Windows Analysis Report
Codecs.exe

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP A8657371F03E2E66DB951C3DCD3AEB42C576894908CA2EB1B3806AA0404CB083

Source: _isres.dll.2.dr

Static PE information: No import functions for PE file found

Source: Codecs.exe, 00000000.00000002.2213553415.0000000000418000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamestub32i.exe vs Codecs.exe
Source: Codecs.exe	Binary or memory string: OriginalFilenamestub32i.exe vs Codecs.exe

Source: Codecs.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: clean13.winEXE@7/40@0/0

Source: C:\Users\user\Desktop\Codecs.exe

File created: C:\Users\user\AppData\Local\Temp\plf1B90.tmp

Source: Codecs.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe

File read: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\SETUP.INI

Source: C:\Users\user\Desktop\Codecs.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\Codecs.exe

File read: C:\Users\user\Desktop\Codecs.exe

Source: unknown	Process created: C:\Users\user\Desktop\Codecs.exe "C:\Users\user\Desktop\Codecs.exe"
Source: C:\Users\user\Desktop\Codecs.exe	Process created: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe "C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe" /SMS
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDEL.EXE
Source: C:\Users\user\Desktop\Codecs.exe	Process created: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe "C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe" /SMS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDEL.EXE	Jump to behavior

Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: lz32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: acspecfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: ddraw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: acspecfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: ddraw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: acspecfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: ddraw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: acwow64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Section loaded: sfc_os.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Users\user\Desktop\Codecs.exe

File written: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\SETUP.INI

Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Automated click: Next >

Source: C:\Users\user\Desktop\Codecs.exe

File opened: C:\Windows\SysWOW64\RICHED32.DLL

Creates an undocumented autostart registry key

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: c\H263\VCM\Release\TxsH263.pdb source: _INS5576._MP, 00000002.00000003.2050210386.000000000084B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c\H263\VCM\Release\TxsH263.pdb5 source: _INS5576._MP, 00000002.00000003.2050210386.000000000084B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: M:\Txs\Arcturus\Codec\H263\VCM\Release\TxsH263.pdb source: _INS5576._MP, 00000002.00000003.2049998616.0000000000829000.00000004.00000020.00020000.00000000.sdmp, TxsH263.dll.2.dr, TxsH263.dll.0.dr
Source:	Binary string: M:\Txs\Arcturus\Codec\H263\VCM\Release\TxsH263.pdb5 source: _INS5576._MP, 00000002.00000003.2049998616.0000000000829000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_WUTL951.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File created: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\Ctl3d32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File created: C:\Windows\IsUninst.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File created: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\IsUninst.728	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File created: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\_isres.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File created: C:\Windows\SysWOW64\TxsH263.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File created: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\4d7894.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File created: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\IsUninst.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\Codecs.exe	File created: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_Setup.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Codecs.exe	File created: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\TxsH263.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Jump to dropped file
Source: C:\Users\user\Desktop\Codecs.exe	File created: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File created: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\IsUninst.exe.orig	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File created: C:\Windows\SysWOW64\txsadp32.acm	Jump to dropped file
Source: C:\Users\user\Desktop\Codecs.exe	File created: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Codecs.exe	File created: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\txsadp32.acm	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\ZDataI51.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File created: C:\Windows\IsUninst.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File created: C:\Windows\SysWOW64\TxsH263.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File created: C:\Windows\SysWOW64\txsadp32.acm	Jump to dropped file

Source: C:\Users\user\Desktop\Codecs.exe	File created: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\txsadp32.acm	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File created: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\IsUninst.728	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File created: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\IsUninst.exe.orig	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File created: C:\Windows\SysWOW64\txsadp32.acm	Jump to dropped file

Boot Survival

Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 msacm.txsadpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 msacm.txsadpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 vidc.T263	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 vidc.T263	Jump to behavior

Source: C:\Users\user\Desktop\Codecs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_WUTL951.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Dropped PE file which has not been started: C:\Windows\IsUninst.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\Ctl3d32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\_isres.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\IsUninst.728	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Dropped PE file which has not been started: C:\Windows\SysWOW64\TxsH263.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\4d7894.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\IsUninst.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\Codecs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_Setup.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Codecs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\TxsH263.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\IsUninst.exe.orig	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	Dropped PE file which has not been started: C:\Windows\SysWOW64\txsadp32.acm	Jump to dropped file
Source: C:\Users\user\Desktop\Codecs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\txsadp32.acm	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\ZDataI51.dll	Jump to dropped file

Source: C:\Users\user\Desktop\Codecs.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Codecs.exe	File opened: C:\Users\user\AppData\Local\Temp\plf1B90.tmp	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	File opened: C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\	Jump to behavior
Source: C:\Users\user\Desktop\Codecs.exe	File opened: C:\Users\user\	Jump to behavior

Source: _INS5576._MP, 00000002.00000000.1685120946.0000000000481000.00000008.00000001.01000000.00000008.sdmp, _INS5576._MP.1.dr	Binary or memory string: PROGMANPROGMAN[CreateGroup(%s,)][CreateGroup()][AddItem(,,,,-1,-1,,,,1,0)][DeleteGroup(%s)][CreateGroup(%s)][DeleteItem(%s)][ShowGroup(%s,%ld)][Reload(%s)][CreateGroup()][ReplaceItem()][AddItem(,,,,-1,-1,,,,1,0)]PROGMAN.EXE[ExitProgMan(%d)]Explorer.exesystem.iniProgMan.exeShellBootGROUPS+%sCTRL+%sALTSHIFT+%sALTSHIFTNUM%s%s%s%sCTRL%sSHIFTALTCTRLNUM%s%s%s%sF1F2F3F4F5F6F7F8F9F10F11F12F13F14F15F16LEFTUPRIGHTDOWNHOMEENDPAGEUPDOWNINSERT+-~!@#$%^&()_+{}\|:?><Ctrl + Shift + Alt + Page UpPage DownEndHomeLeftUpRightDownInsertNum 0Num 1Num 2Num 3Num 4Num 5Num 6Num 7Num 8Num 9Num Num +Num -F1F2F3F4F5F6F7F8F9F10F11F12F13F14F15F16(),,%ldGROUPS,,,,,,,,,,....%.2u-%.2u-%.2u%.2d:%.2d%.2u-%.2u-%.4u%.2d:%.2d%1c%1c%1c%1c%d.%d%s_fty%d.231.*
Source: _INS5576._MP, 00000002.00000003.1992463935.0000000000836000.00000004.00000020.00020000.00000000.sdmp, setup.ins.0.dr	Binary or memory string: Progman.exe(
Source: Setup.exe, 00000001.00000002.2141513574.000000000040F000.00000004.00000001.01000000.00000006.sdmp, Setup.exe, 00000001.00000000.1660522023.000000000040F000.00000008.00000001.01000000.00000006.sdmp, Setup.exe.0.dr	Binary or memory string: LOGO_MSG_LOGOSTATUS_30LOGO_MSG_LOGOCLOSE_30LgoStatusWinLgoBitmapClsLgoBitmapWinstaticsetup.bmpsetup16.bmpShell_TrayWnd file%d
Source: _INS5576._MP, 00000002.00000000.1685120946.0000000000481000.00000008.00000001.01000000.00000008.sdmp, _INS5576._MP, 00000002.00000002.2065063633.0000000000481000.00000004.00000001.01000000.00000008.sdmp, _INS5576._MP.1.dr	Binary or memory string: [ExitProgMan(%d)]
Source: Setup.exe, 00000001.00000002.2141513574.000000000040F000.00000004.00000001.01000000.00000006.sdmp, Setup.exe, 00000001.00000000.1660522023.000000000040F000.00000008.00000001.01000000.00000006.sdmp, Setup.exe.0.dr	Binary or memory string: Shell_TrayWnd
Source: _INS5576._MP, 00000002.00000000.1685120946.0000000000481000.00000008.00000001.01000000.00000008.sdmp, _INS5576._MP, 00000002.00000002.2065063633.0000000000481000.00000004.00000001.01000000.00000008.sdmp, _INS5576._MP.1.dr	Binary or memory string: Progman
Source: _INS5576._MP, 00000002.00000002.2065852635.0000000002F70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman.exe
Source: IsUninst.exe.orig.2.dr, IsUninst.728.2.dr, IsUninst.exe.2.dr	Binary or memory string: PROGMANPROGMAN[DeleteGroup(%s)][CreateGroup(%s)][DeleteItem(%s)][ShowGroup(%s,%ld)]GROUPSCtrl + Shift + Alt + Page UpPage DownEndHomeLeftUpRightDownInsertNum 0Num 1Num 2Num 3Num 4Num 5Num 6Num 7Num 8Num 9Num *Num +Num -F1F2F3F4F5F6F7F8F9F10F11F12F13F14F15F16(),,%ld,,,,,,,,,,LogWindow
Source: Setup.exe, 00000001.00000002.2141513574.000000000040F000.00000004.00000001.01000000.00000006.sdmp, Setup.exe, 00000001.00000000.1660522023.000000000040F000.00000008.00000001.01000000.00000006.sdmp, Setup.exe.0.dr	Binary or memory string: %08lx._MP%04xSETUPDIRyYEnableLangDlgNCmdLineSerialNoFileNameSMSMifTypeFreeDiskSpaceAppNameStartupIsdelNamesetup.iniISMSG32_TERMINATEISMSG16_TERMINATEISDEL_MSG_DELDONE32ISDEL_MSG_DELEXISTS32ISDEL_MSG_DELENABLE32_delis32.iniLAYOUT.BINSETUP.INS_ISDEL.EXEBOOT16.EXEBOOT32.EXEWUTL95I.DLLZDATA.DLLINSTALL.EXE_INST32I.EX__INST32A.EX__INST32M.EX__INST32P.EX__INST16.EX_InstallShieldSetup30_SETUP.DLL -f%s %s -m2 -m1 -m -q1%04x" -x1" -x -c -cx -z1EXETEMP_INS5566._MP.INS%s_ISTMP%d.DIR_INS33IS._MPexeostypedirmainNOT_POSSIBLE_VALUEalt%dSharedErrors_iserr31.ini_isenv31.iniISUNINST.EXEISUN16.EXEEXPLORER.EXEBootShellProgMan.exesystem.ini_INS0432.INI.\.
Source: _INS5576._MP, 00000002.00000002.2065063633.0000000000481000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: PROGMANPROGMAN[CreateGroup(%s,)][CreateGroup()][AddItem(,,,,-1,-1,,,,1,0)][DeleteGroup(%s)][CreateGroup(%s)][DeleteItem(%s)][ShowGroup(%s,%ld)][Reload(%s)][CreateGroup()][ReplaceItem()][AddItem(,,,,-1,-1,,,,1,0)]PROGMAN.EXE[ExitProgMan(%d)]Explorer.exesystem.iniProgMan.exeShellBootGROUPS+%sCTRL+%sALTSHIFT+%sALTSHIFTNUM%s%s%s%sCTRL%sSHIFTALTCTRLNUM%s%s%s%sF1F2F3F4F5F6F7F8F9F10F11F12F13F14F15F16LEFTUPRIGHTDOWNHOMEENDPAGEUPDOWNINSERT+-~!@#$%^&()_+{}\|:?><Ctrl + Shift + Alt + Page UpPage DownEndHomeLeftUpRightDownInsertNum 0Num 1Num 2Num 3Num 4Num 5Num 6Num 7Num 8Num 9Num Num +Num -F1F2F3F4F5F6F7F8F9F10F11F12F13F14F15F16(),,%ldGROUPS,,,,,,,,,,....%.2u-%.2u-%.2u%.2d:%.2d%.2u-%.2u-%.4u%.2d:%.2d%1c%1c%1c%1c%d.%d%s_fty%d.231.*d
Source: _INS5576._MP, 00000002.00000000.1685120946.0000000000481000.00000008.00000001.01000000.00000008.sdmp, _INS5576._MP, 00000002.00000002.2065063633.0000000000481000.00000004.00000001.01000000.00000008.sdmp, IsUninst.exe.orig.2.dr, IsUninst.728.2.dr, IsUninst.exe.2.dr	Binary or memory string: PROGMAN
Source: _INS5576._MP, 00000002.00000000.1685120946.0000000000481000.00000008.00000001.01000000.00000008.sdmp, _INS5576._MP, 00000002.00000002.2065063633.0000000000481000.00000004.00000001.01000000.00000008.sdmp, _INS5576._MP.1.dr	Binary or memory string: view.bmpISAVIEWCMPTWINDOWISAVIEWCMPTCLASS ISAVIEWCMPTCLASSISAVIEWCMPTCLASS%ld.%ld%ld %s%s%s 41943034194303.940964096.9 %s%s%s T Progman -f -x1 -ci -q1%04xISBarCls%d %%
Source: Setup.exe, 00000001.00000002.2141513574.000000000040F000.00000004.00000001.01000000.00000006.sdmp, Setup.exe, 00000001.00000000.1660522023.000000000040F000.00000008.00000001.01000000.00000006.sdmp, _INS5576._MP, 00000002.00000000.1685120946.0000000000481000.00000008.00000001.01000000.00000008.sdmp	Binary or memory string: ProgMan.exe
Source: _INS5576._MP, 00000002.00000000.1685120946.0000000000481000.00000008.00000001.01000000.00000008.sdmp, _INS5576._MP, 00000002.00000002.2065063633.0000000000481000.00000004.00000001.01000000.00000008.sdmp, _INS5576._MP.1.dr	Binary or memory string: PROGMAN.EXE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	3 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	2 Process Injection	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Codecs.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\ZDataI51.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\4d7894.DLL (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\Ctl3d32.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\IsUninst.728	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\IsUninst.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\IsUninst.exe.orig	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\_isres.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_WUTL951.DLL	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\TxsH263.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_Setup.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\setup.ins	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\txsadp32.acm	0%	ReversingLabs
C:\Windows\IsUninst.exe	0%	ReversingLabs
C:\Windows\SysWOW64\TxsH263.dll	0%	ReversingLabs
C:\Windows\SysWOW64\txsadp32.acm	0%	ReversingLabs

