-O........].F...%..A.%....{.%....]Q..>.-..f..C..i.Q..+5.......A'~.....J...M.mtN..0..r.>.@K.....D...<...CI^#.-.P.}?R..M.-.7..GS...Z^9s..<6.....>......<..g.~.9....{]Ju..}`..Z(..ikw^.,)X..g...\|G.LQ9A^...9pe....7d.......SE.Q..../nx.}_..F...$..I..K...o4.^ ..e.X.Q.H......&........Q..............\n....J......./...7.....E.9.....$...K..!...c.`.=.Jd.nq.n.W.Q...Q.#s.w._.d....u...Q].-U.N.J..&.O..=......a+.k.....%.$..(.....@`...lx.......tDC..=.{...^"...@.....\{;#.^...G.q./AA.

C:\Users\user\AppData\Local\Temp\mia1\licensecheck.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32515
Entropy (8bit):	3.2392237095249325
Encrypted:	false
SSDEEP:	768:j2HXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfE:juXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5D1
MD5:	9A87495839CA4357F293308C86139F03
SHA1:	0529F4612D004BAA1FE8806F6EAD5E78B3E76E55
SHA-256:	C623B82A8BE3EAD16900164C09AFEE00215DC1749A6DE8D4F381CF983A3F5CEB
SHA-512:	75F64D527924764598066D157C406FD18A00FA59EAB8D418724EF7E87B8B718EF57595118284710A08B17D7C287723AAF5F06383F877ADF77EFF7F7573AD665E
Malicious:	false
Preview:	...TFRMDESIGN.0..~..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z..

C:\Users\user\AppData\Local\Temp\mia1\licensecheck.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	502
Entropy (8bit):	4.896842553280578
Encrypted:	false
SSDEEP:	6:aHi6GKuMtrk86i6euMtrkeuN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+J:0IMtgfjMtgxINIkU3lkimkU3MIkT
MD5:	D312F2FDC09193A04578D688A2CA292D
SHA1:	54BD3AA4CC72E68FC613A4227CADA7AD702D795E
SHA-256:	DB1C3A93A00A46C77F3E8D19C5DA4D42C54CE58C9EB71B586E512ABEE2D46967
SHA-512:	A71514B0F31010F7BF23954BCE707A277CA765BC14DDED7D7870615528A7751E4B26E72BB826781BC4F57C2A7C75FCFB92C4BA781AAD58372CF6CECE39832D19
Malicious:	false
Preview:	IF (LicenseCheck.Checked = True) THEN Next.Enabled := True;..IF (LicenseCheck.Checked = False) THEN Next.Enabled := False;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia1\mDownExec.dll

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1608992
Entropy (8bit):	6.641020171993679
Encrypted:	false
SSDEEP:	24576:9RuZ5AUvWT9hg3EXGxpkrBoSO6rmsj96CWWc9lyg6+nsq:m5eERkrKSjWCdcjCBq
MD5:	B3E42EA6551FD32F4B95E004186CD87B
SHA1:	66A6F070E7029526BCC0280E3D428BE4B6247139
SHA-256:	EF558752377ECE9E6ABF2F8CB31F4AA90D93D2DA513B2F674B810FA3F3F63EF0
SHA-512:	979E63CA3E6D659A63CA9523670DE5CBB4C3520AAEAAD55848082DC0D22D12ED2446361EF008F97CDF14F38326EBF5662C82E84BB92292352727EFEA03C0AFFF
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....;.b.................H..........4U.......`.....Q................................)................................p..P.... ...8...`...............6.. W..........................................................L*.......`..^....................text............0.................. ..`.itext.......@.......4.............. ..`.data...DV...`...X...L..............@....bss.....V...............................idata...8... ...:..................@....didata.^....`......................@....edata..P....p......................@..@.rdata..............................@..@.reloc..............................@..B.rsrc........`......................@..@.....................6..............@..@........................................................

C:\Users\user\AppData\Local\Temp\mia1\mMSIExec.dll

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1402144
Entropy (8bit):	6.695361468175675
Encrypted:	false
SSDEEP:	24576:WPm3mUFHlLsBXTZGZQ2crKYAKRBaSTGkvwIAsJlpC1IMXVZ:WPm2goth0KR0STGkvZlg1IMXL
MD5:	EAD95E71017BCC7D5A75B508C82997C7
SHA1:	0FEA2F23EA969EC134684CFCB4F7DA279F2F7C15
SHA-256:	BA4DBCF376957742C83E9D82322C46D68BBED301458D876F7A6D5A7333B8414D
SHA-512:	B675C6269B730A50433653CB92C7339910B45DAE6CC826628B3546A88570E82B46E6437A59284CF6AAFB43AD51B80119AE37D4B93CB309CC3B4A008196C6D2A9
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....;.b.................~.........................Q....................................................................O....P..@=...`...Z.............. W..........................................................d[..\............................text....i.......j.................. ..`.itext...............n.............. ..`.data....O.......P..................@....bss....(T...............................idata..@=...P...>..................@....didata.............................@....edata..O...........................@..@.rdata..............................@..@.reloc..............................@..B.rsrc....Z...`...Z..................@..@....................................@..@........................................................

C:\Users\user\AppData\Local\Temp\mia1\mVBExec.dll

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1357600
Entropy (8bit):	6.676037472083791
Encrypted:	false
SSDEEP:	24576:BbQr0YK8Usasyc0ZP0rqqTKOdB4Ssab0IOb/Ng/r0GEj:13CaZzqrdSSfW/WTjEj
MD5:	7084D611F4646FD3652B1ED603A1F4CD
SHA1:	9CA06B546644D37A62F11F79B1463FEBD974EC74
SHA-256:	DEA658AA6156AD4C54BDD4BDE1883CA088D38CDD0E220946F3CE44767FF42BAE
SHA-512:	9D00AC1C77EFEABA6AD59E461C2E396B716D4B888DF8D0FC2CBB7D9D1572C3AF12B7DF4822E19CD73DDDCC346AC6C481B9D725A1E1B5994BCDF74EEC93E41981
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....;.b.....................x.....................Q................................[~..................................N.......\7.......Z...........`.. W... ......................................................,................................text............................... ..`.itext.............................. ..`.data....O.......P..................@....bss.....S...P.......8...................idata..\7.......8...8..............@....didata..............p..............@....edata..N............z..............@..@.rdata...............\|..............@..@.reloc....... .......~..............@..B.rsrc....Z.......Z..................@..@.....................`..............@..@........................................................

C:\Users\user\AppData\Local\Temp\mia1\mWinRunExec.dll

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1353504
Entropy (8bit):	6.674591083664776
Encrypted:	false
SSDEEP:	24576:sff3GymQgwTKYZe9YNTUPTBAS5m0WrSu/CScsOE:EmjtTT6S5ro/CzsOE
MD5:	F7FF3D6E5359DA5243D7889D3200E32B
SHA1:	6B4B02BBE68B09DF0D0CD680ECB56DF6C7F4463C
SHA-256:	69DD649F0D3A05149E048EE216F8F68D8B81AE32473EF511A144C99352FCA960
SHA-512:	9B11E90E0C50826EE571C3B6AA7D039AAD4B18481619404D3E578A41585214943FFC8C2A551E2B883C7C4F3544635A1BF5DF178F94B654C63F11E7ABF494B69E
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....;.b.....................v.....................Q....................................................................R......."6.......Z...........P.. W... .........................................................\.......^....................text...H........................... ..`.itext.............................. ..`.data....O.......P..................@....bss....\|S...P..........................idata.."6.......8.................@....didata.^............b..............@....edata..R............l..............@..@.rdata...............n..............@..@.reloc...... .......p..............@..B.rsrc....Z.......Z..................@..@.....................P..............@..@........................................................

C:\Users\user\AppData\Local\Temp\mia1\maintenance.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	160624
Entropy (8bit):	1.9662006432706152
Encrypted:	false
SSDEEP:	192:tdMMfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4Cwtq69wWnUgK:tfI/kwAgK
MD5:	B3C9C9EE0C9C2DCB15CF24D5DF20F4F3
SHA1:	3B1660EB617CB2751D9CCC79B8C025BD5A7B153B
SHA-256:	23D6D6041B3025A8B1817B5FC455067B534AD91DCB19A1D09509A3AE55065CED
SHA-512:	93C5B855AF462D9772754CB46307F5890735F7476D8ECF0F9CF213BC3A32EB4E19E3C48842A68F9D1DD29EAF2A8A2EE4712E917AB05BC121C18BFA77E3250811
Malicious:	false
Preview:	...TFRMDESIGN.0.\s..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP.tP).sR..{W..}Y.vU2.\|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...\|...r...z...q...w...\|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..\|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8.....................................

C:\Users\user\AppData\Local\Temp\mia1\maintenance.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	374
Entropy (8bit):	4.773773154848379
Encrypted:	false
SSDEEP:	6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82dukT:7INIkU3lkimkU3MIkT
MD5:	8101E0CC3186C05F85B2CD484D26AE9D
SHA1:	B3CF33E0784E3A6F3B3FEB2B2501E0BDA5932EFA
SHA-256:	A0E750466327E92E2DCC96D72A19A7738A65AB765262DF4801E6677528F14D6C
SHA-512:	DF3692D29CDF0434806A0BCF034AFE6869B0BF5C0BE24F18637D373374C1E1803AC5B6D1F671CCD6E89B313E26F85657EA487A2EBAEAE0B99359A66F21DF910B
Malicious:	false
Preview:	IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia1\pPin32.cpl

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	748544
Entropy (8bit):	6.286323674013261
Encrypted:	false
SSDEEP:	12288:e+hZ8e1+K41szV/m21kOR3kkkZkkIkwkpL88888F888nr8H8J28c9fsxkkKO:B8nK41u4
MD5:	773A12BFB25161AD84023B21C241A919
SHA1:	A88488A8BAC4E6615F8A606049D402387DC7076C
SHA-256:	8A4664B28646291B1FA5C8E16B5709E59D48A3E6B297A2C696F2A65F88A78C35
SHA-512:	4C7F3950A6ADD9BBF053AAEAA1E365ABF76CF04C87A89F26B4B112CF6A2412F8B2C0FBDFABB305C2FB14B986832122870C7554B7C9362C01CF7A047C5E85B03F
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....T.....................\|....................@.......................... ..........................................E............`..............................................................................................................text...4........................... ..`.itext.............................. ..`.data....%.......&..................@....bss.....P...0...........................idata..............................@....didata.............................@....edata..E............0..............@..@.reloc...............2..............@..B.rsrc........`......................@..@............. .......l..............@..@................................................................................................

C:\Users\user\AppData\Local\Temp\mia1\pPin64.cpl

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1016832
Entropy (8bit):	5.979344965125846
Encrypted:	false
SSDEEP:	12288:2GBRhi9pc8mQQoBc8wwA21kOR3kkkZkkIkwkpL88888F888nr8H8J28c9fsxkkKO:Px+r
MD5:	A5646553AE51847135D436820C1F21C1
SHA1:	F8601BC366E964DBA7F57C71278F451E2A5E49DA
SHA-256:	740F122FE9707BD4A90048C75B1EB79C86B1B7E852B866517721D2F91CF646C5
SHA-512:	04E97E2120A4805DCABEE5F3E03AFB1DA3646803F86461DD826A44BB39B99DB3E2600A2F4C24A51450F976660B02DC97C0F7FC349A8E38B131C49E56BF5E1F35
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..d......T.........." ................ .........@..............................p....................................... ..................E.......p............0...z...............f..............................................................h....................text............................... ..`.data...............................@....bss.....................................idata..p........ ..................@....didata.h...........................@....edata..E...........................@..@.reloc...f.......h..................@..B.pdata...z...0...\|...T..............@..@.rsrc...............................@..@.............p......................@..@................................................................................

C:\Users\user\AppData\Local\Temp\mia1\prereq.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32639
Entropy (8bit):	3.2633511856005843
Encrypted:	false
SSDEEP:	768:scHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibfi:scXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Dp
MD5:	3B989C7730DF816A13A88B722A25B021
SHA1:	882F64912D28ED7C1EE1D59333E934CC73E1C50A
SHA-256:	9E7054257B4D608BC16547468B0E6D4AA06B0A0CF467CF76CD7ED169979E0B2C
SHA-512:	36E42A53E3F4956DD87DCBF6E36B43E9210B8A5195684228CCF7C465ECB7105505EAFF01F705B8B4D48631E21C02B443AB871D84415A1597FC4B52B22D18689F
Malicious:	false
Preview:	...TFRMDESIGN.0.k...TPF0.TfrmDesign.frmDesign.Left....Top.{.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...

C:\Users\user\AppData\Local\Temp\mia1\prereq.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	744
Entropy (8bit):	4.963019277603885
Encrypted:	false
SSDEEP:	12:qITMDIb6UIJTc6S6juINIkU3lkimkU3MIkT:qIMIb6UIJA6SsuINI53ldm53MIk
MD5:	172D6845744A1EC7DC233E9335C5A47C
SHA1:	F0E3CB9C55F0F0961EF496D3EBF532943FB155E1
SHA-256:	7AEF8EF0D965D2AEDDDF2FBC2B99BA2A3E5E96517BCD38ADB1A3315456D16E6F
SHA-512:	639D0D336EA949B877E12A0DB026FC3D085F3DD2B25A7C5CDCC8850CCD998FCA4364BB18D167454AEDB763793E9D251E08A1A3A06A46117FF0B5B2AE22E06643
Malicious:	false
Preview:	IF (checkWINST.Caption <> TRUE) THEN WINST.Visible := True;..IF (checkJS.Caption <> TRUE) THEN JS.Visible := True;..IF (checkDotNET.Caption <> TRUE) THEN dotNET.Visible := True;..IF (checkWINST.Caption = TRUE) THEN WINST.Visible := False;..IF (checkDotNET.Caption = TRUE) THEN dotNET.Visible := False;..IF (checkJS.Caption = TRUE) THEN JS.Visible := False;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia1\progress.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	25280
Entropy (8bit):	7.001411886189215
Encrypted:	false
SSDEEP:	384:UDxsRBdY8cwyJ+Ic+GJQrSAhn37QpYapNeLNek+vDFNe+sbG7:UibdY8To+G7kYU
MD5:	BEE5A08C5D6026897685C17652F76383
SHA1:	BB82039AF48C28009478FCF86F55AF4EAF37D3A5
SHA-256:	9C7C515DDB9864737330B339F581B2A9562099686930D85793C807AA451429BC
SHA-512:	D59086FD7176C31B8C3B1271C5D2D63CE9E68D499E2B47DA4B504E72DFB2B9B2D3B5D81EF704D455C69C642C77F990E42DA3A5B3F53DDEE11B27FA5311490E25
Malicious:	false
Preview:	...TFRMDESIGN.0..b..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data../...TPngImage.PNG........IHDR.......;......T$L....sRGB.........gAMA......a.....pHYs..........o.d../.IDATx..gx...?....{..".n.m....Kh.$.Z ......B..C.!.@......Kl.eK.%Y.m...5........\...m.=.{...p...Yk.. .C6666...ZoM.../.#4.........Q4!A_..?o..........2.....).D$.Aq...WB..hM...i$.;q...l".... M6H.5Q....*....,..QN4..ep..5..A1.P.A_.p.<.g.f4W...>Y...&.....Q.#...../....nccs.....tOr.\.u9.O.11."Y..+.6x~#%.\|[3..Ni.A.$......T#...dG.Q..=..G$.A!..!8.s.....v89Q"..E..fB..t.`&..D.8,....D,.8i...'....9:!M%0..J...}YN...

C:\Users\user\AppData\Local\Temp\mia1\progress.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.809149901341814
Encrypted:	false
SSDEEP:	6:a3jF2duukAiRcjjuukTDoRcjF2duukTDQTjjuukA6uN82du+wg4RBN82dukU3ekd:csIrqar1sIroarIINIkU3lkimkU3MIkT
MD5:	03D007FB3FC47A2F8CA6EB2C13881052
SHA1:	3212C3FB7FAA97630F849AD7EBA205D90EAC7EE3
SHA-256:	692786FB6BF3363DFDD0CDA8013986F4F63FD9209DA6BD1299CC8CF06275DF89
SHA-512:	A2193DFBB22D9F8EFB3CFFD8F2E4021A3213667F13F218EF1AA9B1DD2BF3044AF1E71CFB19497762A386B6CFB841C4C642C739A52471556ED7C3877907D6EA9E
Malicious:	false
Preview:	IF (TestRemove.Caption <> TRUE) THEN CaptionInstall.Visible := True;..IF (TestRemove.Caption = TRUE) THEN CaptionUninstall.Visible := True;..IF (TestRemove.Caption <> TRUE) THEN CaptionUninstall.Visible := False;..IF (TestRemove.Caption = TRUE) THEN CaptionInstall.Visible := False;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia1\progressprereq.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	24914
Entropy (8bit):	6.9942673423298425
Encrypted:	false
SSDEEP:	384:XAxsRBdY8cwyJ+Ic+GJQrSAhn37QpYapNeLNek+vDFNe+WR+7:X3bdY8To+G7kY5m
MD5:	6D70B06FDC393A0BDCE00687D3D3C799
SHA1:	83B092EC82DDF8F54417A9925AD7B002FD23AEAE
SHA-256:	3DED25DB2B92E4A3932BAA32AA1957C08A8748039552827F4C5D54A487F23D6E
SHA-512:	1875BE4270EC41829908C3E3FD4663E3C5EFA94F3D161FE709DAE6E9A73FE6868BDD88F2F795875B3893554BD5F6C9CBE2A12A2776AE92DE7B0DE960ED33A416
Malicious:	false
Preview:	...TFRMDESIGN.0.>a..TPF0.TfrmDesign.frmDesign.Left....Top.w.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data../...TPngImage.PNG........IHDR.......;......T$L....sRGB.........gAMA......a.....pHYs..........o.d../.IDATx..gx...?....{..".n.m....Kh.$.Z ......B..C.!.@......Kl.eK.%Y.m...5........\...m.=.{...p...Yk.. .C6666...ZoM.../.#4.........Q4!A_..?o..........2.....).D$.Aq...WB..hM...i$.;q...l".... M6H.5Q....*....,..QN4..ep..5..A1.P.A_.p.<.g.f4W...>Y...&.....Q.#...../....nccs.....tOr.\.u9.O.11."Y..+.6x~#%.\|[3..Ni.A.$......T#...dG.Q..=..G$.A!..!8.s.....v89Q"..E..fB..t.`&..D.8,....D,.8i...'....9:!M%0..J...}YN....

C:\Users\user\AppData\Local\Temp\mia1\progressprereq.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	374
Entropy (8bit):	4.773773154848379
Encrypted:	false
SSDEEP:	6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82dukT:7INIkU3lkimkU3MIkT
MD5:	8101E0CC3186C05F85B2CD484D26AE9D
SHA1:	B3CF33E0784E3A6F3B3FEB2B2501E0BDA5932EFA
SHA-256:	A0E750466327E92E2DCC96D72A19A7738A65AB765262DF4801E6677528F14D6C
SHA-512:	DF3692D29CDF0434806A0BCF034AFE6869B0BF5C0BE24F18637D373374C1E1803AC5B6D1F671CCD6E89B313E26F85657EA487A2EBAEAE0B99359A66F21DF910B
Malicious:	false
Preview:	IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia1\readme.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32365
Entropy (8bit):	3.210637703795355
Encrypted:	false
SSDEEP:	768:F2HXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfMR:FuXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Dn
MD5:	8DB37E945737A642476551E6EA537ED5
SHA1:	2579ECFFD229F167398337358778E032AAAE3E3D
SHA-256:	4221122F990055367BE3AF2CCD9A8A6A28E4E8A8889B74BD543C70E96FF63527
SHA-512:	461CD4C6F01A82AC1C6D97968AF1B3CCD6E5D5D8C76C5CDD92822869335C379E8DD07A562DF787232D173588D9DCBC1E3071A5E5BE873D02DE6744BEE599AA92
Malicious:	false
Preview:	...TFRMDESIGN.0.Y~..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z..

C:\Users\user\AppData\Local\Temp\mia1\readme.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	502
Entropy (8bit):	4.896842553280578
Encrypted:	false
SSDEEP:	6:aHi6GKuMtrk86i6euMtrkeuN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+J:0IMtgfjMtgxINIkU3lkimkU3MIkT
MD5:	D312F2FDC09193A04578D688A2CA292D
SHA1:	54BD3AA4CC72E68FC613A4227CADA7AD702D795E
SHA-256:	DB1C3A93A00A46C77F3E8D19C5DA4D42C54CE58C9EB71B586E512ABEE2D46967
SHA-512:	A71514B0F31010F7BF23954BCE707A277CA765BC14DDED7D7870615528A7751E4B26E72BB826781BC4F57C2A7C75FCFB92C4BA781AAD58372CF6CECE39832D19
Malicious:	false
Preview:	IF (LicenseCheck.Checked = True) THEN Next.Enabled := True;..IF (LicenseCheck.Checked = False) THEN Next.Enabled := False;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia1\registration.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32609
Entropy (8bit):	3.2576929890359447
Encrypted:	false
SSDEEP:	768:ewVHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibfg:ewdXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5v
MD5:	357DC1A87B637A95C2255C15ABDB9765
SHA1:	B41DBE26DB3C8F489E32096535E7DF8AF5F7859C
SHA-256:	005829185AC1A56337D40D515C7E8DA84B06A8E7B7487477DE521861248645D0
SHA-512:	ABBBD816EDDE10AF7612ACCF8858434BD9C17443B92CD7E3966F44B2F624822EE123EAD2DA7F1EF686D76D13FE7C4923F1E3460E0681CB9C239462638D14F677
Malicious:	false
Preview:	...TFRMDESIGN.0.M...TPF0.TfrmDesign.frmDesign.Left....Top.z.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TLabel.Label5.Left.(.Top.H.Width.8.Height...Caption..&User Name:.FocusControl..Name...TLabel.Label6.Left.(.Top.x.Width.A.Height...Caption..&Organization:.FocusControl..Company...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a......................................................

C:\Users\user\AppData\Local\Temp\mia1\registration.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	576
Entropy (8bit):	4.8398488933566055
Encrypted:	false
SSDEEP:	12:+GYMtg+YMtgdmMtgpMtgxINIkU3lkimkU3MIkT:+ffFmB5INI53ldm53MIk
MD5:	FF697C2FFA89894EC61F9ADF6839926E
SHA1:	25CA863E1866D72D2AB76F76B15A7705F2C0CD12
SHA-256:	C8FDC1180440954E7773ABFA450D153194FA675B8B2764F0300C00A73C989BAC
SHA-512:	A67389FBA944DEA454F7D4559911F745ADE10A8B3B5ED57A6741546AA4EF77FC47017BC7711A586A19EDFA3825517D78BA46A841B0AB7291B6145EA9B0E63A76
Malicious:	false
Preview:	IF (Name.Text <> ) THEN Next.Enabled := True;..IF (Company.Text <> ) THEN Next.Enabled := True;..IF (Name.Text = ) THEN Next.Enabled := False;..IF (Company.Text = ) THEN Next.Enabled := False;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia1\registrationwithserial.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	33341
Entropy (8bit):	3.3842477874818355
Encrypted:	false
SSDEEP:	768:JdHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfM4:JFXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Dk
MD5:	8616C794648FD69FAC8F0F88EDB22E4E
SHA1:	DDDFECF6EA3719E9CEF5C406FD4D525AF7D74A61
SHA-256:	7E5099588AC9EB46983021CFDFCDDDBEFEBFE4CBD8388A531EDAD35FC3DA842D
SHA-512:	B1288B55785B0CA40F331AE92460F213A1C8D77037D5ABA6BBBD74882024ABDC8985E10899F4476CFF64D83F424957B11FD0B759B537E2216DB4E146B1CD09ED
Malicious:	false
Preview:	...TFRMDESIGN.0.)...TPF0.TfrmDesign.frmDesign.Left....Top.v.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...

C:\Users\user\AppData\Local\Temp\mia1\registrationwithserial.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	4.80637071596533
Encrypted:	false
SSDEEP:	12:+GYMtg+YMtgPt0YMtgPrYMtgP0ZYMtgPpDYMtgPuYMtgdmMtgpMtg6tkMtg63Mtz:+ff7kkKSHFmBBApVeN5INI53ldm53MIk
MD5:	E30F9BD0EB3C6A3372F67E0F8886E28C
SHA1:	B390AAEDCE02E0A1A031506EE73C313221367BBF
SHA-256:	905BBFEDE6E19926541295E4599A14169CDC21392388DAE0EE1974A5C827D608
SHA-512:	CBDCA01D6A8E060307DA35E6F5F5F52D691F0245E285548454B391543680817783CB443046263BEF5BC3B7A774C503771403FC5B76069F02ADD8A72972CE67F8
Malicious:	false
Preview:	IF (Name.Text <> ) THEN Next.Enabled := True;..IF (Company.Text <> ) THEN Next.Enabled := True;..IF (Serial1.Text <> ) THEN Next.Enabled := True;..IF (Serial2.Text <> ) THEN Next.Enabled := True;..IF (Serial3.Text <> ) THEN Next.Enabled := True;..IF (Serial4.Text <> ) THEN Next.Enabled := True;..IF (Serial5.Text <> ) THEN Next.Enabled := True;..IF (Name.Text = ) THEN Next.Enabled := False;..IF (Company.Text = ) THEN Next.Enabled := False;..IF (Serial1.Text = ) THEN Next.Enabled := False;..IF (Serial2.Text = ) THEN Next.Enabled := False;..IF (Serial3.Text = ) THEN Next.Enabled := False;..IF (Serial4.Text = ) THEN Next.Enabled := False;..IF (Serial5.Text = ) THEN Next.Enabled := False;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THE

C:\Users\user\AppData\Local\Temp\mia1\setuptype.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	33637
Entropy (8bit):	3.431633511700928
Encrypted:	false
SSDEEP:	768:+YHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfQd:+YXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Dp
MD5:	0ED309FE577738BE9F9EC6E6D4630658
SHA1:	3D22B4956C8DA2C4E91D99C590E165710915AEC3
SHA-256:	D65D017C4E6F112F1959F6BBC50FDFF35348596BE68183A5570257A199EAC1A6
SHA-512:	10E4E1D32E0A47196D18EAFA4FFF03C7F7D36F3AF37E1A0A3DCDE04ADEB3BBF2B3CE51A76D8236CE60AF63D813469BB20E28E997F10BB7986E39DF97B851BFC7
Malicious:	false
Preview:	...TFRMDESIGN.0.Q...TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TLabel.Label4.Left.(.Top.H.Width.I..Height.!.AutoSize..Caption..Please select a setup type..WordWrap....TBevel.Bevel2.Left...Top.:.Width....Height...Shape..bsTopLine...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................)..

C:\Users\user\AppData\Local\Temp\mia1\setuptype.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	374
Entropy (8bit):	4.773773154848379
Encrypted:	false
SSDEEP:	6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82dukT:7INIkU3lkimkU3MIkT
MD5:	8101E0CC3186C05F85B2CD484D26AE9D
SHA1:	B3CF33E0784E3A6F3B3FEB2B2501E0BDA5932EFA
SHA-256:	A0E750466327E92E2DCC96D72A19A7738A65AB765262DF4801E6677528F14D6C
SHA-512:	DF3692D29CDF0434806A0BCF034AFE6869B0BF5C0BE24F18637D373374C1E1803AC5B6D1F671CCD6E89B313E26F85657EA487A2EBAEAE0B99359A66F21DF910B
Malicious:	false
Preview:	IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia1\startinstallation.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	47304
Entropy (8bit):	7.975218070187998
Encrypted:	false
SSDEEP:	768:O62E2XFXd2pbhliaeVSCqLgle/miee9GIqeK7+72g4krhEF:O6R2XbaewCsX2eLc+72gbrhi
MD5:	0F83894104A961DF18AF122437921981
SHA1:	035D3BCFF5061491EDDD2DD61E06824A6E40F0D2
SHA-256:	745A0A9C58B0DE05C941D3CD2EE9C88CF56499EBB5B28CFAAA3108A8E65E86B8
SHA-512:	82CF13239DF3AAED763DF7AC335C3F1431DF6AE4F24A6240398FAF9AFC10F71DD1504B97EA6383F0384D3C8FADB89AC7AACA62D1FE6897F6E257DF35D9F4210C
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top.~.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.:..Picture.Data......TPngImage.PNG........IHDR.......:........]....sRGB.........gAMA......a.....pHYs..........o.d....IDATx.........d.....9.s8t."E.X..T....."z.k.+z..*.T.D@...4A.Io.r..:.M.I2.L... ....z...e....L.ik=...7>..1 :x!........^ppz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..

C:\Users\user\AppData\Local\Temp\mia1\startinstallation.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	374
Entropy (8bit):	4.773773154848379
Encrypted:	false
SSDEEP:	6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82dukT:7INIkU3lkimkU3MIkT
MD5:	8101E0CC3186C05F85B2CD484D26AE9D
SHA1:	B3CF33E0784E3A6F3B3FEB2B2501E0BDA5932EFA
SHA-256:	A0E750466327E92E2DCC96D72A19A7738A65AB765262DF4801E6677528F14D6C
SHA-512:	DF3692D29CDF0434806A0BCF034AFE6869B0BF5C0BE24F18637D373374C1E1803AC5B6D1F671CCD6E89B313E26F85657EA487A2EBAEAE0B99359A66F21DF910B
Malicious:	false
Preview:	IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia1\startmenu.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	33346
Entropy (8bit):	3.385772495039534
Encrypted:	false
SSDEEP:	768:27HXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibftPV:27XQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Di
MD5:	79A6D4AC0D44492941DBF1BCF729FCE0
SHA1:	B9A4351BA665D5F190FDCEAAC2F278214E402628
SHA-256:	ED50635652C5E71DD4EE1FBEB5B64E312235D3215C519E2DA2966FF44C61745B
SHA-512:	D0B8A675193F05FFB8A71624E67A0FB63BE6433C73798B675486F6D86181DDE52E1910E51A27E7A61932A0360E2236BE3493196497D9B7C198A8B8CE5F6C2808
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top.z.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...

C:\Users\user\AppData\Local\Temp\mia1\startmenu.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	602
Entropy (8bit):	4.858794405298382
Encrypted:	false
SSDEEP:	12:jOYMtgQeMtg1dsdrHEUxIsdrHExINIkU3lkimkU3MIkT:jXoe3GI1INI53ldm53MIk
MD5:	5622CBE0342EA56DBEDDB3F036450AE9
SHA1:	97D52E9CE2FE1BA92BA141BCC66D2ECC6EC93978
SHA-256:	19878CE6F272ECDBE413786244A8476214F99445EBB85F307E92B07F2A4C8869
SHA-512:	C1E7CB7493635D368FBB7DA741353C82CB389488E1D8C32CB769FADACE21BC27416E59D2A9525A8DAC1D69195679CE91120496E7A74BF44377E91D97267B231F
Malicious:	false
Preview:	IF (MenuGroup.Text <> ) THEN Next.Enabled := True;..IF (MenuGroup.Text = ) THEN Next.Enabled := False;..IF (ISNT.Caption = TRUE) THEN AllUsers.Enabled := True;..IF (ISNT.Caption <> TRUE) THEN AllUsers.Enabled := False;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia1\update_download.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32653
Entropy (8bit):	3.2660830298663956
Encrypted:	false
SSDEEP:	768:ytHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibf+:yVXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DV
MD5:	CB602028339D00C4DBB706C86DF9E389
SHA1:	F75C115A08686D6A83A660240F54E5234F815688
SHA-256:	19761B22486D4041528899F9CF8F689648BF17CF8D5418459C67E2F8A0C82CC3
SHA-512:	1DD03D35D4E9DC4AC7EC1A1403072FD2D092BA8265F045C59B557B191C73839A0DF12223E76B357B37DDBB6BF4D1E8935B86E709B961F1679BC80E18D0CFDD43
Malicious:	false
Preview:	...TFRMDESIGN.0.y...TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...

C:\Users\user\AppData\Local\Temp\mia1\update_download.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	372
Entropy (8bit):	4.766720372869046
Encrypted:	false
SSDEEP:	6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82duka:7INIkU3lkimkU3MIka
MD5:	94AD21CCA6267AE8B311FF711DFFAB58
SHA1:	7D1B91BCD6695D60504A4C37524213CB1D72F113
SHA-256:	E8853FE461B20AC2EBE5CABB577D2BFCB786D64B2AF63CC882119400A800BA7A
SHA-512:	CB2DCC281C0D6F07B5448C1195BAD726AE789105CD4B22DC33DB923B900C3627B843E132D38EDBB69D5EC7BDFFE165FD8E6552DFCE677E136EE24ADF32174398
Malicious:	false
Preview:	IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

C:\Users\user\AppData\Local\Temp\mia1\update_install.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32712
Entropy (8bit):	3.276188088838966
Encrypted:	false
SSDEEP:	768:TtHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibf3:TVXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5D2
MD5:	B34F26CDAA44F4052F6E5492DA03A6AF
SHA1:	C72C7C891DBB2AD7387618B340974EF2E35F2CC0
SHA-256:	A9DCE5F9493CAD5A2059F3485D37F3B104C3D2F620E707FF5CA01AB441BF2462
SHA-512:	C23332865986AA058B7677BEF749C42C92F394E495382AF30D4FD761ABA824C634FE22F1F84D3DD2DB8F7BFCC738DB9F18EA20FCEA47F3DD571C79D93714CFF9
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...

C:\Users\user\AppData\Local\Temp\mia1\update_install.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	372
Entropy (8bit):	4.766720372869046
Encrypted:	false
SSDEEP:	6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82duka:7INIkU3lkimkU3MIka
MD5:	94AD21CCA6267AE8B311FF711DFFAB58
SHA1:	7D1B91BCD6695D60504A4C37524213CB1D72F113
SHA-256:	E8853FE461B20AC2EBE5CABB577D2BFCB786D64B2AF63CC882119400A800BA7A
SHA-512:	CB2DCC281C0D6F07B5448C1195BAD726AE789105CD4B22DC33DB923B900C3627B843E132D38EDBB69D5EC7BDFFE165FD8E6552DFCE677E136EE24ADF32174398
Malicious:	false
Preview:	IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

C:\Users\user\AppData\Local\Temp\mia1\update_notify_download.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	33015
Entropy (8bit):	3.3312339385168404
Encrypted:	false
SSDEEP:	768:dPHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfW:dvXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Dj
MD5:	11F85D2CF8875B6F3319A1A04E67D808
SHA1:	C148A7AC0723FE6246B4DD8FBADF36BE90B74D8E
SHA-256:	D4ECD2325508B27B31E2A9FD4A996FC449B06469C018E6FF107325D29700E119
SHA-512:	9D9D08B218CE5634F810FC32CF35146C5183DD7CB51C11A265B3FFFBCAE17737E756BEB34EBBCA8A00B6CD4377C0A0D4E5576AAC923D609E9FA426C8FFB7DE43
Malicious:	false
Preview:	...TFRMDESIGN.0....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TBevel.Bevel2.Left...Top.:.Width....Height...Shape..bsTopLine...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..

C:\Users\user\AppData\Local\Temp\mia1\update_notify_download.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	516
Entropy (8bit):	4.934215231943702
Encrypted:	false
SSDEEP:	6:a2P2J2du+P2pVw6P2/u+P2pVIRBN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgf:tI5V50INIkU3lkimkU3MIka
MD5:	E9C9A11806C14939C22C7EA9FF05EB45
SHA1:	8E82BDE4A7B9024195641649BF4ACF1DD5F92499
SHA-256:	F98E5CEB427FD0F0FED3FCF1125856F580547972AF05ECA6D6BE0358F626ECCA
SHA-512:	E8D605167D01C77964DC649676FD5C5ECEBEE11020951A3DA9D10C49368E46B0FFA761DF6DFF08508214A220B0CCFB539C154F2536ABA7ECD7B63DC2C1B50008
Malicious:	false
Preview:	IF (Scheduling.Caption <> TRUE) THEN SchedulingLink.Visible := False;..IF (Scheduling.Caption = TRUE) THEN SchedulingLink.Visible := True;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

C:\Users\user\AppData\Local\Temp\mia1\update_notify_install.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	33046
Entropy (8bit):	3.336672790672221
Encrypted:	false
SSDEEP:	768:rPHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibfu:rvXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5D9
MD5:	673178885A74C5200D7171E1B4E183E3
SHA1:	5818381EF74CC6B69ECDBCB97705869C059577C4
SHA-256:	1BBC1EE74DFD9A03B95C25C9B011965A9EB7F5DE01C696992FF88E2DE052806D
SHA-512:	983AB426C7F766D5656272A1044716D592DA49DEF880B17002AE46F39A9B6EB1C49190A15FAAB6A90934DE2572BB7E06AFC28E3D233E1BBDD6D62AF76C555A48
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TBevel.Bevel2.Left...Top.:.Width....Height...Shape..bsTopLine...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..

C:\Users\user\AppData\Local\Temp\mia1\update_notify_install.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	516
Entropy (8bit):	4.934215231943702
Encrypted:	false
SSDEEP:	6:a2P2J2du+P2pVw6P2/u+P2pVIRBN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgf:tI5V50INIkU3lkimkU3MIka
MD5:	E9C9A11806C14939C22C7EA9FF05EB45
SHA1:	8E82BDE4A7B9024195641649BF4ACF1DD5F92499
SHA-256:	F98E5CEB427FD0F0FED3FCF1125856F580547972AF05ECA6D6BE0358F626ECCA
SHA-512:	E8D605167D01C77964DC649676FD5C5ECEBEE11020951A3DA9D10C49368E46B0FFA761DF6DFF08508214A220B0CCFB539C154F2536ABA7ECD7B63DC2C1B50008
Malicious:	false
Preview:	IF (Scheduling.Caption <> TRUE) THEN SchedulingLink.Visible := False;..IF (Scheduling.Caption = TRUE) THEN SchedulingLink.Visible := True;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

C:\Users\user\AppData\Local\Temp\mia1\update_reboot.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	877
Entropy (8bit):	5.549505671141563
Encrypted:	false
SSDEEP:	24:7a2XxbXGAwkMLcByKiIabA5SUws88Ya+PR4SoPRebZ9D9KHxWl:m2XxbXGAwkriIr4pkebZ9IHMl
MD5:	624DE50A4A6C0437D980DEA773109FF8
SHA1:	F249E26093386FFE926030F28FE2B0B4873625DA
SHA-256:	C4ACFDD3B07FEFA0DB03CD681ECAA839BFB04EB777E526434599B5A41FF59BCB
SHA-512:	63C82867571F41ADCDE0BF0E6DABABD86A7700D707E3BD302B7375BAFBE5495C8A58233521F5DFA1D39B1F428A07662738ED529EF8E5231869149453C011EB30
Malicious:	false
Preview:	...TFRMDESIGN.0.Y...TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.k.ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TLabel.Label2.Left...Top...Width....Height.!.AutoSize..Caption.cUpdating $TITLE$ is almost complete. You must restart your computer for the updates to take effect..WordWrap....TLabel.Label5.Left...Top.0.Width....Height...AutoSize..Caption.)Do you want to restart your computer now?.WordWrap....TButton.Next.Tag...Left....Top.E.Width.T.Height...Caption..Restart &Now.Default..TabOrder.....TButton.Back.Tag...Left.I..Top.E.Width.P.Height...Caption..Restart &Later.TabOrder.....

C:\Users\user\AppData\Local\Temp\mia1\update_reboot.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	372
Entropy (8bit):	4.766720372869046
Encrypted:	false
SSDEEP:	6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82duka:7INIkU3lkimkU3MIka
MD5:	94AD21CCA6267AE8B311FF711DFFAB58
SHA1:	7D1B91BCD6695D60504A4C37524213CB1D72F113
SHA-256:	E8853FE461B20AC2EBE5CABB577D2BFCB786D64B2AF63CC882119400A800BA7A
SHA-512:	CB2DCC281C0D6F07B5448C1195BAD726AE789105CD4B22DC33DB923B900C3627B843E132D38EDBB69D5EC7BDFFE165FD8E6552DFCE677E136EE24ADF32174398
Malicious:	false
Preview:	IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

C:\Users\user\AppData\Local\Temp\mia1\update_setup_account.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	36152
Entropy (8bit):	3.715506555383873
Encrypted:	false
SSDEEP:	768:V/HXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfW:VfXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DZ
MD5:	6CF506036ACDBE8554FEC0CAD8B54B0F
SHA1:	5AAEF6089C2410141B02DEC3D33F69CF49FAA1B3
SHA-256:	33BE77CEB619494276458E4E460FEF863493B4481620B5A67B3A1316D72C1732
SHA-512:	0668694E92E75FD8224EC27C73855ACC5016ACE6636D441B517030AA14C37751933DF4427D2A2BF9BD9AFE51E55A1615797745D7D8308EA406B6F49DC1B37F03
Malicious:	false
Preview:	...TFRMDESIGN.0.$...TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TBevel.Bevel2.Left...Top.:.Width....Height...Shape..bsTopLine...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..

C:\Users\user\AppData\Local\Temp\mia1\update_setup_account.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	872
Entropy (8bit):	4.899823733661456
Encrypted:	false
SSDEEP:	12:7VGYMtgnWMtgn6o1p6o2bMtgCyYo1yYo1vVmMtgxINIkU3lkimkU3MIka:7Vf+youoE4opoVVm5INI53ldm53MIt
MD5:	6C44799F82A9E3C3F0033400312E777D
SHA1:	484155839C215464D63745A5A144079E52614D57
SHA-256:	BD611C8203E1BD9AA67F8D1F99D8F9C103E8B7384FA7BE037ACA92B077DBA74A
SHA-512:	5C8D32592471A7A9C09479864C48FC80CBFF65F30F673CF01E03C502FD6B70F02C145FE1E6FB30D8EAF0FAA3A00C8AC11F21904921D5B66A822480567CF01D1E
Malicious:	false
Preview:	IF (UserName.Text <> ) THEN Next.Enabled := True;..IF (Password.Text = PasswordConfirm.Text) THEN Next.Enabled := True;..IF (Password.Text = ) THEN Exclamation.Visible := True;..IF (Password.Text = ) THEN ExclamationText.Visible := True;..IF (Password.Text <> PasswordConfirm.Text) THEN Next.Enabled := False;..IF (Password.Text <> ) THEN ExclamationText.Visible := false;..IF (Password.Text <> ) THEN Exclamation.Visible := false;..IF (UserName.Text = ) THEN Next.Enabled := False;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

C:\Users\user\AppData\Local\Temp\mia1\update_setup_finish.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	160068
Entropy (8bit):	1.934119010860282
Encrypted:	false
SSDEEP:	192:XAMMfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4Cump6KDhT5mI:XeI/STn9
MD5:	F9ADFD6EC9732629EA7FCDB171B49987
SHA1:	3092A623D0E27BC5E03DB9EC67997D0E6354E808
SHA-256:	72ECEDF679889DFE4A64EDB63C9EEFE44E9DBA5DFC0251518B9C06CE0C97AFA0
SHA-512:	6085EE32FBA8D9E12B26EE0459A7E16EBA3539913AD4272B9B5EF590EC9389F92E0908E1E091A9C0D0E6856C0A79A822701DE9B37512DC4560A91F2E41F05C60
Malicious:	false
Preview:	...TFRMDESIGN.0.0q..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP.tP).sR..{W..}Y.vU2.\|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...\|...r...z...q...w...\|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..\|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8.....................................

C:\Users\user\AppData\Local\Temp\mia1\update_setup_finish.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	372
Entropy (8bit):	4.766720372869046
Encrypted:	false
SSDEEP:	6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82duka:7INIkU3lkimkU3MIka
MD5:	94AD21CCA6267AE8B311FF711DFFAB58
SHA1:	7D1B91BCD6695D60504A4C37524213CB1D72F113
SHA-256:	E8853FE461B20AC2EBE5CABB577D2BFCB786D64B2AF63CC882119400A800BA7A
SHA-512:	CB2DCC281C0D6F07B5448C1195BAD726AE789105CD4B22DC33DB923B900C3627B843E132D38EDBB69D5EC7BDFFE165FD8E6552DFCE677E136EE24ADF32174398
Malicious:	false
Preview:	IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

C:\Users\user\AppData\Local\Temp\mia1\update_setup_schedule.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	33902
Entropy (8bit):	3.4840746856844267
Encrypted:	false
SSDEEP:	768:kHHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfajKk:knXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5D1
MD5:	FB8DB7BC2352BC8B2189821161CEF379
SHA1:	B6E94A9213291A2D289C62C4859492A1787D6699
SHA-256:	189B671D789580967E60E4C8B3ADD804CD4BF16EE1845250260B828D8761E658
SHA-512:	68DE9CE306C0938988F8CD51FF670A204573591FF8424CFF2C48585EAF7E5E1DE8A396623A2D45497083AF7FE4661AA377A2499A982292FDF21AA708A1CDB369
Malicious:	false
Preview:	...TFRMDESIGN.0.Z...TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TBevel.Bevel2.Left...Top.:.Width....Height...Shape..bsTopLine...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..

C:\Users\user\AppData\Local\Temp\mia1\update_setup_schedule.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	974
Entropy (8bit):	4.892952093471582
Encrypted:	false
SSDEEP:	24:o7wKA7wY7wHvWvXvK/vqvqA77wz7wqAPINI53l53dm53MI53k:o7Q7P7e+vaiD77A7MPWq/icqU
MD5:	D77CCDD3A7937D2219195F35873311D1
SHA1:	7327FFEBD4F904CE4E1351662D4F26FEE272B973
SHA-256:	8089C47E824035E10F1CCF9478F72EA4D09FD946AA0AD71C9B8F7471922C3464
SHA-512:	9DAEDE3C919827762F066D0F3A28AB0174DF6077240B92D49846B9A5B694E0C3DF33B72F7B8FFAB0C1B18315E849052E33BE04BB40927C7D533A669D52D4D5B8
Malicious:	false
Preview:	IF (Keep.Checked <> False) THEN Notify.Enabled := True;..IF (Keep.Checked <> False) THEN Download.Enabled := True;..IF (Keep.Checked <> False) THEN Install.Enabled := True;..IF (Keep.Checked = False) THEN Install.Enabled := False;..IF (Keep.Checked = False) THEN Download.Enabled := False;..IF (Keep.Checked = False) THEN Notify.Enabled := False;..IF (Keep.Checked = False) THEN Time.Enabled := False;..IF (Keep.Checked = False) THEN Date.Enabled := False;..IF (Keep.Checked <> False) THEN Time.Enabled := True;..IF (Keep.Checked <> False) THEN Date.Enabled := True;..IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN InstallAwareX.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN InstallAwareX.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia1\update_setup_welcome.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	160143
Entropy (8bit):	1.9385323471953442
Encrypted:	false
SSDEEP:	192:wbMMfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4CBtLzg6T5mWC:wdI/gVK
MD5:	35F172C45DA2C84338CD11889AE3F058
SHA1:	57159FC6A38D63A1D776654A13F5EAE6B5A52808
SHA-256:	77888A511656391F3864564314ECB416797E6D78FBCB4FC8E81F61CE371DD373
SHA-512:	FF3A9A6952AEACBB94FFFD5759C4BAADBB6172052948874B78520FCB370A05B2F2840274CB9804F59D09172EEBF8EC6ABE0F3A69837FCF16207CD721A661F0F0
Malicious:	false
Preview:	...TFRMDESIGN.0.{q..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP.tP).sR..{W..}Y.vU2.\|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...\|...r...z...q...w...\|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..\|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8.....................................

C:\Users\user\AppData\Local\Temp\mia1\update_setup_welcome.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	372
Entropy (8bit):	4.766720372869046
Encrypted:	false
SSDEEP:	6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82duka:7INIkU3lkimkU3MIka
MD5:	94AD21CCA6267AE8B311FF711DFFAB58
SHA1:	7D1B91BCD6695D60504A4C37524213CB1D72F113
SHA-256:	E8853FE461B20AC2EBE5CABB577D2BFCB786D64B2AF63CC882119400A800BA7A
SHA-512:	CB2DCC281C0D6F07B5448C1195BAD726AE789105CD4B22DC33DB923B900C3627B843E132D38EDBB69D5EC7BDFFE165FD8E6552DFCE677E136EE24ADF32174398
Malicious:	false
Preview:	IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;

C:\Users\user\AppData\Local\Temp\mia1\welcome.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	47223
Entropy (8bit):	7.975755688019769
Encrypted:	false
SSDEEP:	768:VG2E2XFXd2pbhliaeVSCqLgle/miee9GIqeK7+72g4krh/:VGR2XbaewCsX2eLc+72gbrh/
MD5:	197A9BB509D5943B7A9F2ADE53FFB0C9
SHA1:	56A00C20656B5C6146DBC5622DF9FC2456682CB9
SHA-256:	514CA52E32550096CB51CADB1FF36CF6B2B03CF0A46E0FA8D37679F0FFE67945
SHA-512:	B2C57E17F7BEAE3B53D41CCDE26EA05136746E028DE5AC2A06968A1674620E34C179FCA2A24053A35BE94D9DB8FA269F17CEAC4EFA9159E9F3BB1A3AB48EB18F
Malicious:	false
Preview:	...TFRMDESIGN.0.c...TPF0.TfrmDesign.frmDesign.Left....Top.~.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.:..Picture.Data......TPngImage.PNG........IHDR.......:........]....sRGB.........gAMA......a.....pHYs..........o.d....IDATx.........d.....9.s8t."E.X..T....."z.k.+z..*.T.D@...4A.Io.r..:.M.I2.L... ....z...e....L.ik=...7>..1 :x!........^ppz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..Q.8....8=........G..t.P<..(........E...@...p:.(.pz..N....N."....x..

C:\Users\user\AppData\Local\Temp\mia1\welcome.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	374
Entropy (8bit):	4.773773154848379
Encrypted:	false
SSDEEP:	6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82dukT:7INIkU3lkimkU3MIkT
MD5:	8101E0CC3186C05F85B2CD484D26AE9D
SHA1:	B3CF33E0784E3A6F3B3FEB2B2501E0BDA5932EFA
SHA-256:	A0E750466327E92E2DCC96D72A19A7738A65AB765262DF4801E6677528F14D6C
SHA-512:	DF3692D29CDF0434806A0BCF034AFE6869B0BF5C0BE24F18637D373374C1E1803AC5B6D1F671CCD6E89B313E26F85657EA487A2EBAEAE0B99359A66F21DF910B
Malicious:	false
Preview:	IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia1\wizard.dfm

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32251
Entropy (8bit):	3.1896653509607855
Encrypted:	false
SSDEEP:	768:arHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfH:arXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DI
MD5:	8AA68DEE4B3D18226980261469A560ED
SHA1:	E359A76C34D1F906690054A871C85DFA3A1C88A4
SHA-256:	D2267023E1F38FA5E44AFDF55B6DD485E25F2F1A8EC82C9E93EB8F137F0FBA2F
SHA-512:	6FC30F309A79C6A5661E6673B94258B0C1A240ED9934CB3D6A65C76CAAEDA032001A8F4C79416C76D9F278A0ADDFF595D04B1D60A0924363CEBB97311659CF6C
Malicious:	false
Preview:	...TFRMDESIGN.0..}..TPF0.TfrmDesign.frmDesign.Left....Top.z.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight...GlassFrame.Bottom./..TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...

C:\Users\user\AppData\Local\Temp\mia1\wizard.dfm.miaf

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	374
Entropy (8bit):	4.773773154848379
Encrypted:	false
SSDEEP:	6:aiN82du+wg4RBN82dukU3ekRBN+ukYRBN+u+wgAuN+ukU3ecuN82dukT:7INIkU3lkimkU3MIkT
MD5:	8101E0CC3186C05F85B2CD484D26AE9D
SHA1:	B3CF33E0784E3A6F3B3FEB2B2501E0BDA5932EFA
SHA-256:	A0E750466327E92E2DCC96D72A19A7738A65AB765262DF4801E6677528F14D6C
SHA-512:	DF3692D29CDF0434806A0BCF034AFE6869B0BF5C0BE24F18637D373374C1E1803AC5B6D1F671CCD6E89B313E26F85657EA487A2EBAEAE0B99359A66F21DF910B
Malicious:	false
Preview:	IF (Glass.Caption <> TRUE) THEN Separator.Visible := True;..IF (Glass.Caption <> TRUE) THEN InstallAware.Visible := True;..IF (Glass.Caption = TRUE) THEN Install.Visible := True;..IF (Glass.Caption = TRUE) THEN Separator.Visible := False;..IF (Glass.Caption = TRUE) THEN InstallAware.Visible := False;..IF (Glass.Caption <> TRUE) THEN Install.Visible := False;..

C:\Users\user\AppData\Local\Temp\{152D390A-DD7B-4E57-B3A5-14CADE7E1207}

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13062
Entropy (8bit):	5.208608574507286
Encrypted:	false
SSDEEP:	384:CR5+HmxwNPXL/5++SFBG15zMQ5lIBfOz+:fTSEz1OOS
MD5:	B060C2E2B23EE8C084401D9DB3B1047F
SHA1:	7E8F04FD4C4FAFDDCDA35F252A636C409A7F4FE3
SHA-256:	988284190D793D96B590DB3EA89EF48DC90ADA63FCEB02C2A9575DF3600B15E6
SHA-512:	7BEE3FA459C684C7A6EC086C93922EDEEDA95341FA85C1AEB31ACBEB0B9087DDD65AFCFDDE50F83B4C90E7407B1BA512EE8A78327286392AB699C74036E8434F
Malicious:	false
Preview:	SourceDir..C:\PROGRA~3\miaE495.tmp\data\..$ex..MEDIAPACKAGEPATH..\PROGRA~3\miaE495.tmp\..$ex..AAE4ED6BA..FALSE..$ex..AAE68B5EB..FALSE..$ex..A2AFAD2D7..FALSE..$ex..A47890F43..FALSE..$ex..AABF0EABC..FALSE..$ex..A5303394E..FALSE..$ex..A36C4273F..FALSE..$ex..ABEFE417A..FALSE..$ex..A2AFAD2D7..FALSE..$ex..A1AAFDCA9..FALSE..$ex..A4D583000..FALSE..$ex..A47890F43..FALSE..$ex..A392822E1..FALSE..$ex..A9202CBED..FALSE..$ex..A2AFAD2D7..FALSE..$ex..A5B95B812..FALSE..$ex..A1983855A..FALSE..$ex..A392822E1..FALSE..$ex..A6C969A31..FALSE..$ex..A86FEDFFB..FALSE..$ex..A280378AD..FALSE..$ex..A895B52CC..FALSE..$ex..A96D781B4..FALSE..$ex..A303D489..FALSE..$ex..A36C4273F..FALSE..$ex..A4D583000..FALSE..$ex..A47890F43..FALSE..$ex..A9EDFEF92..FALSE..$ex..A33529D6E..FALSE..$ex..AD400EB86..FALSE..$ex..A9202CBED..FALSE..$ex..A2AFAD2D7..FALSE..$ex..A5B95B812..FALSE..$ex..A1983855A..FALSE..$ex..A392822E1..FALSE..$ex..A96D781B4..FALSE..$ex..A4D583000..FALSE..$ex..A47890F43..FALSE..$ex..A759968E7..FALSE..$ex..A705D4320.

C:\Windows\Crystal\Cdo32.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	5.118134691683147
Encrypted:	false
SSDEEP:	768:SbaGLiyxVx9+qtwWRnqZk0ca8lKLRT7vGUsbONP0B4s6r1BW:iLlx79+qtwWFqzrlT7vGUqONsFUO
MD5:	81C8142EED021D18D4ACCEEA8D950068
SHA1:	435173BAFE04157D0EC140B4F77E1C174A304911
SHA-256:	C86E55610D35F87CBB29A89ECD0B838C2710BADE0E772977FCEA336FDCFF6451
SHA-512:	4F169BC6011F8A23C6A71A6C6469EFB26A0ED24BBAA022FF153FC975E762C1FBBDB24D144E1A186ECF1792C353BB7B29E8970687DD333697CC19839B6B13E9D7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H.3O..]...]...]...S...].Q.V...].Q.W...].Q.Y...]...V...]...Y...]...]...].Z.N...]...\.V.].n.N...].S.V...]...[...]...Y...].Rich..].........................PE..L....`l:...........!.....`...`....../k.......p.....A................................{8.......................................y.......................................................................................p...............................text....^.......`.................. ..`.rdata..R....p... ...p..............@..@.data...............................@....rsrc............ ..................@..@.reloc..2...........................@..B.$.>H....$.>U....v1?_....$.>j.....G?w....$.>....UA.<.....$.>............KERNEL32.dll.NTDLL.DLL.USER32.dll.ADVAPI32.dll.ole32.dll.OLEAUT32.dll.MSVCP60.dll.MSVCRT.dll............................................................................................................

C:\Windows\Crystal\Crxlat32.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.7494209933404663
Encrypted:	false
SSDEEP:	96:ejTU6VrXNd5zIrxKnlPJvBCaWNWpUi8par5VqxQDhoK/+YiyhotqG0hoN:ejTU6pP8rYTvCu8pcSQDxwyjG0
MD5:	449045FAE688D76B18624FE566E32A54
SHA1:	EA98B0853BA3A310362C43FA9F619238E7CAF947
SHA-256:	5343CCFE98B12E0D9B064A9AC7291E17086C5853D40E8BC2AEFAADAA09113F67
SHA-512:	7C366DA72221E9FB01D9927970B7539F89232CD77CD0C3C5C8ADEFF0203D68DD811AFFCA3E198941F28121B0ACEB212459EA8077CF7F5D65D5AC9D2F4BE647EA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@..!...!...!..*=...!..V....!...>...!...!...!..V....!..n'...!..V....!..Rich.!..........................PE..L...7..9...........!.........@............... ....V@.........................`.......G..............................0"..U.... ..<....@.......................P..................................................0.... ..P............................text...v........................... ..`.rdata....... ....... ..............@..@.data...h....0.......0..............@....rsrc........@.......@..............@..@.reloc..&....P.......P..............@..B.$.>.....$.>%...........KERNEL32.dll.MSVCRT.dll.................................................................................................................................................................................................................................................................................

C:\Windows\Crystal\P2smon.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	192512
Entropy (8bit):	5.9642286021294835
Encrypted:	false
SSDEEP:	3072:068MaRFejZOvjqOTN9cWLBuQVNysFsfEz1vUgfK/vsIzx4yEo9:3cpAW9uQVUpMJvKMaxB
MD5:	D24020E137BD588D955ACEF0A8E389CF
SHA1:	7836AAA05532145E85C770EFA6B06398E5DDEF7B
SHA-256:	815F428668D75B9328ACA5199A601F1DADB949D50D29E510E73E260B76323852
SHA-512:	EC91F81F66B365D7C4C291D066F64D74A964D3535AFBC72A29C0B6F0DB1B7B260565F26A3CFFB5D4E48C63342B637A65B127019F58982C43593DC81FFD569852
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......'$.cE..cE..cE...Y..dE...Y..aE...Z..gE..=g..`E...Z..gE...Z..gE..Z..aE..e..bE..cE..`E..5Z..pE...Z..nE..cE...E..ef..@E..C..bE..e..bE..RichcE..........................PE..L....A>=...........!.................................................................................................@.......,.......p.. C...........................................................................................................text...%........................... ..`.rdata...J.......P..................@..@.data........P... ...P..............@....rsrc... C...p...P...p..............@..@.reloc...$.......0..................@..B................................................................................................................................................................................................................................................................

C:\Windows\Crystal\crxf_pdf.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	6.270731532321854
Encrypted:	false
SSDEEP:	6144:shwrCzCaYgTe2I3J1un3m6fdjR4vAkGh+:shwmPrI3u3pd9kAM
MD5:	A14947F6BA9E75C5E5C2263157E886CE
SHA1:	0E39F13BEC51D6CB2F1CFF3F35660B0A2E3C4F40
SHA-256:	E43F008E7E57BACDD29E02570C4728B720BA2D11D9D269FCFCA54C875715ABF8
SHA-512:	B7CA2D08D9D5C9D1374CF541BFFF5AC87C2D5C82857AEF1B84BA6307A5157B192AABA62BE399B2B25AAE5176D39E198625A1CBB109B494AEDDC33B4783C73401
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:Km.[%>.[%>.[%>yD/>.[%>yD.>.[%>.G)>.[%>.y.>.[%>.G+>.[%>.y/>.[%>.y/>.[%>.D6>.[%>.D6>.[%>.[$>![%>.y.>.[%>V]#>.[%>n{!>.[%>Rich.[%>........PE..L.....{:...........!......... .......=.......................................0.......................................x.......m..x.......x........................,..............................................\|....................................text...b........................... ..`.rdata...j.......p..................@..@.data....[.......P..................@....rsrc...x...........................@..@.reloc...=.......@..................@..B(.m=8......>E......=O....#.?Z...".m=d...'.m=q...........KERNEL32.dll.NTDLL.DLL.USER32.dll.ole32.dll.OLEAUT32.dll.GDI32.dll......................................................................................................................................................................

C:\Windows\Crystal\crxf_rtf.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180275
Entropy (8bit):	6.1633040175705185
Encrypted:	false
SSDEEP:	3072:nl3w8fl441BooG039ZYWI7ge5JC3t11WX3V0v4zSuoMZmbesm:nlrfZfAQ5efC911y3V0qZ2y
MD5:	A636F5E7FF78759D5F3C677A2875FA2D
SHA1:	DDCE4DC55DF00A4B6B92FBADDA6CF444B4D82F35
SHA-256:	7C33447829876F22FA5D5FD5EF2E67AE06B48BB2BA32840CF44F940F2F547DF7
SHA-512:	8C7A23B9B01075C0355E8889DE007D962E24E84EBA13B896FA8251EF2750D620CDCE74AD423003BFED70C39F7144803089B17C4D949DC9F71714BACC02668E15
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........lx..+..+..+...+...+...+...+p..+..+...+...+...+...+..+...+...+...+4..+..+...+..+Rich..+........................PE..L...M..;...........!.................B....... ...................................................................... ].......Q..x...................................0"............................................... ..0............................text............................... ..`.rdata...?... ...@... ..............@..@.data...08...`...0...`..............@....rsrc...............................@..@.reloc..l........ ..................@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Crystal\p2ixbse.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	245760
Entropy (8bit):	6.5511171261787196
Encrypted:	false
SSDEEP:	3072:awe+BmVTUODP/IcpBxWeZlHEphpV9K8yKD4PtBeGiXdMj5Cn:tHBmdUODP/IcpBcCNEphLK5k
MD5:	B4748AEEB6EDF8C05123B6542A2BE350
SHA1:	F7165A96833C5ED0A30D15492499FC9DCFD998AF
SHA-256:	527093225D1B40925B19A3100E305513AD94D1461ECA862B6D4D9642EA0B6885
SHA-512:	380C9EE7DC5F32563BDBB0D66A25BD7249F91902299B6CECAA4DCBB04564FCA98B95132E9154CE6082A183A1116094120A7325754A9F5EFCB08866FB05C58303
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s..7...7...7...L...2......4..............C..........n..2...7...S......?.....6.....6...Rich7...........................PE..L....Y.:...........!.........`....................h@................................I...........................................<.......`$.......................8..............................................D.......d............................text...T~.......................... ..`.rdata..S........ ..................@..@.data...p...........................@....rsrc...`$.......0...P..............@..@.reloc...?.......@..................@..B.$.> ....$.>-....v1?7...........KERNEL32.dll.NTDLL.DLL.USER32.dll.......................................................................................................................................................................................................................................

C:\Windows\Crystal\p2lodbc.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	135168
Entropy (8bit):	5.712557269847559
Encrypted:	false
SSDEEP:	1536:yOHs9nZRvH2PP034ynzO8i9smTlTrHi1w9rDQtztKZChBohB1DcXvvhdBJ1Q:1WPvH2P7yzOJ9zTrHi1w9nQBzKWXvz5
MD5:	23D3B53421DB2010647BB2379292863E
SHA1:	49220E4A10E20876CB896DB389345C7B6A9333CE
SHA-256:	B8CBBA9370F4011891B8DAEF34438DC3E3EF2EE9297D3C207FFE3F5ED380A024
SHA-512:	8DF554AB0509BFD7B755342E6C78DC4DB7CFAA9D5C42439052EAFECF8853D5753B8975E8B214B75A46DE2C4FF973F8C93F5C358C29158D707F2544FF3901148D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x@....................,.......P.......,.......T.......................................,.......Rich............................PE..L......<...........!.........p......................................................................................@.......`...x....................................................................................................................text...H........................... ..`.rdata..............................@..@.data............ ..................@....rsrc............ ..................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Crystal\u252000.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.8691527276214883
Encrypted:	false
SSDEEP:	96:2IIUH5yvzjhJe5klNxxL3bU1ogumEoQTbbQBCxYmotqDNhoUN:2Ih5yc5klNxxL3boRumErQcDN
MD5:	9CECBCFF995CF75B752130D3137D39F1
SHA1:	6893B2B9F32E12E16F2F5C5D9CBEC3E603B4EEED
SHA-256:	3CCC9887261965B99EC0F2751D3D3096F2E31CBF281E7EA1A9902C814985DB9B
SHA-512:	DB464E70B3141248B3E63449F15D3CD9937F81207B6E32878AAF570FE7B027E1651061F808AA9670017A00B3694824061F06F03E3F446423A633C892AB08C638
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?...Q...Q...Q.j._...Q...P...Q...B...Q...Z...Q...[...Q...W...Q...U...Q.Rich..Q.................PE..L....Y.:...........!.........@............... .....@.........................`......................................."..6.... ..P....@.......................P..................................................D.... ..T............................text............................... ..`.rdata....... ....... ..............@..@.data...L....0.......0..............@....rsrc........@.......@..............@..@.reloc..b....P.......P..............@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll......................................................................................................................................................................................................................................................................

C:\Windows\Crystal\u25dts.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.5243719406147602
Encrypted:	false
SSDEEP:	96:R5XacropfVAbDWmqXUv+lzoY9W2+xiRfhDbRIQYcvEYmotqYC1hoa:NrCmbDBqXw+hbWM1aQDmYC1J
MD5:	6D669FC0192A4F685147B5C7BCF637CD
SHA1:	ED0FECDD48D49645C89CF23056F9310EEA0BB23C
SHA-256:	3F75A0AC5BECFB33C9CC0312B486D45BCD528992FD6EABA7FA7A1539FC7F4F49
SHA-512:	2E23EA333461FE9110E2FA6F83214BA9C83C002EB3CBFF53CB13A30E44619526D00A8ECD87089DEFCED83947D90726BE5687BC4A9B09C07CCC2333A8299C10DA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........OD..........2$......+....~. ....~.!....F(,....~......Rich...................PE..L....Y.:...........!.........@......!........ .....@.........................`.......................................!......` ..(....@.......................P....................................................... .. ............................text............................... ..`.rdata....... ....... ..............@..@.data........0.......0..............@....rsrc........@.......@..............@..@.reloc.......P.......P..............@..B.$.>............MSVCRT.dll......................................................................................................................................................................................................................................................................................................................

C:\Windows\Crystal\u2dapp.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.124598839033411
Encrypted:	false
SSDEEP:	192:LJ2lGLpG+9B8Rzg1auG+i3OeJrcTtWrgwx9r+jCNFeOp5m:LJ2l69Y4a6eJrUtWrgS9r+jCN3Y
MD5:	347E011F0164DB9CFAC6BB066BAADEC0
SHA1:	116E90AD2358FC31F0C9F86035895BFE9A55A8AE
SHA-256:	67263AF5AD1B9E0CD7A9088B8BA0CA2D05995E73F6E2ADBDDABD53E075BA9533
SHA-512:	707FA48E83BF497540A8D688975D8A885E005ABA321C179BDD95B123573786BBB29E4CB176D46291E945068D8EFE6047C393E6303F925ADC2F64F9CF551912B9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1=..u\x.u\x.u\x..@t.w\x..@v.t\x.u\y.[\x..Ck.\|\x..\|s.w\x..\|r.p\x.Z~.t\x..\|\|.v\x.Richu\x.................PE..L....Y.:...........!..... ...@.......*.......0.....@.........................p.......<...............................4.......0..x....P.......................`..................................................l....0...............................text...0........ .................. ..`.rdata.......0.......0..............@..@.data...d....@.......@..............@....rsrc........P.......P..............@..@.reloc..,....`.......`..............@..B.$.>0....v1?=....$.>H....$.>U....$.>a...........KERNEL32.dll.USER32.dll.comdlg32.dll.SHELL32.dll.MSVCRT.dll.....................................................................................................................................................................................................................

C:\Windows\Crystal\u2ddisk.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.744540447798788
Encrypted:	false
SSDEEP:	192:X/62KJlTcY9alIW9avJMdVxWH/Y9VP0QCKFYOpf:X/62EcY9JEavOdVxWHQ9VcQCOT
MD5:	7C94ECB0391127848A8F20AFA8FD63F6
SHA1:	53B7FC88913CAB7E4E030504E58DFDA87E395ED1
SHA-256:	BE4C2FE0AF5612C91EAE9AB4D67F5276C46963FACE2D5B734BE7E40B382B7332
SHA-512:	1AF94DE58B00BE9F49046A0EC5A326957B00550DF5E9F7359CF97FFAF219540C98EBEEA10EEF8CEE7388D4690C9B322624D48962F4628D4D65852D07AE9C1BDF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................@......<......................................<.......Rich...........PE..L...D.5<...........!..... ...@.......'.......0...............................p.......................................4.......0..x....P.......................`.......................................................0...............................text...`........ .................. ..`.rdata..X....0.......0..............@..@.data...T....@.......@..............@....rsrc........P.......P..............@..@.reloc.......`.......`..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\Crystal\u2dmapi.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	4.318216925570331
Encrypted:	false
SSDEEP:	384:6W2HDi9HjAqwwbEdrakQnfsm4taun3RICVM6Db9S6echEFROQk9D7:6WIDiJwuEN/3auBIKMcIHRED
MD5:	E09FEC233CCD2C6E9D390787D2F87DDA
SHA1:	264F65809115879521DAAD866792C92D9D3C6539
SHA-256:	709EFD24B655E782C423D2A73A7B6DB687ADA69FEDC8DED6A0C6081A416E8742
SHA-512:	E9388F6645A586BCCEE14C5DCABEC47F7B64505C6998C9100A19E32B8ED98BD058458859E2CD6D063CD61E90CD4D812FC47F42BEC54502DEAA31ED13F2F6A4B7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........a.....................h.......................................,...............Rich....................PE..L...7<.<...........!.....P...@......-S.......`......................................................................Pe......Ha..P...............................(....................................................`...............................text....C.......P.................. ..`.rdata.......`.......`..............@..@.data........p.......p..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\Crystal\u2dnotes.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	5.320336268402508
Encrypted:	false
SSDEEP:	1536:MnYrP/rZDN5Cz6y9LUXlnsiUG3eJ/TdY9G:tXrZDazf0lsLY
MD5:	FE8A13548CB544D484496B67D7D6589B
SHA1:	933C66BA98D6090E14E04DB3264D674D4C14921D
SHA-256:	B351DCFBFE03D00A688C488046830D1178A06E6CA86D581388250259098C0C11
SHA-512:	73FEB19916CC5E25B591D5B197AA38E9DEABBCA71A559A5AEA47DB73E9461E720F0674D2A757026E2076B5A0E67F8460B42278084C614E7EA7918023EEDAC785
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\.Y.=...=...=..Z!...=..&....=...=...=..."...=...!...=.......=.......=...;...=..&....=..Rich.=..........PE..L.....`;...........!.........P............................................................................................h...P.......................................................................................8............................text....x.......................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc..d...........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\Crystal\u2dpost.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.440036346891534
Encrypted:	false
SSDEEP:	1536:1rKnUevheUuLzGUT842VxV40Zi8ooiWC:QtZ6LzLgxhooiW
MD5:	D6AC6D930525ED743418E29802510BBB
SHA1:	F4AD2AE3E144F6BD1E103DF5E40654EEAC29A728
SHA-256:	06228AC38A5052A9430195B1D00546B05E23D0EBE4E93F6E0364D14282369DC4
SHA-512:	DE41F832F2EB4BDA0C158FEFAD0C0DB9170736A0DF916773286564FADC7E32F1713024CCD4EE8DEF3658F4612AF933DF1A8B6FA312B4B92B5F79E9670C864B05
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Xz.z...)...)...)...)...)...)...)A9.)u..)A9.)...)...)...)~..)...)...)...)...)...)C9.)...)...)...).;.)...)Rich...)........................PE..L...B.\|:...........!.................~.............@...............................................................`.......x...d....`..........................................................................l....................................text...z........................... ..`.rdata..8........ ..................@..@.data....N.......@..................@....rsrc........`... ...P..............@..@.reloc........... ...p..............@..B.$.>0....$.>=....$.>J....v1?T....$.>_...........COMCTL32.dll.KERNEL32.dll.NTDLL.DLL.USER32.dll.GDI32.dll........................................................................................................................................................................................

C:\Windows\Crystal\u2dvim.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.985155994169938
Encrypted:	false
SSDEEP:	768:r/LUjp/k9cBvKyKjvyalzmxzaoxz8VeqiX9WHFN1T8Oqm/TKFIJsa:8jp/kWBC0aR8nmLKFIf
MD5:	C57A3BFF1408C33DE5DA5BB1C62ECC5B
SHA1:	1A4DE7F1677689E71C2AC78080AE62687808FAB5
SHA-256:	83EFCAC4F78331E6F8F25ABBEBBC11667E11F46627AB188EC7E00BEB51B9DAC9
SHA-512:	D2E7B4FDF32E45B032823B7A515BB348DB63A1CD63A3EC7D286521FCCDD39870BABD4E82038FE8937CBC8C30F2FF6D2BFBD05F9CE34CFF2A153654B77AFED08E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^~..?...?...?...#...?..H#...?..4....?...?...?... ...?..4....?...9...?..4....?..Rich.?..........PE..L....Y.:...........!.........P.....................@.................................5..............................p...........P...............................................................................D....................................text...3........................... ..`.rdata..............................@..@.data...............................@....rsrc............ ..................@..@.reloc..............................@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll......................................................................................................................................................................................................................................................................

C:\Windows\Crystal\u2fcr.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.6466214442096905
Encrypted:	false
SSDEEP:	192:soGk2GtWbZ97gEjWzhQEjIhNFeI59g2jQ66FupdS:soGk2LZ97qljIhNFeW9g2jQ66s
MD5:	B86749B441E49EBD58141871DA7F8DD7
SHA1:	83C1D25B2D2803CAB684ECB6F36F2FEAEB79EB4A
SHA-256:	492C644DBEBB7999EA02E2F2CB562C41D1BB10296BCC72900A59F2CA4D5090B4
SHA-512:	84DFF0CEA5E6239090AD3797F5062A1F54DA16FF2387998C415A01C175266F9127CC4A123ECBE98DADD4940E125DCD7A08FF9993DC4B671FF058BC251C6DA5FE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.a./k../k../k...w...k..rI..+k..rI..-k../k...k..Mt..*k..pI..,k...m...k...K...k..Rich/k..........PE..L...B.\|:...........!..... ...@.......$.......0.....@.........................p.......)...............................3.......0..P....P.......................`..................................................D....0...............................text............ .................. ..`.rdata.......0.......0..............@..@.data........@.......@..............@....rsrc........P.......P..............@..@.reloc.......`.......`..............@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll......................................................................................................................................................................................................................................................................

C:\Windows\Crystal\u2fhtml.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.954164176068831
Encrypted:	false
SSDEEP:	384:qi9tF0bg81ZrH7b34Fu2NFuYNFD5Gl8m369SLQJ9yuFpzDt:qiXKbgWrHH3KuIuYzol8m34yuTzD
MD5:	F61DC6C03816ED80201D25FBBB30FED1
SHA1:	3AA785941B1FF7A880228248F94148718FC47146
SHA-256:	5CDC8ADB1C10223A4C3AF25BB192E2FD47F8E83539714661AD4A6FCABB47F163
SHA-512:	E802DD73A1CA937004B3A47E00FF75B744BB2B00A962559684FA01AFBDFC40C3ED4755BC8B5ACA1C57B9A5075B0FB39B1FBB3DD875D5A4F2CB6A88B4CB4BFDEB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y........................W.....B.............Rich..................PE..L..../;...........!.....P...P.......O.......`......................................................................ph.......a.......................................................................................`..8............................text....@.......P.................. ..`.rdata..-....`.......`..............@..@.data........p.......p..............@....rsrc............ ..................@..@.reloc..<...........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\Crystal\u2fsepv.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	4.1158608664095375
Encrypted:	false
SSDEEP:	384:o0a2aB9b6YzTIy2EdQicNtkjmxHSxb/SI9mviJ4zZ95ewFkK492/T:o0aBBMGMy2EdQicNpR2SiqzWQ/T
MD5:	1AF1B68553F1D5D59158727F6EB49DBB
SHA1:	7386BEAE5AC29E8240F7C1D651F1B0D09B535957
SHA-256:	006D43D8400DD964907D0797A9B9E29A8A8964C11BAD3E7A0E35DBE0DB0506D8
SHA-512:	336C996DDC17F8A7AB39486C6980C88F113B96A672D7243B2971850D3055DC767ED285457374D9B5CEBDAD3BFAA56F7D4774222C7B0CA5D2D63B079B9D354D80
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........cu......................................................!......H.......p"......Rich............................PE..L.....c>...........!.....P...@.......O.......`.......................................................................g.......b..d...............................d....................................................`...............................text....@.......P.................. ..`.rdata.......`.......`..............@..@.data........p.......p..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\Crystal\u2fxls.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	221184
Entropy (8bit):	6.073107874518051
Encrypted:	false
SSDEEP:	3072:KegzPMHKTjDd/fW+uTASAnjAmqvgvks5eXIm2099RX9O+84IEo5lDNy:hAP0KbdXUAFgZsqImx9OGfo59
MD5:	E1DCB4C37FCCD79578F1B8E376D1B3F6
SHA1:	9351C62C6302F62049485E4C15BA909B8E902C08
SHA-256:	A3186DDE55B8F897C5D953F986B4F0A77797E9617609909C49DA6F3E285AE4B5
SHA-512:	F5D34E397B5075603384DA42A8617A46834C696720B8B71D3E1384EF6B368422E785127165F34F71A92413980DB510BDD72F24D89E7FAC7C65ED3CE251C36A7B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P...1.R.1.R.1.R.-.R.1.R...R.1.RI-.R.1.R...R.1.R...R.1.R.1.R.1.R...R.1.R...R.1.R.7.R.1.R5..R.1.RRich.1.R........PE..L.....=...........!.........................................................`......................................`.......p........ .......................@.......................................................................................text...5........................... ..`.rdata..o........0..................@..@.data...............................@....rsrc........ ... ... ..............@..@.reloc.......@... ...@..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\Crystal\u2fxml.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	5.724903191036286
Encrypted:	false
SSDEEP:	3072:q54c1n/ypBau8j3dzRTGT2Idm2tbBu5Y6obbliT/mV:q54vaBtzRTf2Bgmb4TmV
MD5:	F122F3946E0C78A8782BA78153E0A4DB
SHA1:	2932A0217CF396C3EA1D0014E09D24BA7FD6DFD7
SHA-256:	33F3970E1C14EDC4962F8394CA7A30F619516EE6A89535DDDF31017EB084DB69
SHA-512:	15EC323EAA5B1D2863B4AC50A21BCB4647B08A776F7A3C981CCEFB4F0CB6E628A305C060721D0C5494BFDF557706D7415ADD88E5FF6C87B4F0E1F2C83F42B3F4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@ .w.A.$.A.$.A.$.^.$.A.$Yc.$.A.$.].$.A.$Yc.$xA.$f^.$.A.$.A.$wA.$[c.$.A.$[c.$.A.$.G.$.A.$.a.$.A.$Rich.A.$........................PE..L.....{:...........!..... ...`.......{.......0.......................................a...............................O......xF..d....@.......................`..................................................l....0...............................text............ .................. ..`.rdata..:$...0...0...0..............@..@.data...Q....`.......`..............@....rsrc........@... ... ..............@..@.reloc... ...`...0...@..............@..B.$.>0....$.>=....v1?G....$.>R....$.>\...........KERNEL32.dll.NTDLL.DLL.USER32.dll.GDI32.dll.comdlg32.dll................................................................................................................................................................................................

C:\Windows\Crystal\u2l2000.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	2.0998953021911198
Encrypted:	false
SSDEEP:	96:rIzc50xqjhJtVyhbHxXoCcRXTTpQidqDJpAmJq+QGCGYmotqDMhoDp0LNf:rB5DXwVxXRc9TpQikDDAmJ5QcDMz
MD5:	3DEE1017263C8973FB882989858A5C2F
SHA1:	819B77196B265FE25E12BC26B8298C2B20DFF5A7
SHA-256:	5D64F25968DD379EC2E4C463D0F181463AD7EF476B03D7BA4C730A08FCF8ACD8
SHA-512:	4557B400B2D8E29B6F82D1F32F74A71E64FC21C45CD9B42BD8976C5BF4811A272FFDC703A7C213DF84EAE0C81239EEFD0EFACFC35392A51D47BF1F7FC49ECABE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................j................................Rich..........................PE..L....Y.:...........!.........@............... .....@.........................`......................................."..F.... ..P....@..0....................P..................................................D.... ..d............................text...T........................... ..`.rdata..&.... ....... ..............@..@.data........0.......0..............@....rsrc...0....@.......@..............@..@.reloc..~....P.......P..............@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll..............................................................................................................................................................................................................................................................

C:\Windows\Crystal\u2lcom.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.19516961379927
Encrypted:	false
SSDEEP:	1536:gw/iTp1rZP6UpbRfOdkWY+o9uLtOpaYlga+gi4+m6bnStQgc:A1lSUTf2YhatKJogi44nStU
MD5:	1EDC1124D987025B4539C6CCD86FE52C
SHA1:	76C6558A038714C0671BE517DC3FAA47A9804BCA
SHA-256:	54EC7365B4C8AF951C0447493D6D0A32CCBE9C1139CAE4D2252D44DC7B1B8E6F
SHA-512:	18EE07CBAA4A443AD8B61E89BA0E466C065B7BFBE5E14258F280E2C3DD266B0D9F78C0C5580C0F2E3EC3A502D9F7A4AE3A38543F0C8B8178E85EA3C9290CCA72
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............H...H...H`..H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H(..H...H...H$..H...H...H...HRich...H........PE..L...4.v=...........!................;................................................................................:..e....2.......P..@....................`.......................................................................................text............................... ..`.rdata.............................@..@.data...T....@.......@..............@....rsrc...@....P.......P..............@..@.reloc..x:...`...@...`..............@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Crystal\u2ldts.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.3865196823068335
Encrypted:	false
SSDEEP:	96:pvhwqwhJhOjVYee/c5T3mqlh+RIQYcHYmotqYnhoajt5:AqwhJhOBYZ/Q6qT+aQbYnJjt
MD5:	965D0761E6321DB219C4DA55DE285278
SHA1:	D36E872C3D44FE152B1707A57D6165F09275C800
SHA-256:	B61529675C236BE1824D6779C8ECE1363A9BA5470B6F171ACFFBF7009ECEC83F
SHA-512:	5B321F47D03919C5B77853E8BFFF4BC4D5627FD40E069B693EA259048331BB62A14D9D457A1782E208D0692EEDAC34CB72EA118B6A158DAC7E3D74DDBE159841
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y./.=.A.=.A.=.A...O.<.A.=.@.1.A._.R.>.A...K.:.A...G.<.A...E.>.A.Rich=.A.........................PE..L....Y.:...........!.........@............... .....@.........................`.......N..............................P!..Y...` ..<....@.......................P..................................................0.... ..0............................text...T........................... ..`.rdata....... ....... ..............@..@.data........0.......0..............@....rsrc........@.......@..............@..@.reloc.......P.......P..............@..B.v1?.....$.>#...........USER32.dll.MSVCRT.dll...........................................................................................................................................................................................................................................................................................

C:\Windows\Crystal\u2lexch.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.267042919287219
Encrypted:	false
SSDEEP:	384:KXcrE+FLvbmBhm1xgv/89aZ8EDQgeNQnKkG:KXc4+hvbehU2v/PZ8zQnKkG
MD5:	BBBC65FDFBE05CF8D64602D96D1CC73C
SHA1:	3AEDB477B3FCFE064998627DEC3F3E40F11C60D3
SHA-256:	6A0255417D2197E016BBCA41E3C8849CDE951F30C2168225D550B19A7C3C5DBF
SHA-512:	66526FBFC157984334C83C42B13DE2DD56C610DFA513637A5B4A9298B4F05AA4015C8532D640FD4A9524080D92B56A7D847575E0E48AB0513B1B66413F276FB1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...ir..ir..ir...n..hr..ir..Nr...m..lr...R..kr...R..nr...t..hr...R..jr..Richir..................PE..L....Y.:...........!..... ...@.......).......0.....@.........................p.......6...............................3.......0..P....P.......................`..................................................D....0...............................text............ .................. ..`.rdata..^....0.......0..............@..@.data...,....@.......@..............@....rsrc........P.......P..............@..@.reloc..p....`.......`..............@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll......................................................................................................................................................................................................................................................................

C:\Windows\Crystal\u2lfinra.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.717620044022021
Encrypted:	false
SSDEEP:	768:TuiZXiv6x2/PBTx30WGdoxJ3jiB9WQgK1JJ+Fo7YIi8E1u:Tupv6EZTx3CoxJRQDUoGE
MD5:	EEACE14739B3E836F44D661C0042F223
SHA1:	24F5967B7B12DA1ED343A73D723FE6FDFEA7F301
SHA-256:	11DF90CC11DFEA9D9D7F2DA22CFFEF805CE658F6AB3E2150861EEBF03D690CA1
SHA-512:	912FBB92B92A3A0BE65514FF13BEB6195A4631EFCDDE4231D48AA516DD59BAEC8D6FD125525B991A95D78B93EB0D6CE75C59D32A2463A83928ECEA8D1BDA5894
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........<...o...o...o9.o...o9.o...oR.o...o..o...o...o...o..o...o..o...o...o...o..o...oRich...o................PE..L....Y.:...........!.....`...p......y .......p.....@................................_g...............................\|..[....v..<...............................................................................D....p...............................text...._.......`.................. ..`.rdata..[....p.......p..............@..@.data....<....... ..................@....rsrc...............................@..@.reloc..L...........................@..B.$.> ....$.>-....v1?7...........KERNEL32.dll.NTDLL.DLL.USER32.dll.......................................................................................................................................................................................................................................................

C:\Windows\Crystal\u2lsamp1.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.965175828785223
Encrypted:	false
SSDEEP:	192:xGqtPxX4u8XuBxGkkUiRh8jJmmj2sucQgeh:xGqdSP4xPibOMm/Qgeh
MD5:	7BBBE3749D17CD539623C60F5E023992
SHA1:	E0769AEA1E7EC30DD33AC022E8C1D0F79983BE36
SHA-256:	D8F7E302FD89ACD8EE36FAA07214ED3B6039F91EC45F72FC954967C04FE906FF
SHA-512:	86AEC1D8FC59DD7B8F86815928196798FD6C0288B331B552298CDD157025B7BD3CD9ED84C0A07D4B3D5ED347AC0B2944931AEC9FA15D9ABA1DDFC8796619AE40
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...ir..ir..ir...n..hr..ir..Nr...m..lr...R..kr...R..nr...t..hr...R..jr..Richir..................PE..L....Y.:...........!.........@............... .....@.........................`.......!..............................."......h ..P....@..(....................P..................................................D.... ..h............................text...~........................... ..`.rdata....... ....... ..............@..@.data........0.......0..............@....rsrc...(....@.......@..............@..@.reloc.......P.......P..............@..B.$.> ....v1?-....$.>8...........KERNEL32.dll.USER32.dll.MSVCRT.dll......................................................................................................................................................................................................................................................................

C:\Windows\Installer\4937c6.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Revision Number: {D529246B-78E5-4E65-A3A2-8E1040E91E59}, Number of Pages: 200, Title: CF Remote, Subject: CF Remote, Keywords: Installer, MSI, Database, Author: NC SBoE, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0, Template: Intel;1033, Number of Words: 8
Category:	dropped
Size (bytes):	868352
Entropy (8bit):	6.27478169655376
Encrypted:	false
SSDEEP:	12288:8vLiSxEFm3BKXsbzlDSJjQ8guBoN2KA2wKc7wMz7:CLiSxdW5BqPA2fc7wMz7
MD5:	07B84F29BDE3DA6F007CB92808F95C72
SHA1:	4B3FE13A83BCDC68960132FB426E040289A14DE1
SHA-256:	BA6852A7F0F0711ADB1F6FC1A32177E7ABBEB8CFC2A62A778252AC3B1EE0B485
SHA-512:	1921A4ECE8E9155A3E8CBC73223940F7DEE796379D3CF6FAD4ACB6F53E449A38AE816B590B40EE4C911E7C69B1B95648482243132174C9A3022F1E7BBFC1BB13
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\4937c9.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Revision Number: {D529246B-78E5-4E65-A3A2-8E1040E91E59}, Number of Pages: 200, Title: CF Remote, Subject: CF Remote, Keywords: Installer, MSI, Database, Author: NC SBoE, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0, Template: Intel;1033, Number of Words: 8
Category:	dropped
Size (bytes):	868352
Entropy (8bit):	6.27478169655376
Encrypted:	false
SSDEEP:	12288:8vLiSxEFm3BKXsbzlDSJjQ8guBoN2KA2wKc7wMz7:CLiSxdW5BqPA2fc7wMz7
MD5:	07B84F29BDE3DA6F007CB92808F95C72
SHA1:	4B3FE13A83BCDC68960132FB426E040289A14DE1
SHA-256:	BA6852A7F0F0711ADB1F6FC1A32177E7ABBEB8CFC2A62A778252AC3B1EE0B485
SHA-512:	1921A4ECE8E9155A3E8CBC73223940F7DEE796379D3CF6FAD4ACB6F53E449A38AE816B590B40EE4C911E7C69B1B95648482243132174C9A3022F1E7BBFC1BB13
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI38EF.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	389632
Entropy (8bit):	6.443465180760872
Encrypted:	false
SSDEEP:	6144:zgj8g8Sy2AoNSlkJAiL9svGFXFPvA2wKcWQwMYW7rmk:zQ8guBoN2KA2wKc7wMz7
MD5:	89B5903624F9CDED346676E88F918693
SHA1:	162201E4E31FB327E0B16531C81041DC574A04A4
SHA-256:	851BB0A420E47AF2F49518FAE86E4B9755BD5DAA6E9EB3B2F1FC4585B6F05163
SHA-512:	FD2587EF52E43EC131E4D06A34306E038B85B98E9EE2866FFD117E906B019FBA6972B794BEC2A9E0FEF357E199A0D13E64A89D4356EA8BF6CAFD6A289B1B48A7
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...>=xQ............................d........ ....@.....................................................................E............p...&.......................}...................................................................................text............................... ..`.itext..\|........................... ..`.data....,... ......................@....bss.....P...P.......8...................idata...............8..............@....didata..............J..............@....edata..E............L..............@..@.reloc...}.......~...N..............@..B.rsrc....&...p...&..................@..@....................................@..@................................................................................................

C:\Windows\Installer\MSI396D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	6.043448081977129
Encrypted:	false
SSDEEP:	1536:bzfplpotJ+Tc5x5XJAIu7+zc2X5X1DznQyrvDklgXUEfbSorHqSCdZQVTbe6Kion:bjbp4gcXsnuRfklg8orHqnzT9ioO
MD5:	6484BEE1546FEB56595EAACF5D019C55
SHA1:	CBFE2EBE0485E447F1887F52D5A3CFA480A8FBBE
SHA-256:	FB73F1E2A71635F6F1F10FB7C7B738E4CE5125C3841B1A656A5F2CD406BDDFB2
SHA-512:	538A1B8981BAF6F35FE58CC862FAA5AF27D68E93572C5E4EF6719E1CF4A9B1A4AC9E61FFA22EBC1E9AEC0FDEB88AF54FE8834B8C384B596A889C07E63C031ECE
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?=xQ.....................f......\|.............@.....................................................................D....`..................................d+..................................................Xb.......p.......................text............................... ..`.itext.............................. ..`.data...h...........................@....bss.....N...............................idata.......`......................@....didata......p......................@....edata..D...........................@..@.reloc..d+.......,..................@..B.rsrc................"..............@..@.....................4..............@..@................................................................................................

C:\Windows\Installer\MSI39BC.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	6.043448081977129
Encrypted:	false
SSDEEP:	1536:bzfplpotJ+Tc5x5XJAIu7+zc2X5X1DznQyrvDklgXUEfbSorHqSCdZQVTbe6Kion:bjbp4gcXsnuRfklg8orHqnzT9ioO
MD5:	6484BEE1546FEB56595EAACF5D019C55
SHA1:	CBFE2EBE0485E447F1887F52D5A3CFA480A8FBBE
SHA-256:	FB73F1E2A71635F6F1F10FB7C7B738E4CE5125C3841B1A656A5F2CD406BDDFB2
SHA-512:	538A1B8981BAF6F35FE58CC862FAA5AF27D68E93572C5E4EF6719E1CF4A9B1A4AC9E61FFA22EBC1E9AEC0FDEB88AF54FE8834B8C384B596A889C07E63C031ECE
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?=xQ.....................f......\|.............@.....................................................................D....`..................................d+..................................................Xb.......p.......................text............................... ..`.itext.............................. ..`.data...h...........................@....bss.....N...............................idata.......`......................@....didata......p......................@....edata..D...........................@..@.reloc..d+.......,..................@..B.rsrc................"..............@..@.....................4..............@..@................................................................................................

C:\Windows\Installer\MSI39DC.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	6.043448081977129
Encrypted:	false
SSDEEP:	1536:bzfplpotJ+Tc5x5XJAIu7+zc2X5X1DznQyrvDklgXUEfbSorHqSCdZQVTbe6Kion:bjbp4gcXsnuRfklg8orHqnzT9ioO
MD5:	6484BEE1546FEB56595EAACF5D019C55
SHA1:	CBFE2EBE0485E447F1887F52D5A3CFA480A8FBBE
SHA-256:	FB73F1E2A71635F6F1F10FB7C7B738E4CE5125C3841B1A656A5F2CD406BDDFB2
SHA-512:	538A1B8981BAF6F35FE58CC862FAA5AF27D68E93572C5E4EF6719E1CF4A9B1A4AC9E61FFA22EBC1E9AEC0FDEB88AF54FE8834B8C384B596A889C07E63C031ECE
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?=xQ.....................f......\|.............@.....................................................................D....`..................................d+..................................................Xb.......p.......................text............................... ..`.itext.............................. ..`.data...h...........................@....bss.....N...............................idata.......`......................@....didata......p......................@....edata..D...........................@..@.reloc..d+.......,..................@..B.rsrc................"..............@..@.....................4..............@..@................................................................................................