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.installshield.com	_INS5576._MP, 00000002.00000002.2065081493.000000000048B000.00000002.00000001.01000000.00000008.sdmp, IsUninst.exe.orig.2.dr, IsUninst.728.2.dr, IsUninst.exe.2.dr, _INS5576._MP.1.dr	false		unknown
http://www.marchnetworks.com	Codecs.exe, 00000000.00000002.2213741410.00000000005B4000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546690
Start date and time:	2024-11-01 13:34:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Codecs.exe
Detection:	CLEAN
Classification:	clean13.winEXE@7/40@0/0
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Codecs.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP	http://www.stitcs.com/files/pcx10_20WinNT_Ver1.08_B.zip	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\Ctl3d32.dll	http://www.stitcs.com/files/pcx10_20WinNT_Ver1.08_B.zip	Get hash	malicious	Unknown	Browse
	SD future outlook.exe	Get hash	malicious	Unknown	Browse
	m7q7gcniEz.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\ZDataI51.dll	http://www.stitcs.com/files/pcx10_20WinNT_Ver1.08_B.zip	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\4d7894.DLL (copy)	http://www.stitcs.com/files/pcx10_20WinNT_Ver1.08_B.zip	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\ZDataI51.dll

Process:	C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	5.561123176685567
Encrypted:	false
SSDEEP:	768:M3Lc/80hLEtx83BAZ/3ClWYefVwVEjywhSvHMFYrAmsNN4kKbimx/y8gs/Mf:M3mZpfiZalDef6XmWrAPQb9bgMM
MD5:	2A9A390018A50F1AF0DF0B7118696F6E
SHA1:	F9A4CF357E49CF1F032CA4F8D46DEF52C6935E33
SHA-256:	1D9321DD5E1790DFF91CBD475A023760F3B6B6B26E849B70B171B841070378F2
SHA-512:	813BE48CF11A14B618FBFA358794B1E6CEF727F305470F27C82BBFCCC0921EF2141D740A71C47890DB1E705F10BC3D0C67E3D9F651710FDD88F19B9E7E30BC38
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'~S.F...F...F...@...F...F...F...Z...F..Rich.F..........................PE..L....;.6...........!.........\|.......c.......................................@.......................}.............. ...(.......(.... .......................0.......................................................................................text............................... ..`.rdata..H...........................@..@.data...<b.......0..................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS0432.INI

Process:	C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.999885491040965
Encrypted:	false
SSDEEP:	3:PFIDkwOt+kiE2J5xAIrVuREVDf5jDt+kiE2J5xAI71S6oBuOt+kiE2J5xAIrVuxp:PyD5Owkn23fxUwwkn23fxS6CuOwkn23I
MD5:	EFB3C5CED8504358AFC2AA2DE5FF0B4A
SHA1:	D31C7679DCD244A66ECA8F2EBB683DF3BAF67954
SHA-256:	0B1A1F4E144BCEAEEB00B38FF84C4612268D4117297A7D89AE1D1E629D10D782
SHA-512:	09B5C326391CE04404EA8F299371782BDBA646F63BC14077A973DFEFC9FD1B0B691727CEA0BD2816E37D4D1A0E885C0A920DF7A8AF511C990B1E41EDDD11793E
Malicious:	false
Reputation:	low
Preview:	/SMS -fC:\Users\user\AppData\Local\Temp\pft1C0F~tmp\SETUP.INS -z1 -cx -xC:\Users\user\AppData\Local\Temp\_ISTMP1.DIR -x1"C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\" -q10009.

C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP

Process:	C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	557056
Entropy (8bit):	6.1773737432227325
Encrypted:	false
SSDEEP:	12288:h/Nylrgxe3z+gd+f+K9e0alJun/cm6lUCMmi1DeAaibW2NL5jC:h/Nylrgxe3zjUf+K9+S/cm6ud1DeAajW
MD5:	D28CB295E2395B3593293470E7784512
SHA1:	8A734689B76929BEAEB6110C45C41948D4D4C12F
SHA-256:	A8657371F03E2E66DB951C3DCD3AEB42C576894908CA2EB1B3806AA0404CB083
SHA-512:	C526B986E47A8CB2F9CB6FD0BF1F48D9FBBCBFAA6DCEE0BCE6670095DF586B179EEF0FA6FC7EE56995D3F100DF5ED359EFF6858D646B68268BD9D3C68DD816F5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N.....F...F...Fq..F...F..F...F...F...Fh..F...F...FZ..F...F...F..F...F...F...FRich...F................PE..L......6.............................j............@.........................................................................(...........`...............................................................................d............................text............................... ..`.rdata..,'.......0..................@..@.data............P..................@....rsrc...`........ ...`..............@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\4d7894.DLL (copy)

Process:	C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	129536
Entropy (8bit):	4.948685815843077
Encrypted:	false
SSDEEP:	1536:BFskkkkkngtHh5U8r8YUGGFMnYbt82nz:zskkkkknHZDTnz
MD5:	18556ED6EA953C31F1C4953D2F210C78
SHA1:	7EC5618BAE6BBFB45A02C933DE7BCE8D0FDEB22C
SHA-256:	F8FA0C3350ED8675C95A9532A0EE057BD0D1C0E79D90BF5E91F75B3F7F25D969
SHA-512:	0523DF4E8062F8DCA1A3096F17EAF359C4CD84A00AAADF734E0431A07DED2FA7FE6549BB5A387D839CFFE60A9705C3E4F376679006D3EEA4E95DCAC21766E79F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'~S.F...F...F...F...F...@...F...Z...F..Rich.F..........................PE..L...Z;.6...........!......................... ...............................0....................................... ..3............0....................... .......................................................................................text............................... ..`.rdata..3.... ......................@..@.rsrc........0......................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\Corecomp.ini