C:\Windows\Installer\MSI3A5A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	83494
Entropy (8bit):	5.5898503904141466
Encrypted:	false
SSDEEP:	768:AMBy/r4EAt/D25v7l4NBf/TxNQ6b7Ndp8W7fZudiuKlbBWHcpE9rDvZF3qUfQSUk:Ds4EAt/a5v7mbQcy9PZVqUf6j4
MD5:	D188592DF1609CA078FAE3E4A87AA337
SHA1:	0DE150E01973506675874031DC1A6C80CC32F5CB
SHA-256:	8559E7DEE1DA223D46923D3B21831DD9C98B9D76327F73A587EB7BEBF45DE125
SHA-512:	1531802CD851609A5F4FCFEE796D6CCB1FF7E9530DDB580915ACBCE7762576D6F360360296AB1C296CD16AB23493159737BA93C40E3E54C0BBCA73C4F4C61E42
Malicious:	false
Preview:	...@IXOS.@.....@...Y.@.....@.....@.....@.....@.....@......&.{152D390A-DD7B-4E57-B3A5-14CADE7E1207}..CF Remote..cfrv_4_0_setup_ALL.msi.@.....@!....@.....@........\PROGRA~3\miaE495.tmp\&.{D529246B-78E5-4E65-A3A2-8E1040E91E59}.....@.....@.....@.....@.......@.....@.....@.......@......CF Remote......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@_....@.....@.]....&.{DBAF7F90-6797-4BCB-8426-E799FE0D75FA}...@.......@.....@.....@......&.{10B1E2F4-E12B-4D18-847D-3579632C4DA0}...@.......@.....@.....@......&.{70233733-63B7-4686-8B22-F467B98A5511}...@.......@.....@.....@......&.{100D9843-4837-4C77-9382-C4AB79C16EC6}...@.......@.....@.....@......&.{360CA8FA-B89D-40E5-8E5D-E0358F8448B5}...@.......@.....@.....@......&.{AAA707EE-74C6-4091-8DF1-A6063B1CAF22}...@.......@.....@.....@......&.{9C72C003-1DC2-41F4-AD0C-E99FEB6FE846}...@.......@.....@.....@......&.{E66B3D7D-9A68-4B63-9A00-00FE935

C:\Windows\Installer\SourceHash{152D390A-DD7B-4E57-B3A5-14CADE7E1207}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.440297633958404
Encrypted:	false
SSDEEP:	192:kFNh1I7ZcPXxPNN+yXv692R+VJYwMvbU:knh1I7Zcpiy/699JY1vbU
MD5:	FE2632BD3B5BE2B338E25473318BDCF1
SHA1:	D6941A0C57DE987DAF01E5B83E949CEB74663978
SHA-256:	579497DEF5D38B65CEFBB14D96D6B73F252E17B32AE0AC4165BDEF9FECD3EC6F
SHA-512:	FE43D9AE450B823F72AEF070E1B93F249B06844A1A12D7716C67F4E74DC218BA67B94703F64B93F4B35E12E2F6BCF2735F90BE552CC437808B27BD17CD31298D
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.8458016767218735
Encrypted:	false
SSDEEP:	96:phN1njTBIQT8lMTwCRmz8e/mqscIXbcP91GxbOVe:B1j1lgIw94JrcF1He
MD5:	2CBE48090A32907839EDAAA12EE842C5
SHA1:	C9B79A3301B785C484C1A4A48B8D87DEFAEA254F
SHA-256:	A0B21961655F544827406261D82098D06966DC8B2E2E03AFC64945770A8818DC
SHA-512:	3A297560844A7554E4E9F2EAB3EC51CFB4F928B937B88C0D68643CE9E143A1F3D4665C2695FFC04616E77C4FCEDC7B1CAC0624CF97E3934B2C65384F2953EE00
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.375174124123903
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauO:zTtbmkExhMJCIpErH
MD5:	DCA4209E1A4F3705E34595CC30FF784C
SHA1:	81383CD6DB7D261AB1171E1CF8E220E294E011D4
SHA-256:	2701F4CEA6CE6F6F9907EB72BEBF0E8A74D61C1B190CD0069207E9C7A71C1489
SHA-512:	3771ED20A24BAF2148583479E8AC9D9E8922A41442566758E60CCC8EFA4D424E9786908F1F3F4C6ED16C452F1BF4158410E8AAE2429E1C77347865E41D39BABC
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\SysWOW64\CRBAS15.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	307200
Entropy (8bit):	6.383146474711384
Encrypted:	false
SSDEEP:	6144:mzdLJkXstL6iKvwzVLb34armOHi7+m463cG/CzQYQ8rk4TCmiSippnec:mxJkXWL6iKvwzVLb34armOHi7+oXzff6
MD5:	FD64262820E74C63BB0D97061776C234
SHA1:	28FC641E0154BCFDF383EDB9D28245F2873E4A12
SHA-256:	2AE2BC42BC655010F11C2686EE4C318F07D6C1CF3EBC79A8E1FBDB57A49A2CC4
SHA-512:	C26D4400EB99A425C886C1707D00A87018D4B0375FCFF39F127DC8CD26DA5114D73233868B99317C7415366D9B26D861DE321110F0F14E31623560A7F0F66826
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?..l{.{?{.{?{.{?..w?z.{?{.{?z.{?..h?..{?..u?z.{?..q?..{?{.z?..{?..p?W.{?..}?z.{?...?}.{?Rich{.{?................PE..L... .t9...........!.....@...`......./.......P.....(....................................................................\......d....`.......................p...4...................................................P..4............................text....4.......@.................. ..`.rdata......P.......P..............@..@.data....V.......`..................@....rsrc........`.......`..............@..@.reloc..N8...p...@...p..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\CRBAS15R.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	2.8457754129966433
Encrypted:	false
SSDEEP:	384:7GiZrKbKxGbk5MOqerr5iKVHHgEKZ2ajjH:tWbKxGbk5MOqirbngbj7
MD5:	2D9A1115B872258CFCD657E32A2955B8
SHA1:	23021F48D1F741BF04F79DB49202A0A3243F3D05
SHA-256:	5D137E1FE18A51D7A7AA6B5F67BA55E00ADB44155F771F81F56A22418FA8EB6F
SHA-512:	F08CEFE2F8D208CBD554B673300536C69C0F08B016B236293CAED0E62C7393CBABC4F8D377EC5BB05D902DAA96B3370648CF188C0B5A0989AFBEFCDFE0B3F205
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.hG]..A[.Rich.A[.................PE..L...M.t9...........!.........p...........................................................................................................]...................p.......................................................................................rsrc....].......`..................@..@.reloc.......p.......p..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\CRUTL15.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	290816
Entropy (8bit):	6.551645416298201
Encrypted:	false
SSDEEP:	6144:sP1hcYD9DDW+j8PPk/axspmqPugvLRyoVLNMIrZO:sPPZ9Dq+oPkwspm2+uO
MD5:	DFCEEBC9D6DBB3DB56B735C7020A35D1
SHA1:	189F681C860D15E997F3ED4502D747F25656BAC1
SHA-256:	09687C007B9D0C4047BC42C58C54E6DB62B9614306AC6DCBCD1B7532CF5ACF17
SHA-512:	15E73EFE925572ED9FDD11C316255880F7F131BEE084121B28B8507AB88E95FC22CDB9D606481CA499BD2BFDB61E871A2F026CEC56F5B747388237E3FB752351
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'"..cC.OcC.OcC.OcC.O.C.O.\.OkC.O.\.OeC.O.\.O.C.O._.OvC.OcC.OfC.O.c.O.C.O.E.ObC.O.c.ObC.O.c.ObC.ORichcC.O........PE..L...K.j9...........!................G0.....................................................................................`...x....@.......................P...8...................................................................................text...R........................... ..`.rdata..............................@..@.data...............................@....rsrc........@....... ..............@..@.reloc...?...P...@...0..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\CRUTL15R.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.807152052248964
Encrypted:	false
SSDEEP:	96:5qsN56E9EADBVzBDaZBcG6fyXmuY+eQ5TMbKGbMH7x6sTFw+YprWUUsmn+sWiNBg:5qP1ADhAZXmuY+LubKRc6smh7
MD5:	859751A660914A75FB9062E47B7111B5
SHA1:	741752CECE787A377987A3C329238E87B1AEBBAE
SHA-256:	7DDDB9C0D38C2BC47EA44B0B5F73A1A6411BC0069AFD4B42AECD79C92D1666FE
SHA-512:	8D8D3278111BCEA19781A3523F863B378BDA40D8AB580775CE6664F080777E5F83C4F0EAA42A98363A0842F6DE9FD47CEDB1AE5DD42AC5D04BB046A6213A4F94
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.hG]..A[.Rich.A[.................PE..L...E.j9...........!.........@...............................................P..........................................................X!...................@.......................................................................................rsrc...X!.......0..................@..@.reloc.......@.......@..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\CRXML15.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	167936
Entropy (8bit):	6.187995719559416
Encrypted:	false
SSDEEP:	3072:RiT9Mjz9fxT8ms8xHZaKV6AORqrkcNnVn6u7OtP:RvfxFHZdYOk4nVnf
MD5:	56A8FDC2477954D863C92D08675FFE57
SHA1:	00E91FC7856C20F05E7203CE3BA72F2F0F78BEB2
SHA-256:	B39FE18BFA62BA1A2F1D680B3505100448F3CB3ABE49B6D55B3DFFDF430E25BE
SHA-512:	233379A84A523A890E593C7550344CCA982E18A5F5A91B42209304279CD0F0798AEC67D9BC897769A537C2DB617E9A2210EB5A5E1A0E6C388AC0A70CE8A40FD6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................%....Y..........Y.....a....Y.....Rich...........................PE..L...E.=9...........!.............................n(.................................................................................`.......................p..X....................................................................................text...r........................... ..`.rdata..sf.......p..................@..@.data....+...0...0...0..............@....rsrc........`.......`..............@..@.reloc.......p... ...p..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\CRXML15R.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.452431739694398
Encrypted:	false
SSDEEP:	96:50f6X9EKZaMwah+RtQl9X8N5MMJigpFnUqmspl65z+muijdwMDRaaPp/MQaf:50CaKHwah1wF3TWd/Rama
MD5:	3243A8F5DB572EAE76FE2348B2E106C0
SHA1:	9DCEE517723C6B2206C83C065B4C0B889B69E0DD
SHA-256:	B7714239D578D588B1AECC55E89DC6327716F43A4CB68627ABFE30AB344AF460
SHA-512:	98F5F5BCACB3B86EA05E493883D62744E20351334A71D7E3066D177797BD132A51B647C60A485E05041E3A1F6003E0D093D267AEFD0AA5DD3008C44676426E05
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.hG]..A[.Rich.A[.................PE..L...G.=9...........!.........@...............................................P...........................................................+...................@.......................................................................................rsrc....+.......0..................@..@.reloc.......@.......@..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\CRXML15S.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	4.673313433135478
Encrypted:	false
SSDEEP:	384:xEXQnim4w2xSKOJtcLFZdMQzf3M7TnSYkN9A/hqycPGSpzuE8d+chaz:xEcim4uUFgQzf4nSH9A/hqycesuac4z
MD5:	1783A2BC9AB938AD923D2040B4ABB243
SHA1:	CA6EABACF16E56723429F65CC5D592699015783A
SHA-256:	0D4B4BAE969E25267C54B367AC9760A718869ACB793CC1380D3A37767BC8E63C
SHA-512:	1A3790C55A7015F4D867C76CB6F4E2D483818A9534E5F4EAD73E44E19B876672EE4A9AEA9A4960E37F729B3C428C40755023FDA7D197064793002B2FFD5AFC20
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K..................5.....X6.....$............$.......,.....$......Rich...........................PE..L...].=9...........!.....0...`......j6.......@.......................................................................N...... C..................................@....................................................@...............................text....,.......0.................. ..`.rdata..d....@... ...@..............@..@.data........`... ...`..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\CRxmlx07.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	942080
Entropy (8bit):	6.65646975675861
Encrypted:	false
SSDEEP:	12288:c30LOWsXFbwAlSc96WPwYW0WxgERNUzD71h1PTMNy:vLOWsXiAlS86WPhOvNUANy
MD5:	4FCCBA7B1CDF3BC6EA31F1B0627AE8EC
SHA1:	770725AF1E58CA070AD3456D8572B3E04A70B7EA
SHA-256:	D97B3B00646FED52DF6855EFBA4269B63F1263EF32B3E477E1E2236A7F126F4E
SHA-512:	0786A923077CC4BA30E79C052590D571F54DF3E3B01BC6F9781B7E0ACF0E3F5D2549641C1CA11ABDCA064D88728F33B7E63C07DFE0D09D19AE339ECB6F86F6E3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^x4...Z...Z...Z.a.V...Z.G;Q...Z..T...Z.G;P..Z.L.I.c.Z.D;Q...Z...[...Z.x.I...Z...Z...Z..9Q..Z.E;Q.0.Z...\...Z..9^...Z.Rich..Z.........PE..L......:...........!................g................................................................(..............p...>........................................v...................................................................................text............................... ..`.rdata..............................@..@.data....>..........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\CRxmlx07r.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	3.5687827741608045
Encrypted:	false
SSDEEP:	1536:ZWJaaymHs15LBdFElh9aaaD+FdhaG9AFqg24CHgSz+Qar:ZWJaaymHs15LBdFElh9aaaD+PUG9AFqQ
MD5:	E8C7545574E4D9E9992CB5B9331271CC
SHA1:	CF271D3B4A88DA069E61D1269DC8EE412695C69D
SHA-256:	14A788E493779B3FD96C1F94D7154642E79F34594B978A6A7E39C97BEC5F7E5B
SHA-512:	F4A5E5D7F2D162260F150E4F3069F707E0D3C291E0766720E813F5A40D410A67AC18DC03ED5DC7B5DF579A8A3BFCA4F5EF667D16733B853D11104F0C7F165E90
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.hG]..A[.Rich.A[.................PE..L......:...........!.................................................................................................................................................................................................................................rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Crpaig80.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	622592
Entropy (8bit):	6.077970194897055
Encrypted:	false
SSDEEP:	12288:H31fVUPM+u1u6RS/olZNeQ1d6JjH/bldq8CMKtBBxSftKaXnDsju:7UP3u17xJ1cHrqTxGt9Xg
MD5:	48713A483F2C48ECE4AF4F098A13469F
SHA1:	D8F6BEDF737C52DA16B560E96DCE45889162D50B
SHA-256:	D6E26D47CC578B701FBB9491D8DC5B3CAB317FE92F447387905755AB8F2DC991
SHA-512:	2F01361C7B3D5326B2BC9D86DA47F49E98380DFA967C33E4DBB446C02278F412EDE5D9088F431E2E3EF3960E7F6F858C94F53F576CE3C87C2356FA7919758849
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X..c...c...c..o...c.,.m...c...i...c...g...c..p...c...b.=.c...S...c...R...c.h.e...c.P.g...c.Rich..c.........PE..L...8Y.<...........!.........p......U...............................................................................@...........d....`..\|....................p..L.......................................................P............................text...V........................... ..`.rdata........... ..................@..@.data...<"...0... ...0..............@....rsrc...\|....`.......P..............@..@.reloc.......p... ...`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Crpe32.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5042233
Entropy (8bit):	6.348947882126544
Encrypted:	false
SSDEEP:	98304:WJdA7Kn4uYmR88wV1s8dxnve1RZ3BUE9nPdf9avG37EuY:WJy7OymLH8dhg3jPdWGLO
MD5:	2517D67C02B04B3D07FEF74501D6E303
SHA1:	8FE46EFC7F3810358F31AC45B87BB54F08C4FFFE
SHA-256:	A1B0116C01EFB841A263DF2A7BA261FB1B131169C0974E90383535F90C704C83
SHA-512:	3032B05A178BA384693A02AC221B394CA3FDA60D7A0EB2D4039A31C527721FF458A1E486CC0C32834E35A3A2D3F4EF0237368D7E5F084267327EB650239CD3E1
Malicious:	false
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.........."..q..q..q..q..q...q..q..q..q..q..q..q..q..q..qn..q..q..q..q..q..q...q..q...q..q..q..q...q..q...q..q...q..q...qb.q.q..q...q..qRich..q........................PE..L....t.?...........!......4.........#.2.......5...............................M......................................J<..j..l.<.......?......................I..^..`.5...............................................5.T.....<.@....................text...>.4.......4................. ..`.rdata..E.....5.......5.............@..@.data.........<.......<.............@..._CODE........>..0...@>.............@....rsrc........?......p>.............@..@.reloc..".....I...... I.............@..B................................................................................................................................................................................................

C:\Windows\SysWOW64\ExportModeller.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.112628297874781
Encrypted:	false
SSDEEP:	3072:I5BjEZYf0mpCQWkmQFkC7SmmNLT1uEfhuVQA6nBgvWKwnvOtzC/8gfPACQ1pH2pE:zYf0mpC3kdFkC7SLLsmA6ESubhD+TU
MD5:	70B34D924E4DBA93BDB051C50B76A935
SHA1:	F3E1B375A577585F89482A78ACBCD92D3CC37796
SHA-256:	80E70DFB52DF7F6DEE86C1DC174799FAC4E189550ED9E0B07AEB26F29E072F40
SHA-512:	124584D8857A604C6B4026C36150074AFB3760893E464A5B2323551BD1E385D763A7FF2E5F5ACAA265AEEB766C08F486673BC9C13ADB53F9EBC03C380AF5C7D5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=..uy..&y..&y..&...&...&...&l..&...&v..&x..&{..&y..&x..&/..&s..&...&p..&y..&...&&..&_..&...&x..&...&x..&Richy..&................PE..L...y.R;...........!.................................................................................................3.......+..........p....................@..$9...................................................................................text............................... ..`.rdata..[...........................@..@.data....O...@...@...@..............@....rsrc...p...........................@..@.reloc...H...@...P...0..............@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Implode.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	6.082251537771566
Encrypted:	false
SSDEEP:	192:Isp6yEkGeVt7mdxy6BhUDwDBEKhixWPGqLukwRWxlRYlRXwHV1UBoN4GI6slUx:Vp6yGeVABrKcb7hjYjXwHHU04GJso
MD5:	0A0324A4282DF0F2C3129E5BD84077BC
SHA1:	5A4FB357AD6A245F75213C5F5593AB8F57E613DF
SHA-256:	11B4C417769C5C4729165C8CA0567F7D3B06D4B82998AB297D59ADBAD9F74D5F
SHA-512:	6074AE20F520449B5F3842F866BB8455B16E488C6D81BFBF898844C821D35EFC036B4DEEB9600502A54287050FE392BDA533FEB112B8A593F30CE779D1045646
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...-..2...........!...2.$...".......".......@....(%...................................................................h....p.......................................................................................................................text...?#.......$.................. ..`.bss....$....@...........................data........P.......(..............@....idata.......p.......>..............@....edata..h............@..............@..@.rsrc................B..............@....reloc.. ............F..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\QECR.LIC

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	796
Entropy (8bit):	2.1709395683364
Encrypted:	false
SSDEEP:	3:2Ao1ihaQDeFS4qs//l8AqjXF1WX0jpuqje2up1Y1p7vuV//14En:251peeFuE8Aqju0jFjenw7WVX1j
MD5:	892C3A800773081A9110542550B11EA4
SHA1:	A9D593E2FA8A59D4F4425DD7679B3D600B47D3F9
SHA-256:	03EEA05D4F15377229E49E38887D2B2BE57E80988FF9741F15F4A6C1EF377562
SHA-512:	68C3021FC86328473A45A56AAE1FF0207956C72392036DB6B4CD67803C701C61B686F925C527DFDAE1A1F98806C10C4A107949113E0306720B699844C97D6999
Malicious:	false
Preview:	........(.....Z`.O.K.$...?..-.{P./.;.T.x............`...................................DataDirect ODBC Driver Pack.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\craxdrt.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5206077
Entropy (8bit):	6.315774370780597
Encrypted:	false
SSDEEP:	98304:LSZEWBxyRHvEK6Y/aZ8HhzAhCpmwks9XiyINsv:8zoRHvE8/i0wzwlssv
MD5:	557903CB9179A5A8CFA6B852049E3884
SHA1:	CDB5AEDA1D9E08E9A3AEE6CA58E0542571050680
SHA-256:	F4E3E3B0699A3F80B7911C64AB17A74F8018B456DCA94A4F5F936B7A7F268466
SHA-512:	77537EACF5D8204C998FA3731FB345C2439DE5672D5C256520BC731F8A8C4937E7F7D7E3A42BFD79E7E401375083F7E5706A24AB97B1D3E1FCEFD9F252AC39FF
Malicious:	false
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.............C...C...C..C...C..C...C..C...C...C...C..C...C...C...C...C...C...C...C...C...C..C...C..C...C...C3..Cl..C...Cl..C..C...C...C...C...CT..C...Cl..C...CRich...C........................PE..L.....g>...........!......4..@......cS1.......4...............................O......................................=.....p.=.......?.......................K..w....4...............................................4.\|............................text.....4.......4................. ..`.rdata........4.......4.............@..@.data........@=.. ...@=.............@..._CODE...P....>..0...`>.............@....rsrc.........?.......>.............@..@.reloc..2.....K......pK.............@..B................................................................................................................................................................................................

C:\Windows\SysWOW64\crtslv.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49223
Entropy (8bit):	4.109718425650408
Encrypted:	false
SSDEEP:	768:+ccYopyfE7saYHK54TbAG9sAiw6SlglrtA:ZcYop1gaYO4oG9sAu/rA
MD5:	9B7EB9FB8DF4F52965CBC4808EA5062D
SHA1:	5D516D6F766A1911C7F1AFCC9B71A2A90F426B02
SHA-256:	30BA60E53FACB1F6AB703108688CE281DFEBEAE01A203DE0D800EC6DE5089538
SHA-512:	C69D998736D2F6CCF515D35436EE0CCC32403F0A6A0E22F28CCCBAF837D65D027E5470DC5805A02ED599DFDC32B113CB394EACBBDBD4B5879EC2C30805D55304
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......uFq.1'..1'..1'...;..4'..0...3'..g8..9'..1'..)'..S8..4'..n...4'...!..0'......0'..Rich1'..................PE..L..._.{:...........!.....@...p.......1.......P......................................"...............................PV.......S..d....p...3......................0....P..........................................h....P...............................text...E1.......@.................. ..`.rdata.......P.......P..............@..@.data...l....`.......`..............@....rsrc....3...p...@...p..............@..@.reloc..............................@..BN_.P0......N=...V\|)LG....sXNQ...z.[J^...........KERNEL32.dll.NTDLL.DLL.ole32.dll.OLEAUT32.dll.ATL.DLL...........................................................................................................................................................................................................................

C:\Windows\SysWOW64\crviewer.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	734504
Entropy (8bit):	6.288077088983874
Encrypted:	false
SSDEEP:	12288:nLC3ZqLXl9ZZVvBMISsHHGg17SnXR2HKg/AggAVKBHFEWl:nLIZKXfVvGaGg1mnX8agDy2Wl
MD5:	7AADDC7C334AE959674073439FA92FE3
SHA1:	ABFD7C6ACCE89009D85C619E91010C307E2C06FA
SHA-256:	C0DB8920AC1E460EE34313829245D2F05F2D71617C69F6B568C5C921747E62F2
SHA-512:	FB0BDC3B495C3541AA5DF5D50C020A377F7C024727C95953984B2DA184091AD0FDE9D2B03D7E5AA2D86C8F454EA484ED16741353123E23CC8D9A35624139A277
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O.u...&...&...&.2.&...&^2.&...&.1.&...&.1.&J..&...&...&.1.&...&51.&...&...&...&...&./.&.1.&...&...&...&.(.&...&"..&...&Rich...&................PE..L...'.G>...........!................Q..............`.........................P.......\|..............................P.......$........`..pE..........@ ...........v.......................................................... ........................text............................... ..`.rdata..............................@..@.data............p..................@....rsrc...pE...`...P...0..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\crwrap32.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	5.764637632023211
Encrypted:	false
SSDEEP:	1536:5a/5Ni0La7Q4JpxsxrkVE55QbK/kglgp8P7M:k/580La7jJpqxrk4/LlgKPo
MD5:	6AF7E771B815A4CEBCB57214B049CE52
SHA1:	99935155D7C4E5693884F1E46955180437070296
SHA-256:	F87575DB6FFCBE1C170A803EA3979D9885A4F13665BCE5DA44FEF5199A9C82B7
SHA-512:	F7765C85F2A5517B2974F26B06794D154F75E8F66589045C6DEEFA99CFF65C6406630A45F057CA1A696AA65B40463E137338C2F1CB4AA047099C3B1B2D7D9F7D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l..............`..O.....L.....Rich...........PE..L....T.8...........!................`:............nB.................................M.................................._...p...P....`.......................p..........................................................4............................text.............................. ..`.rdata..?...........................@..@.data...........:..................@....rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\exlate32.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	675897
Entropy (8bit):	6.33183612141127
Encrypted:	false
SSDEEP:	6144:szNfL5Tx1o6Ky/9vCgchDAhy6Q0KQ7a3spjQ91fsu6UyepsMtt2+cH9ofSNXczFw:sDR5y0hy6aOa3spjQ9lmMEoqxchYIo
MD5:	CD98432FDB8E13C7C5A940C01D3CCE77
SHA1:	B4C5C3979883252DDBD4534CBB09F2D80F82F3D3
SHA-256:	86C6FFBC5463F3A3410BA18B192556BE39ACC1D99CEC94783A5A9A38610B3CC4
SHA-512:	1AC21A31E613C6D3D0518B3A497364BBEFFB33439F21A8D83A62D25123F4EBCA3A8D3BEF371B09187027BD5D84BBB9DEF7942FDB6B1A51A91F7F426BF1009A54
Malicious:	false
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$........=Y.V\7.V\7.V\7.C<.U\7.-@;.T\7..C$.U\7.V\7.Q\7.9C<.U\7..@9.U\7.9C=.R\7.9C3.T\7./}<.U\7./}3.T\7.\|<.Z\7.\|=..\7.V\6.^7.4C$.E\7.P.=.T\7.P.<.y\7.Z1.W\7.\|3.W\7.RichV\7.........................PE..L...e6.?...........!.........`...............................................`.......................................D......$6...................................T...........................................................5..@....................text...N........................... ..`.rdata...U.......`..................@..@.data........P.......P..............@..._CODE...p...........................@....rsrc...............................@..@.reloc..p...........................@..B................................................................................................................................................................................................

C:\Windows\SysWOW64\p2sodbc.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	307200
Entropy (8bit):	6.022609410600443
Encrypted:	false
SSDEEP:	6144:FpQDKIhkfJxWbuqzTZSDS03HSWAuV0W+td9x/LJL:FpQDKIhkfJxWiMTZSDS03yWAuV0BrH/R
MD5:	8394AF480C146EC7F7A554EA1FB8E9C4
SHA1:	C44B3BD7D524A0F37D1171F4066C7BD0AA7E3CF9
SHA-256:	73EE0E2B4822A03136B18AB32C951CFC5E7C68A40B046B82E68B1B156582FC18
SHA-512:	7E7BB50BFDDF3B69813F4A87DCBFC76A6A3DCCCD6CC9F459DCD56A222EF82C980B5B5A900293CE8A6DBDB1C68483443726D4834886AFB067A1A009B875D03E1C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........oa8...k...k...k...k...kP..k...k...k...k...k...k...k...k...k...k...k...k...k...k.-.k...k...k...k,..k...kRich...k........................PE..L....Q.>...........!.......................................................................................................p........ ...S......................4....................................................................................text...;........................... ..`.rdata........... ..................@..@.data....+.......0..................@....rsrc....S... ...`... ..............@..@.reloc..X .......0..................@..B................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\pg32conv.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	100352
Entropy (8bit):	6.01574608255945
Encrypted:	false
SSDEEP:	1536:W0/GIQTIfT9Q2qEB+Jk3gC7UfPnJQBJHl8UPif4xStOgkM:NGg98fC43nuBBGU+4
MD5:	59B610DF85409A13832B9B5B807DA4FE
SHA1:	FADFCE97D3D9F6935D5F6A4ACA53232D733AB4C6
SHA-256:	369C08452CE18AA2894442F63C524C4F8DB416F12D86E624099BE61DAD9F2F98
SHA-512:	117D144807C1BC38858859F8417CE69597FDF3B3FAF28D5567ECA58A84CBAC292C87EB54840E8DAC9A0F3CD66F755CE8CB31BC30D78B01A47B09FAA1C2C8B73C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Nb#P/.pP/.pP/.pP/.p./.p.).pQ/.p.3.pL/.pRichP/.p........................PE..L....V.7...........!.................$.......0.......................................[..............................p5..f....1..d...............................................................................X....0...............................text...P........................... ..`.rdata.......0......................@..@.data...xt...@...D...*..............@....rsrc................n..............@..@.reloc...............p..............@..BN_.P(.../.[J5.....[J@...4..NJ...........KERNEL32.dll.USER32.dll.GDI32.dll.MSVCRT.dll............................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\sscsdk80.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1179648
Entropy (8bit):	6.521473588938597
Encrypted:	false
SSDEEP:	24576:Xm2hiJswkzSpq5Z3jVecFRe+2x3sK6Ms203zviblO8kqO5NnibsBfhUy:X8kQsIOvfhUy
MD5:	D2D3AB42E0FB3AFA8FF6AA9E965D9595
SHA1:	34F244003EF1D43209823CDD946F801AE7A85466
SHA-256:	5AC379FCFBDA3F8DB51CA02BE2C509BD057F17690359F09D4CBB292A67572D6A
SHA-512:	80D468D7495C44988FB655E824575C0DA5ED38FD8A88141FDED106029057E66609CA2E1FF3BA55B0D429FFD737E401F32857A3C92EBCC2ADF97D0B8C49EFEC76
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w..q3.r"3.r"3.r"n.y"0.r"..\|"..r"n.x"..r"Q.a"?.r"3.s"5.r"3.r"5.r"..p"7.r"l.y"#.r"l.x"..r"..t"2.r".v"2.r"Rich3.r"........PE..L...R(i>...........!.........@......<......................................................................................$........P..`$.......................b...................................................................................text............................... ..`.rdata..............................@..@.data..............................@....rsrc...`$...P...0...`..............@..@.reloc..^o.......p..................@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\myah0.cpl

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1016832
Entropy (8bit):	5.979344965125846
Encrypted:	false
SSDEEP:	12288:2GBRhi9pc8mQQoBc8wwA21kOR3kkkZkkIkwkpL88888F888nr8H8J28c9fsxkkKO:Px+r
MD5:	A5646553AE51847135D436820C1F21C1
SHA1:	F8601BC366E964DBA7F57C71278F451E2A5E49DA
SHA-256:	740F122FE9707BD4A90048C75B1EB79C86B1B7E852B866517721D2F91CF646C5
SHA-512:	04E97E2120A4805DCABEE5F3E03AFB1DA3646803F86461DD826A44BB39B99DB3E2600A2F4C24A51450F976660B02DC97C0F7FC349A8E38B131C49E56BF5E1F35
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..d......T.........." ................ .........@..............................p....................................... ..................E.......p............0...z...............f..............................................................h....................text............................... ..`.data...............................@....bss.....................................idata..p........ ..................@....didata.h...........................@....edata..E...........................@..@.reloc...f.......h..................@..B.pdata...z...0...\|...T..............@..@.rsrc...............................@..@.............p......................@..@................................................................................

C:\Windows\Temp\~DF0DBCDAA7D691A867.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.8458016767218735
Encrypted:	false
SSDEEP:	96:phN1njTBIQT8lMTwCRmz8e/mqscIXbcP91GxbOVe:B1j1lgIw94JrcF1He
MD5:	2CBE48090A32907839EDAAA12EE842C5
SHA1:	C9B79A3301B785C484C1A4A48B8D87DEFAEA254F
SHA-256:	A0B21961655F544827406261D82098D06966DC8B2E2E03AFC64945770A8818DC
SHA-512:	3A297560844A7554E4E9F2EAB3EC51CFB4F928B937B88C0D68643CE9E143A1F3D4665C2695FFC04616E77C4FCEDC7B1CAC0624CF97E3934B2C65384F2953EE00
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF21056429D4E536DA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	2.5051268931010933
Encrypted:	false
SSDEEP:	384:T2qI4JIF0lo3Bguf9bsoHcDWpO/D6gsTJJl:iWgXeMOL6TT
MD5:	B8BB9180F4C0D406CE7C0E356581FD2C
SHA1:	8FD5E56E1697ECEA45B436DBDD478CD15D562CEE
SHA-256:	F2B9B82746117BAC316A576C5BCFF1261A3958DE46F04F0E90630C4265DA665D
SHA-512:	05209DA339E96A43C90CCA9E5ED4B2D6464794DD7CD8C58334D793FA15D336D02908F12BD519AEC3B3137793D4C5EB98BE152EDC6E26ADC593F41934DF47C22F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2FFB292567EF379A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF396B15861AF051CA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	1.7244311475997964
Encrypted:	false
SSDEEP:	384:yI4JIFgJJlalo3Bguf9bsoHcDWpO/D6gs:eFrXeMOL6T
MD5:	8A645F5B556AAD24360ED7CFB5AEDE8B
SHA1:	CC141296A67129A5DD58DE9DD2ABDC7491AAFB8C
SHA-256:	04D380B6C80D9531CB7D2FF5C9DECF26D467014B055BBE346B45DD468D0838F8
SHA-512:	8B765EC2A84954BFDE167FDBB66C58A34B7CED3083026F403D88142E8FBCF9F55E46BB47DA7C7E78BBBCA1EDEB9F78C55650C891CCA763E38DD7B509991DA2C3
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF65480E27678CB11B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	2.5051268931010933
Encrypted:	false
SSDEEP:	384:T2qI4JIF0lo3Bguf9bsoHcDWpO/D6gsTJJl:iWgXeMOL6TT
MD5:	B8BB9180F4C0D406CE7C0E356581FD2C
SHA1:	8FD5E56E1697ECEA45B436DBDD478CD15D562CEE
SHA-256:	F2B9B82746117BAC316A576C5BCFF1261A3958DE46F04F0E90630C4265DA665D
SHA-512:	05209DA339E96A43C90CCA9E5ED4B2D6464794DD7CD8C58334D793FA15D336D02908F12BD519AEC3B3137793D4C5EB98BE152EDC6E26ADC593F41934DF47C22F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7E2046DBF29FF208.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7F06595C714478DB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF889A498429E30775.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	2.2933591730497103
Encrypted:	false
SSDEEP:	96:fnCaccxfVxNspq+9L3UXvbTllARl9SvR3cjVJY65B8iC+4sObNmh7gi1Iq+Y+:fCaJxPNN+yXv692R+VJYwMvbUhh1I7Z
MD5:	7ED245F5CB194D528BF9B2B885A7EB9C
SHA1:	00DD2F5385C2E84AF9105D4516CA11E830E18434
SHA-256:	FD36EA9FC84F7EEAEAC147A8993BCD3E9946774F5A6806EE10969316E7F2A252
SHA-512:	0CA3EEA06DAFA7E25508089E4B742620F05BB14455F3E32EA76C7C178EEF6B790C7A1CF9E7E74565D9F61B611DC2BF622DC894F418ED99B29008FF1E3BBA57F8
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9EF3A9B356BDE032.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB80EEA1B2812EB52.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC18711B8AF07CEFC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.8458016767218735
Encrypted:	false
SSDEEP:	96:phN1njTBIQT8lMTwCRmz8e/mqscIXbcP91GxbOVe:B1j1lgIw94JrcF1He
MD5:	2CBE48090A32907839EDAAA12EE842C5
SHA1:	C9B79A3301B785C484C1A4A48B8D87DEFAEA254F
SHA-256:	A0B21961655F544827406261D82098D06966DC8B2E2E03AFC64945770A8818DC
SHA-512:	3A297560844A7554E4E9F2EAB3EC51CFB4F928B937B88C0D68643CE9E143A1F3D4665C2695FFC04616E77C4FCEDC7B1CAC0624CF97E3934B2C65384F2953EE00
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD0DEE3EE06F02025.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	2.5051268931010933
Encrypted:	false
SSDEEP:	384:T2qI4JIF0lo3Bguf9bsoHcDWpO/D6gsTJJl:iWgXeMOL6TT
MD5:	B8BB9180F4C0D406CE7C0E356581FD2C
SHA1:	8FD5E56E1697ECEA45B436DBDD478CD15D562CEE
SHA-256:	F2B9B82746117BAC316A576C5BCFF1261A3958DE46F04F0E90630C4265DA665D
SHA-512:	05209DA339E96A43C90CCA9E5ED4B2D6464794DD7CD8C58334D793FA15D336D02908F12BD519AEC3B3137793D4C5EB98BE152EDC6E26ADC593F41934DF47C22F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\tmp\log\installs\CF_Remote\install.log

Download File

Process:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	19181
Entropy (8bit):	4.784782241126021
Encrypted:	false
SSDEEP:	96:bvxaPaPbQDsxJ/bOss+syQasqkH3KkgXgvftgkPaPp+vT3hP5q5mEyVPhmG/ki5+:1r+DqAw77K4qjqbLt5J91PEw7vzx
MD5:	E1707642142C10170CCB12BFB34EB9CD
SHA1:	B35514BF6BCB43B84F4208D9286730D4EE64DA9F
SHA-256:	ABA06E2A02FDB22D784F985191B8426F5B3CD80D69555E7A1855CB804A47A5EF
SHA-512:	3D94DDB047C00F00D2D14F29B9528E896492804B722B13AAF117061C0476230213238DA372235AB12E690601733A0562A86844DF1C1E497A22714D53B876A510
Malicious:	false
Preview:	.08/08/2024-19:20:03 \| Check for Microsoft Windows Installer 2.0..08/08/2024-19:20:03 \| Check for VB6..08/08/2024-19:20:03 \| Define Setup Globals..08/08/2024-19:20:03 \| First Time Install..08/08/2024-19:20:03 \| Welcome Dialog..08/08/2024-19:20:08 \| License Check..08/08/2024-19:20:08 \| ReadMe Information..08/08/2024-19:20:08 \| User Registration..08/08/2024-19:20:08 \| Setup Type..08/08/2024-19:20:08 \| Custom Setup..08/08/2024-19:20:08 \| Destination Directory..08/08/2024-19:20:08 \| Start Menu..08/08/2024-19:20:08 \| Start Installation..08/08/2024-19:20:08 \| Prepair Install..08/08/2024-19:20:08 \| APP variable equals CF_Remote..08/08/2024-19:20:09 \| Install Crystal..08/08/2024-19:20:09 \| Install CF Remote..08/08/2024-19:20:09 \| Install CF Remote dlls..08/08/2024-19:20:12 \| Create Folders..08/08/2024-19:20:12 \| Create Shortcuts..08/08/2024-19:20:12 \| Before - Apply Install..08/08/2024-19:20:29 \| After - Apply Install: COMPLETE - ..08/08/2024-19:20:29 \| CRUTL15.DLL - Setup Version: 15.0.0.2

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.994170806029125
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% InstallShield setup (43055/19) 0.43% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	cfrv_4_0_setup_ALL.exe
File size:	14'277'760 bytes
MD5:	9197aeadf996dd8cd3885a205927671e
SHA1:	3bf1368b4dae680e580d3958299f9636e255cba8
SHA256:	94e6740812caeb857ef6065984ab4138d56ad4b517c62f2611f303eab519676c
SHA512:	d9709a22c65f95f495d85dc8eb2f686ef1d7d67cb52d36f88c8304668ad91f049495adb1e16dc815297b57127a8dbfccc50fa1a5de334bc7ccc215e35ab1d6a4
SSDEEP:	196608:boV3MNPhVz6u87cGPfIjRHaiBsvZTkqUlrRqFRLRCLWE6UwN3dmjABs3lav9HAjs:u0PhVPfjVaLyrEFRLRCrfwBjUa8J+
TLSH:	E6E6335067EA8260F0FB3B751DB8A6A84937FC259734E1CF8299051EDE72AC19C74327
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ew..............\|.......\|.......\|........t.......b..............\|.......V.......\|......Rich............................PE..L..

File Icon


Icon Hash:	46165f4553a1f271

Static PE Info

General

Entrypoint:	0x422c58
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x62E46D6B [Fri Jul 29 23:29:47 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	b48671fed9d5ca4906417d42fcdb066b

Entrypoint Preview

Instruction
call 00007FDB946C9449h
jmp 00007FDB946C4B7Dh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [0043E4B8h], eax
mov dword ptr [0043E4B4h], ecx
mov dword ptr [0043E4B0h], edx
mov dword ptr [0043E4ACh], ebx
mov dword ptr [0043E4A8h], esi
mov dword ptr [0043E4A4h], edi
mov word ptr [0043E4D0h], ss
mov word ptr [0043E4C4h], cs
mov word ptr [0043E4A0h], ds
mov word ptr [0043E49Ch], es
mov word ptr [0043E498h], fs
mov word ptr [0043E494h], gs
pushfd
pop dword ptr [0043E4C8h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0043E4BCh], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [0043E4C0h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0043E4CCh], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [0043E408h], 00010001h
mov eax, dword ptr [0043E4C0h]
mov dword ptr [0043E3BCh], eax
mov dword ptr [0043E3B0h], C0000409h
mov dword ptr [0043E3B4h], 00000001h
mov eax, dword ptr [0043C024h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [0043C028h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000BCh]

Rich Headers

Programming Language:

[C++] VS2008 SP1 build 30729
[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3a5d8	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x45000	0x15748	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x35200	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x32000	0x284	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x302ed	0x30400	2038b7d87842b64c67b899ba5e78dc0d	False	0.5152303270725389	data	6.494109860999288	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x32000	0x93e8	0x9400	9065fae2bc62d08ab84e542ac170dd32	False	0.34588788006756754	data	4.655429443140589	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3c000	0x8400	0x2400	3b1c2c3bd274b21289a8012d58d091b2	False	0.2587890625	data	4.215578104820278	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x45000	0x15748	0x15800	b5e79db393609dd64cce69fe68a8673e	False	0.04630723110465116	data	3.441131579787985	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x45c54	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.46639784946236557
RT_ICON	0x45f3c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.6216216216216216
RT_DIALOG	0x46064	0x1d8	data			0.5720338983050848
RT_DIALOG	0x4623c	0x1be	data			0.5605381165919282
RT_DIALOG	0x463fc	0x54	data			0.7619047619047619
RT_STRING	0x46450	0x4a4	data	Arabic	Saudi Arabia	0.28703703703703703
RT_STRING	0x468f4	0x4a4	data	Catalan	Spain	0.28703703703703703
RT_STRING	0x46d98	0x4a4	data	Chinese	Taiwan	0.28703703703703703
RT_STRING	0x4723c	0x4a4	data	Czech	Czech Republic	0.28703703703703703
RT_STRING	0x476e0	0x4a4	data	Danish	Denmark	0.28703703703703703
RT_STRING	0x47b84	0x4a4	data	German	Germany	0.28703703703703703
RT_STRING	0x48028	0x4a4	data	Greek	Greece	0.28703703703703703
RT_STRING	0x484cc	0x4a4	data	English	United States	0.28703703703703703
RT_STRING	0x48970	0x4a4	data	Finnish	Finland	0.28703703703703703
RT_STRING	0x48e14	0x4a4	data	French	France	0.28703703703703703
RT_STRING	0x492b8	0x4a4	data	Hebrew	Israel	0.28703703703703703
RT_STRING	0x4975c	0x4a4	data	Hungarian	Hungary	0.28703703703703703
RT_STRING	0x49c00	0x4a4	data	Italian	Italy	0.28703703703703703
RT_STRING	0x4a0a4	0x4a4	data	Japanese	Japan	0.28703703703703703
RT_STRING	0x4a548	0x4a4	data	Korean	North Korea	0.28703703703703703
RT_STRING	0x4a548	0x4a4	data	Korean	South Korea	0.28703703703703703
RT_STRING	0x4a9ec	0x4a4	data	Dutch	Netherlands	0.28703703703703703
RT_STRING	0x4ae90	0x4a4	data	Norwegian	Norway	0.28703703703703703
RT_STRING	0x4b334	0x4a4	data	Polish	Poland	0.28703703703703703
RT_STRING	0x4b7d8	0x4a4	data	Portuguese	Brazil	0.28703703703703703
RT_STRING	0x4bc7c	0x4a4	data	Romanian	Romania	0.28703703703703703
RT_STRING	0x4c120	0x4a4	data	Russian	Russia	0.28703703703703703
RT_STRING	0x4c5c4	0x4a4	data	Croatian	Croatia	0.28703703703703703
RT_STRING	0x4ca68	0x4a4	data	Slovak	Slovakia	0.28703703703703703
RT_STRING	0x4cf0c	0x4a4	data	Swedish	Sweden	0.28703703703703703
RT_STRING	0x4d3b0	0x4a4	data	Thai	Thailand	0.28703703703703703
RT_STRING	0x4d854	0x4a4	data	Turkish	Turkey	0.28703703703703703
RT_STRING	0x4dcf8	0x4a4	data	Slovenian	Slovenia	0.28703703703703703
RT_STRING	0x4e19c	0x4a4	data	Estonian	Estonia	0.28703703703703703
RT_STRING	0x4e640	0x4a4	data	Latvian	Lativa	0.28703703703703703
RT_STRING	0x4eae4	0x4a4	data	Lithuanian	Lithuania	0.28703703703703703
RT_STRING	0x4ef88	0x4a4	data	Vietnamese	Vietnam	0.28703703703703703
RT_STRING	0x4f42c	0x4a4	data	Basque	France	0.28703703703703703
RT_STRING	0x4f42c	0x4a4	data	Basque	Spain	0.28703703703703703
RT_STRING	0x4f8d0	0x4a4	data	Chinese	China	0.28703703703703703
RT_STRING	0x4fd74	0x4a4	data	Portuguese	Portugal	0.28703703703703703
RT_STRING	0x50218	0x4a4	data			0.28703703703703703
RT_STRING	0x506bc	0x2f2	data	Arabic	Saudi Arabia	0.42572944297082227
RT_STRING	0x509b0	0x2f2	data	Catalan	Spain	0.42572944297082227
RT_STRING	0x50ca4	0x2f2	data	Chinese	Taiwan	0.42572944297082227
RT_STRING	0x50f98	0x2f2	data	Czech	Czech Republic	0.42572944297082227
RT_STRING	0x5128c	0x2f2	data	Danish	Denmark	0.42572944297082227
RT_STRING	0x51580	0x2f2	data	German	Germany	0.42572944297082227
RT_STRING	0x51874	0x2f2	data	Greek	Greece	0.42572944297082227
RT_STRING	0x51b68	0x2f2	data	English	United States	0.42572944297082227
RT_STRING	0x51e5c	0x2f2	data	Finnish	Finland	0.42572944297082227
RT_STRING	0x52150	0x2f2	data	French	France	0.42572944297082227
RT_STRING	0x52444	0x2f2	data	Hebrew	Israel	0.42572944297082227
RT_STRING	0x52738	0x2f2	data	Hungarian	Hungary	0.42572944297082227
RT_STRING	0x52a2c	0x2f2	data	Italian	Italy	0.42572944297082227
RT_STRING	0x52d20	0x2f2	data	Japanese	Japan	0.42572944297082227
RT_STRING	0x53014	0x2f2	data	Korean	North Korea	0.42572944297082227
RT_STRING	0x53014	0x2f2	data	Korean	South Korea	0.42572944297082227
RT_STRING	0x53308	0x2f2	data	Dutch	Netherlands	0.42572944297082227
RT_STRING	0x535fc	0x2f2	data	Norwegian	Norway	0.42572944297082227
RT_STRING	0x538f0	0x2f2	data	Polish	Poland	0.42572944297082227
RT_STRING	0x53be4	0x2f2	data	Portuguese	Brazil	0.42572944297082227
RT_STRING	0x53ed8	0x2f2	data	Romanian	Romania	0.42572944297082227
RT_STRING	0x541cc	0x2f2	data	Russian	Russia	0.42572944297082227
RT_STRING	0x544c0	0x2f2	data	Croatian	Croatia	0.42572944297082227
RT_STRING	0x547b4	0x2f2	data	Slovak	Slovakia	0.42572944297082227
RT_STRING	0x54aa8	0x2f2	data	Swedish	Sweden	0.42572944297082227
RT_STRING	0x54d9c	0x2f2	data	Thai	Thailand	0.42572944297082227
RT_STRING	0x55090	0x2f2	data	Turkish	Turkey	0.42572944297082227
RT_STRING	0x55384	0x2f2	data	Slovenian	Slovenia	0.42572944297082227
RT_STRING	0x55678	0x2f2	data	Estonian	Estonia	0.42572944297082227
RT_STRING	0x5596c	0x2f2	data	Latvian	Lativa	0.42572944297082227
RT_STRING	0x55c60	0x2f2	data	Lithuanian	Lithuania	0.42572944297082227
RT_STRING	0x55f54	0x2f2	data	Vietnamese	Vietnam	0.42572944297082227
RT_STRING	0x56248	0x2f2	data	Basque	France	0.42572944297082227
RT_STRING	0x56248	0x2f2	data	Basque	Spain	0.42572944297082227
RT_STRING	0x5653c	0x2f2	data	Chinese	China	0.42572944297082227
RT_STRING	0x56830	0x2f2	data	Portuguese	Portugal	0.42572944297082227
RT_STRING	0x56b24	0x2f2	data			0.42572944297082227
RT_STRING	0x56e18	0x106	data	Arabic	Saudi Arabia	0.5076335877862596
RT_STRING	0x56f20	0x106	data	Catalan	Spain	0.5076335877862596
RT_STRING	0x57028	0x106	data	Chinese	Taiwan	0.5076335877862596
RT_STRING	0x57130	0x106	data	Czech	Czech Republic	0.5076335877862596
RT_STRING	0x57238	0x106	data	Danish	Denmark	0.5076335877862596
RT_STRING	0x57340	0x106	data	German	Germany	0.5076335877862596
RT_STRING	0x57448	0x106	data	Greek	Greece	0.5076335877862596
RT_STRING	0x57550	0x106	data	English	United States	0.5076335877862596
RT_STRING	0x57658	0x106	data	Finnish	Finland	0.5076335877862596
RT_STRING	0x57760	0x106	data	French	France	0.5076335877862596
RT_STRING	0x57868	0x106	data	Hebrew	Israel	0.5076335877862596
RT_STRING	0x57970	0x106	data	Hungarian	Hungary	0.5076335877862596
RT_STRING	0x57a78	0x106	data	Italian	Italy	0.5076335877862596
RT_STRING	0x57b80	0x106	data	Japanese	Japan	0.5076335877862596
RT_STRING	0x57c88	0x106	data	Korean	North Korea	0.5076335877862596
RT_STRING	0x57c88	0x106	data	Korean	South Korea	0.5076335877862596
RT_STRING	0x57d90	0x106	data	Dutch	Netherlands	0.5076335877862596
RT_STRING	0x57e98	0x106	data	Norwegian	Norway	0.5076335877862596
RT_STRING	0x57fa0	0x106	data	Polish	Poland	0.5076335877862596
RT_STRING	0x580a8	0x106	data	Portuguese	Brazil	0.5076335877862596
RT_STRING	0x581b0	0x106	data	Romanian	Romania	0.5076335877862596
RT_STRING	0x582b8	0x106	data	Russian	Russia	0.5076335877862596
RT_STRING	0x583c0	0x106	data	Croatian	Croatia	0.5076335877862596
RT_STRING	0x584c8	0x106	data	Slovak	Slovakia	0.5076335877862596
RT_STRING	0x585d0	0x106	data	Swedish	Sweden	0.5076335877862596
RT_STRING	0x586d8	0x106	data	Thai	Thailand	0.5076335877862596
RT_STRING	0x587e0	0x106	data	Turkish	Turkey	0.5076335877862596
RT_STRING	0x588e8	0x106	data	Slovenian	Slovenia	0.5076335877862596
RT_STRING	0x589f0	0x106	data	Estonian	Estonia	0.5076335877862596
RT_STRING	0x58af8	0x106	data	Latvian	Lativa	0.5076335877862596
RT_STRING	0x58c00	0x106	data	Lithuanian	Lithuania	0.5076335877862596
RT_STRING	0x58d08	0x106	data	Vietnamese	Vietnam	0.5076335877862596
RT_STRING	0x58e10	0x106	data	Basque	France	0.5076335877862596
RT_STRING	0x58e10	0x106	data	Basque	Spain	0.5076335877862596
RT_STRING	0x58f18	0x106	data	Chinese	China	0.5076335877862596
RT_STRING	0x59020	0x106	data	Portuguese	Portugal	0.5076335877862596
RT_STRING	0x59128	0x106	data			0.5076335877862596
RT_GROUP_ICON	0x59230	0x22	data	English	United States	0.9705882352941176
RT_VERSION	0x59254	0x1084	data	English	United States	0.09649952696310313
RT_MANIFEST	0x5a2d8	0x470	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4507042253521127

Imports

DLL	Import
KERNEL32.dll	GetLastError, ResetEvent, CreateEventW, CloseHandle, MultiByteToWideChar, WideCharToMultiByte, FreeLibrary, LoadLibraryW, GetModuleFileNameW, FormatMessageW, LocalFree, GetWindowsDirectoryW, CreateFileW, SetFileTime, SetFileAttributesW, RemoveDirectoryW, CreateDirectoryW, GetFileInformationByHandle, DeleteFileW, GetShortPathNameW, GetFullPathNameW, lstrlenW, GetCurrentDirectoryW, GetTempFileNameW, FindClose, FindFirstFileW, FindNextFileW, GetFileSize, SetFilePointer, ReadFile, WriteFile, SetEndOfFile, DeleteCriticalSection, GetStdHandle, EnterCriticalSection, LeaveCriticalSection, WaitForMultipleObjects, GetCurrentProcessId, InitializeCriticalSection, QueryPerformanceCounter, GetTickCount, Sleep, LocalAlloc, GetProcAddress, SetCurrentDirectoryW, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, SetThreadUILanguage, SetThreadLocale, GetVersion, GetCommandLineW, CreateProcessW, GetExitCodeProcess, FlushFileBuffers, CreateFileA, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, SetStdHandle, LCMapStringW, LCMapStringA, GetStringTypeW, GetStringTypeA, GetConsoleMode, GetConsoleCP, GetLocaleInfoA, IsValidCodePage, GetOEMCP, RaiseException, GetACP, GetCPInfo, LoadLibraryA, RtlUnwind, InitializeCriticalSectionAndSpinCount, GetSystemTimeAsFileTime, WaitForSingleObject, SetEvent, GetVersionExW, VirtualAlloc, GetCurrentThreadId, VirtualFree, GetFileType, SetHandleCount, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, HeapSize, InterlockedDecrement, SetLastError, InterlockedIncrement, TlsFree, TlsSetValue, TlsAlloc, HeapFree, HeapAlloc, ExitThread, CreateThread, HeapReAlloc, GetCommandLineA, GetStartupInfoA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapCreate, GetModuleHandleW, ExitProcess, GetModuleFileNameA, TlsGetValue
USER32.dll	SetForegroundWindow, CharUpperW, GetWindowRect, DestroyWindow, RegisterWindowMessageW, AdjustWindowRect, LoadImageW, LoadIconW, KillTimer, SetTimer, EndDialog, IsDlgButtonChecked, SetDlgItemTextW, GetDlgItem, SetWindowTextW, GetWindowTextW, GetWindowTextLengthW, LoadStringW, DialogBoxParamW, CreateDialogParamW, SystemParametersInfoW, PeekMessageW, GetDesktopWindow, MessageBoxW, SendMessageW, GetWindowLongW, SetWindowLongW, ShowWindow, MoveWindow, PostMessageW
GDI32.dll	GetObjectW
ADVAPI32.dll	RegSetValueExW, RegCreateKeyExW, RegCloseKey
SHELL32.dll	SHGetFolderPathW, ShellExecuteExW
ole32.dll	CoInitializeEx, CoInitialize, CoCreateInstance
OLEAUT32.dll	SysAllocStringLen, SysFreeString, VariantClear, SysAllocString