Process:	C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28290
Entropy (8bit):	4.003303695239376
Encrypted:	false
SSDEEP:	384:2Ezk48HaNWf+lcZn+6TOa2wZ4XCIPo2SN:2EzEaNWG6kyIPo2c
MD5:	B6C87BB7D1504FF47CF73513F85CDDD2
SHA1:	1068BBDE1054E1EFAD18F5DCE17BA539608541CE
SHA-256:	1E7AA59759B9CA31607B5E2DF10117BFA13473354BDACF08EC4625558D040F25
SHA-512:	B2ECA3DC3D3A20D49C58FB1093911F118E93E3A67C419BD19568E35CF7C4ACD08590D795073BABBF21BB2E060AFC86540445DE67AC9549E240E9D8DCF14DFE19
Malicious:	false
Reputation:	low
Preview:	; Corecomp.ini..;..; This file stores information about files that InstallShield..; will install to the Windows\System folder, such as Windows..; 95 and NT 4.0 core components and DAO, ODBC, and ActiveX files...; ..; The entries have the following format, without a space before ..; or after the equal sign:..;..; <file name>=<properties>..; ..; Currently, following properties are supported:..; 0x00000000 No registry entry is created for this file. It is..; not logged for uninstallation, and is therefore ..; never removed...;..; Inappropriate modification to this file can prevent an..; application from getting Windows 95/Windows NT logo...;..; Last Updated: 12/15/1998....[Win32]....12500852.CPX=0x00000000 ..12510866.CPX=0x00000000 ..12520437.cpx=0x00000000..12520850.cpx=0x00000000..12520860.CPX=0x00000000..12520861.CPX=0x00000000 ..12520863.CPX=0x00000000 ..12520865.CPX=0x00000000..82557ndi.dll=0x00000000..8514a.dll=0x00000000..95fiber.dll=0x000000

C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\Ctl3d32.dll

Process:	C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.973934188734012
Encrypted:	false
SSDEEP:	384:S2p4jGewJXucxt8U7fAETozP7vTn3BTgcMBevbNE/srnCLV1x01JXS+vSpHWPJFn:S2p43iecxtloHvb3BUrkTDuLuy+vRJF
MD5:	89CF6AF0A2A1CFEBC82851C20852C121
SHA1:	9106F4ADE6A696D5F98968BCE895333AD5DBD9AE
SHA-256:	94EF91B4C7864BD1ECC0DB099E58298708BC5D22DA40132EBB1C17FEB4675964
SHA-512:	AF4A484B9BB8850C29FBFEE1784B3CD3F78E6CBB419AD49262C28BE16B31B5E1B43328C3088AE83F202AD2941062FA94325D77078F5C8E07A11A3FEA1B56D627
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: SD future outlook.exe, Detection: malicious, Browse Filename: m7q7gcniEz.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r..0...........!...7.<...&...T...G.......P....._....................................................................................`............................................................................................................text....;.......<.................. ..`.bss.....S...P...........................rdata...............@..............@..@.data...]............B..............@....idata...............F..............@....edata...............P..............@..@.rsrc...`............T..............@....reloc..X............^..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\IsUninst.728

Process:	C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306688
Entropy (8bit):	6.460001100986803
Encrypted:	false
SSDEEP:	6144:UPDRrOpaOzOziasZ6wMaWZJlMItbsdVew3C:6DkZdFvMaqfrxsdEiC
MD5:	515E4684008E955DE0C81E6A7AEA1C2A
SHA1:	EBE026F9C551F372AD82186FF6B9C2CA26DD684C
SHA-256:	6D631E94ACCE1F2808A6B1125A6617D1B0BA7E50D93C1D656AA2620BCD0BB965
SHA-512:	C889A733C61687AA9BE0B67CC2E4ECF2A500386054DFFA072780A4F46B29373E0DAD79C35F375FDEB6572DBC11B24436B88CEE3BA431A37965CF0E884AB636B8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........lbS............................Rich............PE..L...a.86............................0.............@.........................................................................T...........h_...........................................................................................................text............................... ..`.rdata..............................@..@.data...\|J...0...8..................@....rsrc...h_.......`...N..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\IsUninst.exe (copy)

Process:	C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306688
Entropy (8bit):	6.460001100986803
Encrypted:	false
SSDEEP:	6144:UPDRrOpaOzOziasZ6wMaWZJlMItbsdVew3C:6DkZdFvMaqfrxsdEiC
MD5:	515E4684008E955DE0C81E6A7AEA1C2A
SHA1:	EBE026F9C551F372AD82186FF6B9C2CA26DD684C
SHA-256:	6D631E94ACCE1F2808A6B1125A6617D1B0BA7E50D93C1D656AA2620BCD0BB965
SHA-512:	C889A733C61687AA9BE0B67CC2E4ECF2A500386054DFFA072780A4F46B29373E0DAD79C35F375FDEB6572DBC11B24436B88CEE3BA431A37965CF0E884AB636B8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........lbS............................Rich............PE..L...a.86............................0.............@.........................................................................T...........h_...........................................................................................................text............................... ..`.rdata..............................@..@.data...\|J...0...8..................@....rsrc...h_.......`...N..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\IsUninst.exe.orig

Process:	C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306688
Entropy (8bit):	6.460001100986803
Encrypted:	false
SSDEEP:	6144:UPDRrOpaOzOziasZ6wMaWZJlMItbsdVew3C:6DkZdFvMaqfrxsdEiC
MD5:	515E4684008E955DE0C81E6A7AEA1C2A
SHA1:	EBE026F9C551F372AD82186FF6B9C2CA26DD684C
SHA-256:	6D631E94ACCE1F2808A6B1125A6617D1B0BA7E50D93C1D656AA2620BCD0BB965
SHA-512:	C889A733C61687AA9BE0B67CC2E4ECF2A500386054DFFA072780A4F46B29373E0DAD79C35F375FDEB6572DBC11B24436B88CEE3BA431A37965CF0E884AB636B8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........lbS............................Rich............PE..L...a.86............................0.............@.........................................................................T...........h_...........................................................................................................text............................... ..`.rdata..............................@..@.data...\|J...0...8..................@....rsrc...h_.......`...N..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\_isres.dll

Process:	C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	129536
Entropy (8bit):	4.948685815843077
Encrypted:	false
SSDEEP:	1536:BFskkkkkngtHh5U8r8YUGGFMnYbt82nz:zskkkkknHZDTnz
MD5:	18556ED6EA953C31F1C4953D2F210C78
SHA1:	7EC5618BAE6BBFB45A02C933DE7BCE8D0FDEB22C
SHA-256:	F8FA0C3350ED8675C95A9532A0EE057BD0D1C0E79D90BF5E91F75B3F7F25D969
SHA-512:	0523DF4E8062F8DCA1A3096F17EAF359C4CD84A00AAADF734E0431A07DED2FA7FE6549BB5A387D839CFFE60A9705C3E4F376679006D3EEA4E95DCAC21766E79F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'~S.F...F...F...F...F...@...F...Z...F..Rich.F..........................PE..L...Z;.6...........!......................... ...............................0....................................... ..3............0....................... .......................................................................................text............................... ..`.rdata..3.... ......................@..@.rsrc........0......................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_ISTMP0.DIR\value.shl

Process:	C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP
File Type:	Generic INItialization configuration [General]
Category:	dropped
Size (bytes):	623
Entropy (8bit):	5.374850316013281
Encrypted:	false
SSDEEP:	12:O70umMdyuuFTIJ2wsd1CRfsqTCXSixdBS0TCcuZaIxbsTC4V6qbRp8Uy:M0uYuu6J2utu5d8PcuZaIxbn4V6qTZy
MD5:	A22EED0703C41F4126465EB2C1B81DF2
SHA1:	05FB19A2413D8FF3F20EAA58392857BED49A3E29
SHA-256:	9E4690B56B15B7358E179EBFA89E6D07502512AF640D38943CD1158A58AC0F09
SHA-512:	FE79823AF70FFC8FA77A03DCD79DA2E98470CCE9BDD67070C69439F0FE271B2E98E2181CD2A1837266835EB164AC8ABF2665896B2CB54E996622FE933810F095
Malicious:	false
Preview:	[Data]..VTU_2000_DESCRIPTION=March Networks H.263 Video Codec..VTU_2000_COMPONENT=VTU-2000 Video Decoder..COMPANY_NAME=MarchNetworks..README_NAME=..REGISTRATION_KEYS_FLAG=no..VTU_2000_FILE=TxsH263.dll..PRODUCT_VERSION=2.0..VTU_2000_NAME=March Networks H.263 Codec..AUDIO_AVAILABLE=yes..VTU_2000_AVAILABLE=yes..AUDIO_FILE=txsadp32.acm..README_VIEWER=..AUDIO_NAME=March Networks ADPCM Audio CODEC..AUDIO_DESCRIPTION=March Networks ADPCM Audio CODEC..VTU_E_AVAILABLE=no..PRODUCT_NAME=March Networks Audio/Video Decoders..AUDIO_COMPONENT=Audio Decoder....[General]..Language=0009..Type=STRINGTABLESPECIFIC..Version=1.00.000....