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Arabic	Saudi Arabia
Catalan	Spain
Chinese	Taiwan
Czech	Czech Republic
Danish	Denmark
German	Germany
Greek	Greece
Finnish	Finland
French	France
Hebrew	Israel
Hungarian	Hungary
Italian	Italy
Japanese	Japan
Korean	North Korea
Korean	South Korea
Dutch	Netherlands
Norwegian	Norway
Polish	Poland
Portuguese	Brazil
Romanian	Romania
Russian	Russia
Croatian	Croatia
Slovak	Slovakia
Swedish	Sweden
Thai	Thailand
Turkish	Turkey
Slovenian	Slovenia
Estonian	Estonia
Latvian	Lativa
Lithuanian	Lithuania
Vietnamese	Vietnam
Chinese	China
Portuguese	Portugal

Target ID:	0
Start time:	19:19:52
Start date:	08/08/2024
Path:	C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\cfrv_4_0_setup_ALL.exe"
Imagebase:	0x400000
File size:	14'277'760 bytes
MD5 hash:	9197AEADF996DD8CD3885A205927671E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:20:00
Start date:	08/08/2024
Path:	C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe
Wow64 process (32bit):	true
Commandline:	.\cfrv_4_0_setup_ALL.exe /m="C:\Users\user\Desktop\CFRV_4~1.EXE" /k=""
Imagebase:	0x400000
File size:	5'675'007 bytes
MD5 hash:	3B2D532673D1567116105D04C621CDBA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000001.00000000.1800575548.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\miaE495.tmp\cfrv_4_0_setup_ALL.exe, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:20:09
Start date:	08/08/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\mscomctl.ocx" /s
Imagebase:	0x6d0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:20:10
Start date:	08/08/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\COMDLG32.OCX" /s
Imagebase:	0x6d0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:20:10
Start date:	08/08/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\COMCT332.OCX" /s
Imagebase:	0x6d0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:20:11
Start date:	08/08/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\regsvr32.exe" "C:\Windows\SysWOW64\TABCTL32.OCX" /s
Imagebase:	0x6d0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:20:11
Start date:	08/08/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\regsvr32.exe" "C:\Program Files (x86)\Common Files\microsoft shared\DAO\DAO350.DLL" /s
Imagebase:	0x6d0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	19:20:11
Start date:	08/08/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_CR_control.dll" /s
Imagebase:	0x6d0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:20:11
Start date:	08/08/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_DB_Connect.dll" /s
Imagebase:	0x6d0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	19:20:12
Start date:	08/08/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_File_Data.dll" /s
Imagebase:	0x6d0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	19:20:12
Start date:	08/08/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_File_Export.dll" /s
Imagebase:	0x6d0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	19:20:12
Start date:	08/08/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\regsvr32.exe" "C:\Windows\NCSBOE\CF_Rmt_DB4_Update.dll" /s
Imagebase:	0x6d0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	19:20:13
Start date:	08/08/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff63bd10000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	19:20:14
Start date:	08/08/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding BC4BF7B426F2DEC97D7EFEF329A7CA50
Imagebase:	0x400000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	19:20:20
Start date:	08/08/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\craxdrt.dll"
Imagebase:	0x400000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	19:20:20
Start date:	08/08/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crviewer.dll"
Imagebase:	0x400000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	19:20:20
Start date:	08/08/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\Crystal\Cdo32.dll"
Imagebase:	0x400000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	19:20:20
Start date:	08/08/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\crtslv.dll"
Imagebase:	0x400000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	19:20:20
Start date:	08/08/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\ExportModeller.dll"
Imagebase:	0x400000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	19:20:22
Start date:	08/08/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\explorer.exe" /separate /root,::{21ec2020-3aea-1069-a2dd-08002b30309d}
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	19:20:22
Start date:	08/08/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12%
Total number of Nodes:	2000
Total number of Limit Nodes:	134

Executed Functions

Function 0041FF60 Relevance: 117.4, APIs: 35, Strings: 31, Instructions: 1866libraryloaderwindowCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll), ref: 0041FF8F
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0041FFA7
GetProcAddress.KERNEL32(00000000,SetDllDirectory), ref: 0041FFBE

Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7

GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 0041FFD1
FreeLibrary.KERNEL32(00000000), ref: 0041FFDC
MessageBoxW.USER32(00000000,024C1528,?,00012010), ref: 00420015
CoInitialize.OLE32(00000000), ref: 00420045
_memset.LIBCMT ref: 00420059
GetVersionExW.KERNEL32 ref: 0042007E
GetCommandLineW.KERNEL32(00000004,00000004,00000004,00000004), ref: 0042013D
_malloc.LIBCMT ref: 004202E1
__CxxThrowException@8.LIBCMT ref: 00420301
MessageBoxW.USER32(00000000,?,?,00000024), ref: 00420916

Part of subcall function 0041EA80: MessageBoxW.USER32(00000000,?,00000000,00012010), ref: 0041EAA0

Part of subcall function 00421DEE: __lock.LIBCMT ref: 00421E0C
Part of subcall function 00421DEE: ___sbh_find_block.LIBCMT ref: 00421E17
Part of subcall function 00421DEE: ___sbh_free_block.LIBCMT ref: 00421E26
Part of subcall function 00421DEE: RtlFreeHeap.NTDLL(00000000,?,00437B30,0000000C,004244D4,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C), ref: 00421E56
Part of subcall function 00421DEE: GetLastError.KERNEL32(?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA,?,?,?,0042458E,0000000D), ref: 00421E67

Strings

setup.exe, xrefs: 004211BD
", xrefs: 0042039F
ExecuteFile, xrefs: 00420A25
-k=, xrefs: 00420368
SetSearchPathMode, xrefs: 0041FFCB
, xrefs: 004203AE
, xrefs: 0042174B
RunProgram, xrefs: 004209DE
Directory, xrefs: 0042089D
runas, xrefs: 00421713
"-k=, xrefs: 00420334
Title, xrefs: 004207F0
, xrefs: 00421086
BeginPrompt, xrefs: 0042081F
Progress, xrefs: 00420851
D, xrefs: 0042154D
ExecuteParameters, xrefs: 00420A6F
%%T, xrefs: 0042130F
%%T\, xrefs: 00421348
"/k=, xrefs: 0042034F
<, xrefs: 004216F6
kernel32.dll, xrefs: 0041FF82
" /k=", xrefs: 00421436, 004215A1
`A, xrefs: 00420E52
<, xrefs: 00420FF6
@E, xrefs: 00421701
/m=", xrefs: 00421450, 004215B8
SetDllDirectory, xrefs: 0041FFB8
mia.lib, xrefs: 00421395
SetDefaultDllDirectories, xrefs: 0041FFA1
/k=, xrefs: 0042037A

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AddressMessageProc$Exception@8FreeLibraryThrow_malloc$CommandErrorHeapInitializeLastLineLoadVersion___sbh_find_block___sbh_free_block__lock_memset
String ID: $ $ $ /m="$"$" /k="$"-k=$"/k=$%%T$%%T\$-k=$/k=$<$<$@E$BeginPrompt$D$Directory$ExecuteFile$ExecuteParameters$Progress$RunProgram$SetDefaultDllDirectories$SetDllDirectory$SetSearchPathMode$Title$`A$kernel32.dll$mia.lib$runas$setup.exe
API String ID: 2774692769-3493990677
Opcode ID: 5dfa002104ee014d5414f4f60ddea48a8ff73199e850730d3e6b6986b97d9c77
Instruction ID: 441557ecdbd4f95e2da424cce832fc79fed486ae06a920805007eef883770e54
Opcode Fuzzy Hash: 5dfa002104ee014d5414f4f60ddea48a8ff73199e850730d3e6b6986b97d9c77
Instruction Fuzzy Hash: 23E2A7B16143509BD220EB75EC82B9FB3E4AFD4308F50492EF58997252DA39F508C79B

Function 0041F0E0 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 181
librarythreadloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultUILanguage.KERNEL32(?,INSTALL), ref: 0041F138
SetThreadUILanguage.KERNELBASE(?,?,?,00000000,?,00000000,0042FDF8,000000FF,0042017D,?,?), ref: 0041F2D5

Part of subcall function 00405140: CharUpperW.USER32(?,?,?,?,00000000,0041DDDA,?,TRUE,08C4B718), ref: 00405175
Part of subcall function 00405140: CharUpperW.USER32(?,?,?,?,00000000,0041DDDA,?,TRUE,08C4B718), ref: 0040517E

GetSystemDefaultUILanguage.KERNEL32(?,SYSTEM,?,INSTALL), ref: 0041F15E
LoadLibraryW.KERNEL32(Kernel32.dll,?,SYSTEM,?,INSTALL), ref: 0041F180
GetProcAddress.KERNEL32(00000000,GetSystemPreferredUILanguages), ref: 0041F196
FreeLibrary.KERNEL32(00000000), ref: 0041F1B2
_malloc.LIBCMT ref: 0041F1D5
__CxxThrowException@8.LIBCMT ref: 0041F1F3
LoadLibraryW.KERNEL32(Kernel32.dll,00000000,?,00000000,0042FDF8,000000FF,0042017D,?,?), ref: 0041F1FF
GetProcAddress.KERNEL32(00000000,GetSystemPreferredUILanguages), ref: 0041F211
FreeLibrary.KERNEL32(00000000,?,00000000,0042FDF8,000000FF,0042017D,?,?), ref: 0041F22D
_swscanf.LIBCMT ref: 0041F242
GetSystemDefaultUILanguage.KERNEL32(?,?,?,00000000,0042FDF8,000000FF,0042017D,?,?), ref: 0041F25C
SetThreadUILanguage.KERNEL32(?), ref: 0041F266
GetUserDefaultUILanguage.KERNEL32(?,USER,?,SYSTEM,?,INSTALL), ref: 0041F281
SetThreadLocale.KERNEL32(?,?,?,00000000,?,00000000,0042FDF8,000000FF,0042017D,?,?), ref: 0041F2E1

Strings

Kernel32.dll, xrefs: 0041F169, 0041F1F8
GetSystemPreferredUILanguages, xrefs: 0041F190, 0041F20B
USER, xrefs: 0041F272
SYSTEM, xrefs: 0041F147
INSTALL, xrefs: 0041F129

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Language$DefaultLibrary$SystemThread$AddressCharFreeLoadProcUpper$Exception@8LocaleThrowUser_malloc_swscanf
String ID: GetSystemPreferredUILanguages$INSTALL$Kernel32.dll$SYSTEM$USER
API String ID: 2081102591-4030941638
Opcode ID: d6cbecddd5c63a5a16641b99ac3714558565683711fe5373a274a81dbf6967dc
Instruction ID: 298e183df9084cad5458aef8e4b5078e0dc32087b97a83fc7525aa864e930c3c
Opcode Fuzzy Hash: d6cbecddd5c63a5a16641b99ac3714558565683711fe5373a274a81dbf6967dc
Instruction Fuzzy Hash: 4051F3725043409BC3149FA4DC85AABB3F5BB88314F50093EFA9697280D77DE94ACB5A

Function 0040B1D0 Relevance: 6.7, APIs: 4, Instructions: 722
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004051F0: __CxxThrowException@8.LIBCMT ref: 00405214
Part of subcall function 004051F0: __CxxThrowException@8.LIBCMT ref: 0040523E
Part of subcall function 004051F0: __CxxThrowException@8.LIBCMT ref: 00405268

_malloc.LIBCMT ref: 0040B483
__CxxThrowException@8.LIBCMT ref: 0040B49F

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw$_malloc
String ID:
API String ID: 175252994-0
Opcode ID: 937635db477e1162a07c148b7f5d37c8b63df266e3ebcbc4e5cdc9dd2a39134f
Instruction ID: 2e6abc30ca2aa20ae5f3f6fc0f68f379590f98e29c4b42247bfa53aa02dcf44d
Opcode Fuzzy Hash: 937635db477e1162a07c148b7f5d37c8b63df266e3ebcbc4e5cdc9dd2a39134f
Instruction Fuzzy Hash: 3C627D71A00248DFCB10DF69C880B9EBBF5EF88304F14819AE849AB391D779ED45CB95

Function 00407E20 Relevance: 4.6, APIs: 3, Instructions: 83fileCOMMON

Download Yara Rule

APIs

FindClose.KERNEL32(?,08C4B718,?,?), ref: 00407E70
FindFirstFileW.KERNELBASE(?,?,08C4B718,?,?), ref: 00407E8A
FindFirstFileW.KERNELBASE(?,?), ref: 00407EDE

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Find$FileFirst$Close
String ID:
API String ID: 2810966245-0
Opcode ID: 4f136a714dd2ec7d8fc94a420128cdf895c729926ec905244d0c22e420e50265
Instruction ID: 6d9093d44a4d32a4fee55667aa604e93bb106650d9471b23b0a41932ce3bcc02
Opcode Fuzzy Hash: 4f136a714dd2ec7d8fc94a420128cdf895c729926ec905244d0c22e420e50265
Instruction Fuzzy Hash: C0316D71908742DFD710DF28D845B5BB7E4EF59320F100B2AE4A5972D0DB38A909CB9A

Function 0041F320 Relevance: 3.0, APIs: 2, Instructions: 45comCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,?,00420066), ref: 0041F323
CoCreateInstance.OLE32 ref: 0041F34A

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CreateInstanceVersion
String ID:
API String ID: 1462612201-0
Opcode ID: 2178591d72f77ed9f68f1ba43183410802dbbc52281cb795d0c4d4a87dbbd7d5
Instruction ID: 4119b896e90871d56b1c7fc6a18c68987ceef037eb140d8bc2a0f6e2bd03ebc3
Opcode Fuzzy Hash: 2178591d72f77ed9f68f1ba43183410802dbbc52281cb795d0c4d4a87dbbd7d5
Instruction Fuzzy Hash: F8010C70304205AFD700DF69CD85F5B77E8AF88B04F109829F458D72A0D7B8E949CB56

Function 00419D20 Relevance: 1.8, Strings: 1, Instructions: 518COMMON

Download Yara Rule

Strings

Unknown error, xrefs: 0041A283

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CharUpper
String ID: Unknown error
API String ID: 9403516-83687255
Opcode ID: 03abcba685fe2a885ec6b92dfc78553d05201041ea68d31cb0b05b8e3ea1f6c2
Instruction ID: 207171b60f41956f4efded5058e7d1de725f9a258d7fd4d3ab9f449e565e6028
Opcode Fuzzy Hash: 03abcba685fe2a885ec6b92dfc78553d05201041ea68d31cb0b05b8e3ea1f6c2
Instruction Fuzzy Hash: 052258756083808FC324DF69C884A9BBBE5BF89304F64891EF69587351CB39E845CF96

Function 0041B9B0 Relevance: 22.7, APIs: 15, Instructions: 227
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003E8), ref: 0041B9F4
LoadIconW.USER32(00400000,?), ref: 0041BA16
SendMessageW.USER32(?,00000080,00000001,00000000), ref: 0041BA28
SetTimer.USER32(?,00000003,00000064,00000000), ref: 0041BA37
SetWindowTextW.USER32(?,?), ref: 0041BA48
PostMessageW.USER32(?,00008000,00000000,00000000), ref: 0041BA5E
SetDlgItemTextW.USER32(?,000003E7,?), ref: 0041BABD
SetDlgItemTextW.USER32(?,00000002,?), ref: 0041BB18
SendMessageW.USER32(?,00000080,00000001,00000000), ref: 0041BB2D
SetEvent.KERNEL32 ref: 0041BB3B
GetLastError.KERNEL32 ref: 0041BB45
GetWindowRect.USER32(?,?), ref: 0041BB74
GetWindowRect.USER32(?,?), ref: 0041BB91
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0041BBC6
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 0041BC38

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ErrorEventIconInfoLastLoadMoveParametersPostSystemTimer
String ID:
API String ID: 4208242464-0
Opcode ID: 1a0c057b221b59d0f93cb03a3ac266563ad6195312975e03b2a8b983faeb84f3
Instruction ID: d4708a701f4d74b9302c6a0546dacd2ca318cb66cb684dddc2989582ad0f470f
Opcode Fuzzy Hash: 1a0c057b221b59d0f93cb03a3ac266563ad6195312975e03b2a8b983faeb84f3
Instruction Fuzzy Hash: 589157B1608344AFD710DF69D984A5BBBE8EF88704F404A2EF988D7390D7B4D940CB96

Function 00422B09 Relevance: 22.6, APIs: 15, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 00422B54
__mtinit.LIBCMT ref: 00422B5A
_fast_error_exit.LIBCMT ref: 00422B65
__RTC_Initialize.LIBCMT ref: 00422B6B
__ioinit.LIBCMT ref: 00422B73
__amsg_exit.LIBCMT ref: 00422B7E
GetCommandLineA.KERNEL32 ref: 00422B84
___crtGetEnvironmentStringsA.LIBCMT ref: 00422B8F
__setargv.LIBCMT ref: 00422B99
__amsg_exit.LIBCMT ref: 00422BA4
__setenvp.LIBCMT ref: 00422BAA
__amsg_exit.LIBCMT ref: 00422BB5
__cinit.LIBCMT ref: 00422BBC
__amsg_exit.LIBCMT ref: 00422BC7
__wincmdln.LIBCMT ref: 00422BCD

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp__wincmdln
String ID:
API String ID: 3545360858-0
Opcode ID: 1bbe4d6a2c1f83ef58cbfe54f8c5cc5bedf82d33bd6d22c311cede4537bf217c
Instruction ID: 59fed90c4ca1eede3bb5b7934065d88dc15ceb01ae7c2db383fc00aafbe58fe6
Opcode Fuzzy Hash: 1bbe4d6a2c1f83ef58cbfe54f8c5cc5bedf82d33bd6d22c311cede4537bf217c
Instruction Fuzzy Hash: C421A270B00335A9DB147F72BA52B6E2674AF00709FD0442FF805AA292EAFCD942961C

Function 0041F6E0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0041F70C
GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0041F723
_memset.LIBCMT ref: 0041F73B
_wcsrchr.LIBCMT ref: 0041F75E
RegCreateKeyExW.KERNELBASE ref: 0041F79F
RegSetValueExW.KERNELBASE(00000000,IsHostApp,00000000,00000001,00000000,00000002), ref: 0041F7BF
RegCloseKey.ADVAPI32 ref: 0041F7C9

Strings

IsHostApp, xrefs: 0041F7B4
Applications\, xrefs: 0041F740

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: _memset$CloseCreateFileModuleNameValue_wcsrchr
String ID: Applications\$IsHostApp
API String ID: 1474337858-1667566961
Opcode ID: cff6f790a36eb52c656df31ff0c4e9f8bf1fe657cd444f3676a6b9194cf5c507
Instruction ID: b4fefd4a986ce641184e98d9e04d4cd0ee7292d218086c9f430e2e44724af58e
Opcode Fuzzy Hash: cff6f790a36eb52c656df31ff0c4e9f8bf1fe657cd444f3676a6b9194cf5c507
Instruction Fuzzy Hash: 2E2165B1654300BAE224EB60DD47FEB73A8AF98B04F40491DB3459A1C1DAB4A544C79A

Function 0041D740 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 86
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDialogParamW.USER32(00400000,000001F6,00000000,Function_000063F0,?), ref: 0041D764
ShowWindow.USER32(?,00000001,?,setup.bmp), ref: 0041D7A5
DialogBoxParamW.USER32(00400000,000001F4,00000000,Function_000063F0,?), ref: 0041D7EB
WaitForSingleObject.KERNEL32(?,000000FF,?,setup.bmp), ref: 0041D800
SetWindowTextW.USER32(?,?), ref: 0041D817
ShowWindow.USER32(?,00000001), ref: 0041D830
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041D83B

Strings

setup.bmp, xrefs: 0041D77A

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Window$DialogObjectParamShowSingleWait$CreateText
String ID: setup.bmp
API String ID: 2497262453-2262724209
Opcode ID: e239099f710c63933b1ce1ddfe16641b3414b7f67aef35d2fd90581470c04a1e
Instruction ID: 0faa20cbb3d567336509cef9e5aebf815778aaddbabd9f03ba19637f0d8d8adc
Opcode Fuzzy Hash: e239099f710c63933b1ce1ddfe16641b3414b7f67aef35d2fd90581470c04a1e
Instruction Fuzzy Hash: EF313172640305AFC720EF24DD81FDB37A4EB49310F20062AFA54672D1CB74E805CBA9

Function 0041C040 Relevance: 12.1, APIs: 8, Instructions: 125
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00008010), ref: 0041C058
GetObjectW.GDI32(00000000,00000018,?), ref: 0041C085
SendMessageW.USER32(?,00000172,00000000,?), ref: 0041C09A
MoveWindow.USER32(?,00000000,00000000,?,?,00000001), ref: 0041C0BA
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0041C0D7
GetWindowLongW.USER32(?,000000F0), ref: 0041C13D
AdjustWindowRect.USER32(?,00000000), ref: 0041C149
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 0041C16D

Part of subcall function 00421DEE: __lock.LIBCMT ref: 00421E0C
Part of subcall function 00421DEE: ___sbh_find_block.LIBCMT ref: 00421E17
Part of subcall function 00421DEE: ___sbh_free_block.LIBCMT ref: 00421E26
Part of subcall function 00421DEE: RtlFreeHeap.NTDLL(00000000,?,00437B30,0000000C,004244D4,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C), ref: 00421E56
Part of subcall function 00421DEE: GetLastError.KERNEL32(?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA,?,?,?,0042458E,0000000D), ref: 00421E67

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Window$Move$AdjustErrorFreeHeapImageInfoLastLoadLongMessageObjectParametersRectSendSystem___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 3689589546-0
Opcode ID: 931e36b93040ea3715695d79846932aa43a43d670a14e1fcc20038c362d01a73
Instruction ID: 10272e37aad25a8ad928242f2c0e3e8038a1b118f2e72c0a5f5bbb975411cee3
Opcode Fuzzy Hash: 931e36b93040ea3715695d79846932aa43a43d670a14e1fcc20038c362d01a73
Instruction Fuzzy Hash: E7412AB1604300AFD354CF38DD85F6BBBE9EBC8710F545A2DB989C7290D671E9088B66

Function 00422013 Relevance: 12.0, APIs: 8, Instructions: 42
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___set_flsgetvalue.LIBCMT ref: 00422019

Part of subcall function 004242F5: TlsGetValue.KERNEL32(?,0042201E), ref: 004242FE
Part of subcall function 004242F5: __decode_pointer.LIBCMT ref: 00424310
Part of subcall function 004242F5: TlsSetValue.KERNEL32(00000000,0042201E), ref: 0042431F

___fls_getvalue@4.LIBCMT ref: 00422024

Part of subcall function 004242D5: TlsGetValue.KERNEL32(?,?,00422029,00000000), ref: 004242E3

___fls_setvalue@8.LIBCMT ref: 00422037

Part of subcall function 00424329: __decode_pointer.LIBCMT ref: 0042433A

GetLastError.KERNEL32(00000000,?,00000000), ref: 00422040
ExitThread.KERNEL32 ref: 00422047
GetCurrentThreadId.KERNEL32 ref: 0042204D
__freefls@4.LIBCMT ref: 0042206D
__IsNonwritableInCurrentImage.LIBCMT ref: 00422080

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 1925773019-0
Opcode ID: 72ddbad82ef0f2b195670e724972f924a497b3df3b9b3875832c963032e7b329
Instruction ID: cba3c34129614957de2666b5bd55052eb0b4080e267b2a8cfe39401b396168e4
Opcode Fuzzy Hash: 72ddbad82ef0f2b195670e724972f924a497b3df3b9b3875832c963032e7b329
Instruction Fuzzy Hash: 8001A074300221FBD714BF73FA4990A3769EF45344791405AF50587622CBBCD846C66D

Function 0041E050 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00421DEE: __lock.LIBCMT ref: 00421E0C
Part of subcall function 00421DEE: ___sbh_find_block.LIBCMT ref: 00421E17
Part of subcall function 00421DEE: ___sbh_free_block.LIBCMT ref: 00421E26
Part of subcall function 00421DEE: RtlFreeHeap.NTDLL(00000000,?,00437B30,0000000C,004244D4,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C), ref: 00421E56
Part of subcall function 00421DEE: GetLastError.KERNEL32(?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA,?,?,?,0042458E,0000000D), ref: 00421E67

_malloc.LIBCMT ref: 0041E1A0

Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42

__CxxThrowException@8.LIBCMT ref: 0041E1BA

Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27

CloseHandle.KERNEL32(00000000,?,00000004,?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 0041E43A
GetLastError.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 0041E444
GetLastError.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 0041E39D

Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7

Part of subcall function 0041D740: CreateDialogParamW.USER32(00400000,000001F6,00000000,Function_000063F0,?), ref: 0041D764
Part of subcall function 0041D740: ShowWindow.USER32(?,00000001,?,setup.bmp), ref: 0041D7A5
Part of subcall function 0041D740: DialogBoxParamW.USER32(00400000,000001F4,00000000,Function_000063F0,?), ref: 0041D7EB
Part of subcall function 0041D740: WaitForSingleObject.KERNEL32(?,000000FF,?,setup.bmp), ref: 0041D800
Part of subcall function 0041D740: SetWindowTextW.USER32(?,?), ref: 0041D817
Part of subcall function 0041D740: ShowWindow.USER32(?,00000001), ref: 0041D830
Part of subcall function 0041D740: WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041D83B

Strings

etup.bmp, xrefs: 0041E2C2

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ErrorLastWindow$DialogException@8HeapObjectParamShowSingleThrowWait_malloc$AllocateCloseCreateExceptionFreeHandleRaiseText___sbh_find_block___sbh_free_block__lock
String ID: etup.bmp
API String ID: 108091135-3436927654
Opcode ID: 2a57222a5e386bf1415b04ae39b66cdc097ea749f01624b54cffa5f12d9e31b8
Instruction ID: 5d8bd30ac3cac1c9bf74f9187621e21ec3f781addd92d798ee7c0fa51436409c
Opcode Fuzzy Hash: 2a57222a5e386bf1415b04ae39b66cdc097ea749f01624b54cffa5f12d9e31b8
Instruction Fuzzy Hash: 2FD1A2755083808FC320EF69C880B9BB7E5AF98304F14892EF99987351D738E949CB5B

Function 0041F7F0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004083B0: CloseHandle.KERNEL32(?,08C4B718,00000000,?,80000000,00000001,00000000), ref: 004083DD
Part of subcall function 004083B0: CreateFileW.KERNELBASE(?,?,?,00000000,00000003,00000080,00000000,08C4B718,00000000,?,80000000,00000001,00000000), ref: 00408410
Part of subcall function 004083B0: CreateFileW.KERNEL32(?,?,?,00000000,00000003,00000080,00000000), ref: 0040846E

CloseHandle.KERNEL32(?,?,00001000,?,80000000,00000001,08C4B718,?,?,?,00000004,00000000,0043092B,000000FF,004205FF,?), ref: 0041F879

Strings

;!@Install@!UTF-8!, xrefs: 0041F88A, 0041F9B3
;!@InstallEnd@!, xrefs: 0041F8A2, 0041F92F

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: ;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 3498533004-372238525
Opcode ID: 91f2affea4869e83765d2e1f74f89e94a0244e6f1a37536b6162920d4a1ac00b
Instruction ID: 1b5d8e8219d8dbe746f9698ee4f6a7a213231ea35f70ff9d4cceb37c5f899a79
Opcode Fuzzy Hash: 91f2affea4869e83765d2e1f74f89e94a0244e6f1a37536b6162920d4a1ac00b
Instruction Fuzzy Hash: E781D4B15083809BD325DF2485807EBBBE1AF95354F244A3EE5D987281D73AD88FCB49

Function 00422096 Relevance: 10.6, APIs: 7, Instructions: 71
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___set_flsgetvalue.LIBCMT ref: 004220C7
__calloc_crt.LIBCMT ref: 004220D3
__getptd.LIBCMT ref: 004220E0
__initptd.LIBCMT ref: 004220E9
CreateThread.KERNELBASE(?,?,00422013,00000000,?,?), ref: 00422117
GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00422121
__dosmaperr.LIBCMT ref: 00422139

Part of subcall function 00422DAA: __getptd_noexit.LIBCMT ref: 00422DAA

Part of subcall function 00424D46: __decode_pointer.LIBCMT ref: 00424D51

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit__initptd
String ID:
API String ID: 3358092440-0
Opcode ID: f5f463cef4b5681ccb206623075628fbbdfffc6e21bc9c542259c479ed839b7a
Instruction ID: fb74a56c9f60d37d37198afcb2bea95722bf172271e528f26766c8b543eded33
Opcode Fuzzy Hash: f5f463cef4b5681ccb206623075628fbbdfffc6e21bc9c542259c479ed839b7a
Instruction Fuzzy Hash: 80110872700225BFCB10BFA5FD829AF77A5EF44324B90002FF60493151DBF99950D6A8

Function 004070D0 Relevance: 7.6, APIs: 5, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,08C4B718,?,?,?,00000000,08C4B718,?,00000000), ref: 00407102

Part of subcall function 00407070: CreateFileW.KERNEL32(?,00000000,00000007,00000000,00000003,00000080,00000000), ref: 00407084
Part of subcall function 00407070: _memset.LIBCMT ref: 0040709A
Part of subcall function 00407070: GetFileInformationByHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0040710F), ref: 004070A8
Part of subcall function 00407070: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,0040710F), ref: 004070B3

DeleteFileW.KERNEL32(?,?,?,00000000,08C4B718,?,00000000), ref: 00407126
DeleteFileW.KERNEL32(?,?,?,00000004,?,?,00000000,08C4B718,?,00000000), ref: 0040716A

Part of subcall function 00406A10: SetFileAttributesW.KERNELBASE(?,00000000,08C4B718,?,?,00000000,00430508,000000FF,00407419), ref: 00406A40

DeleteFileW.KERNEL32(?,?,?,00000000,08C4B718,?,00000000), ref: 004071AC
DeleteFileW.KERNEL32(?,?,?,00000000,08C4B718,?,00000000), ref: 004071C7

Part of subcall function 00421DEE: __lock.LIBCMT ref: 00421E0C
Part of subcall function 00421DEE: ___sbh_find_block.LIBCMT ref: 00421E17
Part of subcall function 00421DEE: ___sbh_free_block.LIBCMT ref: 00421E26
Part of subcall function 00421DEE: RtlFreeHeap.NTDLL(00000000,?,00437B30,0000000C,004244D4,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C), ref: 00421E56
Part of subcall function 00421DEE: GetLastError.KERNEL32(?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA,?,?,?,0042458E,0000000D), ref: 00421E67

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: File$Delete$Handle$AttributesCloseCreateErrorFreeHeapInformationLast___sbh_find_block___sbh_free_block__lock_memset
String ID:
API String ID: 3115853615-0
Opcode ID: 4d2cc51751521c6a92759e4f87ec3283190f4ed72bd4de2a10ef6ad1fec00bda
Instruction ID: ca44fddab62255b2f7870df1ed14c1733f6fd0f03786bcee7d5bc91ed6090572
Opcode Fuzzy Hash: 4d2cc51751521c6a92759e4f87ec3283190f4ed72bd4de2a10ef6ad1fec00bda
Instruction Fuzzy Hash: 71310771A083419BC610AB265C40A5B7798AF95324F10073FF865BB3D1DB3CE906CA5B

Function 00421DEE Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 00421E0C

Part of subcall function 00422F9F: __mtinitlocknum.LIBCMT ref: 00422FB5
Part of subcall function 00422F9F: __amsg_exit.LIBCMT ref: 00422FC1
Part of subcall function 00422F9F: EnterCriticalSection.KERNEL32(?,?,?,0042458E,0000000D,00437C60,00000008,00422072,?,00000000), ref: 00422FC9

___sbh_find_block.LIBCMT ref: 00421E17
___sbh_free_block.LIBCMT ref: 00421E26
RtlFreeHeap.NTDLL(00000000,?,00437B30,0000000C,004244D4,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C), ref: 00421E56
GetLastError.KERNEL32(?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA,?,?,?,0042458E,0000000D), ref: 00421E67

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: c8934a7c4923efb6ac1c1572ab7c9cc304ace5cc8a043a7b62b6768359b908ef
Instruction ID: 36df9ecf480f3c232eb00c3d22aa6e4bf98602e55d40a7a541d3ce7ea1edb9de
Opcode Fuzzy Hash: c8934a7c4923efb6ac1c1572ab7c9cc304ace5cc8a043a7b62b6768359b908ef
Instruction Fuzzy Hash: DD018471B05335AAEB206F71BD0AB5F3674AF21328FD1411FF940A6191CABC99418B9C

Function 0040FD80 Relevance: 6.5, APIs: 4, Instructions: 497
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00411E60: _malloc.LIBCMT ref: 00411E86
Part of subcall function 00411E60: __CxxThrowException@8.LIBCMT ref: 00411EA6

Part of subcall function 00421DEE: __lock.LIBCMT ref: 00421E0C
Part of subcall function 00421DEE: ___sbh_find_block.LIBCMT ref: 00421E17
Part of subcall function 00421DEE: ___sbh_free_block.LIBCMT ref: 00421E26
Part of subcall function 00421DEE: RtlFreeHeap.NTDLL(00000000,?,00437B30,0000000C,004244D4,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C), ref: 00421E56
Part of subcall function 00421DEE: GetLastError.KERNEL32(?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA,?,?,?,0042458E,0000000D), ref: 00421E67

_malloc.LIBCMT ref: 0041001A

Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42

_malloc.LIBCMT ref: 0041005F
__CxxThrowException@8.LIBCMT ref: 004103C7
__CxxThrowException@8.LIBCMT ref: 004103DC

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw_malloc$Heap$AllocateErrorFreeLast___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 692529005-0
Opcode ID: e317ff646a8ddd7d566bdc847a758cac5e3d56cdec4bdd368b62986376f1509a
Instruction ID: 56e3bafea64fc53d2df5d5e03e911840bc184fe3c7d80c36f6e752c328ae0f0a
Opcode Fuzzy Hash: e317ff646a8ddd7d566bdc847a758cac5e3d56cdec4bdd368b62986376f1509a
Instruction Fuzzy Hash: DB32D2B5908380DFD320CF6AC880B9BFBE4BFD9304F54892EE58987251DB79A544CB56

Function 00415A80 Relevance: 6.4, APIs: 4, Instructions: 428
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22077e6261d0ce50dc2a4e52b14bd537c44690fc40115488985def5f82b3dc1
Instruction ID: c83496670c431ab4ea79856a4b507278c9c29364285cad59d9c6f3676edfd229
Opcode Fuzzy Hash: c22077e6261d0ce50dc2a4e52b14bd537c44690fc40115488985def5f82b3dc1
Instruction Fuzzy Hash: 4C026E71604B40CFCB20DF29D480696B7E1FFC9314F148A5EE89A8B346D738E985CB99

Function 00406920 Relevance: 6.1, APIs: 4, Instructions: 83filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,02000000,00000000,08C4B718,00000004,?,?,?), ref: 00406962
CreateFileW.KERNEL32(08C4B718,40000000,00000003,00000000,00000003,02000000,00000000,?,00000000,00000004), ref: 004069BA
SetFileTime.KERNELBASE(00000000,00000000,00000000,?,?,40000000,00000003,00000000,00000003,02000000,00000000,08C4B718,00000004,?,?,?), ref: 004069E0
CloseHandle.KERNEL32(00000000,?,40000000,00000003,00000000,00000003,02000000,00000000,08C4B718,00000004,?,?,?), ref: 004069EC

Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7

Part of subcall function 004081C0: GetCurrentDirectoryW.KERNEL32(00000105,08C4B718), ref: 004082B3

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: File$Create$CloseCurrentDirectoryException@8HandleThrowTime_malloc
String ID:
API String ID: 122967144-0
Opcode ID: 359f6641ccda50597cff89e8d9dda326d606a66c084a5399fbe44e974eb887de
Instruction ID: b3999c9b89675ebd2ae71541746d99067d6c3b718fc365bd41268ac977983332
Opcode Fuzzy Hash: 359f6641ccda50597cff89e8d9dda326d606a66c084a5399fbe44e974eb887de
Instruction Fuzzy Hash: CE210A71244310BBE2209F25DC45F5B7BDCEB45B70F11062EF555A72D0C7789909CAA9

Function 00421F95 Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMON

Download Yara Rule

APIs

__IsNonwritableInCurrentImage.LIBCMT ref: 00421FA8

Part of subcall function 004248C0: __FindPESection.LIBCMT ref: 0042491B

__getptd_noexit.LIBCMT ref: 00421FB8
__freeptd.LIBCMT ref: 00421FC2
ExitThread.KERNEL32 ref: 00421FCB

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
String ID:
API String ID: 3182216644-0
Opcode ID: acf5ac546c9837852431c15dd70e16c76053a486527b636c9cb693f04e975d81
Instruction ID: 75a8cb905a69bf016ed46b0df59a3a75953ea8d07fb7ab818117307767d24168
Opcode Fuzzy Hash: acf5ac546c9837852431c15dd70e16c76053a486527b636c9cb693f04e975d81
Instruction Fuzzy Hash: 70D0EC342206619ADB143B76FE09B1636A99F91755FD50436B914941F1DFEC8880C95C

Function 0041D9C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,08C4B718,?,?,?,?,0042FE62,000000FF), ref: 0041DA16
DestroyWindow.USER32(?,08C4B718,?,?,?,?,0042FE62,000000FF), ref: 0041DA33

Strings

0A, xrefs: 0041D9F6

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: DestroyWindow
String ID: 0A
API String ID: 3375834691-2007828011
Opcode ID: 12db75416d8cdbe545e0d5cf0b0892ff76352a1c4519576d6b4212ba50ea6201
Instruction ID: 742c35474aecbc2d495c618619e94c506e51131d9200873e0cf2b397f01be0b8
Opcode Fuzzy Hash: 12db75416d8cdbe545e0d5cf0b0892ff76352a1c4519576d6b4212ba50ea6201
Instruction Fuzzy Hash: BA31ABB1604B018BC720DFB9D884B87BBE8AF48704F04891DE595CB351D779F808CBA5

Function 00408740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00408766
__CxxThrowException@8.LIBCMT ref: 00408789

Strings

out of memory, xrefs: 00408781

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AllocException@8StringThrow
String ID: out of memory
API String ID: 1617264723-2599737071
Opcode ID: 1ed9c45135ccbe0afddda232c66c0b4c97afda0b6637c0bc8184c57e8a2482c2
Instruction ID: b06795632af80c0f3b2f60a81ac9b2924824ca72a0d9e76516643deceff84f38
Opcode Fuzzy Hash: 1ed9c45135ccbe0afddda232c66c0b4c97afda0b6637c0bc8184c57e8a2482c2
Instruction Fuzzy Hash: DCF03965210B029AD7589F269E45617B2E4AF98748F24D83FE9DAC3690FF78C944830E

Function 0041CF10 Relevance: 4.6, APIs: 3, Instructions: 130timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,00000000,00000000,?), ref: 0041D02F
FindCloseChangeNotification.KERNELBASE(?), ref: 0041D044
GetLastError.KERNEL32 ref: 0041D056

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ChangeCloseErrorFileFindLastNotificationTime
String ID:
API String ID: 3673273941-0
Opcode ID: 598afc9bdab16a93d3b10089d4ba35f6cb7ea56aac1ec8cc64db83f033a8fef5
Instruction ID: c12e9f6ba34e0cb75690c4241fdf9b3d4b5867d1a81a83578a9db8fa05c906e5
Opcode Fuzzy Hash: 598afc9bdab16a93d3b10089d4ba35f6cb7ea56aac1ec8cc64db83f033a8fef5
Instruction Fuzzy Hash: EE4160B16407409FE720DB79C884BD3B7E5AB89318F144A1EE19A873A1C779E8C6C758

Function 004083B0 Relevance: 4.6, APIs: 3, Instructions: 88fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,08C4B718,00000000,?,80000000,00000001,00000000), ref: 004083DD
CreateFileW.KERNELBASE(?,?,?,00000000,00000003,00000080,00000000,08C4B718,00000000,?,80000000,00000001,00000000), ref: 00408410
CreateFileW.KERNEL32(?,?,?,00000000,00000003,00000080,00000000), ref: 0040846E

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CreateFile$CloseHandle
String ID:
API String ID: 1443461169-0
Opcode ID: a7e7d345bd554333e1cc9951ace2e37343c414f258a66117f828e78333558186
Instruction ID: ea8c27ecf3da15231cfb0a4b39e97664de59f0c511d558578ac63eaab3307ad4
Opcode Fuzzy Hash: a7e7d345bd554333e1cc9951ace2e37343c414f258a66117f828e78333558186
Instruction Fuzzy Hash: 98315CB1608711AFD210DF24DC45B5BBBE8EB89774F104B2EF5A4A32D0DB74A904CB99

Function 00406BC0 Relevance: 4.6, APIs: 3, Instructions: 71COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,08C4B718,?,?,00000000,08C4B718,?,?,?), ref: 00406BF5
GetLastError.KERNEL32(?,?), ref: 00406BFF
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000004,?,?), ref: 00406C45

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: cdca8c34eb75ae3e07b83d103eca02d1a73aa3e9677277af3d28c3b850dd8103
Instruction ID: 59b7f8852602325ad3b7576acbac00231ee3a5ddb581369b778845d7921f0455
Opcode Fuzzy Hash: cdca8c34eb75ae3e07b83d103eca02d1a73aa3e9677277af3d28c3b850dd8103
Instruction Fuzzy Hash: C01105B15083449FD200EF259C81A5BB7A8FB85364F510A3EF595A32D0C738E909CBAA

Function 00413C10 Relevance: 4.6, APIs: 3, Instructions: 69COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 00413C4C
GetLastError.KERNEL32 ref: 00413C61

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 6b7253807f8ef255e98dfbf493882eb9d2fc15aa48d8ac2fa26197f0956bf59b
Instruction ID: e59b8c6c9d207f6d54cab4becb255c60ffc16cf7df699e343ca3dfbb7fc882c3
Opcode Fuzzy Hash: 6b7253807f8ef255e98dfbf493882eb9d2fc15aa48d8ac2fa26197f0956bf59b
Instruction Fuzzy Hash: 7011B17761120A4B8710CE6CE8409AB7798AB85321F10822BED18D7350E236D95997E5

Function 00414C40 Relevance: 3.8, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,08C4B718,?,?,?,?,?,0042F7E8,000000FF), ref: 00414C6E
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,0042F7E8,000000FF), ref: 00414C9B
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,0042F7E8,000000FF), ref: 00414CD4

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 188848c371126ab57bf03bd26e69b33c65c7dd8113ad2cd64a699b042e3b5674
Instruction ID: 4acca2b25c34ca54317f79935144ea5dd27772e4ebcf5dfec4b79ca227a1c604
Opcode Fuzzy Hash: 188848c371126ab57bf03bd26e69b33c65c7dd8113ad2cd64a699b042e3b5674
Instruction Fuzzy Hash: 8A11067A204640AFD304CB48D980F6BB7E9FFC8A20F60452AFA15D3350D775A905CBA5

Function 004079A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNELBASE(00000000,mia,00000000,?,00000000,08C4B718,00407AD3,08C4B718,00000004,08C4B718,00000000,?,?,00000000,?), ref: 004079CE

Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7

Strings

mia, xrefs: 004079C8

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8FileNameTempThrow_malloc
String ID: mia
API String ID: 739282062-834928705
Opcode ID: 85ed890860e913ee20a6726b8fb2430cbd5c8761302e1e886de3ef44df40c26c
Instruction ID: e059b37136ce9a7132ddeb773af8d25e1d362e9c040abae9839df66ee31215f0
Opcode Fuzzy Hash: 85ed890860e913ee20a6726b8fb2430cbd5c8761302e1e886de3ef44df40c26c
Instruction Fuzzy Hash: 9FF082B2A046005AE324DB2CD802B57B3F6EF94710F25883BE180E32D4E7B4B8918759

Function 0040E3F0 Relevance: 3.2, APIs: 2, Instructions: 198COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E47B
__CxxThrowException@8.LIBCMT ref: 0040E499

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw_malloc
String ID:
API String ID: 3476970888-0
Opcode ID: ecb0499b1d9c07bbfd8762489ad71739eed922f4fbc2e0f0e235819eb9eaf89a
Instruction ID: 2ce8f76c52d71ee6ea90f967cf5ac0dc49b3900ca87f21fdd147f9ed563b7727
Opcode Fuzzy Hash: ecb0499b1d9c07bbfd8762489ad71739eed922f4fbc2e0f0e235819eb9eaf89a
Instruction Fuzzy Hash: AE61A3716083009BC724DF69D88072BB7E5BB89318F540E2EF995A7381E739E855CB4A

Function 00406A10 Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,08C4B718,?,?,00000000,00430508,000000FF,00407419), ref: 00406A40
SetFileAttributesW.KERNEL32(08C4B718,00000000), ref: 00406A9B

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5b60fd6092214ff5f05b9283c0340dbb38f55870b50d5c315950b3010c9d7896
Instruction ID: 6e6e9d07e5e1d0b40351bad84d41fbed830de9d4b3b2563167fee72041689f41
Opcode Fuzzy Hash: 5b60fd6092214ff5f05b9283c0340dbb38f55870b50d5c315950b3010c9d7896
Instruction Fuzzy Hash: 7721B6B26087419FD710EF64AC41B5BB7D4FB85720F440A2EF955933C0D739A909CBA6

Function 00406B00 Relevance: 3.1, APIs: 2, Instructions: 66COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE(?,08C4B718,00000000,?,?,00000000,000000FF,00407425,00000000), ref: 00406B32
RemoveDirectoryW.KERNELBASE(?,?,?,00000004,?,00000000,000000FF,00407425,00000000), ref: 00406B76

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: DirectoryRemove
String ID:
API String ID: 597925465-0
Opcode ID: 71892814a284d35aefe697e2e460e6b816cde100dd9aafc2616d1e0f829a7e7f
Instruction ID: f8b0e0ce4887a377146ac5a6f91a43faa227c917df174c811a8712e04894c35a
Opcode Fuzzy Hash: 71892814a284d35aefe697e2e460e6b816cde100dd9aafc2616d1e0f829a7e7f
Instruction Fuzzy Hash: B811E7B25043509BC200EF559C41A5BB7A8FB85360F500A3EF591A33C1D73DA909CBAA

Function 0041DF90 Relevance: 3.1, APIs: 2, Instructions: 57synchronizationwindowCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,08C4B718), ref: 0041DFDF
PostMessageW.USER32(00000001,00008000,00000000,00000000), ref: 0041DFF5

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: MessageObjectPostSingleWait
String ID:
API String ID: 1869837590-0
Opcode ID: 0ae074bdfef50da82f8f66b7cc14cb3ca0f2355ec82bfaede708d9a8856dc369
Instruction ID: 67b44cf236718e77661c825e43d0bc0602f7586151c5710897ab21da0a41314e
Opcode Fuzzy Hash: 0ae074bdfef50da82f8f66b7cc14cb3ca0f2355ec82bfaede708d9a8856dc369
Instruction Fuzzy Hash: 2A11A3B2A08788EFD710CF99D944B9AFBF8EB09764F10426FE91593780C7756904C7A4

Function 00404E70 Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00404E89

Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42

__CxxThrowException@8.LIBCMT ref: 00404EA7

Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID:
API String ID: 2732643326-0
Opcode ID: 7eb18a263b203ef1ca04536976229e906a1a431e215e5d262ed08b9100002171
Instruction ID: a8e9cb405463b2bfb29194c4a7db1ddf7ad65b7b3f345e2b191dc1a639ec63bb
Opcode Fuzzy Hash: 7eb18a263b203ef1ca04536976229e906a1a431e215e5d262ed08b9100002171
Instruction Fuzzy Hash: 2801BCB06007019AC720DF69D842627F3E4BFD8304F10883EE59AC33A1EB39E465CB46

Function 00413D40 Relevance: 3.0, APIs: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,?,?,?,?,00000000), ref: 00413D6E
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 00413D98

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: e3304a8171667333fdaac178f79259fccf236578ad01ac04bc50c7c63b81fbe9
Instruction ID: 46ffd835ac929a46f1b1754ee70f3be117443b79a1282e0e598ca55ed5e1d04d
Opcode Fuzzy Hash: e3304a8171667333fdaac178f79259fccf236578ad01ac04bc50c7c63b81fbe9
Instruction Fuzzy Hash: 690162352043029BD350CF18E944BA777E4AF84705F00892EE559D6250D378DD48CB6A

Function 00413BA0 Relevance: 3.0, APIs: 2, Instructions: 35fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,?,?,?,?,00000000), ref: 00413BCD
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00413BEF

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 82dd4830fae7e60dd82e4e8a08d870d85d8bd823a9d0dc89f859ae175ffd171e
Instruction ID: 31285fa28142ff3eda2036dbb8780ef0364bf7388d3a88ddde29d243f6d0e8ff
Opcode Fuzzy Hash: 82dd4830fae7e60dd82e4e8a08d870d85d8bd823a9d0dc89f859ae175ffd171e
Instruction Fuzzy Hash: 22F06D792082029BD304CF18C844B6BB7E4BBC4305F00C92EF595DB391E779E948DB69

Function 0041BE50 Relevance: 3.0, APIs: 2, Instructions: 33timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,?), ref: 0041BE68
KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 0041BE9C

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CallbackDispatcherKillTimerUser
String ID:
API String ID: 45433635-0
Opcode ID: ddf1266d2bd96984e55c2111573cec84cd69dacffde2e565b4b5898f6a62966f
Instruction ID: 00470ecef782a90aa5a81525347fb0470b9370af0cd53691b1602fb172eecf1e
Opcode Fuzzy Hash: ddf1266d2bd96984e55c2111573cec84cd69dacffde2e565b4b5898f6a62966f
Instruction Fuzzy Hash: DDF067722047409BD324DB18E844FABB7E9ABE4714F00491EF98247290C7B9EC85CBA8

Function 00421FD2 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00421FDE

Part of subcall function 004244E3: __getptd_noexit.LIBCMT ref: 004244E6
Part of subcall function 004244E3: __amsg_exit.LIBCMT ref: 004244F3

Part of subcall function 00421F95: __IsNonwritableInCurrentImage.LIBCMT ref: 00421FA8
Part of subcall function 00421F95: __getptd_noexit.LIBCMT ref: 00421FB8
Part of subcall function 00421F95: __freeptd.LIBCMT ref: 00421FC2
Part of subcall function 00421F95: ExitThread.KERNEL32 ref: 00421FCB

__XcptFilter.LIBCMT ref: 00421FFF

Part of subcall function 0042497E: __getptd_noexit.LIBCMT ref: 00424986

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: __getptd_noexit$CurrentExitFilterImageNonwritableThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 393088965-0
Opcode ID: 8069cb46053e809ece7fc975d9d4d70a304da6873b102c594fd6ad5f9402eec9
Instruction ID: 225cb1a2493a05b67e88bf7f72ea339520824f6e15ce0439916c389049fd7118
Opcode Fuzzy Hash: 8069cb46053e809ece7fc975d9d4d70a304da6873b102c594fd6ad5f9402eec9
Instruction Fuzzy Hash: C9E0BFB56406149FD718BBA1D906E2D7775DF44309F60004EF1015B2B1CA7999409B18

Function 0041C010 Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E8), ref: 0041C01C
SendMessageW.USER32(?,00000080,00000001,00000000), ref: 0041C032

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ItemMessageSend
String ID:
API String ID: 3015471070-0
Opcode ID: 5de501a1ff413fbe9085e3604fd8fb62ba8ef300bea9de6c68d42dc9b065594f
Instruction ID: b39bce7e1dc77a8742afbb46725aac72f2e371372a91e58acbf060f5fe3c6fef
Opcode Fuzzy Hash: 5de501a1ff413fbe9085e3604fd8fb62ba8ef300bea9de6c68d42dc9b065594f
Instruction Fuzzy Hash: 69D0A77168031067DA604B64FD49F8373D86B0CB01F014A5AF64AD71C0C9F0A4408B08

Function 00405350 Relevance: 3.0, APIs: 2, Instructions: 14COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00405352

Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42

__CxxThrowException@8.LIBCMT ref: 0040536E

Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID:
API String ID: 2732643326-0
Opcode ID: 9c2fadfb130e266a98ccff6bb26c568532dfe8a0070e7586c49056718d7968ee
Instruction ID: a602915de48d0db7676f328d3f5172f7efee01bdfe68b84f608bad21c35d458a
Opcode Fuzzy Hash: 9c2fadfb130e266a98ccff6bb26c568532dfe8a0070e7586c49056718d7968ee
Instruction Fuzzy Hash: 2EC012C091534035DD185731BC0296752E84CA5348F51486FB84591142E97CD65D921F

Function 00423D10 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 00423D18

Part of subcall function 00423CE5: GetModuleHandleW.KERNEL32(mscoree.dll,?,00423D1D,?,?,00421F04,000000FF,0000001E,?,00424AEF,?,00000001,?,?,00422F29,00000018), ref: 00423CEF
Part of subcall function 00423CE5: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00423CFF

ExitProcess.KERNEL32 ref: 00423D21

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 413c8b1009435b3ffbe48e234a8bb614a3e7ee2aa3c7bc32ca9ee7a0a1530568
Instruction ID: 7c21544d0a3d036927f1def45caf06a8b18b837482dd20d66ee3204eca29a738
Opcode Fuzzy Hash: 413c8b1009435b3ffbe48e234a8bb614a3e7ee2aa3c7bc32ca9ee7a0a1530568
Instruction Fuzzy Hash: A6B09232000118BBCF022F13EE0A8493F3AEB803A1B514025F90909031DFB7EE92DA98

Function 0041C380 Relevance: 2.6, APIs: 2, Instructions: 73COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,08C4B718,?,?,?,?,?,0042F7E8,000000FF,0041C7EE,?,?), ref: 0041C3AC
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,0042F7E8,000000FF,0041C7EE,?,?), ref: 0041C427

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: fd4df8d3fcbbb8da80bc25aa3a6ee8a0f33404e5326e133e9b1a93824fd3a48b
Instruction ID: 793c60a82a3897cbea006ef7a6d765e9df0119faf799fe96586615b7e53cdcb1
Opcode Fuzzy Hash: fd4df8d3fcbbb8da80bc25aa3a6ee8a0f33404e5326e133e9b1a93824fd3a48b
Instruction Fuzzy Hash: 4A21F4BA604A00AFC318DF19DA81A6BB3FAFF8C710B50491EF54693B60D774B845CB65

Function 0041C450 Relevance: 2.6, APIs: 2, Instructions: 72COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,08C4B718,?,?,?,?,?,0042F7E8,000000FF,0041C82F,?,?), ref: 0041C47C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,0042F7E8,000000FF,0041C82F,?,?), ref: 0041C4F9

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 804f14f6e22a247da375789de95732f2e138cad818d84c02829c3f8a1e5d6830
Instruction ID: 745e08ec57bfe2d81673155d5771ce654260503d44a53da57d59fe68b26565c1
Opcode Fuzzy Hash: 804f14f6e22a247da375789de95732f2e138cad818d84c02829c3f8a1e5d6830
Instruction Fuzzy Hash: 2321F2BA200A00AFC314DF19DA81A6BB3FAFB8D710F50491DE68293B50D774B805CBA1

Function 00414AC0 Relevance: 2.5, APIs: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00415AD1,08C4B718), ref: 00414AE9
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,00415AD1,08C4B718), ref: 00414B17

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7819856d66b5851ede3f9bdef5d93ae2c7799b9db804b66b9b6b4ab617a870bd
Instruction ID: 3f647bf7e0689e73f0432b280dd933d7141cac813072c7c94ae20007a4340fe1
Opcode Fuzzy Hash: 7819856d66b5851ede3f9bdef5d93ae2c7799b9db804b66b9b6b4ab617a870bd
Instruction Fuzzy Hash: 8CF0F63168072267DB608E25EC457C777986F447A4F128526F524D73C0C7A4ECD28BD8

Function 00414D50 Relevance: 2.5, APIs: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00415B38,08C4B718), ref: 00414D78
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,00415B38,08C4B718), ref: 00414DA4

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 37fe2aa6ff23e776cda0949a660b7ad76bdcf7dc678ab92d592f4fa13fe7be67
Instruction ID: 8e2800784cee38b2061e6fe60721290af1e5f1d33f89dcf86bc39648f11f61cb
Opcode Fuzzy Hash: 37fe2aa6ff23e776cda0949a660b7ad76bdcf7dc678ab92d592f4fa13fe7be67
Instruction Fuzzy Hash: EBF0907164072357EF604F38BD057C637A86B45B61F110026F951DB3C0D7A498D28B98

Function 004080C0 Relevance: 1.6, APIs: 1, Instructions: 78fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(08C4B718,?,?,00000000), ref: 004080ED

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 4e98acda21bc520af0750d45f365bcf612b41177028bb51abe9b2f04225e281f
Instruction ID: 0ac86ba7e6036cb0bca20b54e3df52c499b184387ab912897b1ff671fb7c457c
Opcode Fuzzy Hash: 4e98acda21bc520af0750d45f365bcf612b41177028bb51abe9b2f04225e281f
Instruction Fuzzy Hash: EE2161706097419FC724DF25D981A6BB7E1BF88304F40892EE5D987381D739F80ACB56

Function 0041BCF0 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0041BD4F

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3e934bf6b8fda8c9455b302bff1661e1d9bd3881a9536dc17bef4322b8786aa9
Instruction ID: 2b345634289db81ae9c8ad967e6cfd939ec9b3350c734fd0bd0422c7a7e865b1
Opcode Fuzzy Hash: 3e934bf6b8fda8c9455b302bff1661e1d9bd3881a9536dc17bef4322b8786aa9
Instruction Fuzzy Hash: 3C01B1B1700B166BC71CAE64E6C0D9EF395FB44750B50842AE20183B41C779F891CBDC

Function 00414E80 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 00414EB2

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: b226f601f7f229672f9c274ea2e6db751be2db2d582a6f224f488ac34b63d6ba
Instruction ID: 7f677e2a0d96dd042953974e68f50ffb109c9cca23682643b4d14ef79ff7504b
Opcode Fuzzy Hash: b226f601f7f229672f9c274ea2e6db751be2db2d582a6f224f488ac34b63d6ba
Instruction Fuzzy Hash: 16F090715007105B8720EB69E8418CBB3E5AE80320B20CD1EF4AE83980E738FC818B6D

Function 00408520 Relevance: 1.5, APIs: 1, Instructions: 40fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000,00000000,?,00000000,0041F8ED,?,00001000,?,80000000,00000001,08C4B718,?), ref: 0040855C

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 2621b06c5321a8c3f0fd18990958dce362ec427473b39e7e457abe834a3f0343
Instruction ID: f39ee7e7f60ea532393ae8b1daf0349f663640ccd44f9b94e31dfc72485cb8ec
Opcode Fuzzy Hash: 2621b06c5321a8c3f0fd18990958dce362ec427473b39e7e457abe834a3f0343
Instruction Fuzzy Hash: 15F06D722043066BC754DE49E980B2BB3E8ABE8310F10443EF284D7280EB75A849C779

Function 00407510 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetShortPathNameW.KERNELBASE(?,?,00000105), ref: 0040753C

Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8NamePathShortThrow_malloc
String ID:
API String ID: 2966644318-0
Opcode ID: 572c1ff56df4c723897f1b5f8077861ec5bcd5b1864dcfcf38f0de8c29b59959
Instruction ID: 803da70797d6faa53c3d6321105406aed6117c351dfe0607d1041baaf81b07e9
Opcode Fuzzy Hash: 572c1ff56df4c723897f1b5f8077861ec5bcd5b1864dcfcf38f0de8c29b59959
Instruction Fuzzy Hash: 14F0B471A046005BE324DB3CD815997B3F6EF98710B24843FE186E7AD0F7B4A8D28745

Function 00416790 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09be56aac9fe1bcd87d90f05d3fd35e2e31454c41ff1b78bfbc62eebb49b2b9e
Instruction ID: b0f22ba89bf6f4baeb6bc1cea3b70d90dd13a4c9dd67412f4e94cd6d2aa3cb97
Opcode Fuzzy Hash: 09be56aac9fe1bcd87d90f05d3fd35e2e31454c41ff1b78bfbc62eebb49b2b9e
Instruction Fuzzy Hash: 1BF09672104151DAD760D719A840FDBB3E09BA0324F02882FF5558A2A0C23DDDD5CB99

Function 00407940 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,?,00000004,00407A91,00000004,08C4B718,00000000,?,?,00000000,?,?,00000000), ref: 00407969

Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8FolderPathThrow_malloc
String ID:
API String ID: 2862337592-0
Opcode ID: 34f6f5cb213bffc77dfebc8498b2f279899a3604e67780ddcea719c6106339d9
Instruction ID: 46fce7617049bad6f137b75ed99042ad9b7eccbfa9cfcc549d31155430e20db5
Opcode Fuzzy Hash: 34f6f5cb213bffc77dfebc8498b2f279899a3604e67780ddcea719c6106339d9
Instruction Fuzzy Hash: 03F0A7716042105BF770AF28DC41B5773E1EF08310F24447BE986DF2D0D6B969C18B59

Function 00407F40 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00407E20: FindClose.KERNEL32(?,08C4B718,?,?), ref: 00407E70
Part of subcall function 00407E20: FindFirstFileW.KERNELBASE(?,?,08C4B718,?,?), ref: 00407E8A
Part of subcall function 00407E20: FindFirstFileW.KERNELBASE(?,?), ref: 00407EDE

FindClose.KERNEL32(FFFFFFFF,?,08C4B718,00000000,?,?,00430488,000000FF,00418955,?), ref: 00407F8E

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 2546e1c02685e61960b6156f213b1b43b7edd20205f17317a08b49c00ca059c2
Instruction ID: dddce3a9af92c8c3231f840ac9d95d7011c8770734e059ed718bfb036d1edd7c
Opcode Fuzzy Hash: 2546e1c02685e61960b6156f213b1b43b7edd20205f17317a08b49c00ca059c2
Instruction Fuzzy Hash: 65F06DB5508740AFD304CF18C885B57B7E8E759330F108B2EF869833D0D738A8098A66

Function 00417040 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00417069

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: _malloc
String ID:
API String ID: 1579825452-0
Opcode ID: 2d63b93e354ad5df073107ab7a35b1a02fb2466c2768f426044e32d254905805
Instruction ID: 7602617d1c0ce983adb61dbcf89cd8959781196aaff58d124a315e77f73bd1bc
Opcode Fuzzy Hash: 2d63b93e354ad5df073107ab7a35b1a02fb2466c2768f426044e32d254905805
Instruction Fuzzy Hash: 92E0EDB060470187DB30CB359891B9377EA7F54344F54892EA89EC7614EB39F884C71A

Function 00422DF3 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00422E08

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 2366ed851773c368dff311633043479c6c90e4a138c4d4a9eb2632cbacb2a32f
Instruction ID: 86aee0bac0538ae6b76e20c7bf6ff8a860abe30deba9c378a37622715fe1d8de
Opcode Fuzzy Hash: 2366ed851773c368dff311633043479c6c90e4a138c4d4a9eb2632cbacb2a32f
Instruction Fuzzy Hash: E7D05E766603046FDB105F717E097233BEC9394395F40443AB90CC6190E5B4C9509608

Function 00423F2C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00423F38

Part of subcall function 00423E00: __lock.LIBCMT ref: 00423E0E
Part of subcall function 00423E00: __decode_pointer.LIBCMT ref: 00423E45
Part of subcall function 00423E00: __decode_pointer.LIBCMT ref: 00423E5A
Part of subcall function 00423E00: __decode_pointer.LIBCMT ref: 00423E84
Part of subcall function 00423E00: __decode_pointer.LIBCMT ref: 00423E9A
Part of subcall function 00423E00: __decode_pointer.LIBCMT ref: 00423EA7
Part of subcall function 00423E00: __initterm.LIBCMT ref: 00423ED6
Part of subcall function 00423E00: __initterm.LIBCMT ref: 00423EE6

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: fa2e777966923ff6dfc8112d92b190de78b5184cf570968b1206adc42845c334
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: FAB0927268020833DA202A42BC03F063E1A87C0B68E660021BA0C295A2A9A6AA6580C9

Function 004166A0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004166AC

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: _malloc
String ID:
API String ID: 1579825452-0
Opcode ID: 9cafb99de2f3493ce3e7878a8b0fea2fc32f41290bda0b55f0f2156e21cf90c1
Instruction ID: d347abebaf0359f5fa1359167306a0a34dd3417ef1332786ed79c0e5b6877914
Opcode Fuzzy Hash: 9cafb99de2f3493ce3e7878a8b0fea2fc32f41290bda0b55f0f2156e21cf90c1
Instruction Fuzzy Hash: 1FB012BEB0020112D970F921BC41D57B2D83FB0785B85882BB8C8C1120F228E87CC22A

Function 00415640 Relevance: 1.3, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,08C4B718,?,?,0042EE5B,000000FF), ref: 0041567C

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: eda4174a4717431e7e9f737c7c7dbf923edcdc2d68691a2a456201ebbdb4da49
Instruction ID: 6eac19e29b5bad37f342a6201f77cddbe98d170c480904c3d704713a42110b49
Opcode Fuzzy Hash: eda4174a4717431e7e9f737c7c7dbf923edcdc2d68691a2a456201ebbdb4da49
Instruction Fuzzy Hash: E6F01975604B41DFD320CF19D884B53B7E8FB88B20F508A19E5A9877D0D779E844CB95

Function 004156C0 Relevance: 1.3, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,08C4B718,?,?,0042EE2B,000000FF), ref: 004156FB

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c87a56866fa1b47c1608489e454f44b453adb3a14ab80ec470fbf3b0ce0cf926
Instruction ID: 7a31c48fe41f0245d7057249d72feef9ac66eab8aee5c8a5e621aac5e61e55c5
Opcode Fuzzy Hash: c87a56866fa1b47c1608489e454f44b453adb3a14ab80ec470fbf3b0ce0cf926
Instruction Fuzzy Hash: 6CF01475604B81DFD720CF18D881B53B7E8FB88B20F204A29E9A5873D0D779E844CB95

Function 00415410 Relevance: 1.3, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00415435

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: d2ddbbd5ed56630edbf359f3a6a23b87cf336805f66c5b382b2410dfdd830d39
Instruction ID: 96464189ef5ab4881843a27eb04bb39dfb4e36e9bcfaf951d4a3f0df901096ff
Opcode Fuzzy Hash: d2ddbbd5ed56630edbf359f3a6a23b87cf336805f66c5b382b2410dfdd830d39
Instruction Fuzzy Hash: FFE0C2B13042016BF3249B749C45FA7339CAB90705F20403EB606D91C0EAA4E890C22D

Non-executed Functions

Function 00409180 Relevance: 45.1, APIs: 24, Strings: 1, Instructions: 1315COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040923A
_malloc.LIBCMT ref: 00409299
_malloc.LIBCMT ref: 00409482
__CxxThrowException@8.LIBCMT ref: 0040949E
__CxxThrowException@8.LIBCMT ref: 004094B3
__CxxThrowException@8.LIBCMT ref: 004094C8
DeleteCriticalSection.KERNEL32(?,00433FF8), ref: 00409542
_malloc.LIBCMT ref: 00409897

Strings

8@C, xrefs: 0040A218, 0040991C, 00409A29, 004099A1, 0040955B, 0040955F, 0040992B, 004099A5, 00409A2D, 0040A21C

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: _malloc$Exception@8Throw$CriticalDeleteSection
String ID: 8@C
API String ID: 4184010672-3398775317
Opcode ID: a1e4b8e8769544cbb003b805fe65e17462dcbafaaefab5edc61fa8b335b789fb
Instruction ID: da0a2bb2dffd0da2cf288ff33df2b5a874d38cbaed28d2defd6f584eaea280d2
Opcode Fuzzy Hash: a1e4b8e8769544cbb003b805fe65e17462dcbafaaefab5edc61fa8b335b789fb
Instruction Fuzzy Hash: 41C26C716083818FC324DF69C480B9BBBE4BFC9304F14892EF58997391DB79A945CB96

Function 004055E0 Relevance: 24.7, APIs: 16, Instructions: 747COMMON

Download Yara Rule

APIs

Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7

Part of subcall function 00405390: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,?,00000004), ref: 00405410
Part of subcall function 00405390: __CxxThrowException@8.LIBCMT ref: 0040542C

_malloc.LIBCMT ref: 00405787
_malloc.LIBCMT ref: 00405854
_malloc.LIBCMT ref: 004058F3
_malloc.LIBCMT ref: 00405992
_malloc.LIBCMT ref: 00405A31
_malloc.LIBCMT ref: 00405AD0
_malloc.LIBCMT ref: 00405B6D
_malloc.LIBCMT ref: 00405C12
__CxxThrowException@8.LIBCMT ref: 00405DDD

Part of subcall function 00421DEE: __lock.LIBCMT ref: 00421E0C
Part of subcall function 00421DEE: ___sbh_find_block.LIBCMT ref: 00421E17
Part of subcall function 00421DEE: ___sbh_free_block.LIBCMT ref: 00421E26
Part of subcall function 00421DEE: RtlFreeHeap.NTDLL(00000000,?,00437B30,0000000C,004244D4,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C), ref: 00421E56
Part of subcall function 00421DEE: GetLastError.KERNEL32(?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA,?,?,?,0042458E,0000000D), ref: 00421E67

__CxxThrowException@8.LIBCMT ref: 00405E7A

Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27

__CxxThrowException@8.LIBCMT ref: 00405E95
__CxxThrowException@8.LIBCMT ref: 00405EB0
__CxxThrowException@8.LIBCMT ref: 00405ECB
__CxxThrowException@8.LIBCMT ref: 00405EE6
__CxxThrowException@8.LIBCMT ref: 00405F01
__CxxThrowException@8.LIBCMT ref: 00405F1C

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw$_malloc$ByteCharErrorExceptionFreeHeapLastMultiRaiseWide___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 1646499912-0
Opcode ID: 675c57c2e196bbbcc5ab6ec87854bd4b67a2df7ce2509b2b8f3f6b0ca6fd73a6
Instruction ID: d3f9713f669ec5f3df7da001e5281389b91580916c26e67ca497a4527f5a7d99
Opcode Fuzzy Hash: 675c57c2e196bbbcc5ab6ec87854bd4b67a2df7ce2509b2b8f3f6b0ca6fd73a6
Instruction Fuzzy Hash: C3421571608B908BD7209F39888076BBBE5EF95304F544A2EE8D5D7392D67CE805CF86

Function 00412B50 Relevance: 11.0, APIs: 7, Instructions: 465synchronizationCOMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 00412DF1
__CxxThrowException@8.LIBCMT ref: 00412E08

Part of subcall function 004130B0: _malloc.LIBCMT ref: 004130D8
Part of subcall function 004130B0: __CxxThrowException@8.LIBCMT ref: 004130F6

__CxxThrowException@8.LIBCMT ref: 00412E86
__CxxThrowException@8.LIBCMT ref: 00412EEF

Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27

SetEvent.KERNEL32(?,00000000,?,?,?,?,?,?,?,00437FD4), ref: 00412F8B
GetLastError.KERNEL32(?,?,?,?,?,?,?,00437FD4), ref: 00412F91
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,00437FD4), ref: 00412FD4

Part of subcall function 004154B0: CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,00412F53,?,?,?,?,?,?,?,00437FD4), ref: 004154C5
Part of subcall function 004154B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,00437FD4), ref: 004154CE

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw$ErrorEventLast$CreateExceptionObjectRaiseSingleWait_malloc
String ID:
API String ID: 2637030848-0
Opcode ID: f9fdbc78714b5f468024bd4ccc9f89bcb4f92527db628ae5e64e64e821519191
Instruction ID: 6db37e9d7ad01f81545c4ce0e11e49c4d9759a330240abb6dd05be9c37f6078c
Opcode Fuzzy Hash: f9fdbc78714b5f468024bd4ccc9f89bcb4f92527db628ae5e64e64e821519191
Instruction Fuzzy Hash: C5027D746047029FC724CF28C580AABB3E1FB88304F248A5EE599C7355D775F896CB95

Function 00421DDF Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00422D1D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00422D32
UnhandledExceptionFilter.KERNEL32(00432388), ref: 00422D3D
GetCurrentProcess.KERNEL32(C0000409), ref: 00422D59
TerminateProcess.KERNEL32(00000000), ref: 00422D60

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: ee80e8d3c8b4e1287dcdca918fd6cd3014df0d1a4d5be41a5f58ca83e8ce57d4
Instruction ID: 6df77d042e21db70d105d2c9e33ae376466ac4bc9509ba677e5ade4139247391
Opcode Fuzzy Hash: ee80e8d3c8b4e1287dcdca918fd6cd3014df0d1a4d5be41a5f58ca83e8ce57d4
Instruction Fuzzy Hash: 5E21F274906201EFD700DF5AFE896447BB4BB2C324F50A53AE509973E1E3B458858F0D

Function 0040E740 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E941
__CxxThrowException@8.LIBCMT ref: 0040EA84

Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27

Strings

, xrefs: 0040E908

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow_malloc
String ID:
API String ID: 1621474382-3916222277
Opcode ID: 16c914ef5d681915e7d92d77c835f6e307eaab084de973a5b7900e38fa3c7e03
Instruction ID: 6bf4d4a0c66dc1ea962e3fac851877465544c5f1d051c7262505d9f3521c3fa1
Opcode Fuzzy Hash: 16c914ef5d681915e7d92d77c835f6e307eaab084de973a5b7900e38fa3c7e03
Instruction Fuzzy Hash: BEE17E756043018FC714DF2AC580A1BB7E5BF89314F548D3FE9A6A7391C638E865CB8A

Function 0041B110 Relevance: 3.1, APIs: 2, Instructions: 51windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7

FormatMessageW.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000,00000004,08C4B718,74DEE010,?,?), ref: 0041B170
LocalFree.KERNEL32(?), ref: 0041B18A

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8FormatFreeLocalMessageThrow_malloc
String ID:
API String ID: 2713084418-0
Opcode ID: ac5f01f677d42775a070dfc2d7d76652363426f171e82a111de39c834594508d
Instruction ID: f5968aaa4db2781cbfa919783bd6b72111f4b5590e0f3694e6d324342bca7b18
Opcode Fuzzy Hash: ac5f01f677d42775a070dfc2d7d76652363426f171e82a111de39c834594508d
Instruction Fuzzy Hash: 1A1106B1204740AFD214DF1AD945F5BFBF8EBD8B54F104A2EF19593250C3B4A904CB65

Function 004011C0 Relevance: 1.7, APIs: 1, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 622117b63befa7973a322741aeb603a8934fb9cc7300e44e43da5c37f40fa5d3
Instruction ID: 3e93a4eee694f26e6faae586ba0078f3ad04e973345864326b6e953aeb32d7b0
Opcode Fuzzy Hash: 622117b63befa7973a322741aeb603a8934fb9cc7300e44e43da5c37f40fa5d3
Instruction Fuzzy Hash: DC51F631B106204AF348CF769C851AA3BD3D7C9386B44C63DE659D66E8DABDC017C798

Function 004011D8 Relevance: 1.7, APIs: 1, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9805ec844e61b1c20006ad2471b23da2c5c5d9f86331cec8f43e7bb082fc1db
Instruction ID: a617d443dbee23744503749e53e855a887ddea7c71caec0ae79ad38ee72a4a7a
Opcode Fuzzy Hash: c9805ec844e61b1c20006ad2471b23da2c5c5d9f86331cec8f43e7bb082fc1db
Instruction Fuzzy Hash: D451F731B106204AF348CF368C852AA7BD3D7CA346F44C63DE659D66E8DABDC017C698

Function 00426C2A Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00026BE8), ref: 00426C2F

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e861745a69044617ac1bea6ecfa3d2f0e8736b247a0f242b783b82f71a65e87b
Instruction ID: 962ed4ba0d295f6b9a0c84e56d2007df0ba939f6c58a15a6d83148043966d6dd
Opcode Fuzzy Hash: e861745a69044617ac1bea6ecfa3d2f0e8736b247a0f242b783b82f71a65e87b
Instruction Fuzzy Hash: 7A9002B0355524464E4017757E0950539A05A88B127D714616101C8054DBD490409519

Function 004105D0 Relevance: .9, Instructions: 901COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 108c66c463fb600f1ef4f2ee0cb47d98a1550b8712bd6b620310585c69700f15
Instruction ID: e4f4b5f0e6080d98b9ee51d6b85e52c5fa7c1b81b31bb3f3eb6839b9fe8b0d70
Opcode Fuzzy Hash: 108c66c463fb600f1ef4f2ee0cb47d98a1550b8712bd6b620310585c69700f15
Instruction Fuzzy Hash: E19238B1908381CFC724DF15C480A9BBBE5BF89304F14892EE59A97352D778A885CF96

Function 0040F2F0 Relevance: .5, Instructions: 523COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: cd63c2c4fe7ec95e53e1055885b901737c58f789091b73efeea92a7c486d5825
Instruction ID: 3095d77bb6f78aa45d5fb910dec581cee314f00d86e746a1153facfe542a7aca
Opcode Fuzzy Hash: cd63c2c4fe7ec95e53e1055885b901737c58f789091b73efeea92a7c486d5825
Instruction Fuzzy Hash: 042238755043419FC734DF15C480A6BB7E1FB88314F14893EE899AB792DB38E84ACB86

Function 00403760 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9803c8db8919b39b22e60e951130245479d9368fb12c4fe1c3f5fb4592283aad
Instruction ID: c2d97246fd2aafeb022947b6bb86a1446f9da4e42c3c7867536164bb694cac53
Opcode Fuzzy Hash: 9803c8db8919b39b22e60e951130245479d9368fb12c4fe1c3f5fb4592283aad
Instruction Fuzzy Hash: 80024C72A042114BD708CE18C580279BFE6FBC5346F114A3FE496A77C4D778DA88CB99

Function 0040DC00 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a6e7d78d6aaaef2a7f40a0806fdccfcdeaa7096f9381f58b6ba9bf01865be7
Instruction ID: d1afe5bdaaf273eaa513a6fab511294eb2313c4e303bc650a9aebec8748cfb60
Opcode Fuzzy Hash: 39a6e7d78d6aaaef2a7f40a0806fdccfcdeaa7096f9381f58b6ba9bf01865be7
Instruction Fuzzy Hash: 61E136719083858FD764DF59C480B5BBBE0FF89304F10492EE99A97391D774A809CF86

Function 004015B0 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d347874e94e17a2217a0dc20e9d9653d82e18ffac58338c6f5489616670a27
Instruction ID: 3ceeb9f01f185fd99b8167d9a09416257b1ad7465954055751da435def19fb93
Opcode Fuzzy Hash: 64d347874e94e17a2217a0dc20e9d9653d82e18ffac58338c6f5489616670a27
Instruction Fuzzy Hash: 65D1D032C156A64FE314EF5DEC812357762ABC8300F6E1279CB58173A2CA34F612DB98

Function 00401AB0 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b7d9839d863fb000ff702bf221cb0633bd704a472fd011186c38929c58f0f53
Instruction ID: 78e49fb2be52b2f7f58f30e4f95c54c21e56b5d13c11c68cfb1cca23aa70ab33
Opcode Fuzzy Hash: 8b7d9839d863fb000ff702bf221cb0633bd704a472fd011186c38929c58f0f53
Instruction Fuzzy Hash: 3FD1D3378142664FD394DF59DC852397762EBC9300F1E067DCB5917292C634FA22DB98

Function 004045A0 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed524da47b8aa2ae254806281c4a749b71c931bd55644e6fcbbed78bd4e0280e
Instruction ID: 57494768f0b92b70c1e5fb60671f8c0904b92fa69cceb7a89f96e62002fbccdf
Opcode Fuzzy Hash: ed524da47b8aa2ae254806281c4a749b71c931bd55644e6fcbbed78bd4e0280e
Instruction Fuzzy Hash: 7E61F4112197D29FD311CE3D488026CFFE1EFA71047588B6ED8D287B86C668E56AC7E1

Function 004042D0 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c57aee5bc17977aafdc7c97f7c58be596e940ff6eefc37f40ebb5461949aa7fb
Instruction ID: 69ac4843b161a5063ae5296b824130d1e1d4dd1cf33e14d0e2b6e5324ebe5178
Opcode Fuzzy Hash: c57aee5bc17977aafdc7c97f7c58be596e940ff6eefc37f40ebb5461949aa7fb
Instruction Fuzzy Hash: 78614A725087118FC318DF49D48494AF3E1FFC8328F1A8A6DEA885B361D771E959CB86

Function 004013F0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7edf9d7677cf5a148deedc6415e29e53bd66bb8e929762ed0f0be55657242144
Instruction ID: 22718e2ba8aa9c85a7860933c045bfb99706646b777ed0143ccf77e3315a414a
Opcode Fuzzy Hash: 7edf9d7677cf5a148deedc6415e29e53bd66bb8e929762ed0f0be55657242144
Instruction Fuzzy Hash: 71315871E046B607E320DE1E8C40126BBD3AFD2311F18C27ED5AC8B79EE479955296A4

Function 00401000 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6af16c8484d87dd613c3a1aa62de61aa8fd9c2e42459e8d3272b73d93abbe76
Instruction ID: db6508d24fc9758a38762259af66184612b3ffe3fafafd84facb5b971e2ac8eb
Opcode Fuzzy Hash: b6af16c8484d87dd613c3a1aa62de61aa8fd9c2e42459e8d3272b73d93abbe76
Instruction Fuzzy Hash: D8110A3E370D0607E71C8769AD33BB921C2E385309B88A53DF68BC96D1EEAD9494C50D

Function 00401100 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9de65a982604af57022305bde5ac8764cd96b40e1cb3bce903844e2d22169a83
Instruction ID: 745e0ab5a1f4135cb869288e75bb92ef0094498d29e0feb23aae1f7a6adb8ed7
Opcode Fuzzy Hash: 9de65a982604af57022305bde5ac8764cd96b40e1cb3bce903844e2d22169a83
Instruction Fuzzy Hash: 0111CE37A54A270BD324A96CDC80B777392EB8A354F1A4271DF449F392D538A94282E8

Function 00414150 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00020000,00001000,00000004,08C4B718,?,00000000,?,00000000,0042EEE7,000000FF,00413965), ref: 00414209
__CxxThrowException@8.LIBCMT ref: 00414228

Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27

Strings

C&B, xrefs: 00414185
C&B, xrefs: 00414193
JA, xrefs: 004141B3
PJA, xrefs: 004141BA
C&B, xrefs: 00414177
C&B, xrefs: 0041418C
C&B, xrefs: 004141A1
0?A, xrefs: 004141AD
C&B, xrefs: 0041417E
C&B, xrefs: 0041419A

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AllocExceptionException@8RaiseThrowVirtual
String ID: JA$0?A$C&B$C&B$C&B$C&B$C&B$C&B$C&B$PJA
API String ID: 3950171414-2120522429
Opcode ID: 0d5661974bf269f5af8409563256e4c29114449b89244a4f43cb1bf1215309df
Instruction ID: 260438ba03119f7b615b79ac7b2777a53ea5ea2c99cdc2cdac365c488f08df6f
Opcode Fuzzy Hash: 0d5661974bf269f5af8409563256e4c29114449b89244a4f43cb1bf1215309df
Instruction Fuzzy Hash: E721C4B0504B808FC320CF869544A87FBF4FB98758F109E4FE5A697A50C3B8B148CB99

Function 00415540 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,08C4B718,?,?,00000000,00000000,0042FB21,000000FF,0040AD9B,?,?), ref: 00415582
GetLastError.KERNEL32 ref: 0041558C
WaitForSingleObject.KERNEL32(?,000000FF,08C4B718,?,?,00000000,00000000,0042FB21,000000FF,0040AD9B,?,?), ref: 0041559C
CloseHandle.KERNEL32(?,08C4B718,?,?,00000000,00000000,0042FB21,000000FF,0040AD9B,?,?), ref: 004155B4
GetLastError.KERNEL32 ref: 004155C0
CloseHandle.KERNEL32(?,08C4B718,?,?,00000000,00000000,0042FB21,000000FF,0040AD9B,?,?), ref: 004155DE
GetLastError.KERNEL32 ref: 004155E4
CloseHandle.KERNEL32(?,08C4B718,?,?,00000000,00000000,0042FB21,000000FF,0040AD9B,?,?), ref: 004155FF
GetLastError.KERNEL32 ref: 00415605

Strings

C&B, xrefs: 00415567

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ErrorLast$CloseHandle$EventObjectSingleWait
String ID: C&B
API String ID: 2212007442-3599845651
Opcode ID: c57171be3ed920f45849e8ec44a75f0ffdecc9bc2c30afcfb972f860a568f160
Instruction ID: 665055ef18fc4c7992229bbc331917046034d4750283f4bd9219c4516c9acca3
Opcode Fuzzy Hash: c57171be3ed920f45849e8ec44a75f0ffdecc9bc2c30afcfb972f860a568f160
Instruction Fuzzy Hash: 34219EB1204B42DBD720DF25DC84B97BBE9EB94760F10492EE965C3390D739E848CB69

Function 004064E0 Relevance: 16.7, APIs: 11, Instructions: 177windowCOMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00406531
SetForegroundWindow.USER32(00000000), ref: 00406538
ShowWindow.USER32(?,00000005), ref: 004065B4
PeekMessageW.USER32(00000000,?,00000000,00000000,00000000), ref: 004065CC
DialogBoxParamW.USER32(00400000,?,?,Function_000063F0,?), ref: 004065E9
SetEvent.KERNEL32(?), ref: 004065F6
ShowWindow.USER32(?,00000005), ref: 00406607
PeekMessageW.USER32(00000000,?,00000000,00000000,00000000), ref: 0040661C
MessageBoxW.USER32(?,?,?,?), ref: 00406632
SetEvent.KERNEL32(?), ref: 0040663F

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Window$Message$EventPeekShow$DesktopDialogForegroundParam
String ID:
API String ID: 1049595212-0
Opcode ID: 3d40821ce19ca547cea518ffdd8c62fdf5f8a9e0590e93619e838d0074d6cd98
Instruction ID: c328493347b47e5292b43415d999d64e624e09d027fc7698bf52afcf243555f5
Opcode Fuzzy Hash: 3d40821ce19ca547cea518ffdd8c62fdf5f8a9e0590e93619e838d0074d6cd98
Instruction Fuzzy Hash: D6518176300201AFD624CF58ED88F6BB7A9EBD8711F11852EF64687390C671EC55CBA8

Function 0041D850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 98registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7

Part of subcall function 0041D370: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,08C4B718,?,?,?,00000000,?,?,0042FEA9,000000FF,0041D90D,?,00000004), ref: 0041D3B2
Part of subcall function 0041D370: RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MODAL_DLG,?,?,0042FEA9,000000FF,0041D90D,?,00000004,00000004,00000004,00000004,08C4B718,?,?,00000000,00000000), ref: 0041D3C2
Part of subcall function 0041D370: RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MESSAGE_BOX,?,?,0042FEA9,000000FF,0041D90D,?,00000004,00000004,00000004,00000004,08C4B718,?,?,00000000,00000000), ref: 0041D3CC
Part of subcall function 0041D370: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000004,?,?,0042FEA9,000000FF,0041D90D,?,00000004,00000004,00000004,00000004,08C4B718), ref: 0041D44F
Part of subcall function 0041D370: GetLastError.KERNEL32(?,?,0042FEA9,000000FF,0041D90D,?,00000004,00000004,00000004,00000004,08C4B718,?,?,00000000,00000000,00430209), ref: 0041D458
Part of subcall function 0041D370: __CxxThrowException@8.LIBCMT ref: 0041D470

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000004,00000004,00000004,00000004,08C4B718,?,?,00000000,00000000,00430209,000000FF), ref: 0041D92D
RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MODAL_DLG), ref: 0041D944
RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MESSAGE_BOX), ref: 0041D951

Strings

CDialog::MSG_CREATE_MODAL_DLG, xrefs: 0041D939
0A, xrefs: 0041D897
C&B, xrefs: 0041D877
C&B, xrefs: 0041D87E
CDialog::MSG_CREATE_MESSAGE_BOX, xrefs: 0041D946

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: MessageRegisterWindow$CreateEvent$Exception@8Throw$ErrorLast_malloc
String ID: 0A$C&B$C&B$CDialog::MSG_CREATE_MESSAGE_BOX$CDialog::MSG_CREATE_MODAL_DLG
API String ID: 1053270758-1754678918
Opcode ID: 6b9a2186c4aacdd9aa879c590d57c6f905f6d015003411dcbe7587b3d416dfd2
Instruction ID: ff79ae979ea3c55558c752116325ba362ad5e0a4aeac68ff67176371f723eebb
Opcode Fuzzy Hash: 6b9a2186c4aacdd9aa879c590d57c6f905f6d015003411dcbe7587b3d416dfd2
Instruction Fuzzy Hash: 5A4116B1904B82AEC314CF26C881782FBE4BB58704F508A2EE6A957651C378B558CBD5

Function 0041D370 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85registrywindowCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,08C4B718,?,?,?,00000000,?,?,0042FEA9,000000FF,0041D90D,?,00000004), ref: 0041D3B2
RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MODAL_DLG,?,?,0042FEA9,000000FF,0041D90D,?,00000004,00000004,00000004,00000004,08C4B718,?,?,00000000,00000000), ref: 0041D3C2
RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MESSAGE_BOX,?,?,0042FEA9,000000FF,0041D90D,?,00000004,00000004,00000004,00000004,08C4B718,?,?,00000000,00000000), ref: 0041D3CC

Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7

Part of subcall function 004047C0: InitializeCriticalSection.KERNEL32(?,08C4B718), ref: 004047FE

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000004,?,?,0042FEA9,000000FF,0041D90D,?,00000004,00000004,00000004,00000004,08C4B718), ref: 0041D44F
GetLastError.KERNEL32(?,?,0042FEA9,000000FF,0041D90D,?,00000004,00000004,00000004,00000004,08C4B718,?,?,00000000,00000000,00430209), ref: 0041D458
__CxxThrowException@8.LIBCMT ref: 0041D470

Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27

Strings

CDialog::MSG_CREATE_MODAL_DLG, xrefs: 0041D3BA
CDialog::MSG_CREATE_MESSAGE_BOX, xrefs: 0041D3C4

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CreateEventException@8MessageRegisterThrowWindow$CriticalErrorExceptionInitializeLastRaiseSection_malloc
String ID: CDialog::MSG_CREATE_MESSAGE_BOX$CDialog::MSG_CREATE_MODAL_DLG
API String ID: 2475960406-1515309323
Opcode ID: dd1457a73b0a163e9de1fc32d0a7b1367226a52f8b3e557f26fbd9f6b0ed3806
Instruction ID: ce6adb0846dacee929c4b269caab47ed56b5dce5ab6c1ff985edc843b1e8f192
Opcode Fuzzy Hash: dd1457a73b0a163e9de1fc32d0a7b1367226a52f8b3e557f26fbd9f6b0ed3806
Instruction Fuzzy Hash: E6316FB1604B86AFD304CF29C881B86FFE8FB59354F50462FE19893651C778B458CB99

Function 0041D490 Relevance: 13.6, APIs: 9, Instructions: 95synchronizationwindowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,08C4B718,?,?,?,?,?,?,0042F9F0,000000FF), ref: 0041D4C5
LeaveCriticalSection.KERNEL32(?), ref: 0041D4FC
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041D50E
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0041D518
PostMessageW.USER32(?,?,?,?), ref: 0041D533
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041D53F
CloseHandle.KERNEL32(?), ref: 0041D545
EnterCriticalSection.KERNEL32(?), ref: 0041D55E
LeaveCriticalSection.KERNEL32(?), ref: 0041D587

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CriticalSection$EnterLeaveObjectSingleWait$CloseCreateEventHandleMessagePost
String ID:
API String ID: 3292403733-0
Opcode ID: 2ab1832f6a7bee7da5fac1aacacfabd99e4207771d9bb24a02fab69fbfaa0d40
Instruction ID: f3d772afd4ee5944f76de5045bb3e40646552dd8c4de7b14b0dca013c747943b
Opcode Fuzzy Hash: 2ab1832f6a7bee7da5fac1aacacfabd99e4207771d9bb24a02fab69fbfaa0d40
Instruction Fuzzy Hash: 793134B1204740AFD324CB29CD84B27B7F9FB89724F104A1DF699933A0C7B4A805CB69

Function 0041E8D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 70memorystringwindowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000,00000000,00420E70), ref: 0041E8F3
lstrlenW.KERNEL32(00000000), ref: 0041E900
LocalAlloc.KERNEL32(00000000,00000040), ref: 0041E937
swprintf.LIBCMT ref: 0041E96E
swprintf.LIBCMT ref: 0041E983

Strings

Unknown error 0x%0lX, xrefs: 0041E97B
IDispatch error #%d, xrefs: 0041E966

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: swprintf$AllocFormatLocalMessagelstrlen
String ID: IDispatch error #%d$Unknown error 0x%0lX
API String ID: 1134423501-2934499512
Opcode ID: f6e50c7be8be514e84a0b90db71478859d0b6e887827da412b84fe5d130f3157
Instruction ID: dfc2c100d0fa81078b2a730f8d319b60173ab00cae5a86e14b41508050d6b34f
Opcode Fuzzy Hash: f6e50c7be8be514e84a0b90db71478859d0b6e887827da412b84fe5d130f3157
Instruction Fuzzy Hash: 9C21EBB0600210A7E774DB29ED45FE673A5EF50344F208059F584DB2D1D3B9BC46CB98

Function 0041F630 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 47registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041F654
GetModuleFileNameW.KERNEL32(00000000,?,00002000,?,?,?), ref: 0041F668
RegCreateKeyExW.ADVAPI32 ref: 0041F694
RegSetValueExW.ADVAPI32(?,00000000,00000000,00000004,00000000,00000004), ref: 0041F6B6
RegCloseKey.ADVAPI32(00000000,?,00000000,00000000,00000004,00000000,00000004), ref: 0041F6C0

Strings

Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted, xrefs: 0041F682
, xrefs: 0041F6AE

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CloseCreateFileModuleNameValue_memset
String ID: $Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted
API String ID: 2280741871-2837994659
Opcode ID: 02b76c714ddad47070057f04439b6013b1663233fbc740c1de6452bbb3833300
Instruction ID: 37a7b5702278f112b31955c87cec25a7fde7f3e4c6faff8a8326e10aa8a02003
Opcode Fuzzy Hash: 02b76c714ddad47070057f04439b6013b1663233fbc740c1de6452bbb3833300
Instruction Fuzzy Hash: 1D014071254300BFF214DB50DC8AFAA77A4AB98B04F50841DB7489A1D2DBB46408CB5A

Function 0041B530 Relevance: 10.7, APIs: 7, Instructions: 156windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0041B562
SetWindowTextW.USER32(00000000,?), ref: 0041B570

Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7

Part of subcall function 00421DEE: __lock.LIBCMT ref: 00421E0C
Part of subcall function 00421DEE: ___sbh_find_block.LIBCMT ref: 00421E17
Part of subcall function 00421DEE: ___sbh_free_block.LIBCMT ref: 00421E26
Part of subcall function 00421DEE: RtlFreeHeap.NTDLL(00000000,?,00437B30,0000000C,004244D4,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C), ref: 00421E56
Part of subcall function 00421DEE: GetLastError.KERNEL32(?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA,?,?,?,0042458E,0000000D), ref: 00421E67

SetWindowTextW.USER32(?,?), ref: 0041B5C7
SetDlgItemTextW.USER32(?,000003E8,?), ref: 0041B623
SetDlgItemTextW.USER32(?,00000001,?), ref: 0041B67C
SetDlgItemTextW.USER32(?,00000002,?), ref: 0041B6D5
SendMessageW.USER32(?,00000080,00000001,00000000), ref: 0041B6E7

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Text$Item$Window$ErrorException@8FreeHeapLastMessageSendThrow___sbh_find_block___sbh_free_block__lock_malloc
String ID:
API String ID: 1891682577-0
Opcode ID: fecb2a4def89a8240c9e8e612f865ce2e1e17d5f52b92b10d04138c39b4718b1
Instruction ID: b462c79913f27606fce5be96d1d4db49be7a94859ae037c386c9d335dcadd2b5
Opcode Fuzzy Hash: fecb2a4def89a8240c9e8e612f865ce2e1e17d5f52b92b10d04138c39b4718b1
Instruction Fuzzy Hash: E55164B1508380AFD700EF69DC85B4BBBE4AF98354F50091DF68597292C7B8E544CB67

Function 004154B0 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,00412F53,?,?,?,?,?,?,?,00437FD4), ref: 004154C5
GetLastError.KERNEL32(?,?,?,?,?,?,?,00437FD4), ref: 004154CE
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,00412F53,?,?,?,?,?,?,?,00437FD4), ref: 004154ED
ResetEvent.KERNEL32(00000000,?,?,00412F53,?,?,?,?,?,?,?,00437FD4), ref: 00415501
GetLastError.KERNEL32(?,?,?,?,?,?,?,00437FD4), ref: 0041550D
ResetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00437FD4), ref: 00415513
GetLastError.KERNEL32(?,?,?,?,?,?,?,00437FD4), ref: 00415519

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Event$ErrorLast$CreateReset
String ID:
API String ID: 2684445861-0
Opcode ID: 397fea74b750bfb1b0a927181ac41e1428b8659026dfcbaf32b253da1c8ae01f
Instruction ID: 46a4382e4f685cd8f0a90a1e671664aa1b9fbbb21dc1a77a4e7868b3bece67f6
Opcode Fuzzy Hash: 397fea74b750bfb1b0a927181ac41e1428b8659026dfcbaf32b253da1c8ae01f
Instruction Fuzzy Hash: 00118831300B01EAE7709B79EC80B97B3E95FD0715F10842AE215D6694D7B8F8C58628

Function 0041BEB0 Relevance: 9.1, APIs: 6, Instructions: 114windowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,08C4B718), ref: 0041BEED
LeaveCriticalSection.KERNEL32(?), ref: 0041BEF7
EnterCriticalSection.KERNEL32(?), ref: 0041BF05
LeaveCriticalSection.KERNEL32(?), ref: 0041BF36
MessageBoxW.USER32(?,?,?,00000024), ref: 0041BF65

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Message
String ID:
API String ID: 850481049-0
Opcode ID: 82bad5d4b6450a5f3498c2cc4406a1a758f602ac9f1bfc62ba9b01eb64b1b5c4
Instruction ID: d58ba03eace6790549a51d7cf0a140a1ee8029c9543b5873e91039f9fafb8494
Opcode Fuzzy Hash: 82bad5d4b6450a5f3498c2cc4406a1a758f602ac9f1bfc62ba9b01eb64b1b5c4
Instruction Fuzzy Hash: B94189B5204345AFC324DF28C984BABBBE4FB89314F100619F55583791C738E94ACF9A

Function 0041BD70 Relevance: 9.1, APIs: 6, Instructions: 79windowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0041BD89
LeaveCriticalSection.KERNEL32(?), ref: 0041BD92
PostMessageW.USER32(?,00008000,00000000,00000000), ref: 0041BDB2
EnterCriticalSection.KERNEL32(?), ref: 0041BDBF
LeaveCriticalSection.KERNEL32(?), ref: 0041BDE2
__aulldiv.LIBCMT ref: 0041BE2C

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$MessagePost__aulldiv
String ID:
API String ID: 3743465594-0
Opcode ID: 8ddcddcfe8e5cc343d9f3872b492c1c617b7ef677ad0fa64153c49aec06e9001
Instruction ID: 0f6cecad49a1d158afd731c11dc079c735cde051cd0f7b3838b3757deac6ee7a
Opcode Fuzzy Hash: 8ddcddcfe8e5cc343d9f3872b492c1c617b7ef677ad0fa64153c49aec06e9001
Instruction Fuzzy Hash: 4621BD72604704ABC324EF759D81FABF7E9EB85B00F04081EFA9647341CB75B84987A9

Function 0041C1F0 Relevance: 9.1, APIs: 6, Instructions: 56synchronizationwindowCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041C209
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0041C22B
SendMessageW.USER32(00000000,?,00000000,?), ref: 0041C243
CloseHandle.KERNEL32(?), ref: 0041C24D
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041C259
MessageBoxW.USER32(00000000,?,?,?), ref: 0041C27C

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: MessageObjectSingleWait$CloseCreateEventHandleSend
String ID:
API String ID: 3833482109-0
Opcode ID: 6d17b11e7bcf11a9d7b57836135ff4d9eb2c6b9d4dfdb948564495aa17a6fda9
Instruction ID: a341cd1b27fd06dd4103b1dfc400c87a0f2c7d7423bf8431d21d9bbe00f176ce
Opcode Fuzzy Hash: 6d17b11e7bcf11a9d7b57836135ff4d9eb2c6b9d4dfdb948564495aa17a6fda9
Instruction Fuzzy Hash: 7A110775604301AFD224DF58DD85F5BF7F4EB98B10F108A1EF59593290D6B0E809CBA6