C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_WUTL951.DLL

Process:	C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.250011755829401
Encrypted:	false
SSDEEP:	768:Xb6LUu1pdNwSn3ssCxVZAdIqg9vQIhsssF:GLUubdNvn3ssCxAZg
MD5:	9567A2DAC1B8EFBD7B0C6DCE2A2251C3
SHA1:	DB72683FF3A3000771394D5EED7E2DE922DCADBF
SHA-256:	67D309A88D68C449C2D0A76C0F2D2C9B2B764A469A6DAEA67DF0279DD49C9296
SHA-512:	51806383E05CBC67754FC746C16DDF8364610BB22260B8638F586B02DBEB0813CEE6ACC9962B2B928205D445A82F2CC2022B6D1162F8DA644AC902C0F3A327A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'~S.F...F...F...F...F...@...F...Z...F..Rich.F..........................PE..L....<.6...........!.....f...b....................................................................... ..........................d.......@............................................................................................................text....d.......f.................. ..`.rdata..:............j..............@..@.data....B...........x..............@....rsrc...@...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ext1B91.tmp

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	Generic INItialization configuration [Dialog1001]
Category:	dropped
Size (bytes):	4533
Entropy (8bit):	4.939578182564759
Encrypted:	false
SSDEEP:	48:zWq2or3ynA0KA07bjaNebeMFFVeag8TYbbtIeEAVki4X2iy5IfsMnV6LQdQ9DPgc:Kq2orCnavjaYCdaMd1scMeJgocuEaegn
MD5:	414378BEE661B0DF11BDB2BE32E15B84
SHA1:	B14FD9207864D6053B2CB099736B4DAFC2084AF4
SHA-256:	F9EFB3E6FE099C649FB4CC20AC6F9B7E90D3F60B8D98F48FB5D167F1A0B1B7F2
SHA-512:	F042D5A58C5F4D6DEE054EEBC9270619A79318BDBAEEB9CD23969ABA09D4EF1BCA77A139C08AF718672EC87B7ADBD6EF0E4BFEDDC1A03E559EAC91763D9361DD
Malicious:	false
Preview:	[Dialog1000]..100=Welcome to the InstallShield Wizard for %s..101=The InstallShield Wizard(TM) will help install %s on your computer. To continue, click Next.....[Dialog1001]..0=License Agreement..1=Please read the following license agreement carefully...121=I &accept the terms in the license agreement..122=I &do not accept the terms in the license agreement....[Dialog1002]..0=Location to Save Files..1=Where would you like to save your files?..101=Please enter the folder where you want these files saved. If the folder does not exist, it will be created for you. To continue, click Next...102=&Save files in folder:..103=&Change.......[Dialog1003]..0=Password..1=This package has been password protected...106=&Password:..107=Enter the password to required to run this package. Please note that passwords are case sensitive. Click Next to continue.....[Dialog1004]..0=Overwrite Protection..2=Cancel..109=&Yes..110=&No..111=Y&es to All..112=N&o to All..113=The following file is already on

C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\DATA.TAG

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.803766000069981
Encrypted:	false
SSDEEP:	3:fgXGl0JOCVKX8cvkJHERMQLaTvztsUhVLdovpGFlV:fgXlOpQqa3LqvpGB
MD5:	557E84002086FE2B220FCDB6B3DC169C
SHA1:	6977E3E2E2592260D1229B079F975BF9A3372352
SHA-256:	4F310757BA3DE3ADAFC844061F574B88B36CB616D81A20D8352FECC78DE0F923
SHA-512:	BC37272971003C4D6EE7A48673E5C68F60604627C0F6D135967100A7D10A1F3A3714F140AEED425C777523505F9B212AC1B07705E06563B08C0C811974FF61F5
Malicious:	false
Preview:	[TagInfo]..Company=March Networks Corporation..Application=Codecs..Version=1.00.000..Category=Multimedia..Misc=..

C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\SETUP.INI

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	Generic INItialization configuration [ISUPDATE]
Category:	dropped
Size (bytes):	106
Entropy (8bit):	5.015313738138515
Encrypted:	false
SSDEEP:	3:3b50JOVKoAAKb2joTAAhMJHYSdVomXj0tXpUzOvn:3bKOVKoAa+lheH/dC7tXqzA
MD5:	8CAC246EB217E56F6304BB89DE187C8C
SHA1:	24BF7DFEA31CCA51449EAA52B35B212E4159B54D
SHA-256:	13BFA43C602900AE58438CD128ECD3A42F9273EF916D34B19A281553EFE26F9C
SHA-512:	C3E69928C97FD5DA2EAC549A79FC0FD9903530A822F946E058FFD9C753364D3420B6BD949BE17DAADF766ECF77DC6F43D53384F17CFA598955A8005F85DFEF11
Malicious:	false
Preview:	[Startup]..AppName=March Networks Audio/Video Decoders..FreeDiskSpace=780..[ISUPDATE]..UpdateURL=http://..

C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	5.665757453858128
Encrypted:	false
SSDEEP:	1536:RX/42dX49uSxNy5fuAOKzxiTQCF+oIjVhhPoSeFB:RX/4eI9RNZAOKCQp5hhPo9F
MD5:	71E6DD8A9DE4A9BAF89FCA951768059A
SHA1:	AAC779471A2F9AE3D3E0E39047EF1744FEDA77B1
SHA-256:	5656E87DA0641C9DCFCD0EE8949CE72B3FA6A7D0E8B1FD985A16F6BD6C34CE52
SHA-512:	D15BB31CE595767DD366EA2130121A7A2A311C4E639F8B464CEAC880D00735C11D950FC16725A3DA9459D22A122DD3C33BC0631BE90556B4078DF9509B0048DE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........p...#...#...#I.#...#".#...#...#...#..#...#...#...#I.#...#..#...#Rich...#........................PE..L......6.....................p......C{............@..........................@..............................................H...x....0..h............................................................................................................text...$........................... ..`.rdata........... ..................@..@.data....4....... ..................@....rsrc...h....0......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\TxsH263.dll

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131139
Entropy (8bit):	5.930120891271448
Encrypted:	false
SSDEEP:	1536:5jJVn/dxC/v7UjppppppTn7jQ1vyeTebkBSuJDzaXOosJoD:5jq7Un7UvakBnneOosJm
MD5:	02AD1472982D93865A7D50FC966390BF
SHA1:	8C847EB8F9F6B5C279CC9E2935D25B31A9A72F23
SHA-256:	E014AC4C8596AE57237E27E6642E7FE2DE3744D5CA9842C065C9C8D1BF43CF79
SHA-512:	5B414EC9B202FFE751D8AB5E057239BACA6083C260704F75092190C54548BBBE4F5B8FEE4AF02DB83E30B91E52579BE8997F0735E0987D1F7E68C617F15684EE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-Za]i;..i;..i;...$..h;..4...j;...'..q;..4...7;...$..b;..i;...;..6...`;..6...z;...=..h;......h;..Richi;..........................PE..L....GP=...........!.....P...................`.....0.........................p.......................................{..I....s..x....@.......................P.......a...............................................`...............................text...\N.......P.................. ..`.rdata..9....`... ...`..............@..@.data............P..................@....rsrc........@......................@..@.reloc.......P... ..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	27648
Entropy (8bit):	4.477675804505155
Encrypted:	false
SSDEEP:	384:K3wIA7GjPE6nnP9TDWsKAkk/fG8+lmQP+0JSfgyz:MwIA7Q7tDUAdnemQVSfg
MD5:	51161BF79F25FF278912005078AD93D5
SHA1:	13CB580AA1D2823CA0F748B1FC262B7DB1689F19
SHA-256:	B5DC0FEB738A91CE3CFA982647FE2779787335C6C2C598D5B49818565D7C3E84
SHA-512:	C91EAC5A01EC7BFB4D3C9DF7F90A1C6C6211464ECFEDE54F7CE2F0C8A79561E4425A56EB41B48BCD89A80BD45228B2CE0C649ED92D24019A15916306D9131D8D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'~S.F...F...F...F...F...@...F...Z...F..Rich.F..........................PE..L.....66.................0...B...............@....@.................................................................PJ..E...XD..<....................................................................................@...............................text............0.................. ..`.rdata.......@.......4..............@..@.data....0...P...(...@..............@....rsrc................h..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_Setup.dll

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	4.538478531303184
Encrypted:	false
SSDEEP:	384:udsKUvnz9TjLWxyf4BkAG+ZyIji6CvysQBrFge5oP+sRn2bAPP+OLMIt/hV:jL5GFB5ZyIjfuUFg0RCt
MD5:	ECACC9AB09D7E8898799FE5C4EBBBDD2
SHA1:	BE255FE9B6C9D638A40A5C1E88F2D5F4E37654E6
SHA-256:	1AD637E80A25F6F885604589056814D16CCAD55699BE14920E2B99F2D74C1019
SHA-512:	16412756B147A9E6C1E8CE503F374ABDE87919A5AE1DE576963ED748A2934EFF9F95D5B33CACEFEBE1C6CDFE64D9B595986C60BDBCE8AEBF0A4BCC83B6F25779
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........lbS............................Rich............PE..L....`.6...........!.....4...f...... ........P...............................................................................S..(.......X............................................................................P...............................text... 3.......4.................. ..`.rdata.. ....P.......8..............@..@.data....<...`...(...B..............@....rsrc...X............j..............@..@.reloc..2...........................@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_inst32i.ex_

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	data
Category:	dropped
Size (bytes):	296674
Entropy (8bit):	7.962476050550789
Encrypted:	false
SSDEEP:	6144:qMGy3V/vFgm9kCAvd3e9FMEeHgPSk0vrWVfQjWTIxA+KgFiefAIXGXrSLQSb:hV9vB93A3ejMEO60zjjcISd/e4I2Xgvb
MD5:	6229A86A1D291C311DA49A7D69A49A1F
SHA1:	586254E13D8FFDD956F1FB4E6CE858B91A390864
SHA-256:	B2FF4E8402A5160C491B1AC7EBA0073FBBE2220DCE107441461B250544EFF35A
SHA-512:	D2E21662258593D17B8DEBBD74F92E2B37EE3F5F3FDB0CBE8A4C9A16A6DBEE6911B92C4AFFF86F4FA2AFA311343E43029DEC9C0E08A728309F2CCBF1DED7E896
Malicious:	false
Preview:	*.y.....Copyright (c) 1990-1995 Stirling Technologies, Inc. All Rights Reserve........\|.................INSTALL.EXE.._INS5576._MP..../d................zdata.dll..ZDataI51.dll.2...I................WUTL95i.DLL.._WUTL951.DLL.\|..9.................BOOT16.EXE.._INJ5176._MP...h..`.........>.................h%h..W..mPA.f..8r......1a.yC...2 ..q."m..'S@.yC.........896...S..8...I..q...Y..D......4.....G.h9.....9#.. ..z...f..E....}L..,..I..O..x.`A..-@;.._..R....sPS1/ j...H\|.5.....}....t...P_y.3.v...o.B..u"S..=...C...K.@;.-..@v.q!.L.:a[`qR..&.!q....R7...9.\|.@...O.+o....t^..ir3Q>..............\|7........U..[T..((V..P..K.a.s$.;6......FE`A.W...#....._....cB..\A3{ c...R.V....Y{...~u0@............B.......h..Lg...s0s@.eP.\.P...`.~..X.+..0H...A.1..._..,..u...H...B.,.....B...]...8.[...P.)...S0....1S..B.TNP..:a...Ag..h...r.@@..4\..v..P~.w T.c.(?.,.c.h^7.dF."8_..@.K..Z....Y.(.O2..bR.(f.R...d.j..A.],.T.......Jn....j7.,Y...>Q...t...cK...[L.."....k.q...d5..2.....c....(..[B...$1..D..t..Q`N

C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_sys1.cab

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	301204
Entropy (8bit):	7.9928380296988575
Encrypted:	true
SSDEEP:	6144:Q0ahJrfzEToEJpnfGHdLbHB5rfzEToEJpnfGHdLbHBTUh8D3v4:HkJ6RJpfGVD76RJpfGVDBxDg
MD5:	E80A4891C94851571150EC9BDCA7614A
SHA1:	BEA54FF1B8A6E94AB7C20B01D18A4B107D97FFFB
SHA-256:	680A46F30EAB7F7DFE6FC05C461FD7993F1B03C12D78F227510EF03D36F562CB
SHA-512:	4DF3DFAA0A2E4C43FBA6FEC72496AC18BB7B816AD74AEE14ECABA746B5A20B47AC6D9A5EDB7EE3E34C3AE6D4F86AED34D62ABED6E2E194F05F7AE21999D448C8
Malicious:	false
Preview:	ISc(.R...............................................................................................................................................................................................................................................................................................................................................................>H`]..G......................U2..........=..a0.\|..B..,..B%....L%'.@..}.R./W.............................................................................}..r....S.w....-.".Ve.R...#..Y....1...H.y...D.9.\$.........hUY.+eFR..~...}!]..RD.."....e.#.V..U....(....+.(...A.%..i.+....Rg......y...3a.D..E.....GLg..}t1.G..:.-.w.._}\|.}..Wo..^q/..........Q.+..5....-......7./......E...k.......}I.T.2rr..8..>@.)...?.[.a=5.....Zr.\|~.M...E..q.1.."...h.O.....K..s....[..s..:..(..O.o...Ge..J..4*.H..'.Q...n.. .....jD6:u=..t=....T..\.....e.p...T....$.+_Ls[.h/...s..4.o_.I3.\|.^......L....h2};...\^._.z..?Tf6._...t>./.........

C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_sys1.hdr

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	3985
Entropy (8bit):	3.479096576395005
Encrypted:	false
SSDEEP:	48:QRwaNeLaG0mPl3MDMw/WyMx1cyAN72zdtG1zUX4KJ:35Lll3ey1OeMgdJ
MD5:	7EE9D81C25BF480F9511B5E52D4188D9
SHA1:	885FDE2AD6A0D0D7986DCD2F2EDEA9A8E35C1649
SHA-256:	74456B57E7ACF3DB64E0131BE2BF72069CADF7ADA96B70FE3C626E43D9F14BDC
SHA-512:	F4672194DAD26C6F3CD789C3EA1AFDFF8E422DE1AE717929451E1F6BE8228FB472F53D6F2ADC165BDCC3EF284B2E0629AA48A432187FE027D191B25CB2D4C94E
Malicious:	false
Preview:	ISc(.R...............................................................................................................................................................................................................................................................................................................................................................>H`*]..G......................U2..........=..a0.\|..B..,..B%....L%'.@..}.R./W...........................................................................M.........................................................P.......$.......................................................................................................0.......................................................................................<...H.................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_user1.cab

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	834
Entropy (8bit):	4.488895836300569
Encrypted:	false
SSDEEP:	6:CUzVN/t6kXxYySGN4HRWIupe8y6Aa3hhNWL/UCObSdzwACRyLmDLDJlnIn:CUzVN16kXxQzxx6PXNWLLCgLm33In
MD5:	56ABD0F1912A5891C63E7FDF5EF856E6
SHA1:	8898D82DA1B1EF780CBFFA718DBAF8246A34B66E
SHA-256:	214235AECF80E912086E12461873D11FC036A23A4229A5CE410F320F3E1C3F1A
SHA-512:	5F6A3BEF158A9550602D52E59C32FECD53F3422D3CBA4E13DB1683B092DDE27F2FC91120B4DF1BD98F5F0DBB0CA0351148C44457D0C2BE7470433A245D9CED71
Malicious:	false
Preview:	ISc(.R...............................................................................................................................................................................................................................................................................................................................................................>H`*]..G......................U2..........=.d._...QD....]\|jm(.[....J.......Z...........................................................................@.}R.j.0.}....`..0.C..$.a.ESG)#..]Y.E[....Y[[. /.9..s.....p.B.e.....8c.`...j.O...O.~u....'^..t.....'q.p..4..[:.....u..@\|!9.i.<..NF..i.do!.E....F...F(.u3...Bq.f._m6..f..c!....\|.....z;.i.4',..@,B.....Q.M...y..:Um'..... ...4...8").=...f...x.........%...+k....9.s..8G.:.P.U..S"U..j......VC.....b6e..^75\|..0.X._

C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_user1.hdr

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	4281
Entropy (8bit):	3.3304907815101132
Encrypted:	false
SSDEEP:	48:uXR348CCC+CfOMqClYywTedoyMx1cV/dlAN72ANahzQzQzQz/:uh6CQ0CGTe21Ey68887
MD5:	2EBB43EDD92B944A98E5A254CF0B3953
SHA1:	AE97960DD12E6E9A785E4526338C4379F18E62E7
SHA-256:	F0A0513DB0A902DA1DA2A3FB48326E07777C2B09C66FEE4708F546B9FC447BA1
SHA-512:	350CEDB48BAFCA0ED8ACB98E13022F6CF1DD843D937612590DE76F56F186B741FAFF483378C698048BBF5C44CB7D7A758A8B105C52211639A87402F9DBC8171B
Malicious:	false
Preview:	ISc(.R..........t....................................................................................................................................................................................................................................................................................................................................................>H`*]..G......................U2..........=.d._...QD....]\|jm(.[....J.......Z.......................................................................................t.......E...E.................................P...................................................................................................)...........5.......................................................................................A...M...................................................................................................................................................................................................................Y...........e.

C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\data1.cab

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	469
Entropy (8bit):	1.534467334149303
Encrypted:	false
SSDEEP:	3:Kkq/lPlmlm/t9zIHuhYLNWZFVSv/BhK3l/:CCezVfZUs
MD5:	6CE6BF65AFC3A496F687363A991F064B
SHA1:	6BF22CDFD138945F37E1A86AB4DBB91853E08430
SHA-256:	130E3C94C37D9E3FC379C92C4447BA514028BCCF838D7BBB5A606A26F09C242F
SHA-512:	85AE3D167E550B7AF94AC86F602FDC039AF2B7A5701990465067C6F6095EAEC4CBA8887616470E2AAB0F728EB8E5BC94BBCFD129BE30790DDAD8F44258CCEC1C
Malicious:	false
Preview:	ISc(.R...............................................................................................................................................................................................................................................................................................................................................................>H`*]..G......................U2..........=.E...\|.K.0..Y...Vm....J......~z................................

C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\data1.hdr

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	3371
Entropy (8bit):	2.918373791578252
Encrypted:	false
SSDEEP:	24:lOwrXpdsG4DmIoqcnKSeu5LTQNoDSnaImAe/LxKQ9SgkZY6XlAtHo:lRcG4CB35LT+oD4aDAN7pXWNo
MD5:	DF915AFDE73AEC24556D92DE42E2EBDC
SHA1:	4833B5FF2C727E73183103BDD9BF003834DC7970
SHA-256:	5B97A64FB1BC4406CB7AC5C35ED635347D7368B3C072B82E200AB10FFC04B43A
SHA-512:	AC3BB1D0C5877F0A4119F6006A0C29CE7FAFB963168280D3B54100B3F26426C5FE1EBA144F1ECB4D6C5B4D669BF1FA8A67C1710BA5C64380A800E030433FE384
Malicious:	false
Preview:	ISc(.R..............+................................................................................................................................................................................................................................................................................................................................................>H`*]..G......................U2..........=.E...\|.K.0..Y...Vm....J......~z...........................................................................\.................................................`.......P...................................................................................................................................................................................................................................................................................................................................................................".........................................................................

C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\lang.dat

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	Generic INItialization configuration [0x0409]
Category:	dropped
Size (bytes):	23541
Entropy (8bit):	5.733732390414712
Encrypted:	false
SSDEEP:	384:FvgwpmJVAXR7X6+natEI2sSOTdBr/5apXgGx0yvKl/8W1E+UfeevRLbK:FvgEmJVAXR7X/SEI2sSORFBapXgGx0Sw
MD5:	70627BD56FE92A5C97027CBBD88BACD0
SHA1:	9CBDB75947DC561C929B0E799CF022961A7FE074
SHA-256:	B67A09F3FE25B08025810BBB20B8FAE05672D0A723F2DBED84F04224A89E6344
SHA-512:	2377840A55F883E4F9FDAFBD370ACE9BF6BFE4AD55C1B7A46A269A5F9EF5C2032F00EF7C37F8863F99C2965D4DD4828EDB11C668ABE5DCA4EBA2C2DFDE2BB0F4
Malicious:	false
Preview:	[Info]..Name=INTL..Version=1.00.000....[0x0409]..TITLE=Choose Setup Language..DESCRIPTION=Select the language for this installation from the choices below...OK=OK..Cancel=Cancel..0x0009=English..0x0007=German..0x040c=French (Standard)..0x0010=Italian..0x000a=Spanish..0x001d=Swedish..0x0416=Portuguese (Brazilian)..0x0c0c=French (Canadian)..0x002d=Basque..0x0003=Catalan..0x0005=Czech..0x0006=Danish..0x0013=Dutch..0x000b=Finnish..0x0008=Greek..0x000e=Hungarian..0x0014=Norwegian..0x0015=Polish..0x0816=Portuguese (Standard)..0x0024=Slovenian..0x001b=Slovak..0x0011=Japanese..0x0019=Russian..0x0804=Chinese (PRC)..0x0404=Chinese (Taiwan)..0x001f=Turkish..0x001e=Thai..0x0012=Korean..0x0021=Indonesian..0x001a=Croatian....[0x0407]..TITLE=W.hlen Sie eine Setup-Sprache aus..DESCRIPTION=W.hlen Sie die Sprache dieser Installation aus der unten aufgef.hrten Auswahl aus...OK=OK..Cancel=Abbrechen..0x0009=Englisch..0x0007=Deutsch..0x040c=Franz.sisch (Standard)..0x0010=Italienisch..0x000a=Spanisch..0x001d