Function 0042DE28 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 0042DE50

Part of subcall function 0042D8E0: __getptd.LIBCMT ref: 0042D8EE
Part of subcall function 0042D8E0: __getptd.LIBCMT ref: 0042D8FC

__getptd.LIBCMT ref: 0042DE5A

Part of subcall function 004244E3: __getptd_noexit.LIBCMT ref: 004244E6
Part of subcall function 004244E3: __amsg_exit.LIBCMT ref: 004244F3

__getptd.LIBCMT ref: 0042DE68
__getptd.LIBCMT ref: 0042DE76
__getptd.LIBCMT ref: 0042DE81
_CallCatchBlock2.LIBCMT ref: 0042DEA7

Part of subcall function 0042D985: __CallSettingFrame@12.LIBCMT ref: 0042D9D1

Part of subcall function 0042DF4E: __getptd.LIBCMT ref: 0042DF5D
Part of subcall function 0042DF4E: __getptd.LIBCMT ref: 0042DF6B

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 732a5a4de1712c62318a0ddeb78ca340981344dd2e45324716b5b23d54ed3c5d
Instruction ID: 2feef8606836cd958bd5a2fd3112628b4059505882e4cd18e6819dd8d5e60df7
Opcode Fuzzy Hash: 732a5a4de1712c62318a0ddeb78ca340981344dd2e45324716b5b23d54ed3c5d
Instruction Fuzzy Hash: 6D1107B1E00219DFDB00EFA5E946BAD7BB0FF08318F50806AF814A7251DB789A11DF58

Function 0041A430 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0041A470

Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42

__CxxThrowException@8.LIBCMT ref: 0041A48C

Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27

GetLastError.KERNEL32(00434200,80000000,00000001), ref: 0041A4D6

Strings

`:A, xrefs: 0041A49B
C&B, xrefs: 0041A491

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AllocateErrorExceptionException@8HeapLastRaiseThrow_malloc
String ID: C&B$`:A
API String ID: 1656954132-1488716206
Opcode ID: 2a486e199a1073192d2ab76fdaf9423da61f3946df1b212c46d744dd35da5e3a
Instruction ID: 1cdb7f40dcaf2c5b6f8298736c64605cc2d4e7cc8bd3ecd4195e4897365a2a63
Opcode Fuzzy Hash: 2a486e199a1073192d2ab76fdaf9423da61f3946df1b212c46d744dd35da5e3a
Instruction Fuzzy Hash: 5F319F71104740AFC320DF19C880B8BBBE8EF8D724F204A1EF59997390C779A945CB96

Function 0041D1A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48registrywindowCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,08C4B718,?,?,?,?,0042F588,000000FF,0041D0DF,?), ref: 0041D1DA
RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MODAL_DLG,?,?,?,?,0042F588,000000FF,0041D0DF,?), ref: 0041D1EE
RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MESSAGE_BOX,?,?,?,?,0042F588,000000FF,0041D0DF,?), ref: 0041D1F8

Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7

Strings

CDialog::MSG_CREATE_MODAL_DLG, xrefs: 0041D1E6
CDialog::MSG_CREATE_MESSAGE_BOX, xrefs: 0041D1F0

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: MessageRegisterWindow$CreateEventException@8Throw_malloc
String ID: CDialog::MSG_CREATE_MESSAGE_BOX$CDialog::MSG_CREATE_MODAL_DLG
API String ID: 1188034692-1515309323
Opcode ID: e5df840c374edb4d314b405cf7927deab87bd118bdc003591a6cefdd6186986a
Instruction ID: 8f30331a7d0a82c71c2cf135fcdddbf6783167e00fcd53bb43b2a30073ddcfa9
Opcode Fuzzy Hash: e5df840c374edb4d314b405cf7927deab87bd118bdc003591a6cefdd6186986a
Instruction Fuzzy Hash: 511179B1A00742AFC300CF15D880B56FBE8FB48760F504A3FE55483B50C378A854CB98

Function 0041B940 Relevance: 8.8, APIs: 7, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,0041C818), ref: 0041B94E
LeaveCriticalSection.KERNEL32(?,?,?,?,0041C818), ref: 0041B95E
EnterCriticalSection.KERNEL32(?), ref: 0041B968
LeaveCriticalSection.KERNEL32(?), ref: 0041B972
Sleep.KERNEL32(00000064), ref: 0041B97D
EnterCriticalSection.KERNEL32(?), ref: 0041B984
LeaveCriticalSection.KERNEL32(?), ref: 0041B98E

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Sleep
String ID:
API String ID: 2348874005-0
Opcode ID: 89fbda83cfde529f4557547a284b07b53fde272b623b93481bab980feee85910
Instruction ID: f1f9374e472945a2e4150c96b9f2f04068727bb37f025097168d847f170bca56
Opcode Fuzzy Hash: 89fbda83cfde529f4557547a284b07b53fde272b623b93481bab980feee85910
Instruction Fuzzy Hash: A6F0F96200E3A57DD71597789C80BDBFFD89F06224F48104AF38442602CB58E45CD3EE

Function 0042DB77 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0042DB91

Part of subcall function 004244E3: __getptd_noexit.LIBCMT ref: 004244E6
Part of subcall function 004244E3: __amsg_exit.LIBCMT ref: 004244F3

__getptd.LIBCMT ref: 0042DBA2
__getptd.LIBCMT ref: 0042DBB0

Strings

MOC, xrefs: 0042DB83
csm, xrefs: 0042DB8A

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: d1bdbd8c26c8a705d5a7a2af35c4b2a202de102865fc560031df8e0dd3ccf076
Instruction ID: 47a718ef4add73cab02364874fd470c84c685f020952b3a97a078907d01c782d
Opcode Fuzzy Hash: d1bdbd8c26c8a705d5a7a2af35c4b2a202de102865fc560031df8e0dd3ccf076
Instruction Fuzzy Hash: A4E01A35B101248FC720AA66E146B2937A4EF84319F9600A7E408C7322C76DEA41964A

Function 00412930 Relevance: 7.6, APIs: 5, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00413180: _malloc.LIBCMT ref: 00413183
Part of subcall function 00413180: __CxxThrowException@8.LIBCMT ref: 004131A1

Part of subcall function 0040AC20: CloseHandle.KERNEL32(?,08C4B718,00000000,?,?,00000000,0042FD93,000000FF,004129BE), ref: 0040AC63
Part of subcall function 0040AC20: GetLastError.KERNEL32(?,00000000,0042FD93,000000FF,004129BE), ref: 0040AC69
Part of subcall function 0040AC20: CloseHandle.KERNEL32(?,08C4B718,00000000,?,?,00000000,0042FD93,000000FF,004129BE), ref: 0040AC81
Part of subcall function 0040AC20: GetLastError.KERNEL32(?,00000000,0042FD93,000000FF,004129BE), ref: 0040AC87
Part of subcall function 0040AC20: CloseHandle.KERNEL32(?,08C4B718,00000000,?,?,00000000,0042FD93,000000FF,004129BE), ref: 0040ACA1
Part of subcall function 0040AC20: GetLastError.KERNEL32(?,00000000,0042FD93,000000FF,004129BE), ref: 0040ACA7

CreateEventW.KERNEL32(00000000,00000001,00000001,00000000), ref: 004129CE
GetLastError.KERNEL32 ref: 004129DA
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 004129F0
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00412A02
GetLastError.KERNEL32 ref: 00412A0F

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ErrorLast$CloseCreateEventHandle$Exception@8Throw_malloc
String ID:
API String ID: 1759989790-0
Opcode ID: 6b857cbb71be1ad28325e6d6b7d75c8c9f3b23fd950410c6b5f2775173ff0025
Instruction ID: d29682d7f2a8e5d8ad5244a4e56567742131bd4529a3a95453868c643860fb60
Opcode Fuzzy Hash: 6b857cbb71be1ad28325e6d6b7d75c8c9f3b23fd950410c6b5f2775173ff0025
Instruction Fuzzy Hash: FF31BA712083009BC720DF19DA84A5BBBF5FBD8720F104A2EF955D7390D7B59884CBAA

Function 0040AC20 Relevance: 7.6, APIs: 6, Instructions: 63COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,08C4B718,00000000,?,?,00000000,0042FD93,000000FF,004129BE), ref: 0040AC63
GetLastError.KERNEL32(?,00000000,0042FD93,000000FF,004129BE), ref: 0040AC69
CloseHandle.KERNEL32(?,08C4B718,00000000,?,?,00000000,0042FD93,000000FF,004129BE), ref: 0040AC81
GetLastError.KERNEL32(?,00000000,0042FD93,000000FF,004129BE), ref: 0040AC87
CloseHandle.KERNEL32(?,08C4B718,00000000,?,?,00000000,0042FD93,000000FF,004129BE), ref: 0040ACA1
GetLastError.KERNEL32(?,00000000,0042FD93,000000FF,004129BE), ref: 0040ACA7

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 01571284487dd8332102ea27bf21fc6b24d93d877b32237917eca0345e84306e
Instruction ID: dcfd2361e2e7680f2d61e14ae5f50a0f0a30a84fdfe528ae2696ca0788a1d8cd
Opcode Fuzzy Hash: 01571284487dd8332102ea27bf21fc6b24d93d877b32237917eca0345e84306e
Instruction Fuzzy Hash: 8D1193B16087418BE320CF25DD44B17B7E8FB40B60F11093EE89193780D73AE518CAAA

Function 00428169 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00428175

Part of subcall function 004244E3: __getptd_noexit.LIBCMT ref: 004244E6
Part of subcall function 004244E3: __amsg_exit.LIBCMT ref: 004244F3

__amsg_exit.LIBCMT ref: 00428195
__lock.LIBCMT ref: 004281A5
InterlockedDecrement.KERNEL32(?), ref: 004281C2
InterlockedIncrement.KERNEL32(024C1660), ref: 004281ED

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 885f7132fb15d35989e5d8cb005eacf4e24859648843b67afef07b52b1d72122
Instruction ID: fd241d50e1f8b1b7d4dc77b21c0c83e36747cdc79bc18032ab753e40f4628816
Opcode Fuzzy Hash: 885f7132fb15d35989e5d8cb005eacf4e24859648843b67afef07b52b1d72122
Instruction Fuzzy Hash: 72018E32B02632ABDA21AB65B94576E7760BF04714F86501FE800B32D0CB6C6952DBDD

Function 00415240 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 00415256
GetLastError.KERNEL32 ref: 00415266
SetEvent.KERNEL32(?), ref: 0041526C
GetLastError.KERNEL32 ref: 00415276
WaitForMultipleObjects.KERNEL32(00000002,00000000,00000000,000000FF), ref: 00415290

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ErrorEventLast$MultipleObjectsResetWait
String ID:
API String ID: 234195192-0
Opcode ID: 09ae9fbb8350569853272b2c8be73804df0dbc38018a1bb2ab0204f4601fc4bc
Instruction ID: 01ba3faf78e38b84e446a84389ce2623cf67465c42dd92f621bab6ccc91c99b8
Opcode Fuzzy Hash: 09ae9fbb8350569853272b2c8be73804df0dbc38018a1bb2ab0204f4601fc4bc
Instruction Fuzzy Hash: B6019E751007019FD320DF64AC80AA7B3F4BBD4710F00892EE969C2740D774E948CF69

Function 00407070 Relevance: 7.5, APIs: 5, Instructions: 36fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,00000007,00000000,00000003,00000080,00000000), ref: 00407084
_memset.LIBCMT ref: 0040709A
GetFileInformationByHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0040710F), ref: 004070A8
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,0040710F), ref: 004070B3
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,0040710F), ref: 004070C1

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Handle$CloseFile$CreateInformation_memset
String ID:
API String ID: 1323354321-0
Opcode ID: 0132f8f558b8720df98c9a6f2a9f479f48355388beba6bfe8d17b00a70df9ae5
Instruction ID: 6e2f4fad45cc1b478236f34afacde46dc3ac694dbfc79934ddf445b22f007f0c
Opcode Fuzzy Hash: 0132f8f558b8720df98c9a6f2a9f479f48355388beba6bfe8d17b00a70df9ae5
Instruction Fuzzy Hash: B4F02E75945310BBD1246324AD0AF873B645F44B24F504B24FF69A61E0E7B4A50CC5DE

Function 0041C190 Relevance: 7.5, APIs: 5, Instructions: 34synchronizationwindowCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041C1A0
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0041C1AA
PostMessageW.USER32(?,?,?,?), ref: 0041C1C5
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041C1D1
CloseHandle.KERNEL32(?), ref: 0041C1D7

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ObjectSingleWait$CloseCreateEventHandleMessagePost
String ID:
API String ID: 1259710111-0
Opcode ID: da4c244dec537242234236758f76901cdaebeb962d90af1f950e35a4ae204856
Instruction ID: 1c2131afe4bbbcb97152305221c9bc3684589986b6a1f07a80391251fe593e57
Opcode Fuzzy Hash: da4c244dec537242234236758f76901cdaebeb962d90af1f950e35a4ae204856
Instruction Fuzzy Hash: F6F0F975204700ABD224DF58EE44F17B7F9EB88720F108A19B666936D0C6B0E804CB64

Function 00422007 Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00423F42: _doexit.LIBCMT ref: 00423F4E

___set_flsgetvalue.LIBCMT ref: 00422019

Part of subcall function 004242F5: TlsGetValue.KERNEL32(?,0042201E), ref: 004242FE
Part of subcall function 004242F5: __decode_pointer.LIBCMT ref: 00424310
Part of subcall function 004242F5: TlsSetValue.KERNEL32(00000000,0042201E), ref: 0042431F

___fls_getvalue@4.LIBCMT ref: 00422024

Part of subcall function 004242D5: TlsGetValue.KERNEL32(?,?,00422029,00000000), ref: 004242E3

___fls_setvalue@8.LIBCMT ref: 00422037

Part of subcall function 00424329: __decode_pointer.LIBCMT ref: 0042433A

GetLastError.KERNEL32(00000000,?,00000000), ref: 00422040
ExitThread.KERNEL32 ref: 00422047
GetCurrentThreadId.KERNEL32 ref: 0042204D
__freefls@4.LIBCMT ref: 0042206D
__IsNonwritableInCurrentImage.LIBCMT ref: 00422080

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 132634196-0
Opcode ID: abb640ab18d0b5c1348d4bac514cf4b1efe66e005ced65b3c2dfaf410d7190e0
Instruction ID: fd81764335df7765f2fb6b6443d515abc26e7ee03fb5a8222b8a574a8caa6766
Opcode Fuzzy Hash: abb640ab18d0b5c1348d4bac514cf4b1efe66e005ced65b3c2dfaf410d7190e0
Instruction Fuzzy Hash: 26E04F35B00235B78F107BB3BE0A99F362CDD91389F810056BB1493516DAACA952C6BD

Function 0041FAF0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 266COMMON

Download Yara Rule

APIs

Part of subcall function 00404E70: _malloc.LIBCMT ref: 00404E89
Part of subcall function 00404E70: __CxxThrowException@8.LIBCMT ref: 00404EA7

Part of subcall function 00421DEE: __lock.LIBCMT ref: 00421E0C
Part of subcall function 00421DEE: ___sbh_find_block.LIBCMT ref: 00421E17
Part of subcall function 00421DEE: ___sbh_free_block.LIBCMT ref: 00421E26
Part of subcall function 00421DEE: RtlFreeHeap.NTDLL(00000000,?,00437B30,0000000C,004244D4,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C), ref: 00421E56
Part of subcall function 00421DEE: GetLastError.KERNEL32(?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA,?,?,?,0042458E,0000000D), ref: 00421E67

Part of subcall function 004080C0: FindNextFileW.KERNELBASE(08C4B718,?,?,00000000), ref: 004080ED

FindClose.KERNEL32(?,?,mia.lib), ref: 0041FDD6

Strings

mia.lib, xrefs: 0041FB04

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Find$CloseErrorException@8FileFreeHeapLastNextThrow___sbh_find_block___sbh_free_block__lock_malloc
String ID: mia.lib
API String ID: 2885634111-3926378727
Opcode ID: 71f4638a6ae644f42298eee8070a1b42ea51541f1e3e248e4cfab438333584da
Instruction ID: 8b4ee6a9bcb3ced087b9b546e1ec6741e99afcab16ee143dc5f2577b8edc9a86
Opcode Fuzzy Hash: 71f4638a6ae644f42298eee8070a1b42ea51541f1e3e248e4cfab438333584da
Instruction Fuzzy Hash: DDB19F716083808FC720DF28C88079BB7E1BF95318F544A2EE5D997351D739A98AC79B

Function 00417D80 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00417D8A

Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42

__CxxThrowException@8.LIBCMT ref: 00417DA8

Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27

Strings

C&B, xrefs: 00417DB3
P!@, xrefs: 00417DAD

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID: C&B$P!@
API String ID: 2732643326-2732990258
Opcode ID: ef0825c52d97dfa396775a1bbff741b6f9787908cb828aca66d1adbd8e82940c
Instruction ID: 6c4891182d0843430d5aa2e3f13a61663bb5cfbeeb03675ddc0dc77422dc16fb
Opcode Fuzzy Hash: ef0825c52d97dfa396775a1bbff741b6f9787908cb828aca66d1adbd8e82940c
Instruction Fuzzy Hash: 860192716017109FC324CF69D845957B7E4FF89750B00C92EE5668B750C778E545CB94

Function 0042E1D5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 0042E1E8

Part of subcall function 0042E143: ___BuildCatchObjectHelper.LIBCMT ref: 0042E179

_UnwindNestedFrames.LIBCMT ref: 0042E1FF
___FrameUnwindToState.LIBCMT ref: 0042E20D

Strings

csm, xrefs: 0042E1E4, 0042E1F9, 0042E20C, 0042E22A, 0042E23A

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: a1cdc47254b0d1e876ebf16cdfd679722edd35116a1de451e27b255c7f3a5f87
Instruction ID: 501dba1919913278d24567a8fb0c29bd8aa274bf433fc8a0c0296e56aab0cabf
Opcode Fuzzy Hash: a1cdc47254b0d1e876ebf16cdfd679722edd35116a1de451e27b255c7f3a5f87
Instruction Fuzzy Hash: 86014B3150112ABBCF126F52EC45EEB7F6AEF18344F444016BC1815121DB7A99B1DBA8

Function 0042973D Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00429771
__isleadbyte_l.LIBCMT ref: 004297A5
MultiByteToWideChar.KERNEL32(00000080,00000009,0042592B,?,00000000,00000000,?,?,?,?,0042592B,00000000,?), ref: 004297D6
MultiByteToWideChar.KERNEL32(00000080,00000009,0042592B,00000001,00000000,00000000,?,?,?,?,0042592B,00000000,?), ref: 00429844

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: b427793e77801bdb7ba370c3e6adb68a2c31af849afecf8bb8cfe1dd9eb1ff06
Instruction ID: 9c24f66b49e3da99480367bb5e631a60a5aacc6aab19caaf07062d906febf1f7
Opcode Fuzzy Hash: b427793e77801bdb7ba370c3e6adb68a2c31af849afecf8bb8cfe1dd9eb1ff06
Instruction Fuzzy Hash: 9D31F331B20366EFDB10EF64E8809AE3BB4FF41310F58456AE0658B291D334DD40DB58

Function 00414250 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,08C4B718,?,000000FF,0042EA77,000000FF,00414134,?), ref: 004142C3

Strings

JA, xrefs: 0041427B
PJA, xrefs: 00414282
0?A, xrefs: 00414275

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: FreeVirtual
String ID: JA$0?A$PJA
API String ID: 1263568516-2687202105
Opcode ID: 2d88bd622d4eed4683b29214fa8f1cad973849dcd576eb5995ac585f71bd9563
Instruction ID: 57a710f7211706a9fe31a66cfd9e96bb7129449c188aa58f507e00ff06fc2ee7
Opcode Fuzzy Hash: 2d88bd622d4eed4683b29214fa8f1cad973849dcd576eb5995ac585f71bd9563
Instruction Fuzzy Hash: 63316D74204B818FC320CF55C844B97B7E8BF88754F148A4DE5969B790C7B9F849CB99

Function 00415100 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00415125

Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42

__CxxThrowException@8.LIBCMT ref: 00415143

Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27

_malloc.LIBCMT ref: 0041516C
__CxxThrowException@8.LIBCMT ref: 00415188

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw_malloc$AllocateExceptionHeapRaise
String ID:
API String ID: 82271797-0
Opcode ID: 628c01bc56a7d7ebefc01971975c629e826112fae3ae03c7ba76f33a046b030a
Instruction ID: def4db18d05b99ab4d6b26ffbfca84adb2a4381ad4f7d30a934532bce5ddbadc
Opcode Fuzzy Hash: 628c01bc56a7d7ebefc01971975c629e826112fae3ae03c7ba76f33a046b030a
Instruction Fuzzy Hash: 0A217CB1A04751AFC320DF1AC881A4AFBE4FF9C714F508A2EF49983350D739A945CB96

Function 00408A00 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00408A15
GetLastError.KERNEL32 ref: 00408A21
GetWindowTextW.USER32(?,?,00000001), ref: 00408A4B
GetLastError.KERNEL32 ref: 00408A77

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ErrorLastTextWindow$Length
String ID:
API String ID: 3440162706-0
Opcode ID: e8e012cd79b6b6bd25b8c7b73373170b438c3aa796ec5f42770a3d37ac7ff58f
Instruction ID: b6694d03e0650564e1b12933c6f234b168eb3154b6e7cc2141c97879f5f5d7ed
Opcode Fuzzy Hash: e8e012cd79b6b6bd25b8c7b73373170b438c3aa796ec5f42770a3d37ac7ff58f
Instruction Fuzzy Hash: 9C118B352145128FDB24DF38F94491BB3E5EFD4710714957EE086D3B94EB34E882CA94

Function 00415450 Relevance: 6.0, APIs: 4, Instructions: 36synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00415462
SetEvent.KERNEL32(?), ref: 00415484
GetLastError.KERNEL32 ref: 0041548A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00415492

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ObjectSingleWait$ErrorEventLast
String ID:
API String ID: 3117263442-0
Opcode ID: 6a9d534bb34e468436ed8922fd9e4c3005a7b31566cd882573cdaab6cdfd99fd
Instruction ID: d9c54cf6459ccd85d0f03389fa364b2fe510f0e71b5d1dca3e53b888f90a5fab
Opcode Fuzzy Hash: 6a9d534bb34e468436ed8922fd9e4c3005a7b31566cd882573cdaab6cdfd99fd
Instruction Fuzzy Hash: E0F03675104B059FD720DB69DD40A5BB3E86B89630B104B19E265933A0C774F8818758

Function 00412B00 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 00412B1D
GetLastError.KERNEL32 ref: 00412B23
ResetEvent.KERNEL32(?), ref: 00412B2D
GetLastError.KERNEL32 ref: 00412B33

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ErrorEventLastReset
String ID:
API String ID: 1621066496-0
Opcode ID: f7a27fea00bfa5551196a168a4661de4bb9f1662255f7ccbc6010f2a403cdef1
Instruction ID: 67aa9b638b15eb6519ceb2daf01db011a7dda1e32d9d81611401a8271e3f4563
Opcode Fuzzy Hash: f7a27fea00bfa5551196a168a4661de4bb9f1662255f7ccbc6010f2a403cdef1
Instruction Fuzzy Hash: 74F0827A600705CF8734AF6AEE80857B7F8EF88251301487ADA55D3211D7B4F895CBA8

Function 00427ECD Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00427ED9

Part of subcall function 004244E3: __getptd_noexit.LIBCMT ref: 004244E6
Part of subcall function 004244E3: __amsg_exit.LIBCMT ref: 004244F3

__getptd.LIBCMT ref: 00427EF0
__amsg_exit.LIBCMT ref: 00427EFE
__lock.LIBCMT ref: 00427F0E

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 05403a0301a6ba57545f7ca89f60679739f76aad3f481758a75143d10c6437fd
Instruction ID: 33523e4aa4e58cc1d750080c8846bc6e86dc2b4c69a7a1b864837c0295b8a662
Opcode Fuzzy Hash: 05403a0301a6ba57545f7ca89f60679739f76aad3f481758a75143d10c6437fd
Instruction Fuzzy Hash: 66F09632B0C3309AD721BB65B50675D73A0AF40728F92415FE450A73D1CBBC5A01DB9E

Function 00411BA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00411BC8

Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42

__CxxThrowException@8.LIBCMT ref: 00411BE4

Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27

Strings

AC, xrefs: 00411BAD

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID: AC
API String ID: 2732643326-3250319772
Opcode ID: 934699a12a52b3141aafc0e45caf1c944e9b6928602c3da0ff549bbca788445f
Instruction ID: ab5f602e63adf12e9f9b42bdfad0bbc760dd87d5a89e028d2f0e125979789b22
Opcode Fuzzy Hash: 934699a12a52b3141aafc0e45caf1c944e9b6928602c3da0ff549bbca788445f
Instruction Fuzzy Hash: 9A11E1B12047018FC324DF19D881B57B3E4EB88714F004A2EE596C73A1E738E848CB96

Function 0040C030 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040C082

Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42

__CxxThrowException@8.LIBCMT ref: 0040C09E

Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27

Strings

C&B, xrefs: 0040C058

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID: C&B
API String ID: 2732643326-3599845651
Opcode ID: 5f8e0597f3182be47e06ce787f4affd8efcdedbadb727185b073082a8d2aa648
Instruction ID: 673f2574accb9efc1f410de1bcad0332c86955ef32305ba439929ca51ee66969
Opcode Fuzzy Hash: 5f8e0597f3182be47e06ce787f4affd8efcdedbadb727185b073082a8d2aa648
Instruction Fuzzy Hash: B62167B1604B42EFC314CF5AD880A46FBF8FB88714F508A2FE15883740D379A959CBA5

Function 0042DF4E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042D933: __getptd.LIBCMT ref: 0042D939
Part of subcall function 0042D933: __getptd.LIBCMT ref: 0042D949

__getptd.LIBCMT ref: 0042DF5D

Part of subcall function 004244E3: __getptd_noexit.LIBCMT ref: 004244E6
Part of subcall function 004244E3: __amsg_exit.LIBCMT ref: 004244F3

__getptd.LIBCMT ref: 0042DF6B

Strings

csm, xrefs: 0042DF79

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 199eeb7c63e04620263b730f4c137685cbdcdb6679406dd5ea4a7cea4fc582b9
Instruction ID: bf84cde6f23fa0aa79f4f710d2ea78ec4cd8ee9a8d4c5decabd064020991354a
Opcode Fuzzy Hash: 199eeb7c63e04620263b730f4c137685cbdcdb6679406dd5ea4a7cea4fc582b9
Instruction Fuzzy Hash: EB012874E002248ECF34EF21F640AAEB3F5AF50315F96442FE08256691CB788AA1CA5D

Function 00418220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00418227

Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42

__CxxThrowException@8.LIBCMT ref: 00418245

Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27

Strings

C&B, xrefs: 0041824F

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID: C&B
API String ID: 2732643326-3599845651
Opcode ID: 0018449c9cc5969ef64ad9f66a75052b5252505b41bac9490c8dbc4052e981ae
Instruction ID: 3e576634322811acd3d1ac759d3a191cb1e7305ee3e78df6768dc5e4f091bde8
Opcode Fuzzy Hash: 0018449c9cc5969ef64ad9f66a75052b5252505b41bac9490c8dbc4052e981ae
Instruction Fuzzy Hash: 79E022B09007106AC7215BE098012C7B7D0AB46754F01ED5FF68587201CB7CA408879A

Function 00416490 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00416493

Part of subcall function 00421ECB: __FF_MSGBANNER.LIBCMT ref: 00421EEE
Part of subcall function 00421ECB: __NMSG_WRITE.LIBCMT ref: 00421EF5
Part of subcall function 00421ECB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00424AEF,?,00000001,?,?,00422F29,00000018,00437BF8,0000000C,00422FBA), ref: 00421F42

__CxxThrowException@8.LIBCMT ref: 004164B1

Part of subcall function 0042D9E5: RaiseException.KERNEL32(?,?,?,00404EAC,?,?,?,?,?,00404EAC,?,00438008), ref: 0042DA27

Strings

C&B, xrefs: 004164B6

Memory Dump Source

Source File: 00000000.00000002.2254515451.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2254409566.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254585775.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254635606.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2254682637.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID: C&B
API String ID: 2732643326-3599845651
Opcode ID: 03b8cf24b1c06656392e758bb381557a573019dbe4851daa8f3d5fbae38c5826
Instruction ID: 11d43d463d30091cd7fc968f8fd7abacb3bf7297c3e1db42a875208d6af1d08c
Opcode Fuzzy Hash: 03b8cf24b1c06656392e758bb381557a573019dbe4851daa8f3d5fbae38c5826
Instruction Fuzzy Hash: 5AE092F05083409ECB088F14E80A887BBE4AB45304F06D4AFF4098B363C778D509CB5E

Analysis Process: cfrv_4_0_setup_ALL.exePID: 7624, Parent PID: 7520COMMON

Execution Graph

Execution Coverage:	7.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.6%
Total number of Nodes:	1867
Total number of Limit Nodes:	23

Executed Functions

Function 6CD6AE70 Relevance: 22.4, APIs: 2, Strings: 10, Instructions: 1392COMMON

Download Yara Rule

APIs

Part of subcall function 6CD707D0: CharUpperW.USER32(?,00000000,?,6CD6FCF3,?,6CD6FE6C,?,00000000,?,00000010,58E5B5EE,?,00000000,00000000), ref: 6CD707F7
Part of subcall function 6CD707D0: CharUpperW.USER32(?,?,6CD6FE6C,?,00000000,?,00000010,58E5B5EE,?,00000000,00000000), ref: 6CD70804

_memset.LIBCMT ref: 6CD6B3D4
VariantClear.OLEAUT32(?), ref: 6CD6BEEE

Strings

r, xrefs: 6CD6B899
rar, xrefs: 6CD6B8F8
R, xrefs: 6CD6B891
udf, xrefs: 6CD6BA33
001, xrefs: 6CD6B76A
a, xrefs: 6CD6B895
Unknown error, xrefs: 6CD6BEB2, 6CD6BEB7
!, xrefs: 6CD6B89D
exe, xrefs: 6CD6B192
iso, xrefs: 6CD6B996

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CharUpper$ClearVariant_memset
String ID: !$001$R$Unknown error$a$exe$iso$r$rar$udf
API String ID: 2702283269-2136912355
Opcode ID: 829eee6b635b75882d98d236f685f539afdb81b11e0a038dba98ae7fd92c8684
Instruction ID: 1f392da1f250d8cc3c2530abc7b67ca8accd1b36e7fd7fb5bce189253fa96e5e
Opcode Fuzzy Hash: 829eee6b635b75882d98d236f685f539afdb81b11e0a038dba98ae7fd92c8684
Instruction Fuzzy Hash: F8C27D75901228DFDB20DF29CC80BDAB7B5AF49304F5441D9E949ABB60DB31AE85CF90

Function 6CD68AB0 Relevance: 16.8, APIs: 7, Strings: 2, Instructions: 1018
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindClose.KERNEL32(FFFFFFFF,?), ref: 6CD68BF9
_malloc.LIBCMT ref: 6CD68CB0
__CxxThrowException@8.LIBCMT ref: 6CD68CCA
__CxxThrowException@8.LIBCMT ref: 6CD68CE1
__CxxThrowException@8.LIBCMT ref: 6CD68CF8
FindClose.KERNEL32(FFFFFFFF,?), ref: 6CD68EA0
__CxxThrowException@8.LIBCMT ref: 6CD6997B

Part of subcall function 6CD8663B: RaiseException.KERNEL32(?,6CD80629,58E5B5EE,?,?,6CD80629,?,6CD98388,58E5B5EE), ref: 6CD8667D

Strings

rar, xrefs: 6CD690BC
001, xrefs: 6CD69003

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw$CloseFind$ExceptionRaise_malloc
String ID: 001$rar
API String ID: 231924613-402399766
Opcode ID: 27ebea4253d0181262245126ef7408234f15c4a47471cd58c74e386a4a0c64e8
Instruction ID: bd931e572ba1871f5f27daa97562a2e8d0fc493839991082f566d9d52214c5ac
Opcode Fuzzy Hash: 27ebea4253d0181262245126ef7408234f15c4a47471cd58c74e386a4a0c64e8
Instruction Fuzzy Hash: 56925AB5508381DFD324CF69C880A9BB7F5BF89304F548A2EE59987761D731E805CB62

Function 6CD82A30 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 122
libraryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 6CD82B0E
FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 6CD82B20
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 6CD82B3C
FindClose.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 6CD82B48
FindResourceW.KERNEL32(6CD60000,00000068,RC_DATA), ref: 6CD82B7E
LoadLibraryW.KERNEL32(?,?), ref: 6CD82BA7

Strings

7z.dll, xrefs: 6CD82AAC
RC_DATA, xrefs: 6CD82B76

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Find$LibraryLoad$CloseFileFirstResource_memset
String ID: 7z.dll$RC_DATA
API String ID: 597928718-3209790242
Opcode ID: ec37cf0298324216820d31aa057802276cc130596ff548a384da9f6fe85c307b
Instruction ID: d0aeae43caa1c1e9c9617e3ab71d1bcc4d9327a5e4524d00cf9d305a36656613
Opcode Fuzzy Hash: ec37cf0298324216820d31aa057802276cc130596ff548a384da9f6fe85c307b
Instruction Fuzzy Hash: E441A27560A3409BD710DF64CD88B9B77E8AB8975CF400A1DF58A97660EB34E50CCBA2

Function 6CD735F0 Relevance: 13.0, APIs: 8, Instructions: 979COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(FFFFFFFF,?), ref: 6CD737C4
GetLastError.KERNEL32(?), ref: 6CD737D1

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CloseErrorFindLast
String ID:
API String ID: 754982922-0
Opcode ID: e7544c629f2f4b62fe66d86f1c0f0bfdac18efb609477cb6a00b9756c86b1e1f
Instruction ID: fcd7ec9c87e09f1d30b762de749d5b84b3e3553fdc1a3279d7d7ccc5932c17d8
Opcode Fuzzy Hash: e7544c629f2f4b62fe66d86f1c0f0bfdac18efb609477cb6a00b9756c86b1e1f
Instruction Fuzzy Hash: 48828EB1608341DFD724CF28C480B9BB7E5AF89318F144A1DF99A97760D771E849CBA2

Function 6CD82980 Relevance: 10.6, APIs: 7, Instructions: 74
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadResource.KERNEL32(6CD60000,00000000,6CD60000,?,?,6CD82B94,?), ref: 6CD82993
SizeofResource.KERNEL32(6CD60000,00000000), ref: 6CD829A1
LockResource.KERNEL32(00000000), ref: 6CD829AE
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 6CD829CF
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 6CD829E5
CloseHandle.KERNEL32(00000000), ref: 6CD829FA
DeleteFileW.KERNEL32(00000000), ref: 6CD82A0A

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: FileResource$CloseCreateDeleteHandleLoadLockSizeofWrite
String ID:
API String ID: 406028064-0
Opcode ID: 24f4d8866b0ad8794811aa1ff20e837452a6bb10036fd177cc4de11cd8e3348f
Instruction ID: 452b0065c17e28d6c750f5e669f273bb07a232db4494ac8bea3ea5b152dd1c31
Opcode Fuzzy Hash: 24f4d8866b0ad8794811aa1ff20e837452a6bb10036fd177cc4de11cd8e3348f
Instruction Fuzzy Hash: 43113B39742604BBE7209FA98C8DF9BBB7CDF86665F104165FF49E7280D671C80182B0

Function 6CD74C00 Relevance: 9.6, APIs: 6, Instructions: 589
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6CD72470: FindClose.KERNEL32(?,58E5B5EE,6CD90658,00000000), ref: 6CD724C4
Part of subcall function 6CD72470: FindFirstFileW.KERNEL32(6CD950B8,?,58E5B5EE,6CD90658,00000000), ref: 6CD724DE
Part of subcall function 6CD72470: FindFirstFileW.KERNEL32(?,?), ref: 6CD7253A

FindClose.KERNEL32(FFFFFFFF,?,?,?,?,?,?,?,?,?,?), ref: 6CD74CE0

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c999fb2287fa7b1483be04e17902097ca615b8e83ce8b05c1afa8a5804f94eb2
Instruction ID: acd433a84d43e55a124a483417d36f8bec841343e85f6f1aec61c01d630a6967
Opcode Fuzzy Hash: c999fb2287fa7b1483be04e17902097ca615b8e83ce8b05c1afa8a5804f94eb2
Instruction Fuzzy Hash: A6324AB1508380CFD320CF69C480A9BB7E5BF89314F544A2EE59997760E771E945CBA3

Function 6CD72470 Relevance: 4.6, APIs: 3, Instructions: 86fileCOMMON

Download Yara Rule

APIs

FindClose.KERNEL32(?,58E5B5EE,6CD90658,00000000), ref: 6CD724C4
FindFirstFileW.KERNEL32(6CD950B8,?,58E5B5EE,6CD90658,00000000), ref: 6CD724DE
FindFirstFileW.KERNEL32(?,?), ref: 6CD7253A

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Find$FileFirst$Close
String ID:
API String ID: 2810966245-0
Opcode ID: c028b19ace41fee82e7d9539c5b723e0ca48fb9afa7b10e5032d9b6fc913dde1
Instruction ID: 50738ff217618558446de8dd9fbc16f2faa032eb953cdf86f2df598f5ff96a70
Opcode Fuzzy Hash: c028b19ace41fee82e7d9539c5b723e0ca48fb9afa7b10e5032d9b6fc913dde1
Instruction Fuzzy Hash: AF317275509741DFD710DF24C84979BB7E8FF49328F100B1DE5A983690E730A909CBA2

Function 10001B41 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 10001B4B

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 62b61814a3264c2a0f4f706347acbeacecd619b648c4921b8ba18a43bc66cf00
Instruction ID: d3e97598432a4a316c69c7b199a975740681d618dafaa63f0622d860b7c48d59
Opcode Fuzzy Hash: 62b61814a3264c2a0f4f706347acbeacecd619b648c4921b8ba18a43bc66cf00
Instruction Fuzzy Hash: A9C09B7490431D97DB00E7E5D9C9D8EB7FCB608204F500451E555F3141E670F94587A1

Function 6CD782B0 Relevance: 51.5, APIs: 28, Strings: 1, Instructions: 779
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CxxThrowException@8.LIBCMT ref: 6CD784B2
__CxxThrowException@8.LIBCMT ref: 6CD78687
__CxxThrowException@8.LIBCMT ref: 6CD786ED
__CxxThrowException@8.LIBCMT ref: 6CD78708
__CxxThrowException@8.LIBCMT ref: 6CD78723
__CxxThrowException@8.LIBCMT ref: 6CD7874D
__CxxThrowException@8.LIBCMT ref: 6CD7882F
__CxxThrowException@8.LIBCMT ref: 6CD78A68
__CxxThrowException@8.LIBCMT ref: 6CD78A83
__CxxThrowException@8.LIBCMT ref: 6CD78A9E
__CxxThrowException@8.LIBCMT ref: 6CD78AF2
__CxxThrowException@8.LIBCMT ref: 6CD78324

Part of subcall function 6CD8663B: RaiseException.KERNEL32(?,6CD80629,58E5B5EE,?,?,6CD80629,?,6CD98388,58E5B5EE), ref: 6CD8667D

__CxxThrowException@8.LIBCMT ref: 6CD78390
_malloc.LIBCMT ref: 6CD783B1
__CxxThrowException@8.LIBCMT ref: 6CD783CB
__CxxThrowException@8.LIBCMT ref: 6CD78416
__CxxThrowException@8.LIBCMT ref: 6CD78468
__CxxThrowException@8.LIBCMT ref: 6CD78CE4
__CxxThrowException@8.LIBCMT ref: 6CD78CF9
__CxxThrowException@8.LIBCMT ref: 6CD78D14

Strings

7zCon.sfx, xrefs: 6CD784F2

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise_malloc
String ID: 7zCon.sfx
API String ID: 1305767944-1084822657
Opcode ID: 75ee4691a954f6ca531c87643614847d29e0ea899b5317405cf9a171edb43313
Instruction ID: d6a01668d26962fb2e256ff2ca98bb5507a02173508e34a5b2f9791a6ebd5086
Opcode Fuzzy Hash: 75ee4691a954f6ca531c87643614847d29e0ea899b5317405cf9a171edb43313
Instruction Fuzzy Hash: 2562AB71801258DBDB21CBA4CD80BDEB7B8AF48308F1486DAD149B7661DB749B89CF71

Function 10004859 Relevance: 30.7, APIs: 16, Strings: 1, Instructions: 904COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000485E

Part of subcall function 100081EF: __EH_prolog.LIBCMT ref: 100081F4

Part of subcall function 10017690: InitializeCriticalSection.KERNEL32 ref: 100176BE

DeleteCriticalSection.KERNEL32(?), ref: 10004A99
SysFreeString.OLEAUT32(?), ref: 10004D73
DeleteCriticalSection.KERNEL32(?,00000000,?,00000000), ref: 10004E67
DeleteCriticalSection.KERNEL32(?,00000000,?,00000000), ref: 10004ED2
DeleteCriticalSection.KERNEL32(?,00000000,?,00000000), ref: 10004F2E
DeleteCriticalSection.KERNEL32(?), ref: 10005080
DeleteCriticalSection.KERNEL32(?), ref: 100050D7
DeleteCriticalSection.KERNEL32(?), ref: 10005131
DeleteCriticalSection.KERNEL32(?), ref: 1000519C
SysFreeString.OLEAUT32(?), ref: 100051C5
DeleteCriticalSection.KERNEL32(?), ref: 10005201
SysFreeString.OLEAUT32(?), ref: 10005238
DeleteCriticalSection.KERNEL32(?), ref: 10005274
DeleteCriticalSection.KERNEL32(?), ref: 100052EC
DeleteCriticalSection.KERNEL32(?), ref: 1000537C

Strings

*, xrefs: 100053D3

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CriticalSection$Delete$FreeString$H_prolog$Initialize
String ID: *
API String ID: 3004459923-163128923
Opcode ID: a2fd4f51cf098088f1d673df1d5e7e4f5325e63a52518889363f111df623ee90
Instruction ID: ecb8a8915c69c7c96d6c908040f4422d87eeaffb21051c4ea884642e96cadca4
Opcode Fuzzy Hash: a2fd4f51cf098088f1d673df1d5e7e4f5325e63a52518889363f111df623ee90
Instruction Fuzzy Hash: C3926B74900289DFEF04CFA4C884ADDBBB5FF19344F21849CE446AB256CB71AA89CF51

Function 6CD83EF0 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 431
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-i, xrefs: 6CD83FF8, 6CD84110
-x, xrefs: 6CD841BA, 6CD84256
-p, xrefs: 6CD842F4
7za L , xrefs: 6CD83F2F
!, xrefs: 6CD84375

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID:
String ID: -i$ -p$ -x$!$7za L
API String ID: 0-2873427068
Opcode ID: 43315624232320bd146766df0ed35b4cc092d6e63f3dd50cebf83c056553890d
Instruction ID: 37db3e7c97359603f1497ad6a96f3010f5185a06d08d7450b5c3309bf81ac2d8
Opcode Fuzzy Hash: 43315624232320bd146766df0ed35b4cc092d6e63f3dd50cebf83c056553890d
Instruction Fuzzy Hash: ECF18772D02248EBDB04DBE4C940BDFBBB9AF54308F148559E5057B761E774AA08CBB1

Function 6CD642E0 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 538
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6CD62670: __CxxThrowException@8.LIBCMT ref: 6CD62688

Part of subcall function 6CD64D10: _malloc.LIBCMT ref: 6CD64D3A
Part of subcall function 6CD64D10: __CxxThrowException@8.LIBCMT ref: 6CD64D54

__CxxThrowException@8.LIBCMT ref: 6CD646C2

Part of subcall function 6CD8663B: RaiseException.KERNEL32(?,6CD80629,58E5B5EE,?,?,6CD80629,?,6CD98388,58E5B5EE), ref: 6CD8667D

__CxxThrowException@8.LIBCMT ref: 6CD64855
__CxxThrowException@8.LIBCMT ref: 6CD64876
CharUpperW.USER32(?), ref: 6CD64943

Strings

Incorrect command line, xrefs: 6CD6431B, 6CD6433E, 6CD6454F, 6CD64579, 6CD648F9
Cannot use absolute pathnames for this command, xrefs: 6CD64521

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw$CharExceptionRaiseUpper_malloc
String ID: Cannot use absolute pathnames for this command$Incorrect command line
API String ID: 2609558216-724315024
Opcode ID: 56a6478220cc2e440e1ea751973d68fead017225cc410575e9ae83f54d68149d
Instruction ID: 41c1c7bfcba0e6cad718d17864bd00f661218a3b773499d1ba978d44be80d051
Opcode Fuzzy Hash: 56a6478220cc2e440e1ea751973d68fead017225cc410575e9ae83f54d68149d
Instruction Fuzzy Hash: A522D475508380DFD701CF25C490B96BBE1AF8530CF188A9DE4994BFA2C771E949CBA2

Function 1001A421 Relevance: 9.1, APIs: 6, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNEL32(?,00100000,00004000,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A459
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A464
HeapFree.KERNEL32(00000000,?,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A471
HeapFree.KERNEL32(00000000,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A48D
VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000,?,?,10019FC1,1001A015,?,?,?), ref: 1001A4AE
HeapDestroy.KERNELBASE(?,?,10019FC1,1001A015,?,?,?), ref: 1001A4C0

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Free$HeapVirtual$Destroy
String ID:
API String ID: 716807051-0
Opcode ID: a134391120f2aacd7473546f5f7e68fbc99744a2b02380d7265d2bcfbbc009a3
Instruction ID: 1c740d521b0f7e213dbb02f6402200852ca7cbed31c7f2444751ff5461a08e8a
Opcode Fuzzy Hash: a134391120f2aacd7473546f5f7e68fbc99744a2b02380d7265d2bcfbbc009a3
Instruction Fuzzy Hash: 5A110035240365BBE661EB10DCCAF05B7A6E785750F314026FA456A571C7B2BCA2CB14

Function 6CD769E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000002,58E5B5EE,6CD9FCC8,00000000), ref: 6CD76A18
FreeLibrary.KERNEL32(00000000), ref: 6CD76A38
FreeLibrary.KERNEL32(00000000,58E5B5EE,6CD9FCC8,00000000), ref: 6CD76A84
GetProcAddress.KERNEL32(?,CreateObject), ref: 6CD76AA5

Strings

CreateObject, xrefs: 6CD76A9D

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Library$Free$AddressLoadProc
String ID: CreateObject
API String ID: 1386263645-166191583
Opcode ID: 13da2552944b49469baa61c07e357278f769dfa2e9d5ce6784b8b84a900eaaee
Instruction ID: 824f70316f45684fb4453220ee60815d095c207eae329720280cc318b67e94ad
Opcode Fuzzy Hash: 13da2552944b49469baa61c07e357278f769dfa2e9d5ce6784b8b84a900eaaee
Instruction Fuzzy Hash: A8415B75A40705EBEB10DF66C480A9EBBF9FB49314F10861AE829DB790E734E905CB60

Function 6CD6C2D0 Relevance: 7.6, APIs: 5, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CxxThrowException@8.LIBCMT ref: 6CD6C32F

Part of subcall function 6CD8663B: RaiseException.KERNEL32(?,6CD80629,58E5B5EE,?,?,6CD80629,?,6CD98388,58E5B5EE), ref: 6CD8667D

_malloc.LIBCMT ref: 6CD6C313

Part of subcall function 6CD85F2A: __FF_MSGBANNER.LIBCMT ref: 6CD85F4D
Part of subcall function 6CD85F2A: __NMSG_WRITE.LIBCMT ref: 6CD85F54
Part of subcall function 6CD85F2A: RtlAllocateHeap.NTDLL(00000000,6CD6FA6F,?,00000000,?,?,6CD64D3F,0000000C,58E5B5EE,?,?,00000000,?,?,6CD8EF9B,000000FF), ref: 6CD85FA1

_malloc.LIBCMT ref: 6CD6C353
__CxxThrowException@8.LIBCMT ref: 6CD6C36F
GetLastError.KERNEL32(6CD94C28,80000000,00000001,00000003), ref: 6CD6C3BC

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw_malloc$AllocateErrorExceptionHeapLastRaise
String ID:
API String ID: 2571202727-0
Opcode ID: 587932c01ea1444d1c2b0f3667ea880ecf6c368eb9ac86f3410568bb4629ab53
Instruction ID: 3c9dab86bae648fc1559e79f3fb2bb101d49ba1bbf9813d8278794ea29af84ba
Opcode Fuzzy Hash: 587932c01ea1444d1c2b0f3667ea880ecf6c368eb9ac86f3410568bb4629ab53
Instruction Fuzzy Hash: 1F41F476601204EFDB10DF99C880B9AB7F8FF89314F108259E95497BA0D770E906C7A0

Function 6CD75F50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,GetMethodProperty), ref: 6CD75F83
GetProcAddress.KERNEL32(00000000,GetNumberOfMethods), ref: 6CD75F9F

Strings

GetMethodProperty, xrefs: 6CD75F77
GetNumberOfMethods, xrefs: 6CD75F99

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AddressProc
String ID: GetMethodProperty$GetNumberOfMethods
API String ID: 190572456-2134343882
Opcode ID: c4a0756034b609f8e35bf0ee0e946fe9b9959883b12f97a4faac145d354d3e31
Instruction ID: 751d6e0156e7e758259caf42438703a209f2f122c235c420bbe7167ad9a108a1
Opcode Fuzzy Hash: c4a0756034b609f8e35bf0ee0e946fe9b9959883b12f97a4faac145d354d3e31
Instruction Fuzzy Hash: CF2168B5A01219EBDB14CFA5D9809DEB7B8FF48308B10402AE904A7A15E731E906CBA0

Function 6CD68670 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00000000,?,00000000), ref: 6CD68916
__CxxThrowException@8.LIBCMT ref: 6CD6892C