C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\layout.bin

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	data
Category:	dropped
Size (bytes):	590
Entropy (8bit):	2.9245449643426578
Encrypted:	false
SSDEEP:	12:ousjrqtJOAzVlCqM60ugynsC3i9VXqHSTvSD:CjetnzPk6JgcssMxqHSTKD
MD5:	7F52CB0FDD07725EB703E7CC07B564A4
SHA1:	E5D2CBD02D4AF8F56F42CF0D38D884C0BB86F760
SHA-256:	09EC9E7E973C14C5E30F5699275C882D83174D2F06DFB9874C7F6E0610052BD1
SHA-512:	33B44C61D6CF2DAFCBF97936AEDF9CE9E9B007D51B269994F40E0DEE308CD4D372A908E5B7E66AD4D634D8B5802AB4AF887C2F2E0FF910E3A392BAED7D83BE0A
Malicious:	false
Preview:	c..R.@..N..........@.(..........................................................................................................................................................................................................................................................\....@......................................................"...-...8...C...............................................!...,...7...B...M...Setup.exe.._inst32i.ex_.._ISDel.exe..lang.dat..os.dat.._Setup.dll..setup.ins.._sys1.hdr.._sys1.cab.._user1.hdr.._user1.cab..DATA.TAG..SETUP.INI..setup.lid..data1.hdr..data1.cab..

C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\os.dat

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	Generic INItialization configuration [0x0009]
Category:	dropped
Size (bytes):	450
Entropy (8bit):	4.065285388168147
Encrypted:	false
SSDEEP:	12:HslfUTjkmvioqkeMoDRc/y2oDRcGMkoDRc/oD1ErkoDfkoDI:HDTfKhpBDW63DWGMZDWgDSlDRDI
MD5:	478F65A0B922B6BA0A6CE99E1D15C336
SHA1:	577BB092378B8E4522EFF40335FF7A50040170B7
SHA-256:	BE2292517342DE82D50CEFBACB185E36558FCDFBF686692E7DF08A80331F9BEE
SHA-512:	747589CAE4514CFF7D5EA9B51B483C0FE6CB9242B0F31503268A73881ACDDF25541A7AE56F8826B4F15235DD2AB8C98C94674666E47C36EA913BCFB539143C9C
Malicious:	false
Preview:	[Info]..Name=PLATFORM..Version=1.00.000....[0x0009]..OS Independent=0x0000000000000000..Windows 3.1 & 3.11=0x0000000000000001..Windows 95=0x0000000000000010..Windows 98=0x0000000000000040..Windows NT 3.51 (Intel)=0x0000000000001000..Windows NT 3.51 (Alpha)=0x0000000000002000..Windows NT 3.51 (MIPS)=0x0000000000004000..Windows NT 4.0 (Intel)=0x0000000000010000..Windows NT 4.0 (Alpha)=0x0000000000020000..Windows NT 4.0 (MIPS)=0x0000000000040000....

C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\pftw1.pkg

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	Microsoft Cabinet archive data, many, 773515 bytes, 19 files, at 0x2c +A "\Disk1\DATA.TAG" +A "\Disk1\data1.cab", ID 12345, number 1, 34 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	773515
Entropy (8bit):	7.998950851087197
Encrypted:	true
SSDEEP:	12288:5aIWowvKWnyJ03LIUZoS3AVUi9xxYtvQ6ch8+hiwNGRLXUv+6kwjkR34UGqaERSO:5afowC2BZonii9xqtI6chJhDmLUmXwjq
MD5:	2A572C870C9AB389955D0217B9F3C5DF
SHA1:	D0BEDE84B6B90F8AE06866374E4AA88B8D70E8BA
SHA-256:	7838BD4826E13871519569483B0180CE0A02DF910359ABBF9835881542DE503B
SHA-512:	A9037C8C5683B2BCE10D7034F7CCCC7AEE0ADD321FC7084B73DA9FA907BC1BC1F75A45CCFC2507EE460F64D0C70C7FACAE6AB8A6604FE81F962E2DC936BB5114
Malicious:	false
Preview:	MSCF............,...............90......"...q........../.E .\Disk1\DATA.TAG.....q....../.E .\Disk1\data1.cab.+...F....../.E .\Disk1\data1.hdr..[..q.....,&U\ .\Disk1\lang.dat.N...fk...../.E .\Disk1\layout.bin......m.....$#. .\Disk1\os.dat.. ..vo....,&Je .\Disk1\Setup.exe.j...v....../.E .\Disk1\SETUP.INI..2........./.E .\Disk1\setup.ins.1........../.E .\Disk1\setup.lid...........9,.N .\Disk1\txsadp32.acm.C.........-.. .\Disk1\TxsH263.dll..........W&.] .\Disk1\_inst32i.ex_..l........[%.h .\Disk1\_ISDel.exe...........=%\. .\Disk1\_Setup.dll............/.E .\Disk1\_sys1.cab............/.E .\Disk1\_sys1.hdr.B........../.E .\Disk1\_user1.cab....._....../.E .\Disk1\_user1.hdr.....V'..CK.\{l..y.lW..(i....}l....K EJ...Q..$.....H6.......v.. u..h(..Nm.HZ5M... ......Gl9.T.vc7.Q....DS.(..6.fvv.{w..8vZ...\|3....o..}.,.s.e...r...../ .hnE..5.p0N..ot..@<...]..^(8...f.Ic._..{>-7.ij..M...8C<P.:...i..l.j.....{.Z.l.aY.....]....W.]..^..w6?v.o...s.$.....so...o..p..6..:..C.....G....=.......?.

C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\setup.ins

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	144066
Entropy (8bit):	5.35125554167495
Encrypted:	false
SSDEEP:	3072:LzkW212h2il7KJ9H7EyejE6rvqWtod5jp1BwZWXDqY:kpm4Jt6rvqWa512WXDqY
MD5:	C4C1C8BADC766F8A430DA88FEC64AD72
SHA1:	9DFFAEB35D547DF17C72BE43BA9A05EA7454BD62
SHA-256:	1E030501EF28567E1C131854284433B4F53CAB2028BEFAE579881ACCD486EBE6
SHA-512:	4173EFEE239699DC0C9CBFF08FDCB6FC5A2697983BE58680F44D33FB4635E2938593B07FDC26A9C64C9032941AB19B58B0D7A3BD2EE5407151CD179871E52728
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	....P.......20.InstallSHIELD Software Coporation (c) 1990-1997..,...............................................................................................SRCDIR....SRCDISK....TARGETDISK....TARGETDIR....WINDIR....WINDISK....WINSYSDIR....WINSYSDISK....ERRORFILENAME....INFOFILENAME....SUPPORTDIR....CMDLINE....ISVERSION....SHARED....UNINST....ISRES....ISUSER....FOLDER_DESKTOP....FOLDER_STARTMENU....FOLDER_STARTUP....PROGRAMFILES....COMMONFILES....MEDIA....FOLDER_PROGRAMS....SHELL_OBJECT_FOLDERB.......LAST_RESULT....CMDVALUE....HINST_INSTALL....BATCH_INSTALL....MODE....LOGHANDLE......_sdRECT........left......top......right......bottom...._sdSIZE........cx......cy....ISOSVERSIONINFO........ISIOSVersionInfoSize......ISIMajorVersion......ISIMinorVersion......ISIBuildNumber......ISIPlatformId......szISCSDVersion...................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\setup.lid

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	49
Entropy (8bit):	4.188376876524785
Encrypted:	false
SSDEEP:	3:XCYEL4PmX4eZ57v:SvL4PY4U5r
MD5:	1B79748E93A541CC1590505B6C72828A
SHA1:	1DDEFEE04DC9E9B2576DC34EEBCFA3DE4AA82AF9
SHA-256:	708D29C649525882937031B3D73CC851B7B1BC30772EB4E0E2A71523908F2EB5
SHA-512:	E85C1F04D3841CD1E5AA5D7BA37BB3AFF557D67B1ACEB2D9435F07862593EB4E139162C71D9B017C82AADE2E1C535C79D1A18D26DFFB95282E10BC64BDA04BFC
Malicious:	false
Preview:	[Languages]..key0=0009..Default=0009..count=1....