Strings

<H, xrefs: 6CD6896F

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ErrorException@8LastThrow
String ID: <H
API String ID: 1006195485-4022674625
Opcode ID: 5fd1a4f22fdbb0e9c80fd2b97992fe7d4350916dc379977758fd1303ae9aa29a
Instruction ID: 41bbf40eb4c59aaea75835b10c69fa89945292c8d8b75d47f4e30dc1978ec225
Opcode Fuzzy Hash: 5fd1a4f22fdbb0e9c80fd2b97992fe7d4350916dc379977758fd1303ae9aa29a
Instruction Fuzzy Hash: E4E193B5D01248DFDB00DFE9C9809DEBBB5BF49304F14825EE515ABB50E731AA09CB61

Function 6CD6CAE0 Relevance: 4.8, APIs: 3, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 6CD6CB18

Part of subcall function 6CD85F2A: __FF_MSGBANNER.LIBCMT ref: 6CD85F4D
Part of subcall function 6CD85F2A: __NMSG_WRITE.LIBCMT ref: 6CD85F54
Part of subcall function 6CD85F2A: RtlAllocateHeap.NTDLL(00000000,6CD6FA6F,?,00000000,?,?,6CD64D3F,0000000C,58E5B5EE,?,?,00000000,?,?,6CD8EF9B,000000FF), ref: 6CD85FA1

__CxxThrowException@8.LIBCMT ref: 6CD6CB30

Part of subcall function 6CD8663B: RaiseException.KERNEL32(?,6CD80629,58E5B5EE,?,?,6CD80629,?,6CD98388,58E5B5EE), ref: 6CD8667D

Part of subcall function 6CD6A910: __CxxThrowException@8.LIBCMT ref: 6CD6A992

GetLastError.KERNEL32(?,00000000,00000000), ref: 6CD6CBD3

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw$AllocateErrorExceptionHeapLastRaise_malloc
String ID:
API String ID: 214124409-0
Opcode ID: bfc47b0a97f0bb033c0575e96dfaa8a6d02365a16997ab3a67c267af2ba9969d
Instruction ID: fe4851eedb4986961a5a9f0acd20eb92a0d2778a3db0b93a7f626b432b254409
Opcode Fuzzy Hash: bfc47b0a97f0bb033c0575e96dfaa8a6d02365a16997ab3a67c267af2ba9969d
Instruction Fuzzy Hash: 62A183B1D01108EFDB04DFA8D980ADEB7B4FF48318F148269E915A7750E734EA19CBA1

Function 6CD72A70 Relevance: 4.6, APIs: 3, Instructions: 93
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(?,58E5B5EE,?,00000000,?,?,00000000,?,?,?,00000000,6CD90C38,000000FF), ref: 6CD72A9F
CreateFileW.KERNEL32(?,?,00000000,00000000,?,00000080,00000000,58E5B5EE,?,00000000,?,?,00000000), ref: 6CD72ACC
CreateFileW.KERNEL32(?,?,?,00000000,00000000,00000080,00000000), ref: 6CD72B2B

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CreateFile$CloseHandle
String ID:
API String ID: 1443461169-0
Opcode ID: 9f77af2e0a97819b2a4d4708ba59f0bf0d034a4e58f1c79ca12cacfe5c7c943b
Instruction ID: 99f9a9de3d90a8d0b4b9e9702a3a48cccd295c602cbd53368cdc52f2ed0e5d53
Opcode Fuzzy Hash: 9f77af2e0a97819b2a4d4708ba59f0bf0d034a4e58f1c79ca12cacfe5c7c943b
Instruction Fuzzy Hash: 93318F75A0124AEFDB10CF64CC45BABBBB8FB05768F204719F925976C0D731AA15CBA0

Function 6CD71340 Relevance: 4.6, APIs: 3, Instructions: 86COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,00000000,58E5B5EE,?,?,?,?,?,00000000), ref: 6CD7136E
GetLastError.KERNEL32 ref: 6CD7138C
CreateDirectoryW.KERNEL32(?,00000000), ref: 6CD713D7

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: 7896c7ac546985b8ed7fba1e1fcb26a8699b77836678cba2d8b1aad4e13a921b
Instruction ID: e0f666da6d4db6b46afa8b5753a29a744971c909365fa6814acf77b21a5bbb6c
Opcode Fuzzy Hash: 7896c7ac546985b8ed7fba1e1fcb26a8699b77836678cba2d8b1aad4e13a921b
Instruction Fuzzy Hash: F021F177E04204DBEB108F95D8017EFBBBCEB45624F10026AEA1993B40DB369904C7E1

Function 6CD61AB0 Relevance: 4.6, APIs: 3, Instructions: 69COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,?), ref: 6CD61AEC
GetLastError.KERNEL32 ref: 6CD61B01

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: ca689443d5d85f1ff465cc915187ecad3de4b7a345b0c0c48983aec55d3fde97
Instruction ID: 0c3f06f92fcbcc6aa65b824508bd90b036dd044a074970312677877a58a1b6cf
Opcode Fuzzy Hash: ca689443d5d85f1ff465cc915187ecad3de4b7a345b0c0c48983aec55d3fde97
Instruction Fuzzy Hash: 5111937670520A8B8700CF6EE8419BB77E8EB86365F10822EFD18C7A60E632D415D7E1

Function 10008A65 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10008A6A

Part of subcall function 1000A4D5: __EH_prolog.LIBCMT ref: 1000A4DA

Strings

, xrefs: 10008B73

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-3916222277
Opcode ID: e5ab11678a7af806c47a763770102e730e2bdbd4d0fd60aadb5155847553715b
Instruction ID: 5679c1a6151dc724afce86c3166b852d76cd262a1264ab291975f652ea8321e5
Opcode Fuzzy Hash: e5ab11678a7af806c47a763770102e730e2bdbd4d0fd60aadb5155847553715b
Instruction Fuzzy Hash: E3717F74E00609DFEB04DFA4C981AADB7F1FF44390F104519E495AB39ADB34AB81CBA0

Function 100087AE Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 100087B3

Strings

, xrefs: 1000887A

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-3916222277
Opcode ID: 87f4fbd9ed9835f185afa277318771e429ef2e1cba041ba48d785ab7c3d46741
Instruction ID: dc996c4eb68a87c8f199726ed84f9ce0c47e74a02a5fa25993d790b30f922306
Opcode Fuzzy Hash: 87f4fbd9ed9835f185afa277318771e429ef2e1cba041ba48d785ab7c3d46741
Instruction Fuzzy Hash: B4515275E002069FEB14DFA8C881ABEB7F5FF88380F548529E545E7245DB70AE41CB61

Function 6CD63E70 Relevance: 3.2, APIs: 2, Instructions: 250COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CD64042

Part of subcall function 6CD64D10: _malloc.LIBCMT ref: 6CD64D3A
Part of subcall function 6CD64D10: __CxxThrowException@8.LIBCMT ref: 6CD64D54

__CxxThrowException@8.LIBCMT ref: 6CD641B5

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw$_malloc
String ID:
API String ID: 175252994-0
Opcode ID: f501f0fbd9a5bb348e1b37c8eeed89cf30f2e18cbbedbfdea188c4e1a9272421
Instruction ID: 85f89db95ae3743106e53090be03035a7a43a9d5096d142ce54383de29f14f5f
Opcode Fuzzy Hash: f501f0fbd9a5bb348e1b37c8eeed89cf30f2e18cbbedbfdea188c4e1a9272421
Instruction Fuzzy Hash: EFB114B1D01258DBDB10CF9AD980ADEFBB4BF08304F6481AEE519A7750D7345A49CFA1

Function 6CD71060 Relevance: 3.1, APIs: 2, Instructions: 85COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,00000000,58E5B5EE,?,00000000,?,?,00000000,?,58E5B5EE,00000000), ref: 6CD7108F
SetFileAttributesW.KERNEL32(?,00000000), ref: 6CD710ED

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bc300abc87a0d02ac4aa047730fb89098f5a38ce170c41016ecc9acb4c2b2ef2
Instruction ID: 2b7e9979dece6bee4a1756dca34cf356c933befb92a2df27bc86b4638b3e6e26
Opcode Fuzzy Hash: bc300abc87a0d02ac4aa047730fb89098f5a38ce170c41016ecc9acb4c2b2ef2
Instruction Fuzzy Hash: 4821A477E042089BDF10CF95D805BDFFBB8EB45664F10016AED1993740EB36AA04C7A1

Function 6CD777E0 Relevance: 3.0, APIs: 2, Instructions: 48COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6CD777E6

Part of subcall function 6CD85F2A: __FF_MSGBANNER.LIBCMT ref: 6CD85F4D
Part of subcall function 6CD85F2A: __NMSG_WRITE.LIBCMT ref: 6CD85F54
Part of subcall function 6CD85F2A: RtlAllocateHeap.NTDLL(00000000,6CD6FA6F,?,00000000,?,?,6CD64D3F,0000000C,58E5B5EE,?,?,00000000,?,?,6CD8EF9B,000000FF), ref: 6CD85FA1

__CxxThrowException@8.LIBCMT ref: 6CD77803

Part of subcall function 6CD8663B: RaiseException.KERNEL32(?,6CD80629,58E5B5EE,?,?,6CD80629,?,6CD98388,58E5B5EE), ref: 6CD8667D

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID:
API String ID: 2732643326-0
Opcode ID: 6ab047158aa3fb63405b679b6f558198e8d13f791fe4409681033db5f50e6fe1
Instruction ID: c05a598ff07e0530c49a48dbb88570650edbb850ecb438df7d913282777ba253
Opcode Fuzzy Hash: 6ab047158aa3fb63405b679b6f558198e8d13f791fe4409681033db5f50e6fe1
Instruction Fuzzy Hash: 33019E71601205EBDB14CF18C49099AF3A9EF45318F0584AAEC05DFB65EA71EE49C7F0

Function 10019CB8 Relevance: 3.0, APIs: 2, Instructions: 45threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1001C480: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,10019E24,10021318,000000FF,?,1001C056,00000001,00000074), ref: 1001C576

CreateThread.KERNEL32(00000000,00000000,10019D23,00000000,?,?), ref: 10019CF9
GetLastError.KERNEL32(?,10017589,00000000,00000000,10002FF6,00000000,00000000,00000000,?,10002FF2,?,?,?,?,10003E76,?), ref: 10019D03

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AllocCreateErrorHeapLastThread
String ID:
API String ID: 3580101977-0
Opcode ID: 53b11fc37b3e5cb832321f1eb73cf4aff9b5aac8ba68efd3095b3517519951be
Instruction ID: 578384fe474d0b562f95e97df9c8fae57dcf2a9e42d60c7228f8a9f52e2ea293
Opcode Fuzzy Hash: 53b11fc37b3e5cb832321f1eb73cf4aff9b5aac8ba68efd3095b3517519951be
Instruction Fuzzy Hash: 77F028372043156BDB21DF65EC05DAF3BA5DF446B0B104029FA18CA190CB31D8918B91

Function 6CD61C20 Relevance: 3.0, APIs: 2, Instructions: 44fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 6CD61C4C
GetLastError.KERNEL32 ref: 6CD61C75

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 65bca61a76bc991f5ae0fb67e0dda30fd2dfd200f0da45fdbca0d562156d485b
Instruction ID: 25e02635857472d9533953a359aacbe944b49fea2568e7589d4af4d69878edc3
Opcode Fuzzy Hash: 65bca61a76bc991f5ae0fb67e0dda30fd2dfd200f0da45fdbca0d562156d485b
Instruction Fuzzy Hash: 9D01623234070A9BD750CF59D840BAB77FCBB44718F11892AF91ADB990D375E854DBA0

Function 6CD619C0 Relevance: 3.0, APIs: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 6CD619EB
GetLastError.KERNEL32 ref: 6CD61A0C

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: ea4baab475ee665c6b22497690210e275274ac009885441968c25dd50234fc61
Instruction ID: 6fe6c17bebe4a396a36139701a901d630c40e11e62aba78d8fa83d74762ffbb3
Opcode Fuzzy Hash: ea4baab475ee665c6b22497690210e275274ac009885441968c25dd50234fc61
Instruction Fuzzy Hash: D2F0CD7635030ADBEB00CF55D884B6B33ADBB84318F10C52AF91ACBA90D776D821CB60

Function 1001A3C4 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,10019F1B,00000001), ref: 1001A3D5

Part of subcall function 1001A27C: GetVersionExA.KERNEL32 ref: 1001A29B

HeapDestroy.KERNEL32 ref: 1001A414

Part of subcall function 1001A4C9: HeapAlloc.KERNEL32(00000000,00000140,1001A3FD,000003F8), ref: 1001A4D6

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: bc4e9ed2508816d106b6c68f37e2140fc1a3498347a5ba50f7c2e7f5e8612b28
Instruction ID: f49a4552e00520ddd5bd994c2c6f56530b3037705a70c7491d35245aff95e9ec
Opcode Fuzzy Hash: bc4e9ed2508816d106b6c68f37e2140fc1a3498347a5ba50f7c2e7f5e8612b28
Instruction Fuzzy Hash: 80F09274611302ABFF14EB309D8AB5935D1DB86791F308436F905CD0A6EBF0D8D2A611

Function 6CD61BE0 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(00000002,6CD7B356,?,?,?,?,?,?,6CD95380,?), ref: 6CD61BE9
GetLastError.KERNEL32(?,?,?,?,?,?,6CD95380,?), ref: 6CD61BFD

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 9382a01f043c7e857d86d6b304b3b6afa15d68f6b6424f135e74b6947f05b32b
Instruction ID: 30b7a73414560ed1b43decfe96c50d155d630997c081420e9d449b6adae760e5
Opcode Fuzzy Hash: 9382a01f043c7e857d86d6b304b3b6afa15d68f6b6424f135e74b6947f05b32b
Instruction Fuzzy Hash: 75E01274351A039BEB204F3BCC4432675A86B0277AFA08B28E17ED6CF0E72DC041CA04

Function 6CD709E0 Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6CD709E8

Part of subcall function 6CD85F2A: __FF_MSGBANNER.LIBCMT ref: 6CD85F4D
Part of subcall function 6CD85F2A: __NMSG_WRITE.LIBCMT ref: 6CD85F54
Part of subcall function 6CD85F2A: RtlAllocateHeap.NTDLL(00000000,6CD6FA6F,?,00000000,?,?,6CD64D3F,0000000C,58E5B5EE,?,?,00000000,?,?,6CD8EF9B,000000FF), ref: 6CD85FA1

__CxxThrowException@8.LIBCMT ref: 6CD70A02

Part of subcall function 6CD8663B: RaiseException.KERNEL32(?,6CD80629,58E5B5EE,?,?,6CD80629,?,6CD98388,58E5B5EE), ref: 6CD8667D

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID:
API String ID: 2732643326-0
Opcode ID: 03ad0c46a21d75348c06bd841780457bcf974a7c88dce3596d6a608e5b10e287
Instruction ID: 658ef4c116c18c01efe496d6e65c48ff14735175f82c1d2734037d8b0a400cb2
Opcode Fuzzy Hash: 03ad0c46a21d75348c06bd841780457bcf974a7c88dce3596d6a608e5b10e287
Instruction Fuzzy Hash: 00D0A790C1E24CB39F04C7A5AC419EEB7EC8B15748F4402D5FC09C3A11FA32E61E42B5

Function 10005AA5 Relevance: 2.1, APIs: 1, Instructions: 563COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10005AAA

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 77d91d3dc47dd387f4a4c0ba6b5aa2c283876a1cf57c9fbbaea89970380046ef
Instruction ID: 24b6dd137383e7686c229cdd86bb12439a3ed7e02ed9f8727553bb3e51178dae
Opcode Fuzzy Hash: 77d91d3dc47dd387f4a4c0ba6b5aa2c283876a1cf57c9fbbaea89970380046ef
Instruction Fuzzy Hash: 37427F74904249DFEB00CFA4C984BDDBBF5EF09384F244099E849AB386DB75AE45CB61

Function 10009824 Relevance: 2.0, APIs: 1, Instructions: 502COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10009829

Part of subcall function 1000940A: __EH_prolog.LIBCMT ref: 1000940F

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 20f936d777ea9103e340114ca1ee5d19f73f9782134bda5456cca3b6a12e0127
Instruction ID: 7486e4567ea8ddc6047f59b84a49b8006f4fb568e8041e622ffbf8bfe16b7337
Opcode Fuzzy Hash: 20f936d777ea9103e340114ca1ee5d19f73f9782134bda5456cca3b6a12e0127
Instruction Fuzzy Hash: FE326A74904249DFEB14CFA4C880BDEBBB5FF45384F50806EE44AA7296DB70AA85CF51

Function 1000A0CE Relevance: 1.8, APIs: 1, Instructions: 315COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000A0D3

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: dc746a499187cff85fc7484ade5f2022362ea269692349762d9b171528c868e0
Instruction ID: 16904ee073535d8266284e3ab4d1ee50d97a619b8a40ccf019ff2181d9a9fe66
Opcode Fuzzy Hash: dc746a499187cff85fc7484ade5f2022362ea269692349762d9b171528c868e0
Instruction Fuzzy Hash: 4DC17F74A0024ADFEB14CFA8C884BDEBBF1FF49380F204629E445A7245DB75AE81CB51

Function 6CD67350 Relevance: 1.7, APIs: 1, Instructions: 158timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32(?,00000000,00000000,00000000,58E5B5EE,?,?,?,?,?,6CD90300,000000FF), ref: 6CD67438

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 700c805b944b7b6773d11ad984985a8c11cc35653ca939ab74ad901ccb78db79
Instruction ID: e83e3e5f076075db22aab4ebb7f442e6202d218608c0ca3d19f4e343fe629f88
Opcode Fuzzy Hash: 700c805b944b7b6773d11ad984985a8c11cc35653ca939ab74ad901ccb78db79
Instruction Fuzzy Hash: A1516CB1A05A86FFD308CF76C480BA5FBA0FB49318F15865DD46987E21D731B868CB90

Function 10008DDD Relevance: 1.7, APIs: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10008DE2

Part of subcall function 1000A51C: __EH_prolog.LIBCMT ref: 1000A521

Part of subcall function 1000809D: __EH_prolog.LIBCMT ref: 100080A2

Part of subcall function 10008A65: __EH_prolog.LIBCMT ref: 10008A6A

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0f2ef54e4d54980d6866c9ca524e59761326e1e766cc54546d6848b3260f56d2
Instruction ID: 0609df34ebabf0a4a76e2918ca157b4269ad3ae51d55b8a1eb59a52bcf34417c
Opcode Fuzzy Hash: 0f2ef54e4d54980d6866c9ca524e59761326e1e766cc54546d6848b3260f56d2
Instruction Fuzzy Hash: DF51B274D00159DBEF14DFA4C885AEEBBB2FF44390F108159E8556B286CB71AF41CB90

Function 1000790D Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10007912

Part of subcall function 1000A496: __EH_prolog.LIBCMT ref: 1000A49B

Part of subcall function 10007AD6: __EH_prolog.LIBCMT ref: 10007ADB

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6bb2def5445f3f3c03a7c343a9c0ad1c6318bdf414d74d1a9ec3108368a0102b
Instruction ID: b40d17a970ea470072cc094887da7a6dca03317504114bf01e9f4a1a4d97d151
Opcode Fuzzy Hash: 6bb2def5445f3f3c03a7c343a9c0ad1c6318bdf414d74d1a9ec3108368a0102b
Instruction Fuzzy Hash: 71516D34900249DFEB11CFA4C954AEDBBB4FF95344F244099E845A7246DB74AF01DB62

Function 1000670B Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10006710

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ef6ed3350f196110724b134d7ae58aa8eb2fad54a812ca61983dfb10647da9bd
Instruction ID: 1deedfb3ed3693e114189d5c8674f5dba158b51214873baba276ba9a2bcc193c
Opcode Fuzzy Hash: ef6ed3350f196110724b134d7ae58aa8eb2fad54a812ca61983dfb10647da9bd
Instruction Fuzzy Hash: 73419F74900246CFDB24CF58C88496ABBF2FF48358B2546ADD0999B351C731ED46CF50

Function 10001BB7 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10001BB7

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 5099f1d692100a5232163a5791f00c8b8683fd86d0e2744a0ba1ce0008d983f8
Instruction ID: 59f6696383dde50044605197c7a13ccbc641f9314ce92faebeca66c50bce22a2
Opcode Fuzzy Hash: 5099f1d692100a5232163a5791f00c8b8683fd86d0e2744a0ba1ce0008d983f8
Instruction Fuzzy Hash: 47219F7198468ADBFB24CF60D9808EEB7B6EB412D0B21852DE49267648D730FE41CB91

Function 100188B8 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,?,?,?), ref: 1001899F

Part of subcall function 1001A13A: InitializeCriticalSection.KERNEL32(00000000,?,?,?,10018A6D,00000009,?,?,?), ref: 1001A177
Part of subcall function 1001A13A: EnterCriticalSection.KERNEL32(?,?,?,10018A6D,00000009,?,?,?), ref: 1001A192

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: 64ac742c6e18b1ebf1a9d12a1be87a2e2d80d958cc1a171f76a8005aa0769b83
Instruction ID: bde266228d008e092059639ff97bb6b14f601e90ad82446575358dbeed7d10ff
Opcode Fuzzy Hash: 64ac742c6e18b1ebf1a9d12a1be87a2e2d80d958cc1a171f76a8005aa0769b83
Instruction Fuzzy Hash: C5219032A00255BAEB10DB68DC42BADB7A4FB01764F284215F924EF1C0C774EBC18B52

Function 6CD6A910 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 6CD725A0: FindClose.KERNEL32(FFFFFFFF,?,58E5B5EE,?,00000000,6CD950B8,?,6CD90438,000000FF,?,6CD7265E), ref: 6CD725EA

__CxxThrowException@8.LIBCMT ref: 6CD6A992

Part of subcall function 6CD8663B: RaiseException.KERNEL32(?,6CD80629,58E5B5EE,?,?,6CD80629,?,6CD98388,58E5B5EE), ref: 6CD8667D

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CloseExceptionException@8FindRaiseThrow
String ID:
API String ID: 2665002293-0
Opcode ID: 5c8b65de01290b2d54cd349323b8867aa4dbdfe02e7438ee7eb54982cda4be19
Instruction ID: aff9fede00e37fe5813e3cadeae0a5d6827dc6801047cd18627d55981ceece22
Opcode Fuzzy Hash: 5c8b65de01290b2d54cd349323b8867aa4dbdfe02e7438ee7eb54982cda4be19
Instruction Fuzzy Hash: A31190B6900744ABD710CF69C880EDBF7F8EF54618F10461EE95683BA0EB34A509CBA0

Function 10001BB2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10001BB7

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1b3d449f9b1d9ca4bc486b6888b2a71bf231b77982e7f41f13db39985a04daa4
Instruction ID: c4781e215bb38ec63fc671d50aeec44c86b20336711f2647e792547350c1aef8
Opcode Fuzzy Hash: 1b3d449f9b1d9ca4bc486b6888b2a71bf231b77982e7f41f13db39985a04daa4
Instruction Fuzzy Hash: 3911E232A4124A9FFB14CF64C9808EEB3F2EB403D0B21813DE052A7648D730FE428B90

Function 6CD71420 Relevance: 1.6, APIs: 1, Instructions: 310COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(6CD6890F,58E5B5EE,?,?,00000000), ref: 6CD71528

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 36242bdd5ae8aecd0ad08badd11f626e8c2f5b05844eb0435308a52c63496675
Instruction ID: a0dac973581e9a581c6f40e77eae453849951ab3d4dfe76ca6e7a02f6b980e8d
Opcode Fuzzy Hash: 36242bdd5ae8aecd0ad08badd11f626e8c2f5b05844eb0435308a52c63496675
Instruction Fuzzy Hash: 77B19271E01209CBDF14CFA4D991AEEB7B5EF44308F184269D90AA7B60E735E90987B1

Function 100030FD Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10003102

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: b051d9f97361328a0859d23c7aef542bc19b666e6010b629010daeab35dc1547
Instruction ID: 1a273919c2d2e3c34155be655625f51d11ef425e7a56d82b9c8decfb09a307f8
Opcode Fuzzy Hash: b051d9f97361328a0859d23c7aef542bc19b666e6010b629010daeab35dc1547
Instruction Fuzzy Hash: 4011CE71A44155ABE722CF29CC05B9F37A9EF0A7E4F008119F805DB265DB31DD01C790

Function 100039C8 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 100039CD

Part of subcall function 10003600: __EH_prolog.LIBCMT ref: 10003605

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 257c9c1ad85ce65f22fa997ad81c770c6af4072d1a7d7a18d6b680d099e47f4b
Instruction ID: a8771e25a5af01616f041783a1a562797f3037f43c5b4569f99eca130688d05b
Opcode Fuzzy Hash: 257c9c1ad85ce65f22fa997ad81c770c6af4072d1a7d7a18d6b680d099e47f4b
Instruction Fuzzy Hash: 44118274E01795DAEB09DBA8C9153EEFBEADF95300F54414D9057A7282CBF42B04C7A2

Function 10006A20 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10006A25

Part of subcall function 10001B41: GetSystemInfo.KERNEL32(?), ref: 10001B4B

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: H_prologInfoSystem
String ID:
API String ID: 3096475795-0
Opcode ID: 52262b521e3cf9d1fda4bec855af299aea3512d706ab6bf0f58a7f0b292b1210
Instruction ID: 655e083bcbb9f064a1fc17e82f19a2947c3b56c2b4f5fa8eba001858af0e0911
Opcode Fuzzy Hash: 52262b521e3cf9d1fda4bec855af299aea3512d706ab6bf0f58a7f0b292b1210
Instruction Fuzzy Hash: 8701A2B0901B949FD320CF59D48469AFBE5FB09300F90886EE4AA9B612C7B8A6448F50

Function 6CD725A0 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 6CD72470: FindClose.KERNEL32(?,58E5B5EE,6CD90658,00000000), ref: 6CD724C4
Part of subcall function 6CD72470: FindFirstFileW.KERNEL32(6CD950B8,?,58E5B5EE,6CD90658,00000000), ref: 6CD724DE
Part of subcall function 6CD72470: FindFirstFileW.KERNEL32(?,?), ref: 6CD7253A

FindClose.KERNEL32(FFFFFFFF,?,58E5B5EE,?,00000000,6CD950B8,?,6CD90438,000000FF,?,6CD7265E), ref: 6CD725EA

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 6073c3f44528d5a8dc27317ff126680b9e841c42d22c8b30608ba0e5e71b3afb
Instruction ID: b1942d1e0b1533d75f8404894693c4f201a59ca91bf893d750eebe90f1156720
Opcode Fuzzy Hash: 6073c3f44528d5a8dc27317ff126680b9e841c42d22c8b30608ba0e5e71b3afb
Instruction Fuzzy Hash: 0EF06DB6A04648EFDB10CF98CC44BAAB7BCFB0A624F50071AF935937D0D73469058A60

Function 10001C8A Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10001C8F

Part of subcall function 10001BB2: __EH_prolog.LIBCMT ref: 10001BB7

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 45d6ff788914fcc1d4c4362c08418d30e3fc6f4cbe7bfcd3fb78a9b9f7420235
Instruction ID: 5875ca03f24213d4aa71392faa60c1249694dc7a06dd944ad61b31c616a183da
Opcode Fuzzy Hash: 45d6ff788914fcc1d4c4362c08418d30e3fc6f4cbe7bfcd3fb78a9b9f7420235
Instruction Fuzzy Hash: 3AF03432A00219ABEB05CF98CC01BEEB7B9EB44365F108659B821E7290C775EE00CB50

Function 10001C8F Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10001C8F

Part of subcall function 10001BB2: __EH_prolog.LIBCMT ref: 10001BB7

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a6999b822fc1317c87866c67a3b2559ab8b1b0de13d547d74b0740a9a50685af
Instruction ID: a1ce7e251bf4dddfe6d8e665bceb41a424ebb3d89783d3dba666d18c8877da87
Opcode Fuzzy Hash: a6999b822fc1317c87866c67a3b2559ab8b1b0de13d547d74b0740a9a50685af
Instruction Fuzzy Hash: 43F0F876A00219EBEB15CF94CC05BEEB7B9FB44365F108659B825E7290C775AA10CB50

Function 1000A4D5 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000A4DA

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 5e305e5dd078dffe59473feca98cbca4bc7fff0512b603f2e5de80fa23a82b3e
Instruction ID: 00a3cd71fa0aca0c29c4385373171d1cf368eeee970badd092b8d780c186b9fa
Opcode Fuzzy Hash: 5e305e5dd078dffe59473feca98cbca4bc7fff0512b603f2e5de80fa23a82b3e
Instruction Fuzzy Hash: ECE09275E00510ABDB08DFA88C066AE7AE5EB04360F10462EA016E72C1DFB06B408654

Function 10006B51 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10006B56

Part of subcall function 10006B9E: __EH_prolog.LIBCMT ref: 10006BA3

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c2b4014cf6554101de5823dbb260c55468e89f1724bea5b528826ce213b76a0a
Instruction ID: 8d9a37c6723f40ac26746b696ab844ca15524eaf609cb6dee056dacbd79d311a
Opcode Fuzzy Hash: c2b4014cf6554101de5823dbb260c55468e89f1724bea5b528826ce213b76a0a
Instruction Fuzzy Hash: 8BF08C71C01A60DBD724CF54C8057DEB7B4EF08310F10464EA8A6A7281CBB0BA40CB90

Function 6CD61950 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?), ref: 6CD6196C

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 3aa118522589043f971fd46ba496e6a867c03a5fd4209e7bb62c5fea358771a6
Instruction ID: 7720e709e150219b4ffd2ddb8ee7863adc52f1de54f2f348b7caa12bcc227626
Opcode Fuzzy Hash: 3aa118522589043f971fd46ba496e6a867c03a5fd4209e7bb62c5fea358771a6
Instruction Fuzzy Hash: E5E092762017005BD7105F699805B46BBD89F01275B208B19E57A97FF0D770D400C790

Function 1000A496 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000A49B

Part of subcall function 1000A0CE: __EH_prolog.LIBCMT ref: 1000A0D3

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 49073b19b42d1aece4de8f7d12bddb7de673f44c594ea106af3184a1002e2511
Instruction ID: 889d54ac72d292b4943fb779c3a4a2c7d1dd2e9b7142568b78a9c6437da24382
Opcode Fuzzy Hash: 49073b19b42d1aece4de8f7d12bddb7de673f44c594ea106af3184a1002e2511
Instruction Fuzzy Hash: 12E08C36900148FBDF02CF84C805FEF7B75EB452A0F00851AF40415051C3BAAA50DBA0

Function 10019DDE Relevance: 1.5, APIs: 1, Instructions: 20threadCOMMON

Download Yara Rule

APIs

ExitThread.KERNEL32 ref: 10019E13

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ExitThread
String ID:
API String ID: 2158977761-0
Opcode ID: 0fe3482dfa25c527acbd858d9d887206c278c7a8d427f86923067702572674c7
Instruction ID: 587474e3f6e270900c506b7264c4806e64e6eaefbf2122b89b9aa41b5ebd9e7a
Opcode Fuzzy Hash: 0fe3482dfa25c527acbd858d9d887206c278c7a8d427f86923067702572674c7
Instruction Fuzzy Hash: D6E08C3694052AABEB12E7A0CC46A9E37A0EF08380F040010F8005E062DB70FED24692

Function 6CD893E1 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,?,6CD86375,00000001,?,?,?,6CD864EE,?,?,?,6CD97F18,0000000C,6CD865A9), ref: 6CD893F6

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 744e134ab0cf0f7dd23a144bf0632709b3be4102211a10d8b1e8adca05bf0a57
Instruction ID: 24b258284c655be048f2fa07c74be67c33a628accf34fb8410d120409a93fe2f
Opcode Fuzzy Hash: 744e134ab0cf0f7dd23a144bf0632709b3be4102211a10d8b1e8adca05bf0a57
Instruction Fuzzy Hash: 01D05E7A6543489EEB005EB59C08B223BFCE786399F148536BA0CC6150E670C550C600

Function 1000AB8D Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000AB92

Part of subcall function 10006A20: __EH_prolog.LIBCMT ref: 10006A25

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7465464f3484d0fe6a61d7cab71274671711f41a51988a712e270957caaa37a7
Instruction ID: f583651af7419ed68212601d7f78bfec3ebd47bcdcb2918c529af6d70d782719
Opcode Fuzzy Hash: 7465464f3484d0fe6a61d7cab71274671711f41a51988a712e270957caaa37a7
Instruction Fuzzy Hash: 1AD05E75F14141AFEB08DBB4981636D76E2EB48280F10856DA012E66C1DFB0BA80C625

Function 10019DE9 Relevance: 1.5, APIs: 1, Instructions: 17threadCOMMON

Download Yara Rule

APIs

ExitThread.KERNEL32 ref: 10019E13

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ExitThread
String ID:
API String ID: 2158977761-0
Opcode ID: e83cf6b22c983a4ed28e69ad6d1585a06803cfa532badbaccde98c5e56e59925
Instruction ID: 55bdce0fba70f3b5ff24939f3ea0e7f6c7887ef7bde984f872fb15fca6cc6046
Opcode Fuzzy Hash: e83cf6b22c983a4ed28e69ad6d1585a06803cfa532badbaccde98c5e56e59925
Instruction Fuzzy Hash: 4FD05E31540626ABE213E770DC86A5E2394DF05790B110115F8408D062DF70FEC24192

Function 10002828 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(?,?,?,?), ref: 1000284F

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: 56af7d4527998fa58668fa72375b4fbb66d6daa40091eae34442c31c73413363
Instruction ID: 11d10b3ae5732a811c03e9ac0d646ffa47e7b15fd82cf01c80c2bb2696228c6f
Opcode Fuzzy Hash: 56af7d4527998fa58668fa72375b4fbb66d6daa40091eae34442c31c73413363
Instruction Fuzzy Hash: 18F03036A01155DFDB12DFA4C808A89BBA5FF84794B16845AF955D7220D734CC12DF60

Function 10017570 Relevance: 1.3, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 10019CB8: CreateThread.KERNEL32(00000000,00000000,10019D23,00000000,?,?), ref: 10019CF9
Part of subcall function 10019CB8: GetLastError.KERNEL32(?,10017589,00000000,00000000,10002FF6,00000000,00000000,00000000,?,10002FF2,?,?,?,?,10003E76,?), ref: 10019D03

GetLastError.KERNEL32 ref: 10017598

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ErrorLast$CreateThread
String ID:
API String ID: 665435222-0
Opcode ID: 6a6f0967b860a04a4a08b52caf4fd14ddb262ad7e1e0691d2c85b8c655ef118e
Instruction ID: 5da84cd6a30c0b06f2c1d8553272c344b363e72c39abfbd7409f2c23709d4e44
Opcode Fuzzy Hash: 6a6f0967b860a04a4a08b52caf4fd14ddb262ad7e1e0691d2c85b8c655ef118e
Instruction Fuzzy Hash: 2EE0ECB2254252AEF304DB648C46FA776E9EB94B81F50442DBA49CA180E6B0D944C7B5

Function 10012A20 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,10001E62,?,?,1000B459,?), ref: 10012A31

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0101ec0f5aa2d88080453061d33e9d0ea43cdee5597a4dbf4051f6854f2c80fe
Instruction ID: 499c3da3a26d341c9e988975342de67c6826636d0b386d7712dafe969d9ecfde
Opcode Fuzzy Hash: 0101ec0f5aa2d88080453061d33e9d0ea43cdee5597a4dbf4051f6854f2c80fe
Instruction Fuzzy Hash: 18B012F07B238176FE6E87204C5BF662451A740BC7F601098F301DC0C4E7E094409015

Function 10012A40 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,10001E7E,?,10001E58,?,?,1000B459,?), ref: 10012A4C

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 66144b5ccae04c28c88a4e760bc3cd1d0957039cec557337da64c84822766760
Instruction ID: 32e2f69f7c2909d2d391187de9ef312e1eea697864ad2fb4147c7fa98b3e1f25
Opcode Fuzzy Hash: 66144b5ccae04c28c88a4e760bc3cd1d0957039cec557337da64c84822766760
Instruction Fuzzy Hash: 96B012B034230023FD78C3110D45B1611506B00741E60405C73016C4C08570E4018504

Function 0045D344 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2247293264.000000000045D000.00000020.00000001.01000000.00000004.sdmp, Offset: 0045D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_45d000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e7b173bbb215450c8b4f74675491754b7c61381db732ae293535029b8f08084
Instruction ID: d99f86c8ffeddc58f6e936e0a3f2476e49bd5441f60632e001b21c3972d2faf1
Opcode Fuzzy Hash: 0e7b173bbb215450c8b4f74675491754b7c61381db732ae293535029b8f08084
Instruction Fuzzy Hash: 5F0165B16002046FCB10EB98DC81FAB37A9FB08315F048216FD14D7296DBBDD884876D

Function 0045D3F8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2247293264.000000000045D000.00000020.00000001.01000000.00000004.sdmp, Offset: 0045D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_45d000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49f8392043f557017d62716db24232c23fbed2275b2329eef47e5a4435b534a6
Instruction ID: 198944c7f122d1c37403e03e802124c787ccbd8fdaa22fabfa5f4f4463f0d47f
Opcode Fuzzy Hash: 49f8392043f557017d62716db24232c23fbed2275b2329eef47e5a4435b534a6
Instruction Fuzzy Hash: 1EC0122160663826162032A92CC18EA00488C472AA32803BBFC20962A3DA8C9DC602AE

Non-executed Functions

Function 6CD851C7 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CD86B91
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CD86BA6
UnhandledExceptionFilter.KERNEL32(6CD93328), ref: 6CD86BB1
GetCurrentProcess.KERNEL32(C0000409), ref: 6CD86BCD
TerminateProcess.KERNEL32(00000000), ref: 6CD86BD4

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: eb4000952088f98f989b21ba9f9eac8955200b99547eacb37c375794de348b6b
Instruction ID: acf70ba06507da9113bd0894613add3e231a589bd4d4e89217f2b0f893d66734
Opcode Fuzzy Hash: eb4000952088f98f989b21ba9f9eac8955200b99547eacb37c375794de348b6b
Instruction Fuzzy Hash: EE21ACBDB01204EFEB00DF29C585A483BBCFB1A319F60411BFB09A7260E7B059858F95

Function 6CD62AD0 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 202fileCOMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNEL32(00000004,00000000,?,00000002), ref: 6CD62BB4
GetLastError.KERNEL32 ref: 6CD62BC3
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 6CD62BDF
UnmapViewOfFile.KERNEL32(00000000), ref: 6CD62C88
CloseHandle.KERNEL32(?), ref: 6CD62C96
OpenEventW.KERNEL32(00000002,00000000,?), ref: 6CD62CA8
GetLastError.KERNEL32 ref: 6CD62CBD
SetEvent.KERNEL32(00000000), ref: 6CD62CC4
GetLastError.KERNEL32 ref: 6CD62CCE
CloseHandle.KERNEL32(00000000), ref: 6CD62CD5
GetLastError.KERNEL32 ref: 6CD62CDF

Part of subcall function 6CD62670: __CxxThrowException@8.LIBCMT ref: 6CD62688

Strings

Can not open mapping, xrefs: 6CD62BCD
Incorrect command line, xrefs: 6CD62B13, 6CD62B63
MapViewOfFile error, xrefs: 6CD62BEE
data error, xrefs: 6CD62C6A
Incorrect mapping data, xrefs: 6CD62C02

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ErrorLast$File$CloseEventHandleOpenView$Exception@8MappingThrowUnmap
String ID: Can not open mapping$Incorrect command line$Incorrect mapping data$MapViewOfFile error$data error
API String ID: 682782048-464465891
Opcode ID: aa52311e2bda2ea54f2f378affe9f2a4603aa0ca876487e0399c9999de07a2a6
Instruction ID: e88296640780ea79a7fc716c707534157a8369f46cfc1a993a7780ac395a79c5
Opcode Fuzzy Hash: aa52311e2bda2ea54f2f378affe9f2a4603aa0ca876487e0399c9999de07a2a6
Instruction Fuzzy Hash: 9761C175A0060ADBDB00DFAAC848BEEB7B4EF4535CF144125E915A7F60EB70E905C7A1

Function 6CD8715B Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,6CD97F58,0000000C,6CD87296,00000000,00000000,?,6CD64D3F,0000000C,58E5B5EE,?,?,00000000,?,?,6CD8EF9B), ref: 6CD8716D
__crt_waiting_on_module_handle.LIBCMT ref: 6CD87178

Part of subcall function 6CD87790: Sleep.KERNEL32(000003E8,?,?,6CD870BE,KERNEL32.DLL,?,6CD894A4,?,6CD85FE3,6CD6FA7E,?,?,6CD64D3F,0000000C,58E5B5EE,?), ref: 6CD8779C
Part of subcall function 6CD87790: GetModuleHandleW.KERNEL32(6CD6FA7E,?,6CD870BE,KERNEL32.DLL,?,6CD894A4,?,6CD85FE3,6CD6FA7E,?,?,6CD64D3F,0000000C,58E5B5EE,?,?), ref: 6CD877A5

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 6CD871A1
GetProcAddress.KERNEL32(?,DecodePointer), ref: 6CD871B1
__lock.LIBCMT ref: 6CD871D3
InterlockedIncrement.KERNEL32(02C08302), ref: 6CD871E0
__lock.LIBCMT ref: 6CD871F4
___addlocaleref.LIBCMT ref: 6CD87212

Strings

DecodePointer, xrefs: 6CD871A9
KERNEL32.DLL, xrefs: 6CD87167, 6CD8716C, 6CD87177
EncodePointer, xrefs: 6CD87195

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: db092061bccaa6a3118b575a2aa61f1013dfa9dc184a0e4667ba7103e4d00393
Instruction ID: 522f92500b5cf5c9dc16caa51318ca3764e9cd60e383c3d5a9fbbc3bed975788
Opcode Fuzzy Hash: db092061bccaa6a3118b575a2aa61f1013dfa9dc184a0e4667ba7103e4d00393
Instruction Fuzzy Hash: D9117275A06701FAE710DF79C84179ABBF4AF05318F11451AE4ADA7BB0CB349544CB64

Function 6CD80680 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 295COMMON

Download Yara Rule

APIs

Part of subcall function 6CD81230: _malloc.LIBCMT ref: 6CD81258
Part of subcall function 6CD81230: __CxxThrowException@8.LIBCMT ref: 6CD81272

__CxxThrowException@8.LIBCMT ref: 6CD80704

Part of subcall function 6CD8663B: RaiseException.KERNEL32(?,6CD80629,58E5B5EE,?,?,6CD80629,?,6CD98388,58E5B5EE), ref: 6CD8667D

Part of subcall function 6CD782B0: __CxxThrowException@8.LIBCMT ref: 6CD78324
Part of subcall function 6CD782B0: __CxxThrowException@8.LIBCMT ref: 6CD78390
Part of subcall function 6CD782B0: _malloc.LIBCMT ref: 6CD783B1
Part of subcall function 6CD782B0: __CxxThrowException@8.LIBCMT ref: 6CD783CB
Part of subcall function 6CD782B0: __CxxThrowException@8.LIBCMT ref: 6CD78416

Part of subcall function 6CD85FF4: __lock.LIBCMT ref: 6CD86012
Part of subcall function 6CD85FF4: ___sbh_find_block.LIBCMT ref: 6CD8601D
Part of subcall function 6CD85FF4: ___sbh_free_block.LIBCMT ref: 6CD8602C
Part of subcall function 6CD85FF4: HeapFree.KERNEL32(00000000,6CD6FA7E,6CD97EB0,0000000C,6CD881B5,00000000,6CD98028,0000000C,6CD881EF,6CD6FA7E,?,?,6CD8C6AB,00000004,6CD982E8,0000000C), ref: 6CD8605C
Part of subcall function 6CD85FF4: GetLastError.KERNEL32(?,6CD8C6AB,00000004,6CD982E8,0000000C,6CD87669,6CD6FA7E,?,00000000,00000000,00000000,?,6CD8726D,00000001,00000214), ref: 6CD8606D

__CxxThrowException@8.LIBCMT ref: 6CD80A37

Strings

7za , xrefs: 6CD806D6
-ssw, xrefs: 6CD80736
-w, xrefs: 6CD8077E
-mhe, xrefs: 6CD808F0
-sfx, xrefs: 6CD80723

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw$_malloc$ErrorExceptionFreeHeapLastRaise___sbh_find_block___sbh_free_block__lock
String ID: -mhe$ -sfx$ -ssw$ -w$7za
API String ID: 1499254937-429077366
Opcode ID: 57e70ccc7fe3b838ec232c33e0df4362ddb87933fe973c536f771a1e19426297
Instruction ID: cdf88c4e259f8fd9582e51940448a0f1506c49c8987d943ba9fc7a1b9b029943
Opcode Fuzzy Hash: 57e70ccc7fe3b838ec232c33e0df4362ddb87933fe973c536f771a1e19426297
Instruction Fuzzy Hash: CEC152B5801248DBDB04DBE4CD84BDEB7B8AF14308F144559E905ABB65E7B4EA0CCBB1

Function 1001D844 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,1001CEDA,?,Microsoft Visual C++ Runtime Library,00012010,?,10021594,?,100215E4,?,?,?,Runtime Error!Program: ), ref: 1001D856
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 1001D86E
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 1001D87F
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 1001D88C

Strings

MessageBoxA, xrefs: 1001D868
GetActiveWindow, xrefs: 1001D879
GetLastActivePopup, xrefs: 1001D881
user32.dll, xrefs: 1001D851

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: fdf4bd263d9911628fa84a0538cd68ee630e044ef978d7ae2b799142876d2cfd
Instruction ID: 0f002242f215f962b8815e3b350398d74b100aa23eb915cf8c40db05b23b1dbb
Opcode Fuzzy Hash: fdf4bd263d9911628fa84a0538cd68ee630e044ef978d7ae2b799142876d2cfd
Instruction Fuzzy Hash: A9014431604221AFE750FFF59CC4AAA7BE9EB59194721043BF604C6121DF35C8829B70

Function 1001DD3D Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,10021660,00000001,00000000,00000000,74DEE860,1002CE50,?,00000003,00000000,00000001,00000000,?,?,1001DA1F), ref: 1001DD7F
LCMapStringA.KERNEL32(00000000,00000100,1002165C,00000001,00000000,00000000,?,?,1001DA1F,?), ref: 1001DD9B
LCMapStringA.KERNEL32(?,?,00000000,00000001,00000000,00000003,74DEE860,1002CE50,?,00000003,00000000,00000001,00000000,?,?,1001DA1F), ref: 1001DDE4
MultiByteToWideChar.KERNEL32(?,1002CE51,00000000,00000001,00000000,00000000,74DEE860,1002CE50,?,00000003,00000000,00000001,00000000,?,?,1001DA1F), ref: 1001DE1C
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,?,00000000), ref: 1001DE74
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 1001DE8A
LCMapStringW.KERNEL32(?,?,?,00000000,?,?), ref: 1001DEBD
LCMapStringW.KERNEL32(?,?,?,?,?,00000000), ref: 1001DF25

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 7282f78b9d4349d0a3e93c4e54105c3ff287b2395515df487960fdaa6e95e452
Instruction ID: 295e34877b95ddc79519c14bcd414cd7068b9c5c0158a783dd3936514e77c558
Opcode Fuzzy Hash: 7282f78b9d4349d0a3e93c4e54105c3ff287b2395515df487960fdaa6e95e452
Instruction Fuzzy Hash: FB517B31400259ABDF22EF94CD85ADE3FF9FB59751F20411AF910A9160C732DDA1EB60

Function 6CD76530 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 323libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(6CD76AD8,GetHandlerProperty2), ref: 6CD76584
GetProcAddress.KERNEL32(?,GetHandlerProperty), ref: 6CD76595
GetProcAddress.KERNEL32(?,GetNumberOfFormats), ref: 6CD765B1

Strings

GetNumberOfFormats, xrefs: 6CD765AB
GetHandlerProperty2, xrefs: 6CD76579
GetHandlerProperty, xrefs: 6CD7658F

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AddressProc
String ID: GetHandlerProperty$GetHandlerProperty2$GetNumberOfFormats
API String ID: 190572456-3564775856
Opcode ID: 21d9ce2dbebaf9f32b253572ceb16e60ce504ae6fd8f2b0fabc0e19c7f6ff083
Instruction ID: e299fb5c6f64b3f0029e7a8d3ca4c2a8bdc1e72ac024a32730b8d661a7d85246
Opcode Fuzzy Hash: 21d9ce2dbebaf9f32b253572ceb16e60ce504ae6fd8f2b0fabc0e19c7f6ff083
Instruction Fuzzy Hash: 9FD119B1D00258DBDB24DFA9C880BDEB7B4BF48304F5041ADE559E76A1EB309A49CF61

Function 1001CDB6 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 1001CE23
GetStdHandle.KERNEL32(000000F4,10021594,00000000,?,00000000,?), ref: 1001CEF9
WriteFile.KERNEL32(00000000), ref: 1001CF00

Strings

Microsoft Visual C++ Runtime Library, xrefs: 1001CECF
..., xrefs: 1001CE75
<program name unknown>, xrefs: 1001CE33
Runtime Error!Program: , xrefs: 1001CE89

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 1d1f0148e6be3939dc2033fdbd363d62c3fffa52be97f4f1b611f55ef9c5ba02
Instruction ID: d8c9acc08caec27d87d178c777f48a963db8df66c36a8e0edad6fccd900c7ff8
Opcode Fuzzy Hash: 1d1f0148e6be3939dc2033fdbd363d62c3fffa52be97f4f1b611f55ef9c5ba02
Instruction Fuzzy Hash: 4131C476A0022CAFEB11EAA0CD85FDE77BDFB45344F6001A6F945DA041E770EAC5CA61

Function 1001CC4B Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,10019F70), ref: 1001CC66
GetEnvironmentStrings.KERNEL32(?,?,?,?,10019F70), ref: 1001CC7A
GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,10019F70), ref: 1001CCA6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,10019F70), ref: 1001CCDE
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,10019F70), ref: 1001CD00
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,10019F70), ref: 1001CD19
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,10019F70), ref: 1001CD2C
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 1001CD6A

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: 27e7f926a98a65f15a8b3ff8da03a04564288c716e1c3f2051146ef706dc850c
Instruction ID: 10dabb665d0db05ed410ab17b42963db07fe2840a9ab64d8aea903b972c4df90
Opcode Fuzzy Hash: 27e7f926a98a65f15a8b3ff8da03a04564288c716e1c3f2051146ef706dc850c
Instruction Fuzzy Hash: 7331A6B25043AE5FE311EBB8ACC5D2A7ADDEB4A1D4B220639F545CB111EA31DCC187A1