C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\txsadp32.acm

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	4.670659646009736
Encrypted:	false
SSDEEP:	768:CO8nPxvFMFnG+9OUTZ9davwslFbnZoELNzMp6OgofwBJ:CO8nPxtMFG+9OUTZ9+HFo42Aofw7
MD5:	870E1E913E79CA37DE5DDD9DBE87411F
SHA1:	6E5B41E0C7B7667629CC68F7C4E0280F36BFB64B
SHA-256:	077441B921F3B23D04E11CEC9FB923CB4EB536B5DB5F2E78A7C7FD84030A7394
SHA-512:	D6E2E8C0EADE46F5ECE8850CAD87C46F5FDA4D8B9328DB0DCD92E889397A4AC5CC2B8E9F47AE1443FA06A5565F5FCDFEC4A040C97ADB2098C957BE976A65F1FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................<......R........<.......................<...............>......Rich....................PE..L....qQ<...........!.....`...p......y1.......p.......................................................................{..J...Xv..P....................................................................................p...............................text....\.......`.................. ..`.rdata.......p.......p..............@..@.data....4.......0..................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\plf1B90.tmp

Process:	C:\Users\user\Desktop\Codecs.exe
File Type:	Generic INItialization configuration [Dialog1001]
Category:	dropped
Size (bytes):	4533
Entropy (8bit):	4.939578182564759
Encrypted:	false
SSDEEP:	48:zWq2or3ynA0KA07bjaNebeMFFVeag8TYbbtIeEAVki4X2iy5IfsMnV6LQdQ9DPgc:Kq2orCnavjaYCdaMd1scMeJgocuEaegn
MD5:	414378BEE661B0DF11BDB2BE32E15B84
SHA1:	B14FD9207864D6053B2CB099736B4DAFC2084AF4
SHA-256:	F9EFB3E6FE099C649FB4CC20AC6F9B7E90D3F60B8D98F48FB5D167F1A0B1B7F2
SHA-512:	F042D5A58C5F4D6DEE054EEBC9270619A79318BDBAEEB9CD23969ABA09D4EF1BCA77A139C08AF718672EC87B7ADBD6EF0E4BFEDDC1A03E559EAC91763D9361DD
Malicious:	false
Preview:	[Dialog1000]..100=Welcome to the InstallShield Wizard for %s..101=The InstallShield Wizard(TM) will help install %s on your computer. To continue, click Next.....[Dialog1001]..0=License Agreement..1=Please read the following license agreement carefully...121=I &accept the terms in the license agreement..122=I &do not accept the terms in the license agreement....[Dialog1002]..0=Location to Save Files..1=Where would you like to save your files?..101=Please enter the folder where you want these files saved. If the folder does not exist, it will be created for you. To continue, click Next...102=&Save files in folder:..103=&Change.......[Dialog1003]..0=Password..1=This package has been password protected...106=&Password:..107=Enter the password to required to run this package. Please note that passwords are case sensitive. Click Next to continue.....[Dialog1004]..0=Overwrite Protection..2=Cancel..109=&Yes..110=&No..111=Y&es to All..112=N&o to All..113=The following file is already on

C:\Windows\IsUninst.exe

Process:	C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306688
Entropy (8bit):	6.460001100986803
Encrypted:	false
SSDEEP:	6144:UPDRrOpaOzOziasZ6wMaWZJlMItbsdVew3C:6DkZdFvMaqfrxsdEiC
MD5:	515E4684008E955DE0C81E6A7AEA1C2A
SHA1:	EBE026F9C551F372AD82186FF6B9C2CA26DD684C
SHA-256:	6D631E94ACCE1F2808A6B1125A6617D1B0BA7E50D93C1D656AA2620BCD0BB965
SHA-512:	C889A733C61687AA9BE0B67CC2E4ECF2A500386054DFFA072780A4F46B29373E0DAD79C35F375FDEB6572DBC11B24436B88CEE3BA431A37965CF0E884AB636B8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........lbS............................Rich............PE..L...a.86............................0.............@.........................................................................T...........h_...........................................................................................................text............................... ..`.rdata..............................@..@.data...\|J...0...8..................@....rsrc...h_.......`...N..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\TxsH263.dll

Process:	C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131139
Entropy (8bit):	5.930120891271448
Encrypted:	false
SSDEEP:	1536:5jJVn/dxC/v7UjppppppTn7jQ1vyeTebkBSuJDzaXOosJoD:5jq7Un7UvakBnneOosJm
MD5:	02AD1472982D93865A7D50FC966390BF
SHA1:	8C847EB8F9F6B5C279CC9E2935D25B31A9A72F23
SHA-256:	E014AC4C8596AE57237E27E6642E7FE2DE3744D5CA9842C065C9C8D1BF43CF79
SHA-512:	5B414EC9B202FFE751D8AB5E057239BACA6083C260704F75092190C54548BBBE4F5B8FEE4AF02DB83E30B91E52579BE8997F0735E0987D1F7E68C617F15684EE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-Za]i;..i;..i;...$..h;..4...j;...'..q;..4...7;...$..b;..i;...;..6...`;..6...z;...=..h;......h;..Richi;..........................PE..L....GP=...........!.....P...................`.....0.........................p.......................................{..I....s..x....@.......................P.......a...............................................`...............................text...\N.......P.................. ..`.rdata..9....`... ...`..............@..@.data............P..................@....rsrc........@......................@..@.reloc.......P... ..................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\txsadp32.acm

Process:	C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	4.670659646009736
Encrypted:	false
SSDEEP:	768:CO8nPxvFMFnG+9OUTZ9davwslFbnZoELNzMp6OgofwBJ:CO8nPxtMFG+9OUTZ9+HFo42Aofw7
MD5:	870E1E913E79CA37DE5DDD9DBE87411F
SHA1:	6E5B41E0C7B7667629CC68F7C4E0280F36BFB64B
SHA-256:	077441B921F3B23D04E11CEC9FB923CB4EB536B5DB5F2E78A7C7FD84030A7394
SHA-512:	D6E2E8C0EADE46F5ECE8850CAD87C46F5FDA4D8B9328DB0DCD92E889397A4AC5CC2B8E9F47AE1443FA06A5565F5FCDFEC4A040C97ADB2098C957BE976A65F1FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................<......R........<.......................<...............>......Rich....................PE..L....qQ<...........!.....`...p......y1.......p.......................................................................{..J...Xv..P....................................................................................p...............................text....\.......`.................. ..`.rdata.......p.......p..............@..@.data....4.......0..................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\_delis32.ini

Process:	C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe
File Type:	JSON data
Category:	modified
Size (bytes):	203
Entropy (8bit):	5.101990997842644
Encrypted:	false
SSDEEP:	6:d6ClLVDwkn23fxS6aVswkn23fxS6BpzSRPwkn23fxS6EKM:Dxsf5Wf554mf5sKM
MD5:	CF5B170304D014DBCBDEC6A33D14CA04
SHA1:	8D7728C655377C094B021B1DD21F23D3857304C0
SHA-256:	C4C857AEA2621D6F83E71DA1240D34BD9297C0C89211ABA3B40A37E2A9D8BC32
SHA-512:	1765258C509D5464D4DD57B9AA43571AA533EDE7D869B6782B44B550A2869D868B970EB83E65AA60D378089937C12FF49678E7B5D0926FB3B269016F7DDC15DC
Malicious:	false
Preview:	[file0]..main=C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP..dir=C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR..exeostype=2..alt1=C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_WUTL951.DLL..

C:\Windows\_isenv31.ini

Process:	C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	5.534681444438438
Encrypted:	false
SSDEEP:	48:RkPZElQFDYva7BK7U1M7e7Z7DH1yat39XNtx9:mThL3
MD5:	7B5367B22D483512B751F3C46B025E10
SHA1:	7D94AE9E160E3C489B47A3660F2CA66A1990650D
SHA-256:	FFDE02814AC4E91B378BCB2C0FBDFFA33B249A655E485902FEFE651EEE8FCCF7
SHA-512:	1360C1345F3DD1996B86C048A88BC511E78479A0D10AC8C4C5E7269806C4671E1368A16E32D1C167B7034E311CE36A95EA99B48111DA19382C8FA0956D5775EC
Malicious:	false
Preview:	ALLUSERSPROFILE=C:\ProgramData.APPDATA=C:\Users\user\AppData\Roaming.CommonProgramFiles=C:\Program Files (x86)\Common Files.CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files.CommonProgramW6432=C:\Program Files\Common Files.COMPUTERNAME=user-PC.ComSpec=C:\Windows\system32\cmd.exe.DriverData=C:\Windows\System32\Drivers\DriverData.FPS_BROWSER_APP_PROFILE_STRING=Internet Explorer.FPS_BROWSER_USER_PROFILE_STRING=Default.HOMEDRIVE=C:.HOMEPATH=\Users\user.LOCALAPPDATA=C:\Users\user\AppData\Local.LOGONSERVER=\\user-PC.NUMBER_OF_PROCESSORS=2.OneDrive=C:\Users\user\OneDrive.OS=Windows_NT.Path=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;.PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC.PROCESSOR_ARCHITECTURE=x86.PROCESSOR_ARCHITEW6432=AMD64.PROCESSOR_IDENTIFIER=Intel64 Family 6

C:\Windows\_iserr31.ini

Process:	C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	521
Entropy (8bit):	4.669273067839213
Encrypted:	false
SSDEEP:	12:omkpfdMfskA5a9UxFemBnpJe1Hu7TZIiFKpc1i2iX7pypEW9:tkBSsV0UD/eU7T2u17iXspEW9
MD5:	B99921C1CE27E631044AD7AD03E27FAA
SHA1:	13FA80578E7A9F5ECE1CFD7913EEC6E3E5B12250
SHA-256:	BD6EFC8E0F5B775AE357F3B647D74B7DDBC5FB8FC827E659D77AC2EF9888F16F
SHA-512:	79FF7699AD240F4B62C5B336FB6EBB684E675B2D74CF541997F1D42716C1E05BCC35D92443C0641A6F0E60A26D3ADD03F6316390AACB22701B718F652E5472AB
Malicious:	false
Preview:	[SharedErrors]..7068=Insufficient memory available to run Setup. Close all other applications to make more memory available and try to run Setup again.``Error 111...7063=Setup is unable to find a hard disk location to store temporary files.``Make at least %dKB free disk space available and then try running Setup again.``Error 101...7064=Setup is unable to decompress and copy all of the program files needed to proceed with the installation. Contact your software vendor.``Error 112...7110=Setup Initialization Error..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
Entropy (8bit):	7.812009425267034
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Codecs.exe
File size:	942'125 bytes
MD5:	3bb0f37d0e11e3a60faa457a637253ef
SHA1:	f9340cd1548cb7f18c6995e87e3ef248128827cd
SHA256:	91735654bd0e15102f22efa9ae4460752789031f457224ea986dabb01c9fb47e
SHA512:	7456b9eadd01c2c523b3c74d8719c298eae1256484dcc2fa2a4d623f703fa24a321e8bb19e60c28be7ea1a434f0871f12d65077788bdb5330efc616541590a9c
SSDEEP:	24576:xQD4q2vZKafowC2BZonii9xqtI6chJhDmLUmXwjc3bVWBA:uUL4aOiCqa6guhgAJD
TLSH:	1D1512947FF78E64D8A57631C261FC7148AE782145F29F8A8AD80F461A72DDDAFC4302
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......mWY.)67.)67.)67.)67.%67..)<.!67..*9.;67..)=.`67.K)$.$67.)66..67...<.#67..01.(67.Rich)67.................PE..L......8...........

File Icon


Icon Hash:	4cf8f0f8daf2b607

Static PE Info

General

Entrypoint:	0x4083f7
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x38DFA3F6 [Mon Mar 27 18:09:58 2000 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	690c9e79bb34f8d71799aa65a51d3c5d

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 00412310h
push 0040B530h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 58h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
call dword ptr [004121E8h]
xor edx, edx
mov dl, ah
mov dword ptr [00415330h], edx
mov ecx, eax
and ecx, 000000FFh
mov dword ptr [0041532Ch], ecx
shl ecx, 08h
add ecx, edx
mov dword ptr [00415328h], ecx
shr eax, 10h
mov dword ptr [00415324h], eax
xor esi, esi
push esi
call 00007F9E74C9D6C5h
pop ecx
test eax, eax
jne 00007F9E74C9D5EAh
push 0000001Ch
call 00007F9E74C9D695h
pop ecx
mov dword ptr [ebp-04h], esi
call 00007F9E74CA04F6h
call dword ptr [004121ECh]
mov dword ptr [004168E4h], eax
call 00007F9E74CA03B4h
mov dword ptr [004152FCh], eax
call 00007F9E74CA015Dh
call 00007F9E74CA009Fh
call 00007F9E74C9E50Eh
mov dword ptr [ebp-30h], esi
lea eax, dword ptr [ebp-5Ch]
push eax
call dword ptr [00412088h]
call 00007F9E74CA0030h
mov dword ptr [ebp-64h], eax
test byte ptr [ebp-30h], 00000001h
je 00007F9E74C9D5E8h
movzx eax, word ptr [ebp-2Ch]
jmp 00007F9E74C9D5E5h
push 0000000Ah
pop eax
push eax
push dword ptr [ebp-64h]
push esi
push esi
call dword ptr [004120DCh]

Rich Headers

Programming Language:

[C++] VS98 (6.0) build 8168
[ C ] VS98 (6.0) build 8168
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x12800	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18000	0x11230	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x12000	0x2f4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x105ca	0x11000	5b6df619664624884a834fcf0f52f02c	False	0.5853486902573529	data	6.455157540625488	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x12000	0x17e8	0x2000	96eeaaf8a45fd302a50f5a1059a07b8e	False	0.3365478515625	data	4.6091985757023854	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x14000	0x3cfc	0x2000	fcd90c29c828117eaa5760e89ff74528	False	0.24365234375	data	2.42683208281741	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x18000	0x11230	0x12000	8f960b40ad50f9b71835df259478ff4e	False	0.1780734592013889	data	3.7533896502914343	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x1a568	0xcd50	Device independent bitmap graphic, 164 x 314 x 8, image size 51496, 256 important colors	English	United States	0.12165144596651446
RT_BITMAP	0x272b8	0xfc0	Device independent bitmap graphic, 53 x 53 x 8, image size 2968, 256 important colors	English	United States	0.4290674603174603
RT_ICON	0x18ca0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.4594594594594595
RT_ICON	0x18dc8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.5202312138728323
RT_ICON	0x19330	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.3655913978494624
RT_ICON	0x19618	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.5153429602888087
RT_DIALOG	0x28278	0x19a	data	English	United States	0.5121951219512195
RT_DIALOG	0x188a0	0x92	data	English	United States	0.7054794520547946
RT_DIALOG	0x18938	0xbe	data	English	United States	0.6263157894736842
RT_DIALOG	0x18aa8	0xd6	data	English	United States	0.5841121495327103
RT_DIALOG	0x189f8	0xae	data	English	United States	0.6091954022988506
RT_DIALOG	0x18628	0x272	data	English	United States	0.4792332268370607
RT_DIALOG	0x18540	0xe2	data	English	United States	0.6017699115044248
RT_DIALOG	0x18be8	0xb2	data	English	United States	0.5674157303370787
RT_DIALOG	0x18b80	0x62	data	English	United States	0.8061224489795918
RT_STRING	0x28418	0x632	data	English	United States	0.3291298865069357
RT_STRING	0x28a50	0x1a8	data	English	United States	0.5165094339622641
RT_STRING	0x29020	0x11a	data	English	United States	0.549645390070922
RT_STRING	0x28bf8	0xba	data	English	United States	0.5483870967741935
RT_STRING	0x28cb8	0x366	data	English	United States	0.3793103448275862
RT_STRING	0x29140	0x98	data	English	United States	0.7302631578947368
RT_STRING	0x291d8	0x58	data	English	United States	0.4318181818181818
RT_GROUP_ICON	0x19ec0	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x19f00	0x668	data	English	United States	0.2810975609756098

Imports

DLL	Import
KERNEL32.dll	FormatMessageA, GetSystemDefaultLCID, GetProcAddress, GetTempFileNameA, MulDiv, CreateProcessA, WaitForSingleObject, GetStartupInfoA, IsDBCSLeadByte, Sleep, CompareStringA, SetFileTime, LocalFileTimeToFileTime, DosDateTimeToFileTime, FreeLibrary, RemoveDirectoryA, FindNextFileA, WritePrivateProfileSectionA, WritePrivateProfileStringA, lstrcpynA, GetPrivateProfileSectionA, WriteFile, DeleteFileA, LocalAlloc, LockResource, LoadResource, FindResourceA, SizeofResource, GetModuleHandleA, GlobalFree, GlobalUnlock, GlobalLock, GlobalAlloc, MultiByteToWideChar, lstrcmpiA, GetDiskFreeSpaceA, HeapAlloc, GetProcessHeap, HeapFree, GetModuleFileNameA, ExitProcess, CreateFileA, CreateFileMappingA, MapViewOfFile, UnmapViewOfFile, SetFileAttributesA, GetFileSize, ReadFile, SetFilePointer, FindFirstFileA, CreateDirectoryA, GetLastError, GetPrivateProfileStringA, FindClose, GetFileAttributesA, lstrcatA, lstrlenA, GetWindowsDirectoryA, lstrcpyA, GetSystemDirectoryA, GetTempPathA, MoveFileExA, LoadLibraryA, LocalFree, GetShortPathNameA, FlushFileBuffers, CloseHandle, SetStdHandle, IsBadCodePtr, IsBadReadPtr, SetUnhandledExceptionFilter, LCMapStringW, LCMapStringA, GetFileType, GetStdHandle, SetHandleCount, GetEnvironmentStringsW, GetEnvironmentStrings, WideCharToMultiByte, FreeEnvironmentStringsW, FreeEnvironmentStringsA, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetStringTypeW, GetStringTypeA, GetOEMCP, GetACP, GetCPInfo, IsBadWritePtr, HeapReAlloc, VirtualAlloc, VirtualFree, HeapCreate, HeapDestroy, GetVersion, GetCommandLineA, RtlUnwind
USER32.dll	GetParent, GetDlgItem, SendDlgItemMessageA, EnableWindow, CheckRadioButton, SetWindowTextA, GetWindowTextA, LoadStringA, LoadImageA, MessageBoxA, IsDlgButtonChecked, GetDlgItemTextA, SetDlgItemTextA, ReleaseDC, GetDC, GetWindowLongA, SetFocus, PostMessageA, GetWindow, wsprintfA, GetDesktopWindow, DestroyWindow, CreateDialogParamA, DispatchMessageA, TranslateMessage, GetSysColor, GetSysColorBrush, FillRect, BeginPaint, DrawTextA, EndPaint, GetClientRect, ScreenToClient, MoveWindow, SetParent, MapDialogRect, GetNextDlgTabItem, GetWindowRect, CreateDialogIndirectParamA, IsWindow, InvalidateRect, IsWindowEnabled, ShowWindow, UpdateWindow, IsDialogMessageA, SetWindowPos, GetActiveWindow, SetActiveWindow, CharNextA, LoadIconA, SendMessageA, PeekMessageA, SetWindowLongA
GDI32.dll	DeleteObject, CreatePalette, RealizePalette, GetDeviceCaps, CreateDIBitmap, GetObjectA, SelectPalette, EnumFontFamiliesExA, GetTextExtentPointA, GetStockObject, TextOutA, DeleteDC, SelectObject, CreateCompatibleDC, SetBkMode, BitBlt, SetTextColor, CreateSolidBrush, SetBkColor, CreateFontIndirectA
ADVAPI32.dll	RegCloseKey, RegQueryValueExA, RegOpenKeyExA
SHELL32.dll	ShellExecuteA, SHBrowseForFolderA, SHGetPathFromIDListA, SHGetMalloc
LZ32.dll	LZOpenFileA, LZCopy, LZClose
COMCTL32.dll

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	08:35:24
Start date:	01/11/2024
Path:	C:\Users\user\Desktop\Codecs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Codecs.exe"
Imagebase:	0x400000
File size:	942'125 bytes
MD5 hash:	3BB0F37D0E11E3A60FAA457A637253EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	08:35:24
Start date:	01/11/2024
Path:	C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\Setup.exe" /SMS
Imagebase:	0x400000
File size:	73'728 bytes
MD5 hash:	71E6DD8A9DE4A9BAF89FCA951768059A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Target ID:	2
Start time:	08:35:27
Start date:	01/11/2024
Path:	C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\_ISTMP1.DIR\_INS5576._MP
Imagebase:	0x400000
File size:	557'056 bytes
MD5 hash:	D28CB295E2395B3593293470E7784512
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	08:35:27
Start date:	01/11/2024
Path:	C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDel.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\pft1C0F~tmp\_ISDEL.EXE
Imagebase:	0x400000
File size:	27'648 bytes
MD5 hash:	51161BF79F25FF278912005078AD93D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true