Function 6CD80AA0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 213COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6CD80C28
__CxxThrowException@8.LIBCMT ref: 6CD80C42
__CxxThrowException@8.LIBCMT ref: 6CD80D3F

Part of subcall function 6CD8663B: RaiseException.KERNEL32(?,6CD80629,58E5B5EE,?,?,6CD80629,?,6CD98388,58E5B5EE), ref: 6CD8667D

__CxxThrowException@8.LIBCMT ref: 6CD80D54

Strings

-an, xrefs: 6CD80BF4
7za l, xrefs: 6CD80AE6

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise_malloc
String ID: -an$7za l
API String ID: 1305767944-193614407
Opcode ID: 99dad335fe7c5451a6b0a2d91fae9633d85ae8e71acf0cd46ce29d6a3f760cb0
Instruction ID: 5d457c8c40ecb62bd13477d3e39352b2bdca477f65ed3a51791ee188499046c9
Opcode Fuzzy Hash: 99dad335fe7c5451a6b0a2d91fae9633d85ae8e71acf0cd46ce29d6a3f760cb0
Instruction Fuzzy Hash: 03917071902248DFDB00DFA8C980BDEBBB8AF14348F144559E805ABB61D774FA49CBB1

Function 6CD8E5CE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindMITargetTypeInstance.LIBCMT ref: 6CD8E624

Part of subcall function 6CD8E370: PMDtoOffset.LIBCMT ref: 6CD8E400

FindVITargetTypeInstance.LIBCMT ref: 6CD8E62B
PMDtoOffset.LIBCMT ref: 6CD8E63B
std::bad_exception::bad_exception.LIBCMT ref: 6CD8E661
__CxxThrowException@8.LIBCMT ref: 6CD8E66F

Strings

Bad dynamic_cast!, xrefs: 6CD8E659

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: FindInstanceOffsetTargetType$Exception@8Throwstd::bad_exception::bad_exception
String ID: Bad dynamic_cast!
API String ID: 3308565544-2956939130
Opcode ID: e0d44417f2f8610efbebcda236f7c1e43ffc9eef3e18fe51573cc5b1fe138555
Instruction ID: bea0bf6b2ad05a900d2365962958a91b96e7585d5857c27c22d325df21478b47
Opcode Fuzzy Hash: e0d44417f2f8610efbebcda236f7c1e43ffc9eef3e18fe51573cc5b1fe138555
Instruction Fuzzy Hash: 9711897AA022159FDB00DFA8C941ADE77B0AF55729F140958E414E7EA0EB34D9098FE1

Function 6CD70450 Relevance: 9.2, APIs: 6, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 6CD72A70: CloseHandle.KERNEL32(?,58E5B5EE,?,00000000,?,?,00000000,?,?,?,00000000,6CD90C38,000000FF), ref: 6CD72A9F
Part of subcall function 6CD72A70: CreateFileW.KERNEL32(?,?,00000000,00000000,?,00000080,00000000,58E5B5EE,?,00000000,?,?,00000000), ref: 6CD72ACC
Part of subcall function 6CD72A70: CreateFileW.KERNEL32(?,?,?,00000000,00000000,00000080,00000000), ref: 6CD72B2B

GetFileSize.KERNEL32(FFFFFFFF,?,00000004,80000000,00000001,00000003,58E5B5EE,?,?,00000000,?,?,?,00000000,6CD90C38,000000FF), ref: 6CD704A7
GetLastError.KERNEL32(?,?,?,00000000,6CD90C38,000000FF), ref: 6CD704B4
CloseHandle.KERNEL32(FFFFFFFF,00000004,80000000,00000001,00000003,58E5B5EE,?,?,00000000,?,?,?,00000000,6CD90C38,000000FF), ref: 6CD7051D
CloseHandle.KERNEL32(FFFFFFFF,?,00000000,00000000,00000001,?,?,?,00000000,6CD90C38,000000FF), ref: 6CD7053D
CloseHandle.KERNEL32(FFFFFFFF,FFFFFFFF,00000000,?,00000000,00000000,00000001,?,?,?,00000000,6CD90C38,000000FF), ref: 6CD7056C

Part of subcall function 6CD70A20: MultiByteToWideChar.KERNEL32(00000002,00000000,?,?,?,?,58E5B5EE,00000000), ref: 6CD70AA7
Part of subcall function 6CD70A20: __CxxThrowException@8.LIBCMT ref: 6CD70AC1

CloseHandle.KERNEL32(FFFFFFFF,?,?,?,?,00000000,00000001,?,?,?,00000000), ref: 6CD706D8

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CloseHandle$File$Create$ByteCharErrorException@8LastMultiSizeThrowWide
String ID:
API String ID: 1518168698-0
Opcode ID: d5b4e1957062d6204ed68a98cc4a5fddf7029fcb9dfbb08ed68b31afd62f589d
Instruction ID: c74939db13be0cc10440d8cc0da77f4758242f8a75d7379f7c5094e0e6d777fb
Opcode Fuzzy Hash: d5b4e1957062d6204ed68a98cc4a5fddf7029fcb9dfbb08ed68b31afd62f589d
Instruction Fuzzy Hash: 9B817372E00248DBDF10DFA4D850BDEB775EB45358F104619E925A7BE0EB35A509CB70

Function 6CD82CE0 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 472COMMON

Download Yara Rule

Strings

-r, xrefs: 6CD82DD2
7za A , xrefs: 6CD82D17
-p, xrefs: 6CD82E33
-ir-!, xrefs: 6CD82FAB

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw_malloc
String ID: -ir-!$ -p$ -r$7za A
API String ID: 3476970888-2239425251
Opcode ID: cc8130c2da344edcc617b7e59f9b25e4621fe60422e63dd6548113dc65ab914e
Instruction ID: cf0ae8e349fa15463d279f36f7f3fe4e525f60382eb93481937178e14d52bd81
Opcode Fuzzy Hash: cc8130c2da344edcc617b7e59f9b25e4621fe60422e63dd6548113dc65ab914e
Instruction Fuzzy Hash: 10029375D02248DBDB10DFA4C880BDEB7B4BF14308F148599E809B7B61E771AA49CBB1

Function 1001DF8C Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,10021660,00000001,?,74DEE860,1002CE50,?,?,00000002,00000000,?,?,1001DA1F,?), ref: 1001DFCB
GetStringTypeA.KERNEL32(00000000,00000001,1002165C,00000001,?,?,?,1001DA1F,?), ref: 1001DFE5
GetStringTypeA.KERNEL32(?,?,?,00000000,00000002,74DEE860,1002CE50,?,?,00000002,00000000,?,?,1001DA1F,?), ref: 1001E019
MultiByteToWideChar.KERNEL32(?,1002CE51,?,00000000,00000000,00000000,74DEE860,1002CE50,?,?,00000002,00000000,?,?,1001DA1F,?), ref: 1001E051
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?), ref: 1001E0A7
GetStringTypeW.KERNEL32(?,?,00000000,?,?,?), ref: 1001E0B9

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 9cb96698784a2f131f153e3bcad8cc4bc2e41755872ea77c6cd091048275da51
Instruction ID: 73f36e6d74bf66f6ce57e3c8a420cabe8a1af6d8c6052cc8844ff2d98f481940
Opcode Fuzzy Hash: 9cb96698784a2f131f153e3bcad8cc4bc2e41755872ea77c6cd091048275da51
Instruction Fuzzy Hash: 0041577250029AAFDB21DF94CC85EDE7BBAEB09790F20052AFA119A150C735DDD1CBA0

Function 6CD8ACE3 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 6CD8AD0B

Part of subcall function 6CD86968: __getptd.LIBCMT ref: 6CD86976
Part of subcall function 6CD86968: __getptd.LIBCMT ref: 6CD86984

__getptd.LIBCMT ref: 6CD8AD15

Part of subcall function 6CD872BB: __getptd_noexit.LIBCMT ref: 6CD872BE
Part of subcall function 6CD872BB: __amsg_exit.LIBCMT ref: 6CD872CB

__getptd.LIBCMT ref: 6CD8AD23
__getptd.LIBCMT ref: 6CD8AD31
__getptd.LIBCMT ref: 6CD8AD3C
_CallCatchBlock2.LIBCMT ref: 6CD8AD62

Part of subcall function 6CD86A0D: __CallSettingFrame@12.LIBCMT ref: 6CD86A59

Part of subcall function 6CD8AE09: __getptd.LIBCMT ref: 6CD8AE18
Part of subcall function 6CD8AE09: __getptd.LIBCMT ref: 6CD8AE26

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: d44243b4f320999035a76f229c36fe2390c62f7492497c20122fa56d0591ade4
Instruction ID: 3924cbf3f32cf563ee9a0c5f7ba4e1cd8d4cd268c9d7e480e88752b3dd3b1ad7
Opcode Fuzzy Hash: d44243b4f320999035a76f229c36fe2390c62f7492497c20122fa56d0591ade4
Instruction Fuzzy Hash: B61196B1D01609EFDB00EFA4D984BDE7BB0FF04318F11846AF854A7760DB389A199B60

Function 6CD802B0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 271COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CD8060F
__CxxThrowException@8.LIBCMT ref: 6CD80329

Part of subcall function 6CD8663B: RaiseException.KERNEL32(?,6CD80629,58E5B5EE,?,?,6CD80629,?,6CD98388,58E5B5EE), ref: 6CD8667D

__CxxThrowException@8.LIBCMT ref: 6CD80624

Strings

7za , xrefs: 6CD802F6
-an, xrefs: 6CD80569

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: -an$7za
API String ID: 3476068407-1592202885
Opcode ID: 73d7d1ec2d2e227603a969f8a3f4c2bba6bd2a0b4c7cd8ce7deb200edcb4325a
Instruction ID: 99f36c90ba70609018d3a2f36a5defa72d1e868f5f4b74bca9aa0b0ab0ec52ff
Opcode Fuzzy Hash: 73d7d1ec2d2e227603a969f8a3f4c2bba6bd2a0b4c7cd8ce7deb200edcb4325a
Instruction Fuzzy Hash: A0B182B5C01188EBDB00DFA8D980BCEBBB4AF14308F144559E905A7B61E775EA4DC7B2

Function 1001A27C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 1001A29B
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 1001A2D0
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1001A330

Strings

__MSVCRT_HEAP_SELECT, xrefs: 1001A2CB
__GLOBAL_HEAP_SELECTED, xrefs: 1001A30A

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 8d68a081adb5fb00688b35fa97c12b05e84aee0a2816abf6642aa1a3e48e784b
Instruction ID: ff41b7170f7c9f9639ed0085cf635e38180a7bd29c628196ad01e98acd5c5e28
Opcode Fuzzy Hash: 8d68a081adb5fb00688b35fa97c12b05e84aee0a2816abf6642aa1a3e48e784b
Instruction Fuzzy Hash: DB310575C412986EEB61D6745C81BDD37E9DB17344F2400EAF195DE042E631DFC99B20

Function 6CD7F5A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CD7F621

Strings

-aot, xrefs: 6CD7F5FF
-aoa, xrefs: 6CD7F5C9
-aos, xrefs: 6CD7F5DB
-aou, xrefs: 6CD7F5ED

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw
String ID: -aoa$ -aos$ -aot$ -aou
API String ID: 2005118841-2698752949
Opcode ID: 4d9237b69eec7fd6bd4f04210fe218b026cc1086edb4e00bb1e30238c63f30cd
Instruction ID: 8226da2723d2c45a3612e9d0a48e30292151a130babe49fafe4e5f352f59d86d
Opcode Fuzzy Hash: 4d9237b69eec7fd6bd4f04210fe218b026cc1086edb4e00bb1e30238c63f30cd
Instruction Fuzzy Hash: 79F0626471941CA39A10DB9DAC4049D739C870695EF004AD6F80DDBF30DB728E1A53EA

Function 6CD8AA32 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6CD8AA4C

Part of subcall function 6CD872BB: __getptd_noexit.LIBCMT ref: 6CD872BE
Part of subcall function 6CD872BB: __amsg_exit.LIBCMT ref: 6CD872CB

__getptd.LIBCMT ref: 6CD8AA5D
__getptd.LIBCMT ref: 6CD8AA6B

Strings

MOC, xrefs: 6CD8AA3E
csm, xrefs: 6CD8AA45

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: 66512fbb1fdfae65ddc3ab14898e2b81321cc8c81d018f826881ec3a7f1cfdf2
Instruction ID: 2d4e9a7b1e59e43725aa4f8ea7f5789a2e041fe7ea282f6ceb84a07a8abd6826
Opcode Fuzzy Hash: 66512fbb1fdfae65ddc3ab14898e2b81321cc8c81d018f826881ec3a7f1cfdf2
Instruction Fuzzy Hash: D6E04F31212104DFC700EBA4C184B9A33A4FB4531CF5701A1F48CC7F72CB38D4489A62

Function 1001C735 Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 1001C793
GetFileType.KERNEL32(00000480), ref: 1001C83E
GetStdHandle.KERNEL32(-000000F6), ref: 1001C8A1
GetFileType.KERNEL32(00000000), ref: 1001C8AF
SetHandleCount.KERNEL32 ref: 1001C8E6

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 96bd8d765951caf66320892a5d82298be417aadad03bc705412f471f5a66fdb5
Instruction ID: 9e0b50c6418c78b4ce1b27a1f486aee3850f1a3a2b75f6582e04b96d90fbb996
Opcode Fuzzy Hash: 96bd8d765951caf66320892a5d82298be417aadad03bc705412f471f5a66fdb5
Instruction Fuzzy Hash: 0C51243190436A8FE710DB68C8C4F697BE0EB05768F354669D5A29F2E2DB30DC86CB51

Function 100010A6 Relevance: 7.6, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

CharUpperW.USER32 ref: 100010C1
GetLastError.KERNEL32 ref: 100010CD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,00000004,00000000,00000000), ref: 100010E8
CharUpperA.USER32(?), ref: 10001101
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,00000001), ref: 10001114

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Char$ByteMultiUpperWide$ErrorLast
String ID:
API String ID: 3939315453-0
Opcode ID: 8383e40484a713360037c6af6127c53484664dbcfb1822a6f6cfd995dd4f40d0
Instruction ID: 5dd45f2d0006c2546d84b721a00360ca66f9a592c23ae8bd0920251664c2bfef
Opcode Fuzzy Hash: 8383e40484a713360037c6af6127c53484664dbcfb1822a6f6cfd995dd4f40d0
Instruction Fuzzy Hash: 210156B68002697BFB15EBE09CC9EDFB6ADEB082D4F110551FA42D3101E2B45D448770

Function 6CD8C0C6 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6CD8C0D2

Part of subcall function 6CD872BB: __getptd_noexit.LIBCMT ref: 6CD872BE
Part of subcall function 6CD872BB: __amsg_exit.LIBCMT ref: 6CD872CB

__amsg_exit.LIBCMT ref: 6CD8C0F2
__lock.LIBCMT ref: 6CD8C102
InterlockedDecrement.KERNEL32(?), ref: 6CD8C11F
InterlockedIncrement.KERNEL32(02971658), ref: 6CD8C14A

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 1ff0f8f9c14d12c3591eb67105712bb3a811a2a36f48e2edba32c5981ac2191c
Instruction ID: d4af164d592b6e6f197f519c68d8a5ee40a9d04006f184525ffdb7b144be60ad
Opcode Fuzzy Hash: 1ff0f8f9c14d12c3591eb67105712bb3a811a2a36f48e2edba32c5981ac2191c
Instruction Fuzzy Hash: 6D019236A47B11EBEB01AF65888478EB774BF45B18F110207E814A7FA0CF349945CBE1

Function 6CD85FF4 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 6CD86012

Part of subcall function 6CD881D4: __mtinitlocknum.LIBCMT ref: 6CD881EA
Part of subcall function 6CD881D4: __amsg_exit.LIBCMT ref: 6CD881F6
Part of subcall function 6CD881D4: EnterCriticalSection.KERNEL32(?,?,?,6CD8C6AB,00000004,6CD982E8,0000000C,6CD87669,6CD6FA7E,?,00000000,00000000,00000000,?,6CD8726D,00000001), ref: 6CD881FE

___sbh_find_block.LIBCMT ref: 6CD8601D
___sbh_free_block.LIBCMT ref: 6CD8602C
HeapFree.KERNEL32(00000000,6CD6FA7E,6CD97EB0,0000000C,6CD881B5,00000000,6CD98028,0000000C,6CD881EF,6CD6FA7E,?,?,6CD8C6AB,00000004,6CD982E8,0000000C), ref: 6CD8605C
GetLastError.KERNEL32(?,6CD8C6AB,00000004,6CD982E8,0000000C,6CD87669,6CD6FA7E,?,00000000,00000000,00000000,?,6CD8726D,00000001,00000214), ref: 6CD8606D

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: fc9dccf3583541491928d035df07a3c774f1f1c3c274ae3b60872524a63a42b2
Instruction ID: 89f0d179f9e40dba00e120327b1323c42a46d5276306636f3dc0c94895261843
Opcode Fuzzy Hash: fc9dccf3583541491928d035df07a3c774f1f1c3c274ae3b60872524a63a42b2
Instruction Fuzzy Hash: 1001A7B5A17301EAEB205FB19808B8E3BB89F0177CF214105F514E79B0DB398545CB69

Function 1001C031 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,1001C473,1001D0D7,00000000,?,?,00000000,00000001), ref: 1001C033
TlsGetValue.KERNEL32 ref: 1001C041
SetLastError.KERNEL32(00000000), ref: 1001C08D

Part of subcall function 1001C480: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,10019E24,10021318,000000FF,?,1001C056,00000001,00000074), ref: 1001C576

TlsSetValue.KERNEL32(00000000), ref: 1001C065
GetCurrentThreadId.KERNEL32 ref: 1001C076

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 2a7b4345b55e60806f6563897d190d9d6c15b8e2791512da656746999b9ff8e8
Instruction ID: c7b26c2ea065f329baa6dbda2ade13875997561f4633f5fb0c8b07fada39eb07
Opcode Fuzzy Hash: 2a7b4345b55e60806f6563897d190d9d6c15b8e2791512da656746999b9ff8e8
Instruction Fuzzy Hash: 0DF0BB35901331DBF2329B749C89F1A3AA6EF097B1F214318F6559E1A1CB30D8C29690

Function 1001A0CE Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,?,?,1001C005,10019FBC,1001A015,?,?,?), ref: 1001A102

Part of subcall function 100189EE: HeapFree.KERNEL32(00000000,?,?,?,?), ref: 10018AC2

DeleteCriticalSection.KERNEL32(?,?,1001C005,10019FBC,1001A015,?,?,?), ref: 1001A11D
DeleteCriticalSection.KERNEL32 ref: 1001A125
DeleteCriticalSection.KERNEL32 ref: 1001A12D
DeleteCriticalSection.KERNEL32 ref: 1001A135

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CriticalDeleteSection$FreeHeap
String ID:
API String ID: 447823528-0
Opcode ID: 31fd23f1ab8c03e9a7f37bef3c6a7256c8a93bd33ca8f004c8e74067c6c1dcf0
Instruction ID: 436f94670acdd869086ea8be0b95e1bb75b4415bd69928cd2107d9a27a45b4f1
Opcode Fuzzy Hash: 31fd23f1ab8c03e9a7f37bef3c6a7256c8a93bd33ca8f004c8e74067c6c1dcf0
Instruction Fuzzy Hash: 1AF0F4268002647AEA65F719AD8C8A97BD5DB822B27920476EC53B7030CD778CC29DA5

Function 6CD80DB0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 236COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CD8109D

Part of subcall function 6CD7F640: __CxxThrowException@8.LIBCMT ref: 6CD7F66A

Part of subcall function 6CD782B0: __CxxThrowException@8.LIBCMT ref: 6CD78324
Part of subcall function 6CD782B0: __CxxThrowException@8.LIBCMT ref: 6CD78390
Part of subcall function 6CD782B0: _malloc.LIBCMT ref: 6CD783B1
Part of subcall function 6CD782B0: __CxxThrowException@8.LIBCMT ref: 6CD783CB
Part of subcall function 6CD782B0: __CxxThrowException@8.LIBCMT ref: 6CD78416

Strings

-w, xrefs: 6CD80E18
7za d, xrefs: 6CD80DF6
-mhe, xrefs: 6CD80F69

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw$_malloc
String ID: -mhe$ -w$7za d
API String ID: 175252994-4051784903
Opcode ID: 5dd544d540e7deb2e3cd0560ae0b61fe7ef72ee13750dab19d27d0f95122d9bf
Instruction ID: b88944238ec35102ba484a11efb992073a61797c110424fbd37e620305139790
Opcode Fuzzy Hash: 5dd544d540e7deb2e3cd0560ae0b61fe7ef72ee13750dab19d27d0f95122d9bf
Instruction Fuzzy Hash: 079171B5D01248EBDB00DFA4C980BCEBBB8AF14308F144559E905A7B61E775EA4DCBB1

Function 6CD62830 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CD62893

Part of subcall function 6CD8663B: RaiseException.KERNEL32(?,6CD80629,58E5B5EE,?,?,6CD80629,?,6CD98388,58E5B5EE), ref: 6CD8667D

__CxxThrowException@8.LIBCMT ref: 6CD628BD

Strings

Cannot find listfile, xrefs: 6CD6288C, 6CD628B5
Incorrect item in listfile.Check charset encoding and -scs switch., xrefs: 6CD628B6

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Cannot find listfile$Incorrect item in listfile.Check charset encoding and -scs switch.
API String ID: 3476068407-2427230106
Opcode ID: f4bd9674de897fe5b847f0067a0cb5f721c7eeb9d1da6637f5b168de5cbace60
Instruction ID: 8ed14fafd249f4f5beeda06df9406ecdd0c2e246e14418f8bbe3a774509e62e9
Opcode Fuzzy Hash: f4bd9674de897fe5b847f0067a0cb5f721c7eeb9d1da6637f5b168de5cbace60
Instruction Fuzzy Hash: 82318FB6D002599BCB00CF99CD85AEEF7B8FB08218F044669E914A3B61D7315A09CBB1

Function 6CD75BE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\7-zip,00000000,00020019,6CD8FD48,58E5B5EE,00000000,?,80000001,00000000,6CD8FD48,000000FF,?,6CD75DBD,?,6CD9FCC8), ref: 6CD75C1D

Part of subcall function 6CD72FE0: RegQueryValueExW.ADVAPI32(00000000,Path,00000000,?,00000000,6CD75DBD,?,?,6CD75C37,?,6CD75DBD,?,6CD9FCC8,00000000,00000000), ref: 6CD7300E
Part of subcall function 6CD72FE0: RegQueryValueExW.ADVAPI32(6CD75DBD,Path,00000000,6CD75DBD,?,6CD75DBD,?,6CD75DBD,?,6CD9FCC8,00000000,00000000), ref: 6CD7304E

RegCloseKey.ADVAPI32(?,?,6CD75DBD,?,6CD9FCC8,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6CD75C47
RegCloseKey.ADVAPI32(?,?,6CD75DBD,?,6CD9FCC8,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6CD75C65

Strings

Software\7-zip, xrefs: 6CD75C11

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CloseQueryValue$Open
String ID: Software\7-zip
API String ID: 4082589901-3321436535
Opcode ID: 5fe8611ec19d692960395c8863c405623342621d71a5454110356b0527526d0c
Instruction ID: 518c92ff2230845ec0948813cc27fd7861485c54cdf7a7906b5453e131f9db6c
Opcode Fuzzy Hash: 5fe8611ec19d692960395c8863c405623342621d71a5454110356b0527526d0c
Instruction Fuzzy Hash: A2117076E05A28EBDB218F45DC44BAFBBBCFB05B24F00066BF919A7700E734590486E4

Function 6CD8B090 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 6CD8B0A3

Part of subcall function 6CD8AFFE: ___BuildCatchObjectHelper.LIBCMT ref: 6CD8B034

_UnwindNestedFrames.LIBCMT ref: 6CD8B0BA
___FrameUnwindToState.LIBCMT ref: 6CD8B0C8

Strings

csm, xrefs: 6CD8B09F, 6CD8B0B4, 6CD8B0C7, 6CD8B0E5, 6CD8B0F5

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: 140d385d04fdb06c5864635da4643ae5f7030d20822db344ff7144d47db4523a
Instruction ID: 43ad9a14dae159249a3ba3a93b213b69d48090da3b9b108770e718bea30c733c
Opcode Fuzzy Hash: 140d385d04fdb06c5864635da4643ae5f7030d20822db344ff7144d47db4523a
Instruction Fuzzy Hash: DE01D271002509FBDF125F51CC41AEA7F6AEF09358F104010FD6855AB0DB3699A6DBA5

Function 6CD7F640 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CD7F66A

Part of subcall function 6CD8663B: RaiseException.KERNEL32(?,6CD80629,58E5B5EE,?,?,6CD80629,?,6CD98388,58E5B5EE), ref: 6CD8667D

Strings

-r, xrefs: 6CD7F693
-r0, xrefs: 6CD7F66F
-r-, xrefs: 6CD7F681

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow
String ID: -r$ -r-$ -r0
API String ID: 3976011213-1696425382
Opcode ID: b0ae262631be860301a35eedf249fe1d4e1e95413895668d21cda046dd25f820
Instruction ID: 760495068764bb9fd0df29fb8cbf70ecd0dc5e1c66e687e17aefde78fbdaf478
Opcode Fuzzy Hash: b0ae262631be860301a35eedf249fe1d4e1e95413895668d21cda046dd25f820
Instruction Fuzzy Hash: 3AF0A920726018B7D621CBADAD24BAD739C870291DF000B95F808E7F30E7728E1883E9

Function 100197CF Relevance: 6.5, APIs: 5, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd9724b1c61d381fd748c7ffe039d77dfbf158c8da40872393acd8e509287be1
Instruction ID: c5e9eab5286596022c0fc86455b854ac72cbfdbbf2fd81343e62aa3bf37372db
Opcode Fuzzy Hash: fd9724b1c61d381fd748c7ffe039d77dfbf158c8da40872393acd8e509287be1
Instruction Fuzzy Hash: 7791C371D01664AADB11EB68CC81ADE7AF9EF497A0F600226F854BE191D731DDC0CBA1

Function 1001B010 Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,10025958,10025958,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?), ref: 1001B031
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?), ref: 1001B055
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?), ref: 1001B06F
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?,?), ref: 1001B130
HeapFree.KERNEL32(00000000,00000000,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?,?,?), ref: 1001B147

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 08a6be7fdf41f6db4eaa31ea6addab7da968f7782194b53cc123b6d70fe20246
Instruction ID: 9791cdc1e8676e8be9240cb2db72b85fdf48b460ca22e9baef45e6ba91bfb517
Opcode Fuzzy Hash: 08a6be7fdf41f6db4eaa31ea6addab7da968f7782194b53cc123b6d70fe20246
Instruction Fuzzy Hash: F4312670500B56EBE332CF24CCC5B2677E0EB447A5FA14529F5669B290E771E8C5CB48

Function 6CD6FD20 Relevance: 6.3, APIs: 4, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cccf98f04461603991430c97992756bff8f6cab2f2e7963668195bc048fefd6b
Instruction ID: d625cc480a496f6d86504ee76e8a5281940c9665512896272b06ef7b996d87e1
Opcode Fuzzy Hash: cccf98f04461603991430c97992756bff8f6cab2f2e7963668195bc048fefd6b
Instruction Fuzzy Hash: 21C1C575D05509DFCB00CF99C480ADEF7B5FF49328F248259E815ABB60D731AA45CBA1

Function 6CD8CEA8 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 6CD8CEDC
__isleadbyte_l.LIBCMT ref: 6CD8CF10
MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,?,?,00000000,?,?,?), ref: 6CD8CF41
MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,00000001,?,00000000,?,?,?), ref: 6CD8CFAF

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: a5fcac9014a83d5ef7d0c8c387f07f1a4ee4e8bc328248e3c9a894fd8bdcf4ef
Instruction ID: 8a40fd5330adc301b36279976627a784de19705c425e9b128191718156a5b717
Opcode Fuzzy Hash: a5fcac9014a83d5ef7d0c8c387f07f1a4ee4e8bc328248e3c9a894fd8bdcf4ef
Instruction Fuzzy Hash: B531C431A07245EFEB01EF68C8809AE7BF5BF41315F2446A9F1649B9A0E330D950DB60

Function 6CD70F70 Relevance: 6.1, APIs: 4, Instructions: 86filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000003,00000000,00000003,02000000,00000000,58E5B5EE,00000000,?,?,00000000,00000000,00000000), ref: 6CD70FAE
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 6CD7100C
SetFileTime.KERNEL32(00000000,?,?,?,?,?,?), ref: 6CD71033
CloseHandle.KERNEL32(00000000,?,?,?), ref: 6CD7103F

Part of subcall function 6CD728A0: GetCurrentDirectoryW.KERNEL32(00000105,?,58E5B5EE,FFFFFFFF,?,00000004), ref: 6CD72994

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: File$Create$CloseCurrentDirectoryHandleTime
String ID:
API String ID: 2622452211-0
Opcode ID: e321fe8125e5fd2bdd727eea964fec79da2c53dd933a4ab706d7ba9bf9baf3ff
Instruction ID: b0b8b5be750f1e285cd99a49711cf155042db028371e1a0a449bd3101d70f4d2
Opcode Fuzzy Hash: e321fe8125e5fd2bdd727eea964fec79da2c53dd933a4ab706d7ba9bf9baf3ff
Instruction Fuzzy Hash: 6621A175A00204ABFB208F54DC85FAFB7BCEB45768F104229FA19A76D0D734AE0496B0

Function 1000112C Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000112C
CharUpperW.USER32 ref: 10001144
GetLastError.KERNEL32 ref: 10001150
CharUpperA.USER32(?), ref: 10001183

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CharUpper$ErrorH_prologLast
String ID:
API String ID: 826227211-0
Opcode ID: ff1246a03657b54eff9156cf09a95992e04e2b4fa534e0be7897412a772be6bf
Instruction ID: 99cf40d06858b6207db1331b5053b1e25ae539a9e8e767eb293be6f8fe8ea0fc
Opcode Fuzzy Hash: ff1246a03657b54eff9156cf09a95992e04e2b4fa534e0be7897412a772be6bf
Instruction Fuzzy Hash: 8A11043590025BDFEB05EFA0D8919EEB7F4FF09384F200424F542A2269EB705E41CB80

Function 6CD7D4C0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CD9FC98,58E5B5EE,?,?,?,6CD8FB68,000000FF), ref: 6CD7D4F2
LeaveCriticalSection.KERNEL32(6CD9FC98,?,?,?,6CD8FB68,000000FF), ref: 6CD7D50A
LeaveCriticalSection.KERNEL32(6CD9FC98,?,?,?,?,6CD8FB68,000000FF), ref: 6CD7D547

Strings

[Content], xrefs: 6CD7D52D

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: [Content]
API String ID: 2978645861-3799411330
Opcode ID: 434d1cbb7c89e3ed1657f8f079ea5fb8d6f4236c2e186f4a4950d355ed26e5df
Instruction ID: b69fbeb80cfd95cb699ad7ce370bda4eba4a9e912739cddba828034f5551138b
Opcode Fuzzy Hash: 434d1cbb7c89e3ed1657f8f079ea5fb8d6f4236c2e186f4a4950d355ed26e5df
Instruction Fuzzy Hash: F001D676904508AFE710DF58C845B99B7F8FB0A714F40866AF805E7B90E775AD48CBA0

Function 6CD61A30 Relevance: 6.0, APIs: 4, Instructions: 46fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6,?,00100000,?,00000000), ref: 6CD61A4E
ReadFile.KERNEL32(00000000), ref: 6CD61A55
GetLastError.KERNEL32 ref: 6CD61A72
GetLastError.KERNEL32 ref: 6CD61A80

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 332c624d3799ab7a2914dad8357b2b51f436939790301c59939654680b799b6b
Instruction ID: 15f8e19cd3e5ee7bef712830788bd48cf248031fc194d7a71981be430ee242dd
Opcode Fuzzy Hash: 332c624d3799ab7a2914dad8357b2b51f436939790301c59939654680b799b6b
Instruction Fuzzy Hash: 4101D67734020A9BEB00CF959D40BB7336C9B443A4F104636F91AC7A90D630D811C7A0

Function 6CD6EF70 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6CD6EF8A

Part of subcall function 6CD85F2A: __FF_MSGBANNER.LIBCMT ref: 6CD85F4D
Part of subcall function 6CD85F2A: __NMSG_WRITE.LIBCMT ref: 6CD85F54
Part of subcall function 6CD85F2A: RtlAllocateHeap.NTDLL(00000000,6CD6FA6F,?,00000000,?,?,6CD64D3F,0000000C,58E5B5EE,?,?,00000000,?,?,6CD8EF9B,000000FF), ref: 6CD85FA1

__CxxThrowException@8.LIBCMT ref: 6CD6EFA4

Part of subcall function 6CD8663B: RaiseException.KERNEL32(?,6CD80629,58E5B5EE,?,?,6CD80629,?,6CD98388,58E5B5EE), ref: 6CD8667D

std::exception::exception.LIBCMT ref: 6CD6EFC3
__CxxThrowException@8.LIBCMT ref: 6CD6EFD8

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw$AllocateExceptionHeapRaise_mallocstd::exception::exception
String ID:
API String ID: 1974103008-0
Opcode ID: 52bf041bf5c1a294a3dc13658dcf447134e95ac12192a25dcceb1863ae894655
Instruction ID: c4b1b543731ffd0b5984871558379f2fb852e4e3ba128128f6736ec4d356e7df
Opcode Fuzzy Hash: 52bf041bf5c1a294a3dc13658dcf447134e95ac12192a25dcceb1863ae894655
Instruction Fuzzy Hash: 36F028B0C052046BEB08CBB49D417EFB77A5B84714F0486A9D40191E64FB30821D86B2

Function 6CD759C0 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6CD759D3

Part of subcall function 6CD85F2A: __FF_MSGBANNER.LIBCMT ref: 6CD85F4D
Part of subcall function 6CD85F2A: __NMSG_WRITE.LIBCMT ref: 6CD85F54
Part of subcall function 6CD85F2A: RtlAllocateHeap.NTDLL(00000000,6CD6FA6F,?,00000000,?,?,6CD64D3F,0000000C,58E5B5EE,?,?,00000000,?,?,6CD8EF9B,000000FF), ref: 6CD85FA1

__CxxThrowException@8.LIBCMT ref: 6CD759ED

Part of subcall function 6CD8663B: RaiseException.KERNEL32(?,6CD80629,58E5B5EE,?,?,6CD80629,?,6CD98388,58E5B5EE), ref: 6CD8667D

std::exception::exception.LIBCMT ref: 6CD75A0C
__CxxThrowException@8.LIBCMT ref: 6CD75A21

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw$AllocateExceptionHeapRaise_mallocstd::exception::exception
String ID:
API String ID: 1974103008-0
Opcode ID: c33adcc2cb57a8456684a0c4b2e9c791a5c47ceab5b201fcec1c7953d0267db9
Instruction ID: 8ccc2225c3411437b7b0776a48b35da549b64d962be106261e47e2314ec87c4a
Opcode Fuzzy Hash: c33adcc2cb57a8456684a0c4b2e9c791a5c47ceab5b201fcec1c7953d0267db9
Instruction Fuzzy Hash: F3F02BF581520965EB04DBF48941AEFB77D5F40718F00079AD402A2DA5FB70971D8273

Function 6CD6F310 Relevance: 6.0, APIs: 4, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6CD6F320

Part of subcall function 6CD85F2A: __FF_MSGBANNER.LIBCMT ref: 6CD85F4D
Part of subcall function 6CD85F2A: __NMSG_WRITE.LIBCMT ref: 6CD85F54
Part of subcall function 6CD85F2A: RtlAllocateHeap.NTDLL(00000000,6CD6FA6F,?,00000000,?,?,6CD64D3F,0000000C,58E5B5EE,?,?,00000000,?,?,6CD8EF9B,000000FF), ref: 6CD85FA1

__CxxThrowException@8.LIBCMT ref: 6CD6F33A

Part of subcall function 6CD8663B: RaiseException.KERNEL32(?,6CD80629,58E5B5EE,?,?,6CD80629,?,6CD98388,58E5B5EE), ref: 6CD8667D

std::exception::exception.LIBCMT ref: 6CD6F359
__CxxThrowException@8.LIBCMT ref: 6CD6F36E

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw$AllocateExceptionHeapRaise_mallocstd::exception::exception
String ID:
API String ID: 1974103008-0
Opcode ID: 13a77cb5efcb4f716ac503ac52969d6d423487ba3321b013d6e6531849f30278
Instruction ID: e02a4e514c67fa787aec583fee3d16d71a7e38404a6d05217d4b75339136c7e6
Opcode Fuzzy Hash: 13a77cb5efcb4f716ac503ac52969d6d423487ba3321b013d6e6531849f30278
Instruction Fuzzy Hash: DBF02BB081520877DB08CF75D901ADE77699F00718F00825EEC1982E64FB70D30CC665

Function 6CD8BE2A Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6CD8BE36

Part of subcall function 6CD872BB: __getptd_noexit.LIBCMT ref: 6CD872BE
Part of subcall function 6CD872BB: __amsg_exit.LIBCMT ref: 6CD872CB

__getptd.LIBCMT ref: 6CD8BE4D
__amsg_exit.LIBCMT ref: 6CD8BE5B
__lock.LIBCMT ref: 6CD8BE6B

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: dc98ad90defee895a665558e57fca3df9abcadbba7adc2ededb47e5dfd9d060b
Instruction ID: 5ff9bfbfd89d7c66d1a5c889e6aff094f97dbd7f65105f79d10a1637e73d8fcc
Opcode Fuzzy Hash: dc98ad90defee895a665558e57fca3df9abcadbba7adc2ededb47e5dfd9d060b
Instruction Fuzzy Hash: 8CF09032A03B00FEEB51ABA48C4078E72A0AF01718F164649E55197FF0CB34A909CBB2

Function 100081EF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 100081F4

Strings

, xrefs: 100083AB
, xrefs: 100083D3

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: H_prolog
String ID: $
API String ID: 3519838083-227171996
Opcode ID: 312c2aec7e709d08ccb2c85a8bc715850654904397243e69b9c15c2e37b53766
Instruction ID: 9585d42676a0d41e953fe7fe136552d86f024f2135ab78c93d006785aed77b76
Opcode Fuzzy Hash: 312c2aec7e709d08ccb2c85a8bc715850654904397243e69b9c15c2e37b53766
Instruction Fuzzy Hash: D471583090060ACFEB20CF94C881AAEB7B1FF88394F50456DD596A7255DB30BB86CF50

Function 6CD7FC00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CD7FD8E
__CxxThrowException@8.LIBCMT ref: 6CD7FDA3

Strings

-u, xrefs: 6CD7FC64

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throw
String ID: -u
API String ID: 2005118841-3343466670
Opcode ID: 3870b510708da7f0afe038d6e487aa8ce0c94477fbd56c56e34bc53e92c43c79
Instruction ID: 99abd5098d94e578dcfcc29a653da98bb964fe5f5524fcb6bbe0e2dc0b4826eb
Opcode Fuzzy Hash: 3870b510708da7f0afe038d6e487aa8ce0c94477fbd56c56e34bc53e92c43c79
Instruction Fuzzy Hash: A141BA75D09248EFDB20CFA8C940ACEB7B4EF05344F504A26E804E7B20E7719A49C7B1

Function 1001D6A3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 1001D6B7

Strings

, xrefs: 1001D6DC
, xrefs: 1001D700

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 14eba8f351f7a606bf476568831cf335b29103052037c0e04881c2f51051340a
Instruction ID: 27a1dab1f5f815cb8d427bf576b62c8b4ec6ff9cec70f847aa7466e11b016868
Opcode Fuzzy Hash: 14eba8f351f7a606bf476568831cf335b29103052037c0e04881c2f51051340a
Instruction Fuzzy Hash: 2B41483140436C1AEB11FA64CD85FEA7F9ADB01744F1006F7D585CF092D271C989DBA2

Function 6CD7FDE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 6CD7FE54
__CxxThrowException@8.LIBCMT ref: 6CD7FED8

Strings

-v, xrefs: 6CD7FE5D

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: Exception@8Throwwsprintf
String ID: -v
API String ID: 2898814609-1581256980
Opcode ID: 8af17a79aa06f2aa8da5f339ddca2c2469202a3d3f3c37b3c4634f0f5c63c507
Instruction ID: 66015833459180d9d76fb53a75969c4692b01ea4c4678865af0574b9969e4170
Opcode Fuzzy Hash: 8af17a79aa06f2aa8da5f339ddca2c2469202a3d3f3c37b3c4634f0f5c63c507
Instruction Fuzzy Hash: 84316375D00248EBDB10CFE5C944ADEFBF8EF44704F10452AE505A7655E7759A08CBA0

Function 6CD70AF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,0000005F,00000000,58E5B5EE,00000000), ref: 6CD70B62
__CxxThrowException@8.LIBCMT ref: 6CD70B88

Part of subcall function 6CD8663B: RaiseException.KERNEL32(?,6CD80629,58E5B5EE,?,?,6CD80629,?,6CD98388,58E5B5EE), ref: 6CD8667D

Strings

_, xrefs: 6CD70B25

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ByteCharExceptionException@8MultiRaiseThrowWide
String ID: _
API String ID: 3144726602-701932520
Opcode ID: 8e5b6b0bc738fabf8a1cf37d9c9c2f341487d6c56818fed4cc00e048b3816d01
Instruction ID: 174caaad63b34ecba4f43126be0461568d883a182ac0b708f37a155a186a2325
Opcode Fuzzy Hash: 8e5b6b0bc738fabf8a1cf37d9c9c2f341487d6c56818fed4cc00e048b3816d01
Instruction Fuzzy Hash: 4221CF75500249EFDB00CF99C880BABFBF8EF49718F10855AE914DB790D771AA04CBA0

Function 6CD72FE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,Path,00000000,?,00000000,6CD75DBD,?,?,6CD75C37,?,6CD75DBD,?,6CD9FCC8,00000000,00000000), ref: 6CD7300E
RegQueryValueExW.ADVAPI32(6CD75DBD,Path,00000000,6CD75DBD,?,6CD75DBD,?,6CD75DBD,?,6CD9FCC8,00000000,00000000), ref: 6CD7304E

Strings

Path, xrefs: 6CD73002, 6CD73045

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: QueryValue
String ID: Path
API String ID: 3660427363-2875597873
Opcode ID: f5760b380d490bb344b42c9061d5b20b98689a538dee98795f36e40b7b1cf1e0
Instruction ID: c5e64ca5f755c8eff9cf7a81e8cc7ad0eccc84b68af6a4c3c842670d7274ddd9
Opcode Fuzzy Hash: f5760b380d490bb344b42c9061d5b20b98689a538dee98795f36e40b7b1cf1e0
Instruction Fuzzy Hash: 89118275A05604EFEB24DFA5C8C48AEF7B9FF49704B20896EE14AD3A10E7709D44CB60

Function 6CD7C8BE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CD7C8C2

Part of subcall function 6CD8663B: RaiseException.KERNEL32(?,6CD80629,58E5B5EE,?,?,6CD80629,?,6CD98388,58E5B5EE), ref: 6CD8667D

GetLastError.KERNEL32(00000000,00000000), ref: 6CD7C8C7

Strings

7-Zip cannot load Mapi32.dll, xrefs: 6CD7C8D2

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ErrorExceptionException@8LastRaiseThrow
String ID: 7-Zip cannot load Mapi32.dll
API String ID: 2060628206-1691247220
Opcode ID: c12362ebbcbc2cd4c61ce8e8a114f955c37fbda2098c97336a9b7eec22a0eab3
Instruction ID: 899912a1d352a40d72058c9ea91f0937aa46a96332053adfa0189f65b0a36d30
Opcode Fuzzy Hash: c12362ebbcbc2cd4c61ce8e8a114f955c37fbda2098c97336a9b7eec22a0eab3
Instruction Fuzzy Hash: 9711A172905248EBEB10DBE4DD00BDEB7B8AF49318F64419DE508977A0EB315A08CB72

Function 6CD8AE09 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6CD869BB: __getptd.LIBCMT ref: 6CD869C1
Part of subcall function 6CD869BB: __getptd.LIBCMT ref: 6CD869D1

__getptd.LIBCMT ref: 6CD8AE18

Part of subcall function 6CD872BB: __getptd_noexit.LIBCMT ref: 6CD872BE
Part of subcall function 6CD872BB: __amsg_exit.LIBCMT ref: 6CD872CB

__getptd.LIBCMT ref: 6CD8AE26

Strings

csm, xrefs: 6CD8AE34

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: c868b9202c40c128ab5c124d4baf2a7191ffbd882dd3f7671e77d16ed862952d
Instruction ID: 9dbb66d53f5377f44b6a34ed21e05a32671df07f778452283de194c5c8f75d31
Opcode Fuzzy Hash: c868b9202c40c128ab5c124d4baf2a7191ffbd882dd3f7671e77d16ed862952d
Instruction Fuzzy Hash: 6B014B74A03605DFCB269FA1D4407ADB3B5AF00319F24492DE44996EF0DB30D589CB71

Function 6CD8E688 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CD8E66F

Part of subcall function 6CD8663B: RaiseException.KERNEL32(?,6CD80629,58E5B5EE,?,?,6CD80629,?,6CD98388,58E5B5EE), ref: 6CD8667D

std::bad_exception::bad_exception.LIBCMT ref: 6CD8E697

Part of subcall function 6CD85DCA: std::bad_exception::bad_exception.LIBCMT ref: 6CD85DD5

Strings

Access violation - no RTTI data!, xrefs: 6CD8E68F

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: std::bad_exception::bad_exception$ExceptionException@8RaiseThrow
String ID: Access violation - no RTTI data!
API String ID: 1432139112-2158758863
Opcode ID: 20c0ddbb290d0c83652378410b13d1931632ab9894198cd322e4a1d4ccf224b6
Instruction ID: a783731e967df1702b9072b48a94a13e32c13976c2b77241dc4dea857b7bd1a9
Opcode Fuzzy Hash: 20c0ddbb290d0c83652378410b13d1931632ab9894198cd322e4a1d4ccf224b6
Instruction Fuzzy Hash: A2E0C279910104CFDF00CBA8C981ADE73B0AB09315F050844E402F3B70D730A945CF61

Function 6CD8518F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CD85196
__CxxThrowException@8.LIBCMT ref: 6CD851C1

Part of subcall function 6CD8663B: RaiseException.KERNEL32(?,6CD80629,58E5B5EE,?,?,6CD80629,?,6CD98388,58E5B5EE), ref: 6CD8667D

Strings

invalid string position, xrefs: 6CD8519B

Memory Dump Source

Source File: 00000001.00000002.2252022239.000000006CD61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000001.00000002.2251986708.000000006CD60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252185441.000000006CD93000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252253123.000000006CD9D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDA3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2252298028.000000006CDC8000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cd60000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrow
String ID: invalid string position
API String ID: 1961742612-1799206989
Opcode ID: 8343693f9612d7e93253d55fb5208a4a6f800fc28f11c9a4fad528965a7e68f3
Instruction ID: 507070f05404c668f257a80d78968a35b1fd7ff9070990e53a792fbd95c1e987
Opcode Fuzzy Hash: 8343693f9612d7e93253d55fb5208a4a6f800fc28f11c9a4fad528965a7e68f3
Instruction Fuzzy Hash: CBD01775861118ABDB00DBD0CC44FDDB378AB14728F840825A204E6EA0EB64EA0DCB70

Function 1001AB6E Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,?,?,00000000,1001A936,?,?,?,10018906,?,?,?,?,?,?), ref: 1001AB96
HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,1001A936,?,?,?,10018906,?,?,?,?,?,?), ref: 1001ABCA
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 1001ABE4
HeapFree.KERNEL32(00000000,?), ref: 1001ABFB

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 6f699eca9e893f575dde21e6c4b4ec1254527531fada708ecaea67c30c461b13
Instruction ID: 484c1ce75c38baac158856a15f7ab205fd40ab6127819ea80900b3ceb95b3c03
Opcode Fuzzy Hash: 6f699eca9e893f575dde21e6c4b4ec1254527531fada708ecaea67c30c461b13
Instruction Fuzzy Hash: E8112570240321AFE721EF19CCC6A167BF6FB86764B61491AF552C69B1D3729CA2CF40

Function 1001A0A5 Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,1001BFB2,?,10019F53), ref: 1001A0B2
InitializeCriticalSection.KERNEL32 ref: 1001A0BA
InitializeCriticalSection.KERNEL32 ref: 1001A0C2
InitializeCriticalSection.KERNEL32 ref: 1001A0CA

Memory Dump Source

Source File: 00000001.00000002.2251706080.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2251670829.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251834288.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251875919.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251908131.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2251948985.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_cfrv_4_0_setup_ALL.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: 9eddfc3165ec3fc15766a975bd316014652016b7c432d0d5cadee5ee0f614abc
Instruction ID: bb73eb11f573fb0f18e311b5dd9e76b2e5dde51fe535fe889abf8312516ef5db
Opcode Fuzzy Hash: 9eddfc3165ec3fc15766a975bd316014652016b7c432d0d5cadee5ee0f614abc
Instruction Fuzzy Hash: BEC00231801138AFFA556B55DC848493FA6EB042723210063E10561030CEB31C93DFE8

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report cfrv_4_0_setup_ALL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\4937c8.rbs

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\CF_Remote.exe

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\CF_Remote.exe.manifest

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Campaign Finance Remote.chm

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\1998_NC_Disclosure.rpt

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\Accounts.rpt

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\Contributions.rpt

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\Cover.rpt

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\Debts.rpt

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\Expenditures.rpt

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\LoanEndorsers.rpt

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\LoanProceeds.rpt

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\LoanRepayments.rpt

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\1998\Summary.rpt

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\2003_Disclosure.rpt

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\2003_Electioneering_Report.rpt

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\2003_FED_Disclosure.rpt

C:\Program Files (x86)\SBoE\Campaign Finance\CF Remote\Reports\2002\2003_FED_Org_Statement.rpt

Windows Analysis Report
cfrv_4_0_setup_ALL.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	To disguise the source of malicious traffic, adversaries may chain together multiple proxies. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source. A particular variant of this behavior is to use onion routing networks, such as the publicly available TOR network.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre