Windows Analysis Report
int_duca.exe

Source:	Binary string: e:\pb126\BUILD\UNICODE\PBVM126.pdb source: PBVMfb5c.rra.3.dr
Source:	Binary string: e:\pb126\BUILD\UNICODE\PBODB126.pdb source: pbodf9e5.rra.3.dr
Source:	Binary string: E:\pb126\build\unicode\PBUIS126.pdb source: pbUIfab0.rra.3.dr
Source:	Binary string: e:\pb126\BUILD\UNICODE\pbo10126.pdb source: pbo1f9c6.rra.3.dr
Source:	Binary string: E:\pb126\build\unicode\PBUIS126.pdb source: pbUIfab0.rra.3.dr

Source: C:\Users\user\Desktop\int_duca.exe	Code function: 0_2_004014C2 wsprintfA,FindFirstFileA,FindClose,	0_2_004014C2
Source: C:\Users\user\Desktop\int_duca.exe	Code function: 0_2_004050D5 lstrcpyA,lstrcpyA,lstrcatA,lstrcatA,DeleteFileA,DeleteFileA,FindFirstFileA,lstrcpyA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,DeleteFileA,FindNextFileA,FindClose,lstrcpyA,lstrlenA,RemoveDirectoryA,	0_2_004050D5
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_00458620 CreateEventA,GetProcAddress,SearchPathA,GetModuleFileNameA,FindFirstFileA,VirtualProtect,VirtualQuery,VirtualProtect,VirtualProtect,FindClose,FindClose,	2_2_00458620
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_0042A298 __EH_prolog,FindFirstFileA,FindClose,	2_2_0042A298
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_0045256E __EH_prolog,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,FindClose,	2_2_0045256E
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_0045A9E4 __EH_prolog,FindFirstFileA,FindClose,lstrcmpA,lstrcmpA,lstrcmpA,FindNextFileA,FindClose,RemoveDirectoryA,FindClose,DeleteFileA,	2_2_0045A9E4
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_0044ACA8 __EH_prolog,FindFirstFileA,FindNextFileA,SafeArrayCopy,FindClose,	2_2_0044ACA8
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_00428EA6 __EH_prolog,FindFirstFileA,lstrcmpA,lstrcmpA,lstrcmpA,FindNextFileA,FindClose,	2_2_00428EA6
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_00429025 __EH_prolog,FindFirstFileA,FileTimeToLocalFileTime,FileTimeToDosDateTime,FindNextFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,	2_2_00429025
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_0044B21F __EH_prolog,FindFirstFileA,lstrcmpA,lstrcmpA,lstrcmpA,FindNextFileA,SafeArrayCopy,FindClose,	2_2_0044B21F
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_00458620 CreateEventA,GetProcAddress,SearchPathA,GetModuleFileNameA,FindFirstFileA,VirtualProtect,VirtualQuery,VirtualProtect,VirtualProtect,FindClose,FindClose,	3_2_00458620
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_00428EA6 __EH_prolog,FindFirstFileA,lstrcmpA,lstrcmpA,lstrcmpA,FindNextFileA,FindClose,	3_2_00428EA6
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_00429025 __EH_prolog,FindFirstFileA,FileTimeToLocalFileTime,FileTimeToDosDateTime,FindNextFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,	3_2_00429025
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_0042A298 __EH_prolog,FindFirstFileA,FindClose,	3_2_0042A298
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_0045256E __EH_prolog,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,FindClose,	3_2_0045256E
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_0045A9E4 __EH_prolog,FindFirstFileA,FindClose,lstrcmpA,lstrcmpA,lstrcmpA,FindNextFileA,FindClose,RemoveDirectoryA,FindClose,DeleteFileA,	3_2_0045A9E4
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_0044ACA8 __EH_prolog,FindFirstFileA,FindNextFileA,SafeArrayCopy,FindClose,	3_2_0044ACA8
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_0044B21F __EH_prolog,FindFirstFileA,lstrcmpA,lstrcmpA,lstrcmpA,FindNextFileA,SafeArrayCopy,FindClose,	3_2_0044B21F

Source: C:\Users\user\Desktop\int_duca.exe	File opened: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	File opened: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	File opened: C:\Users\user\	Jump to behavior

Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe

Code function: 2_2_00458869 InternetReadFile,SetLastError,

2_2_00458869

Source: duca59d.rra.3.dr	String found in binary or memory: http://aca-web.gencat.cat/acDAT
Source: duca474.rra.3.dr	String found in binary or memory: http://aca-web.gencat.cat/sig/rest/INTERN/CERCADOR/MapServer//query?geometry=&DAT
Source: duca59d.rra.3.dr	String found in binary or memory: http://web.gencat.cat/ca/tramits/tramits-temes/Declaracio-de-lUs-i-la-Contaminacio-de-lAigua-DUCA?ca
Source: dataf6d8.rra.3.dr	String found in binary or memory: http://www.installengine.com/engine/
Source: duca59d.rra.3.dr	String found in binary or memory: https://acanet.gencat.cat/geco/establiments/login.aspInternetgetcontextservice
Source: duca59d.rra.3.dr	String found in binary or memory: https://web.gencat.cat/ca/tramits/trDAT
Source: duca59d.rra.3.dr	String found in binary or memory: https://web.gencat.cat/ca/tramits/tramits-temes/Peticio-genericahyperlinktourl

Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_00442FC7 __EH_prolog,SysAllocString,SysFreeString,WritePrivateProfileStringA,GetVersionExA,RegCreateKeyExA,RegQueryValueExA,wsprintfA,lstrcpyA,lstrlenA,RegSetValueExA,RegCloseKey,ExitWindowsEx,ExitWindowsEx,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,		2_2_00442FC7
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_00442FC7 __EH_prolog,SysAllocString,SysFreeString,WritePrivateProfileStringA,GetVersionExA,RegCreateKeyExA,RegQueryValueExA,wsprintfA,lstrcpyA,lstrlenA,RegSetValueExA,RegCloseKey,ExitWindowsEx,ExitWindowsEx,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,		3_2_00442FC7

Source: C:\Users\user\Desktop\int_duca.exe	Code function: 0_2_004124E8	0_2_004124E8
Source: C:\Users\user\Desktop\int_duca.exe	Code function: 0_2_0040FD34	0_2_0040FD34
Source: C:\Users\user\Desktop\int_duca.exe	Code function: 0_2_0040D3CF	0_2_0040D3CF
Source: C:\Users\user\Desktop\int_duca.exe	Code function: 0_2_0040F7D6	0_2_0040F7D6
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_004600B0	2_2_004600B0
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_00462482	2_2_00462482
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_00454689	2_2_00454689
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_00457AA7	2_2_00457AA7
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_00454689	3_2_00454689
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_004600B0	3_2_004600B0
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_00462482	3_2_00462482
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_00457AA7	3_2_00457AA7

Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: String function: 0045C1CC appears 1905 times
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: String function: 00416F93 appears 52 times
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: String function: 0045BBB5 appears 114 times
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: String function: 0045BD44 appears 61 times
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: String function: 0045C2F8 appears 44 times

Source: temp.000.1.dr	Static PE information: Resource name: PUBLICKEY type: b.out overlay separate pure segmented executable V2.3 186 286 286 386 Large Text Large Data Huge Objects Enabled
Source: mdacf774.rra.3.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 7802465 bytes, 16 files, at 0x1830 +A "cabinet.dll" +RA "advpack.dll", flags 0x4, ID 17544, number 1, extra bytes 6144 in head, 261 datablocks, 0x1503 compression
Source: pbo1f9c6.rra.3.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: pborf9f5.rra.3.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: pbshfa14.rra.3.dr	Static PE information: Resource name: RT_STRING type: x86 executable not stripped
Source: pbshfa14.rra.3.dr	Static PE information: Resource name: None type: PE32 executable (GUI) Intel 80386, for MS Windows

Source: int_duca.exe, 00000000.00000000.1696070391.000000000041A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamestub32i.exe vs int_duca.exe
Source: int_duca.exe	Binary or memory string: OriginalFilenamestub32i.exe vs int_duca.exe

Source: int_duca.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: clean9.winEXE@8/340@0/0

Source: C:\Users\user\Desktop\int_duca.exe

Code function: 0_2_00402388 GetLastError,FormatMessageA,

0_2_00402388

Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_00442FC7 __EH_prolog,SysAllocString,SysFreeString,WritePrivateProfileStringA,GetVersionExA,RegCreateKeyExA,RegQueryValueExA,wsprintfA,lstrcpyA,lstrlenA,RegSetValueExA,RegCloseKey,ExitWindowsEx,ExitWindowsEx,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,		2_2_00442FC7
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_00442FC7 __EH_prolog,SysAllocString,SysFreeString,WritePrivateProfileStringA,GetVersionExA,RegCreateKeyExA,RegQueryValueExA,wsprintfA,lstrcpyA,lstrlenA,RegSetValueExA,RegCloseKey,ExitWindowsEx,ExitWindowsEx,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,		3_2_00442FC7

Source: C:\Users\user\Desktop\int_duca.exe

Code function: 0_2_00405C6C GetModuleHandleA,GetProcAddress,lstrcpyA,lstrcatA,GetDiskFreeSpaceExA,GetLastError,GetDiskFreeSpaceA,

0_2_00405C6C

Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe

Code function: 1_2_00405F89 lstrcpyA,__setjmp3,CoCreateInstance,CoCreateInstance,Sleep,CoCreateInstance,

1_2_00405F89

Source: C:\Users\user\Desktop\int_duca.exe

Code function: 0_2_00405416 FindResourceA,LoadResource,LockResource,LocalAlloc,CreatePalette,LocalFree,

0_2_00405416

Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe

File created: C:\Program Files (x86)\Common Files\InstallShield\

Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe

File created: C:\Users\Public\Desktop\e-DUCA.lnk

Source: C:\Users\user\Desktop\int_duca.exe

File created: C:\Users\user\AppData\Local\Temp\plfE16B.tmp

Source: int_duca.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe

File read: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.ini

Source: C:\Users\user\Desktop\int_duca.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: duca59d.rra.3.dr	Binary or memory string: update d_dcca_capcalera set estat_dcca ='C' where codest =0 and num_dcca =0 :;JK
Source: duca59d.rra.3.dr	Binary or memory string: UPDATE d_dcca_preu set coef_innovacio=1 WHERE coef_innovacio IS NULL;
Source: duca59d.rra.3.dr	Binary or memory string: select * from ;d_dcca_ciasALTER TABLE d_dcca_cias ADD COLUMN cabal_anuaDAT*
Source: duca59d.rra.3.dr	Binary or memory string: select * from ;d_dcca_ciasALTER TABLE d_dcca_cias ADD COLUMN cabal_anual DOUBLEsetsqlselect

Source: Setup.exe

String found in binary or memory: -InstallShield

Source: C:\Users\user\Desktop\int_duca.exe

File read: C:\Users\user\Desktop\int_duca.exe

Source: unknown	Process created: C:\Users\user\Desktop\int_duca.exe "C:\Users\user\Desktop\int_duca.exe"
Source: C:\Users\user\Desktop\int_duca.exe	Process created: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe "C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe"
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Process created: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe "C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe" -RegServer
Source: unknown	Process created: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe C:\PROGRA~2\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe -Embedding
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process created: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe "C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe" /REGSERVER
Source: C:\Users\user\Desktop\int_duca.exe	Process created: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe "C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Process created: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe "C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe" -RegServer	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process created: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe "C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe" /REGSERVER	Jump to behavior

Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: lz32.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: acspecfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: ddraw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: acspecfc.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: ddraw.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: acspecfc.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: ddraw.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: acspecfc.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: ddraw.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Section loaded: winhttp.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32

Source: e-DUCA.lnk.3.dr

LNK file: ..\..\..\int_duca\intduca.exe

Source: C:\Users\user\Desktop\int_duca.exe

File written: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.ini

Source: C:\Users\user\Desktop\int_duca.exe

File opened: C:\Windows\SysWOW64\RICHED32.DLL

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: int_duca.exe

Static file information: File size 26890785 > 1048576

Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe

File opened: c:\int_duca\msvcr100.dll

Source:	Binary string: e:\pb126\BUILD\UNICODE\PBVM126.pdb source: PBVMfb5c.rra.3.dr
Source:	Binary string: e:\pb126\BUILD\UNICODE\PBODB126.pdb source: pbodf9e5.rra.3.dr
Source:	Binary string: E:\pb126\build\unicode\PBUIS126.pdb source: pbUIfab0.rra.3.dr
Source:	Binary string: e:\pb126\BUILD\UNICODE\pbo10126.pdb source: pbo1f9c6.rra.3.dr
Source:	Binary string: E:\pb126\build\unicode\PBUIS126.pdb source: pbUIfab0.rra.3.dr

Source: C:\Users\user\Desktop\int_duca.exe

Code function: 0_2_00405DF9 LoadLibraryA,GetProcAddress,lstrlenA,lstrlenA,lstrlenA,

0_2_00405DF9

Source: objeee9a.rra.3.dr	Static PE information: section name: .orpc
Source: odbcf8fb.rra.3.dr	Static PE information: section name: .sdbid
Source: pbshfa14.rra.3.dr	Static PE information: section name: .textidx
Source: pbshfa14.rra.3.dr	Static PE information: section name: CONST

Source: C:\Users\user\Desktop\int_duca.exe	Code function: 0_2_00408928 push eax; ret	0_2_00408946
Source: C:\Users\user\Desktop\int_duca.exe	Code function: 0_2_004081B0 push eax; ret	0_2_004081DE
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Code function: 1_2_00407AB0 push eax; ret	1_2_00407ADE
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_0045A03A pushad ; retn 0046h	2_2_0045A03B
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_0045C1CC push eax; ret	2_2_0045C1EA
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_0045C360 push eax; ret	2_2_0045C38E
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_00406AAF push esp; ret	2_2_00406ABE
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_0041BC2A pushfd ; ret	2_2_0041BC2B
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_0045C1CC push eax; ret	3_2_0045C1EA
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_0045C360 push eax; ret	3_2_0045C38E
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_0046E458 push ebp; retf	3_2_0046E46C
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_00406AAF push esp; ret	3_2_00406ABE

Source: msvcfc85.rra.3.dr

Static PE information: section name: .text entropy: 6.909044922675825

Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\PBVM126.DLL (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\libjtml.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\libjutils.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	File created: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\temp.000	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\pbtrfaa0.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\msvcp100.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\pbdwe126.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\unzip.exe (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\pborf9f5.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctoree5c.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\_IsRes.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\atl1fc56.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\unzif8ac.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\pbjvf9b6.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\Program Files (x86)\Common Files\InstallShield\IScript\iscreed9.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\intd3c8.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\pbtra126.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\zip.exe (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\objeee9a.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\msvcfc85.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\Program Files (x86)\InstallShield Installation Information\{E66DF05C-F85B-4711-A050-6A0F738964E0}\Setuf6f7.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\odbcf8fb.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\pbdpl126.DLL (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\pbjvm126.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\libjf8cc.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\pbacc126.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\zipf764.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\isrt.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuseee9a.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\PBVMfb5c.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\Program Files (x86)\InstallShield Installation Information\{E66DF05C-F85B-4711-A050-6A0F738964E0}\Setup.exe (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\msvcfc66.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\mdacf774.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\pbo1f9c6.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\pbshr126.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\isrtf0bd.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\pbodf9e5.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\atl100.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	File created: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\pbdwf90a.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\intduca.exe (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\nlwnsck.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\libjcc.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\pbUIfab0.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\libjf8bc.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\pbo10126.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\odbcjt32.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\pbodb126.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\Program Files (x86)\Common Files\InstallShield\IScript\iscript.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\mdac_typ_es.exe (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\pbdpfc46.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\_IsRf0ec.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\pbacf90a.rra	Jump to dropped file
Source: C:\Users\user\Desktop\int_duca.exe	File created: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\pbshfa14.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\libjf8db.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\pbUIS126.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\nlwnf8eb.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\msvcr100.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: c:\int_duca\pbora126.dll (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	File created: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\temp.000	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctoree5c.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\objeee9a.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuseee9a.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\Program Files (x86)\Common Files\InstallShield\IScript\iscreed9.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\isrtf0bd.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\_IsRf0ec.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\Program Files (x86)\InstallShield Installation Information\{E66DF05C-F85B-4711-A050-6A0F738964E0}\Setuf6f7.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\zipf764.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\mdacf774.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\unzif8ac.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\libjf8bc.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\libjf8cc.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\libjf8db.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\nlwnf8eb.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\odbcf8fb.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\pbacf90a.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\pbdwf90a.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\pbjvf9b6.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\pbo1f9c6.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\pbodf9e5.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\pborf9f5.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\pbshfa14.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\pbtrfaa0.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\pbUIfab0.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\PBVMfb5c.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\pbdpfc46.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\atl1fc56.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\msvcfc66.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\msvcfc85.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	File created: C:\int_duca\intd3c8.rra	Jump to dropped file

Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe

Code function: 2_2_00458426 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_00458426

Source: C:\Users\user\Desktop\int_duca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\PBVM126.DLL (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\libjutils.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\libjtml.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\pbtrfaa0.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\msvcp100.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\pbdwe126.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\unzip.exe (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\pborf9f5.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\_IsRes.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctoree5c.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\atl1fc56.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\unzif8ac.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\pbjvf9b6.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\InstallShield\IScript\iscreed9.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\intd3c8.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\pbtra126.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\zip.exe (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\objeee9a.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\msvcfc85.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\odbcf8fb.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\pbdpl126.DLL (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\pbjvm126.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\pbacc126.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\libjf8cc.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\zipf764.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\isrt.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuseee9a.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\PBVMfb5c.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\msvcfc66.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\mdacf774.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\pbo1f9c6.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\pbshr126.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\isrtf0bd.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\pbodf9e5.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\atl100.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\pbdwf90a.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\intduca.exe (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\nlwnsck.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\libjcc.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\pbUIfab0.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\libjf8bc.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\pbo10126.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\odbcjt32.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\pbodb126.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\InstallShield\IScript\iscript.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\mdac_typ_es.exe (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\pbdpfc46.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\_IsRf0ec.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\pbacf90a.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\pbshfa14.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\libjf8db.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\pbUIS126.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: C:\int_duca\nlwnf8eb.rra	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\msvcr100.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Dropped PE file which has not been started: c:\int_duca\pbora126.dll (copy)	Jump to dropped file

Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe

API coverage: 6.0 %

Source: C:\Users\user\Desktop\int_duca.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\int_duca.exe	Code function: 0_2_004014C2 wsprintfA,FindFirstFileA,FindClose,	0_2_004014C2
Source: C:\Users\user\Desktop\int_duca.exe	Code function: 0_2_004050D5 lstrcpyA,lstrcpyA,lstrcatA,lstrcatA,DeleteFileA,DeleteFileA,FindFirstFileA,lstrcpyA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,DeleteFileA,FindNextFileA,FindClose,lstrcpyA,lstrlenA,RemoveDirectoryA,	0_2_004050D5
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_00458620 CreateEventA,GetProcAddress,SearchPathA,GetModuleFileNameA,FindFirstFileA,VirtualProtect,VirtualQuery,VirtualProtect,VirtualProtect,FindClose,FindClose,	2_2_00458620
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_0042A298 __EH_prolog,FindFirstFileA,FindClose,	2_2_0042A298
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_0045256E __EH_prolog,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,FindClose,	2_2_0045256E
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_0045A9E4 __EH_prolog,FindFirstFileA,FindClose,lstrcmpA,lstrcmpA,lstrcmpA,FindNextFileA,FindClose,RemoveDirectoryA,FindClose,DeleteFileA,	2_2_0045A9E4
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_0044ACA8 __EH_prolog,FindFirstFileA,FindNextFileA,SafeArrayCopy,FindClose,	2_2_0044ACA8
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_00428EA6 __EH_prolog,FindFirstFileA,lstrcmpA,lstrcmpA,lstrcmpA,FindNextFileA,FindClose,	2_2_00428EA6
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_00429025 __EH_prolog,FindFirstFileA,FileTimeToLocalFileTime,FileTimeToDosDateTime,FindNextFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,	2_2_00429025
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_0044B21F __EH_prolog,FindFirstFileA,lstrcmpA,lstrcmpA,lstrcmpA,FindNextFileA,SafeArrayCopy,FindClose,	2_2_0044B21F
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_00458620 CreateEventA,GetProcAddress,SearchPathA,GetModuleFileNameA,FindFirstFileA,VirtualProtect,VirtualQuery,VirtualProtect,VirtualProtect,FindClose,FindClose,	3_2_00458620
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_00428EA6 __EH_prolog,FindFirstFileA,lstrcmpA,lstrcmpA,lstrcmpA,FindNextFileA,FindClose,	3_2_00428EA6
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_00429025 __EH_prolog,FindFirstFileA,FileTimeToLocalFileTime,FileTimeToDosDateTime,FindNextFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,	3_2_00429025
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_0042A298 __EH_prolog,FindFirstFileA,FindClose,	3_2_0042A298
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_0045256E __EH_prolog,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,FindClose,	3_2_0045256E
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_0045A9E4 __EH_prolog,FindFirstFileA,FindClose,lstrcmpA,lstrcmpA,lstrcmpA,FindNextFileA,FindClose,RemoveDirectoryA,FindClose,DeleteFileA,	3_2_0045A9E4
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_0044ACA8 __EH_prolog,FindFirstFileA,FindNextFileA,SafeArrayCopy,FindClose,	3_2_0044ACA8
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_0044B21F __EH_prolog,FindFirstFileA,lstrcmpA,lstrcmpA,lstrcmpA,FindNextFileA,SafeArrayCopy,FindClose,	3_2_0044B21F

Source: C:\Users\user\Desktop\int_duca.exe	File opened: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	File opened: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\int_duca.exe	File opened: C:\Users\user\	Jump to behavior

Source: int_duca.exe	Binary or memory string: qEMutA
Source: IKernel.exe, 00000003.00000002.1841334437.0000000003BC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: IKernel.exe, 00000002.00000002.1727003885.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllL
Source: int_duca.exe, 00000000.00000002.1903812038.00000000023A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ilva76\OneDrive - DXC Production\Desktop\VMware-Compartida\aca_eDuca_4.17\InstallShield\eDuca_con_Evolutivo4_17\Installshield package\02 - projecte - nou_v.4.5\Media\COMPLET\Disk Images
Source: IKernel.exe, 00000003.00000002.1837603773.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, IKernel.exe, 00000004.00000002.1733998599.0000000000574000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	API call chain: ExitProcess graph end node	graph_1-4734
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	API call chain: ExitProcess graph end node	graph_1-2977
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	API call chain: ExitProcess graph end node	graph_1-4437
Source: C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	API call chain: ExitProcess graph end node	graph_1-4388

Source: C:\Users\user\Desktop\int_duca.exe

Code function: 0_2_00405DF9 LoadLibraryA,GetProcAddress,lstrlenA,lstrlenA,lstrlenA,

0_2_00405DF9

Source: C:\Users\user\Desktop\int_duca.exe

Code function: 0_2_004061FB GetProcessHeap,HeapAlloc,

0_2_004061FB

Source: C:\Users\user\Desktop\int_duca.exe	Code function: 0_2_0040CC52 SetUnhandledExceptionFilter,	0_2_0040CC52
Source: C:\Users\user\Desktop\int_duca.exe	Code function: 0_2_0040CC64 SetUnhandledExceptionFilter,	0_2_0040CC64
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_0045E8EA SetUnhandledExceptionFilter,	2_2_0045E8EA
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 2_2_0045E8FC SetUnhandledExceptionFilter,	2_2_0045E8FC
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_0045E8EA SetUnhandledExceptionFilter,	3_2_0045E8EA
Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe	Code function: 3_2_0045E8FC SetUnhandledExceptionFilter,	3_2_0045E8FC

Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe

Code function: 2_2_0045B905 GetCurrentThread,OpenThreadToken,GetLastError,GetLastError,GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetTokenInformation,GetLastError,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,

2_2_0045B905

Source: IKernel.exe	Binary or memory string: OPTYPE_PROGMAN
Source: Setup.exe, 00000001.00000002.1829545321.00000000007ED000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000001.00000003.1724138543.000000000078C000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000001.00000003.1724064024.0000000000784000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OPTYPE_PROGMAN_FIELDS
Source: Setup.exe, 00000001.00000002.1829545321.00000000007ED000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000001.00000003.1724138543.000000000078C000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000001.00000003.1724064024.0000000000784000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OPTYPE_PROGMAN_FIELDS%H
Source: IKernel.exe, 00000003.00000002.1837702067.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, IKernel.exe, 00000003.00000003.1836411010.00000000005FB000.00000004.00000020.00020000.00000000.sdmp, IKernel.exe, 00000003.00000003.1835835192.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: BOPTYPE_PROGMAN
Source: IKernel.exe, 00000003.00000002.1837702067.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, IKernel.exe, 00000003.00000003.1836411010.00000000005FB000.00000004.00000020.00020000.00000000.sdmp, IKernel.exe, 00000003.00000003.1835835192.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: B`OPTYPE_PROGMAN
Source: IKernel.exe, 00000002.00000002.1726601366.0000000000482000.00000008.00000001.01000000.00000007.sdmp, IKernel.exe, 00000002.00000000.1724761190.0000000000482000.00000008.00000001.01000000.00000007.sdmp, IKernel.exe, 00000003.00000000.1727866716.0000000000482000.00000008.00000001.01000000.00000007.sdmp	Binary or memory string: ISGlobalOpTypesTableISLOG_VERSION_INFOOPTYPE_FILEOPTYPE_SHELLOPTYPE_REGISTRYOPTYPE_PROGMANOPTYPE_INIOPTYPE_FILEREGISLOGDB_USER_PROPERTIES

Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe

Queries volume information: C:\ VolumeInformation

Source: C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe

Code function: 2_2_00429477 GetSystemTime,SystemTimeToFileTime,SystemTimeToFileTime,SystemTimeToFileTime,

2_2_00429477

Source: C:\Users\user\Desktop\int_duca.exe

Code function: 0_2_00408947 EntryPoint,GetVersion,GetCommandLineA,GetStartupInfoA,GetModuleHandleA,

0_2_00408947

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Access Token Manipulation	12 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	2 Process Injection	1 Access Token Manipulation	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	2 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	4 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	15 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
int_duca.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctoree5c.rra	0%	ReversingLabs
C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuseee9a.rra	0%	ReversingLabs
C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\objeee9a.rra	0%	ReversingLabs
C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\temp.000	0%	ReversingLabs
C:\Program Files (x86)\Common Files\InstallShield\IScript\iscreed9.rra	0%	ReversingLabs
C:\Program Files (x86)\Common Files\InstallShield\IScript\iscript.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\InstallShield Installation Information\{E66DF05C-F85B-4711-A050-6A0F738964E0}\Setuf6f7.rra	0%	ReversingLabs
C:\Program Files (x86)\InstallShield Installation Information\{E66DF05C-F85B-4711-A050-6A0F738964E0}\Setup.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\_IsRes.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\_IsRf0ec.rra	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\isrt.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\isrtf0bd.rra	0%	ReversingLabs
C:\int_duca\PBVMfb5c.rra	2%	ReversingLabs
C:\int_duca\atl1fc56.rra	0%	ReversingLabs
C:\int_duca\libjf8bc.rra	0%	ReversingLabs
C:\int_duca\libjf8cc.rra	3%	ReversingLabs
C:\int_duca\libjf8db.rra	0%	ReversingLabs
C:\int_duca\mdacf774.rra	0%	ReversingLabs
C:\int_duca\msvcfc66.rra	0%	ReversingLabs
C:\int_duca\msvcfc85.rra	0%	ReversingLabs
C:\int_duca\nlwnf8eb.rra	0%	ReversingLabs
C:\int_duca\odbcf8fb.rra	0%	ReversingLabs
C:\int_duca\pbUIfab0.rra	0%	ReversingLabs
C:\int_duca\pbacf90a.rra	0%	ReversingLabs
C:\int_duca\pbdpfc46.rra	0%	ReversingLabs
C:\int_duca\pbdwf90a.rra	0%	ReversingLabs
C:\int_duca\pbjvf9b6.rra	0%	ReversingLabs
C:\int_duca\pbo1f9c6.rra	0%	ReversingLabs
C:\int_duca\pbodf9e5.rra	0%	ReversingLabs
C:\int_duca\pborf9f5.rra	0%	ReversingLabs
C:\int_duca\pbshfa14.rra	3%	ReversingLabs
C:\int_duca\pbtrfaa0.rra	0%	ReversingLabs
C:\int_duca\unzif8ac.rra	4%	ReversingLabs
C:\int_duca\zipf764.rra	0%	ReversingLabs
c:\int_duca\PBVM126.DLL (copy)	2%	ReversingLabs
c:\int_duca\atl100.dll (copy)	0%	ReversingLabs
c:\int_duca\libjcc.dll (copy)	0%	ReversingLabs
c:\int_duca\libjtml.dll (copy)	3%	ReversingLabs
c:\int_duca\libjutils.dll (copy)	0%	ReversingLabs
c:\int_duca\mdac_typ_es.exe (copy)	0%	ReversingLabs
c:\int_duca\msvcp100.dll (copy)	0%	ReversingLabs
c:\int_duca\msvcr100.dll (copy)	0%	ReversingLabs
c:\int_duca\nlwnsck.dll (copy)	0%	ReversingLabs
c:\int_duca\odbcjt32.dll (copy)	0%	ReversingLabs
c:\int_duca\pbUIS126.dll (copy)	0%	ReversingLabs
c:\int_duca\pbacc126.dll (copy)	0%	ReversingLabs
c:\int_duca\pbdpl126.DLL (copy)	0%	ReversingLabs
c:\int_duca\pbdwe126.dll (copy)	0%	ReversingLabs
c:\int_duca\pbjvm126.dll (copy)	0%	ReversingLabs
c:\int_duca\pbo10126.dll (copy)	0%	ReversingLabs
c:\int_duca\pbodb126.dll (copy)	0%	ReversingLabs
c:\int_duca\pbora126.dll (copy)	0%	ReversingLabs
c:\int_duca\pbshr126.dll (copy)	3%	ReversingLabs
c:\int_duca\pbtra126.dll (copy)	0%	ReversingLabs
c:\int_duca\unzip.exe (copy)	4%	ReversingLabs
c:\int_duca\zip.exe (copy)	0%	ReversingLabs

Source	Detection	Scanner	Label
https://web.gencat.cat/ca/tramits/trDAT	0%	Avira URL Cloud	safe
http://www.installengine.com/engine/	0%	Avira URL Cloud	safe
http://aca-web.gencat.cat/sig/rest/INTERN/CERCADOR/MapServer//query?geometry=&DAT	0%	Avira URL Cloud	safe
http://aca-web.gencat.cat/acDAT	0%	Avira URL Cloud	safe
https://acanet.gencat.cat/geco/establiments/login.aspInternetgetcontextservice	0%	Avira URL Cloud	safe
http://web.gencat.cat/ca/tramits/tramits-temes/Declaracio-de-lUs-i-la-Contaminacio-de-lAigua-DUCA?ca	0%	Avira URL Cloud	safe
https://web.gencat.cat/ca/tramits/tramits-temes/Peticio-genericahyperlinktourl	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://aca-web.gencat.cat/acDAT	duca59d.rra.3.dr	false	Avira URL Cloud: safe	unknown
http://web.gencat.cat/ca/tramits/tramits-temes/Declaracio-de-lUs-i-la-Contaminacio-de-lAigua-DUCA?ca	duca59d.rra.3.dr	false	Avira URL Cloud: safe	unknown
http://aca-web.gencat.cat/sig/rest/INTERN/CERCADOR/MapServer//query?geometry=&DAT	duca474.rra.3.dr	false	Avira URL Cloud: safe	unknown
https://web.gencat.cat/ca/tramits/trDAT	duca59d.rra.3.dr	false	Avira URL Cloud: safe	unknown
https://web.gencat.cat/ca/tramits/tramits-temes/Peticio-genericahyperlinktourl	duca59d.rra.3.dr	false	Avira URL Cloud: safe	unknown
http://www.installengine.com/engine/	dataf6d8.rra.3.dr	false	Avira URL Cloud: safe	unknown
https://acanet.gencat.cat/geco/establiments/login.aspInternetgetcontextservice	duca59d.rra.3.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559466
Start date and time:	2024-11-20 15:19:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	int_duca.exe
Detection:	CLEAN
Classification:	clean9.winEXE@8/340@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 147 Number of non-executed functions: 274
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: int_duca.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe (copy)	ovXPH4wjBB.exe	Get hash	malicious	Unknown	Browse
	Lisect_AVT_24003_G1B_73.exe	Get hash	malicious	Unknown	Browse
	Lisect_AVT_24003_G1B_73.exe	Get hash	malicious	Unknown	Browse
	KcsSetup-WS.exe	Get hash	malicious	Unknown	Browse
	https://soft.emcon.ua/files/EmconZvitInstall.exe	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctoree5c.rra	ovXPH4wjBB.exe	Get hash	malicious	Unknown	Browse
	Lisect_AVT_24003_G1B_73.exe	Get hash	malicious	Unknown	Browse
	Lisect_AVT_24003_G1B_73.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Adware.GameVance.283.16569.357.exe	Get hash	malicious	Unknown	Browse
	KcsSetup-WS.exe	Get hash	malicious	Unknown	Browse
	https://soft.emcon.ua/files/EmconZvitInstall.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe (copy)

Process:	C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	614532
Entropy (8bit):	6.195803070094149
Encrypted:	false
SSDEEP:	6144:cTqa+rypBCk+Fx7/BCttXXikQklSn8nbFpBJkCcjalJ/M6HnpJpaijgBwTFg56lX:fr/SlSBUJjnNRjpTWamB4
MD5:	B3FD01873BD5FD163AB465779271C58F
SHA1:	E1FF9981A09AB025D69AC891BFC931A776294D4D
SHA-256:	985EB55ECB750DA812876B8569D5F1999A30A24BCC54F9BAB4D3FC44DFEDB931
SHA-512:	6674AB1D65DA9892B7DD2FD37F300E087F58239262D44505B53379C676FD16DA5443D2292AEAAE01D3E6C40960B12F9CAC651418C827D2A33C29A6CDF874BE43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: ovXPH4wjBB.exe, Detection: malicious, Browse Filename: Lisect_AVT_24003_G1B_73.exe, Detection: malicious, Browse Filename: Lisect_AVT_24003_G1B_73.exe, Detection: malicious, Browse Filename: KcsSetup-WS.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1"\.PL..PL..PL..L@..PL.?LB..PL.TOF..PL.TOG..PL..O_..PL..PL..PL..PM.oPL..s_..PL.CpF..PL.CpG..PL.{VJ..PL.Rich.PL.........................PE..L...lh@=........../...............................@..................................................................................................................................................................................................text...Z........................... ..`.rdata..`T.......`..................@..@.data...\.... ...P... ..............@....rsrc................p..............@..@........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\coreee4c.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28529
Entropy (8bit):	4.000373969114487
Encrypted:	false
SSDEEP:	384:2ERJ48bJNafWlc/n++TOa2SZ4+CIPo2S4m:2ER3JNaM+MJIPo27m
MD5:	62D5F9827D867EB3E4AB9E6B338348A1
SHA1:	828E72F9C845B1C0865BADAEF40D63FB36447293
SHA-256:	5214789C08EE573E904990DCD29E9E03AAF5CF12E86FAE368005FD8F4E371BD5
SHA-512:	B38BB74DC2E528C2A58A7D14A07BD1ECAAF55168B53AFC8F4718F3BF5D6F8C8B922B98551A355EBB1009F23CFF02FD8596413468993A43756C4DE7DFED573732
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	; Corecomp.ini..;..; This file stores information about files that InstallShield..; will install to the Windows\System folder, such as Windows..; 95 and NT 4.0 core components and DAO, ODBC, and ActiveX files...; ..; The entries have the following format, without a space before ..; or after the equal sign:..;..; <file name>=<properties>..; ..; Currently, following properties are supported:..; 0x00000000 No registry entry is created for this file. It is..; not logged for uninstallation, and is therefore ..; never removed...;..; Inappropriate modification to this file can prevent an..; application from getting Windows 95/Windows NT logo...;..; Last Updated: 12/8/1999; bn....[Win32]....12500852.CPX=0x00000000 ..12510866.CPX=0x00000000 ..12520437.cpx=0x00000000..12520850.cpx=0x00000000..12520860.CPX=0x00000000..12520861.CPX=0x00000000 ..12520863.CPX=0x00000000 ..12520865.CPX=0x00000000..82557ndi.dll=0x00000000..8514a.dll=0x00000000..95fiber.dll=0x000

C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctoree5c.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	5.420648120129751
Encrypted:	false
SSDEEP:	768:uj5UUtenZewInMM66FwMd21I1FNVBt3NogjISsK7phsfTkF0kN1usI5FrAg1OBoM:Q5PI9F6SCdNoe57phsgW7Ag8lj
MD5:	003A6C011AAC993BCDE8C860988CE49B
SHA1:	6D39D650DFA5DED45C4E0CB17B986893061104A7
SHA-256:	590BE865DDF8C8D0431D8F92AA3948CC3C1685FD0649D607776B81CD1E267D0A
SHA-512:	032ABA4403EB45646AA1413FDC6C5D08BAAB4D0306D20B4209E70C84E47F6B72E68457BBC4331A5F1A5FA44AA776A89EB9FD29D0D956FA2FE11364C26AB09EE7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: ovXPH4wjBB.exe, Detection: malicious, Browse Filename: Lisect_AVT_24003_G1B_73.exe, Detection: malicious, Browse Filename: Lisect_AVT_24003_G1B_73.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Adware.GameVance.283.16569.357.exe, Detection: malicious, Browse Filename: KcsSetup-WS.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9l..}..L}..L}..L...Ly..L.-.Lx..L}..Lx..L+..Lv..L}..L=..L$..Lt..L.-.L{..L...L\|..L.-.L\|..LRich}..L........PE..L.....;...........!.....p...........i.......................................0......................................@..........x........l................... ..........................................................4............................text....k.......p.................. ..`.rdata..'........ ..................@..@.data...............................@....rsrc....l.......p..................@..@.reloc....... ....... ..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuseee9a.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	176128
Entropy (8bit):	6.103238184891712
Encrypted:	false
SSDEEP:	3072:r+qN/OeBOZOptEHrOM/JUb1pZHYJvY6zsB7qAJy/Km1kUpbVxgr:5/bPtQxJUb1pdGQ6z73vzpbV6r
MD5:	377765FD4DE3912C0F814EE9F182FEDA
SHA1:	A0AB6A28F4BA057D5EAE5C223420EB599CD4D3B1
SHA-256:	8EFCBD8752D8BBFD7EE559502D1AA28134C9BF391BF7FC5CE6FDFD4473599AFB
SHA-512:	31BEFB11715F78043B7684287B4086CE003CB66F97C6EFF8C2B438EAE29045D8856172C6B898BE9F08C139EDC4647C2BCE000DA497AED208B7A5A69D4D90C710
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<`.]...]...]...A...]..yB...]...A...]..n}...]..yB...]...]...]...B...]...~...]...]..D]..n}...]..V[...]..n}...]..Rich.]..................PE..L.....;...........!.....p...@.......................................................................................................... .......................@.......................................................X............................text....m.......p.................. ..`.rdata...>.......@..................@..@.data....-....... ..................@....rsrc... ...........................@..@.reloc...$.......0..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\objeee9a.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	2.240898610474827
Encrypted:	false
SSDEEP:	192:Ec9t9ShCx1JQ5BoQZgTWPLnOBog5MOSiYp7e9MCMWnaaAyqX:EAxoVgTNk9sM9pE
MD5:	8F02B204853939F8AEFE6B07B283BE9A
SHA1:	C161B9374E67D5FA3066EA03FC861CC0023EB3CC
SHA-256:	32C6AD91DC66BC12E1273B1E13EB7A15D6E8F63B93447909CA2163DD21B22998
SHA-512:	8DF23B7D80A4DD32C484CA3BD1922E11938D7ECDA9FC5FD5045EED882054EFCA7B7131EA109C4F20D8279845FFEB50EF46FB7419D190B8CF307EB00168746E59
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?..hQ..hQ..hQ.Rt_..hQ..KB..hQ..hP..hQ..H[..hQ..nW..hQ..HU..hQ.Rich.hQ.........................PE..L.....;...........!.....0...@......p0.......@.......................................................................H.......C..<....`.......................p..h....................................................@...............................orpc...p........ .................. ..`.text...B....0.......0.............. ..`.rdata.......@.......@..............@..@.data...,....P.......P..............@....rsrc........`.......`..............@..@.reloc.......p.......p..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\temp.000

Process:	C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	614532
Entropy (8bit):	6.195803070094149
Encrypted:	false
SSDEEP:	6144:cTqa+rypBCk+Fx7/BCttXXikQklSn8nbFpBJkCcjalJ/M6HnpJpaijgBwTFg56lX:fr/SlSBUJjnNRjpTWamB4
MD5:	B3FD01873BD5FD163AB465779271C58F
SHA1:	E1FF9981A09AB025D69AC891BFC931A776294D4D
SHA-256:	985EB55ECB750DA812876B8569D5F1999A30A24BCC54F9BAB4D3FC44DFEDB931
SHA-512:	6674AB1D65DA9892B7DD2FD37F300E087F58239262D44505B53379C676FD16DA5443D2292AEAAE01D3E6C40960B12F9CAC651418C827D2A33C29A6CDF874BE43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1"\.PL..PL..PL..L@..PL.?LB..PL.TOF..PL.TOG..PL..O_..PL..PL..PL..PM.oPL..s_..PL.CpF..PL.CpG..PL.{VJ..PL.Rich.PL.........................PE..L...lh@=........../...............................@..................................................................................................................................................................................................text...Z........................... ..`.rdata..`T.......`..................@..@.data...\.... ...P... ..............@....rsrc................p..............@..@........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\InstallShield\IScript\iscreed9.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.172364662668933
Encrypted:	false
SSDEEP:	6144:v4cBIsIikn+3HUYzZ2HWrXzXdgASLB2X4X:v4cBI5X+kkkqjXdpX
MD5:	B2F7E6DC7E4AAE3147FBFC74A2DDB365
SHA1:	716301112706E93F85977D79F0E8F18F17FB32A7
SHA-256:	4F77A9018B6B0D41151366E9ACAB3397416D114FC895703DEB82B20F40116AD1
SHA-512:	E6AE396BD9B4F069B5FAFE135C0F83718CC236D1CF9007DB7305BD5442C86483C0F1E0FAD9CD6D547E8715278E23E6FAFA973C63EBBE998A31A2153DBBBE7F83
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.".~.L.~.L.~.L...@...L...B.d.L...F.-.L...G.l.L...F...L.~.L.{.L.(._.c.L.'._.u.L.~.M...L...G.q.L...J...L...H...L.Rich~.L.........................PE..L.....;...........!.....P... ...............`..............................................................................P........ .......................@...1...................................................`..X............................text...fJ.......P.................. ..`.rdata..T....`.......`..............@..@.data....!....... ..................@....rsrc........ ... ..................@..@.reloc...=...@...@...0..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\InstallShield\IScript\iscript.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.172364662668933
Encrypted:	false
SSDEEP:	6144:v4cBIsIikn+3HUYzZ2HWrXzXdgASLB2X4X:v4cBI5X+kkkqjXdpX
MD5:	B2F7E6DC7E4AAE3147FBFC74A2DDB365
SHA1:	716301112706E93F85977D79F0E8F18F17FB32A7
SHA-256:	4F77A9018B6B0D41151366E9ACAB3397416D114FC895703DEB82B20F40116AD1
SHA-512:	E6AE396BD9B4F069B5FAFE135C0F83718CC236D1CF9007DB7305BD5442C86483C0F1E0FAD9CD6D547E8715278E23E6FAFA973C63EBBE998A31A2153DBBBE7F83
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.".~.L.~.L.~.L...@...L...B.d.L...F.-.L...G.l.L...F...L.~.L.{.L.(._.c.L.'._.u.L.~.M...L...G.q.L...J...L...H...L.Rich~.L.........................PE..L.....;...........!.....P... ...............`..............................................................................P........ .......................@...1...................................................`..X............................text...fJ.......P.................. ..`.rdata..T....`.......`..............@..@.data....!....... ..................@....rsrc........ ... ..................@..@.reloc...=...@...@...0..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\corecomp.ini (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28529
Entropy (8bit):	4.000373969114487
Encrypted:	false
SSDEEP:	384:2ERJ48bJNafWlc/n++TOa2SZ4+CIPo2S4m:2ER3JNaM+MJIPo27m
MD5:	62D5F9827D867EB3E4AB9E6B338348A1
SHA1:	828E72F9C845B1C0865BADAEF40D63FB36447293
SHA-256:	5214789C08EE573E904990DCD29E9E03AAF5CF12E86FAE368005FD8F4E371BD5
SHA-512:	B38BB74DC2E528C2A58A7D14A07BD1ECAAF55168B53AFC8F4718F3BF5D6F8C8B922B98551A355EBB1009F23CFF02FD8596413468993A43756C4DE7DFED573732
Malicious:	false
Preview:	; Corecomp.ini..;..; This file stores information about files that InstallShield..; will install to the Windows\System folder, such as Windows..; 95 and NT 4.0 core components and DAO, ODBC, and ActiveX files...; ..; The entries have the following format, without a space before ..; or after the equal sign:..;..; <file name>=<properties>..; ..; Currently, following properties are supported:..; 0x00000000 No registry entry is created for this file. It is..; not logged for uninstallation, and is therefore ..; never removed...;..; Inappropriate modification to this file can prevent an..; application from getting Windows 95/Windows NT logo...;..; Last Updated: 12/8/1999; bn....[Win32]....12500852.CPX=0x00000000 ..12510866.CPX=0x00000000 ..12520437.cpx=0x00000000..12520850.cpx=0x00000000..12520860.CPX=0x00000000..12520861.CPX=0x00000000 ..12520863.CPX=0x00000000 ..12520865.CPX=0x00000000..82557ndi.dll=0x00000000..8514a.dll=0x00000000..95fiber.dll=0x000

C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	5.420648120129751
Encrypted:	false
SSDEEP:	768:uj5UUtenZewInMM66FwMd21I1FNVBt3NogjISsK7phsfTkF0kN1usI5FrAg1OBoM:Q5PI9F6SCdNoe57phsgW7Ag8lj
MD5:	003A6C011AAC993BCDE8C860988CE49B
SHA1:	6D39D650DFA5DED45C4E0CB17B986893061104A7
SHA-256:	590BE865DDF8C8D0431D8F92AA3948CC3C1685FD0649D607776B81CD1E267D0A
SHA-512:	032ABA4403EB45646AA1413FDC6C5D08BAAB4D0306D20B4209E70C84E47F6B72E68457BBC4331A5F1A5FA44AA776A89EB9FD29D0D956FA2FE11364C26AB09EE7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9l..}..L}..L}..L...Ly..L.-.Lx..L}..Lx..L+..Lv..L}..L=..L$..Lt..L.-.L{..L...L\|..L.-.L\|..LRich}..L........PE..L.....;...........!.....p...........i.......................................0......................................@..........x........l................... ..........................................................4............................text....k.......p.................. ..`.rdata..'........ ..................@..@.data...............................@....rsrc....l.......p..................@..@.reloc....... ....... ..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	176128
Entropy (8bit):	6.103238184891712
Encrypted:	false
SSDEEP:	3072:r+qN/OeBOZOptEHrOM/JUb1pZHYJvY6zsB7qAJy/Km1kUpbVxgr:5/bPtQxJUb1pdGQ6z73vzpbV6r
MD5:	377765FD4DE3912C0F814EE9F182FEDA
SHA1:	A0AB6A28F4BA057D5EAE5C223420EB599CD4D3B1
SHA-256:	8EFCBD8752D8BBFD7EE559502D1AA28134C9BF391BF7FC5CE6FDFD4473599AFB
SHA-512:	31BEFB11715F78043B7684287B4086CE003CB66F97C6EFF8C2B438EAE29045D8856172C6B898BE9F08C139EDC4647C2BCE000DA497AED208B7A5A69D4D90C710
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<`.]...]...]...A...]..yB...]...A...]..n}...]..yB...]...]...]...B...]...~...]...]..D]..n}...]..V[...]..n}...]..Rich.]..................PE..L.....;...........!.....p...@.......................................................................................................... .......................@.......................................................X............................text....m.......p.................. ..`.rdata...>.......@..................@..@.data....-....... ..................@....rsrc... ...........................@..@.reloc...$.......0..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	2.240898610474827
Encrypted:	false
SSDEEP:	192:Ec9t9ShCx1JQ5BoQZgTWPLnOBog5MOSiYp7e9MCMWnaaAyqX:EAxoVgTNk9sM9pE
MD5:	8F02B204853939F8AEFE6B07B283BE9A
SHA1:	C161B9374E67D5FA3066EA03FC861CC0023EB3CC
SHA-256:	32C6AD91DC66BC12E1273B1E13EB7A15D6E8F63B93447909CA2163DD21B22998
SHA-512:	8DF23B7D80A4DD32C484CA3BD1922E11938D7ECDA9FC5FD5045EED882054EFCA7B7131EA109C4F20D8279845FFEB50EF46FB7419D190B8CF307EB00168746E59
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?..hQ..hQ..hQ.Rt_..hQ..KB..hQ..hP..hQ..H[..hQ..nW..hQ..HU..hQ.Rich.hQ.........................PE..L.....;...........!.....0...@......p0.......@.......................................................................H.......C..<....`.......................p..h....................................................@...............................orpc...p........ .................. ..`.text...B....0.......0.............. ..`.rdata.......@.......@..............@..@.data...,....P.......P..............@....rsrc........`.......`..............@..@.reloc.......p.......p..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\InstallShield Installation Information\{E66DF05C-F85B-4711-A050-6A0F738964E0}\Setuf6f7.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	56320
Entropy (8bit):	6.027925766515646
Encrypted:	false
SSDEEP:	1536:ztsySvW1Xro1uNjEaJUJTmH90vK27leQE:ZMssQNxJUJTxvK27QQE
MD5:	1AEB989E361AF85F5099DE3DA25457F4
SHA1:	4F494142E3FB00C6D6845525CD4540BA3F7BE9EF
SHA-256:	AB9E0291A763EFC32E84E7117F9A0FBC99B681C96DF0BB27A66433A726667E5C
SHA-512:	0ECD71F3DEB154C8F48EC278822820F41AB15C6EFE76B00B8F6A95E28A62A97FBB8C44EB38293CAE3FE3A0FE29FEDBC660671885C4E3F7EB0016B6DBF3B4B273
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k.z..b)..b)..b)P.h)..b);.l)..b)Gh)..b)..b)..b)..q)..b)..c)..b).)q)..b)Gi)..b)..d)..b)Rich..b)........PE..L.....;.................t...d.......$............@.....................................................................................I...........................................................................................................text....r.......t.................. ..`.rdata..:............x..............@..@.data...............................@....rsrc....I.......J..................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\InstallShield Installation Information\{E66DF05C-F85B-4711-A050-6A0F738964E0}\Setuf707.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	155231
Entropy (8bit):	4.624418700390723
Encrypted:	false
SSDEEP:	1536:tzsCbI/bLpTA2UNsAjnNS6oNi4DZ3x7O7atCjrHJ7zKWIxvqefVjGpHrwOfEO3Z/:7seRIxiefVjMrwODyW
MD5:	39F1EF347EC7A2F5C8ADFD628A3099A8
SHA1:	26663992093E086C326113BEFBE83A4E0C646A29
SHA-256:	F14C041054253A00101E58BA63B8BFFF191EC6DD423F52A8A90622A14EE6E715
SHA-512:	B372F5DCF4E6B2935AC3FB71062546F2EF8B7AD98EF969FB946634F077C393E55AF833DC6239263F5A201DC68C139FC575A40F2CD5CB2FDB2201387A810A3140
Malicious:	false
Preview:	aLuZ..Copyright (c) 1990-1999 Stirling Technologies, Ltd. All Rights Reserved...........................\|............2...]..M...............................................................J................bWin95.....bWin9X.....bWin98.....bWinMe.....bSubversion_A.....bSubversion_B.....bSubversion_C.....bVersionNotFound.......bWinNT.....bWinNT4.....bWinNT351.....bWin2000.....bWinXP.....bAdmin_Logged_On.....nServicePack.......WINNT.....WIN9X.....bShellExplorer.....bAlpha.....bIntel.....nOSMajor.....nOSMinor.....nWinMajor.....nWinMinor.......int1.....int2.......dwEventType.....dwRestorePtType.....llSequenceNumber.@...szDescription.......nStatus.....llSequenceNumber.......nYearMonth.....nDay.....nHourMin.....nSeconds.......nOSVersionInfoSize.....nMajorVersion.....nMinorVersion.....nBuildNumber.....nPlatformId.....szCSDVersion.......nOSVersionInfoSize.....nMajorVersion.....nMinorVersion.....nuildNumber.....nPlatformId.....szCSDVersion.....nServicePackMajor.....nServicePackMinor.....nSuiteMas

C:\Program Files (x86)\InstallShield Installation Information\{E66DF05C-F85B-4711-A050-6A0F738964E0}\Setup.exe (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	56320
Entropy (8bit):	6.027925766515646
Encrypted:	false
SSDEEP:	1536:ztsySvW1Xro1uNjEaJUJTmH90vK27leQE:ZMssQNxJUJTxvK27QQE
MD5:	1AEB989E361AF85F5099DE3DA25457F4
SHA1:	4F494142E3FB00C6D6845525CD4540BA3F7BE9EF
SHA-256:	AB9E0291A763EFC32E84E7117F9A0FBC99B681C96DF0BB27A66433A726667E5C
SHA-512:	0ECD71F3DEB154C8F48EC278822820F41AB15C6EFE76B00B8F6A95E28A62A97FBB8C44EB38293CAE3FE3A0FE29FEDBC660671885C4E3F7EB0016B6DBF3B4B273
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k.z..b)..b)..b)P.h)..b);.l)..b)Gh)..b)..b)..b)..q)..b)..c)..b).)q)..b)Gi)..b)..d)..b)Rich..b)........PE..L.....;.................t...d.......$............@.....................................................................................I...........................................................................................................text....r.......t.................. ..`.rdata..:............x..............@..@.data...............................@....rsrc....I.......J..................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\InstallShield Installation Information\{E66DF05C-F85B-4711-A050-6A0F738964E0}\Setup.ini

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Generic INItialization configuration [Languages]
Category:	dropped
Size (bytes):	158
Entropy (8bit):	5.150185103513333
Encrypted:	false
SSDEEP:	3:3bn4db1VffzIhQsUrAVSWMGCVbYq/n6YfqLCYrYygZ5CcGZ:3bng1tmQJA4ygbYUzyLCNyW5fGZ
MD5:	541F948EE6F05F64E030D919889403C3
SHA1:	B5F368DD0BAA211AAD58457C85CA6A405D9FFFD4
SHA-256:	A52859B8F099393C524E652F0DB2ED764B893C30D86B04B8B5B6D156B082DCAE
SHA-512:	70975CD7DCDCADE8833DF91EA7B5CCC1FD1C9473FA46E864F0A6D0DAAC137A35FADB5D8814C807AEE5A9C9B3B7E6A5333C0608A8B718B679E3A5F6EEC7A7777B
Malicious:	false
Preview:	[Startup]..AppName=int_duca..ProductGUID=E66DF05C-F85B-4711-A050-6A0F738964E0..Engine=0..Copy=1..Source=0..[Languages]..Default=0x0009..count=1..key0=0x0009..

C:\Program Files (x86)\InstallShield Installation Information\{E66DF05C-F85B-4711-A050-6A0F738964E0}\data1.cab (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	467018
Entropy (8bit):	7.998576741017199
Encrypted:	true
SSDEEP:	12288:C2xBihWGDfPn06MOQQjn1AhO33ST6EuCWfcWeWgYwC:NxBihd46MLQhmO30bWfcW2Yl
MD5:	A4822CB09E2AECED8C7D286C10ACBE3E
SHA1:	527ECE471059332D3AA890C5D659A2E09996B1FF
SHA-256:	AB791C634DA455F464159450A8DA2C929EDFC90AE05212D1F9E11C6BA5BC711E
SHA-512:	9B9FCFE05D844F6A954135EA7F1F1361CF040F411E8177A8324A47E03970A47B048EB717774695E2F7DDA4E7D36CDD9B5957D1177B0541D9856BF53237AFDFE2
Malicious:	false
Preview:	ISc(.`.....................................................................................................................................................................................................................................................................................................................................................d.................................\.m.[..G.Pj.s.d......................'.I...i.6...<"..k.A.(..\.$1..R..@.M...a.r`.......................................................\.r"9.}....>..m....(.n.m0...8..P. ;..%.....V...f..8..P..R...h..z..+Y.w...._~....^.^.K.........QW.'...[6..^...(.r......K..E{..R../m....~.Q.^Q...?..A.{"\|......yo..]]\.$..K...1...............e.....T.i..G_xM..Z...f..v.;....k..^pB.^...b...=QD../..A...w.o.B.{+ +...?..\|...?.w`\|.:P....f.].'..pp..Q..^.wy.....-..W;...o...I.^...O.....^o..=...?......>.8.Yig.$=.fQ......U...2U....pi$^Sgz..u..iu...}.Hai.T.%...%}W~/Z...v*.$...@.........W..}.!..]....^........z.....7}6

C:\Program Files (x86)\InstallShield Installation Information\{E66DF05C-F85B-4711-A050-6A0F738964E0}\data1.hdr (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	34774
Entropy (8bit):	4.342563820396839
Encrypted:	false
SSDEEP:	384:aUHgH+WhsL7l3xDeGgQWGQlXENOoYyJ5H015zfTS:aUHgH+XPl3/PWmYNrS
MD5:	E633AEC9141C0EC605CC4B5423EB5728
SHA1:	87C7064CFD02A220FB2A62CA9234FBBD050D19B5
SHA-256:	C60BA909346B409DB885535BAAEC82552CED72A86F76DF3B22D997FD1BA02D28
SHA-512:	D59036A1D48666FED713FC980D47D223189A89F32D1738F3648AE0781FB0701364D6397A50EE346071F8932C3368BE432989F3BCE90060F234ECE641B87FDCF9
Malicious:	false
Preview:	ISc(.`..........G>........................................................................................................................................................................................................................................................................................................................................d.................................\.m.[..G.Pj.s.d......................'.I...i.6...<"..k.A.(..\.$1..R..@.M...a.r`.....................................................5..........G>.......G...G..................................Q..........,...,...............................,.......,...,.......,...............,...................,...................,.......................,.......-...-...-..........................................................7-..............C-..........O-......g-..............s-.......-...............-...........-...........-.......................-.......................-...-.......-.......................-...................-

C:\Program Files (x86)\InstallShield Installation Information\{E66DF05C-F85B-4711-A050-6A0F738964E0}\dataf6d8.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	34774
Entropy (8bit):	4.342563820396839
Encrypted:	false
SSDEEP:	384:aUHgH+WhsL7l3xDeGgQWGQlXENOoYyJ5H015zfTS:aUHgH+XPl3/PWmYNrS
MD5:	E633AEC9141C0EC605CC4B5423EB5728
SHA1:	87C7064CFD02A220FB2A62CA9234FBBD050D19B5
SHA-256:	C60BA909346B409DB885535BAAEC82552CED72A86F76DF3B22D997FD1BA02D28
SHA-512:	D59036A1D48666FED713FC980D47D223189A89F32D1738F3648AE0781FB0701364D6397A50EE346071F8932C3368BE432989F3BCE90060F234ECE641B87FDCF9
Malicious:	false
Preview:	ISc(.`..........G>........................................................................................................................................................................................................................................................................................................................................d.................................\.m.[..G.Pj.s.d......................'.I...i.6...<"..k.A.(..\.$1..R..@.M...a.r`.....................................................5..........G>.......G...G..................................Q..........,...,...............................,.......,...,.......,...............,...................,...................,.......................,.......-...-...-..........................................................7-..............C-..........O-......g-..............s-.......-...............-...........-...........-.......................-.......................-...-.......-.......................-...................-

C:\Program Files (x86)\InstallShield Installation Information\{E66DF05C-F85B-4711-A050-6A0F738964E0}\dataf6e7.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	467018
Entropy (8bit):	7.998576741017199
Encrypted:	true
SSDEEP:	12288:C2xBihWGDfPn06MOQQjn1AhO33ST6EuCWfcWeWgYwC:NxBihd46MLQhmO30bWfcW2Yl
MD5:	A4822CB09E2AECED8C7D286C10ACBE3E
SHA1:	527ECE471059332D3AA890C5D659A2E09996B1FF
SHA-256:	AB791C634DA455F464159450A8DA2C929EDFC90AE05212D1F9E11C6BA5BC711E
SHA-512:	9B9FCFE05D844F6A954135EA7F1F1361CF040F411E8177A8324A47E03970A47B048EB717774695E2F7DDA4E7D36CDD9B5957D1177B0541D9856BF53237AFDFE2
Malicious:	false
Preview:	ISc(.`.....................................................................................................................................................................................................................................................................................................................................................d.................................\.m.[..G.Pj.s.d......................'.I...i.6...<"..k.A.(..\.$1..R..@.M...a.r`.......................................................\.r"9.}....>..m....(.n.m0...8..P. ;..%.....V...f..8..P..R...h..z..+Y.w...._~....^.^.K.........QW.'...[6..^...(.r......K..E{..R../m....~.Q.^Q...?..A.{"\|......yo..]]\.$..K...1...............e.....T.i..G_xM..Z...f..v.;....k..^pB.^...b...=QD../..A...w.o.B.{+ +...?..\|...?.w`\|.:P....f.].'..pp..Q..^.wy.....-..W;...o...I.^...O.....^o..=...?......>.8.Yig.$=.fQ......U...2U....pi$^Sgz..u..iu...}.Hai.T.%...%}W~/Z...v*.$...@.........W..}.!..]....^........z.....7}6

C:\Program Files (x86)\InstallShield Installation Information\{E66DF05C-F85B-4711-A050-6A0F738964E0}\layof6d8.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	453
Entropy (8bit):	2.2189873329045167
Encrypted:	false
SSDEEP:	3:o/9taaRt/flIlWlNlhtpllGCl/yqww/l9lN/VVVVVVVV3El2pas2DpZnRXnyiSTg:o/9x1GWl3VDtewtV3QllXnHSTNULT9Fn
MD5:	D97F4CD84B88DEE5BC7E8D5219B1097A
SHA1:	4EEC7DC33A26A3907837B5892528BE982C1A2A02
SHA-256:	8765D453418674FACD4E702BD73ADC6FC046C54802C0F0E09E7BE6F7192B22A2
SHA-512:	8CCD5A1AEBB0C20F9EA362349BE8F04459ABEAD32DC797483CFE4D692264AE16320E8BAE1521D9EE5B93D35EBE05B4A5E2986C63879B8528B106B671A064B861
Malicious:	false
Preview:	c..R.@...................................................................................................................................................................................................................................................................... ...D...............h...s...}...........................r...r...r...r...r...r...r...r...r...SETUP.INI..Setup.exe.setup.bmp.Thumbs.db.ikernel.ex_.Setup.inx.data1.hdr.data1.cab.data2.cab.

C:\Program Files (x86)\InstallShield Installation Information\{E66DF05C-F85B-4711-A050-6A0F738964E0}\layout.bin (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	453
Entropy (8bit):	2.2189873329045167
Encrypted:	false
SSDEEP:	3:o/9taaRt/flIlWlNlhtpllGCl/yqww/l9lN/VVVVVVVV3El2pas2DpZnRXnyiSTg:o/9x1GWl3VDtewtV3QllXnHSTNULT9Fn
MD5:	D97F4CD84B88DEE5BC7E8D5219B1097A
SHA1:	4EEC7DC33A26A3907837B5892528BE982C1A2A02
SHA-256:	8765D453418674FACD4E702BD73ADC6FC046C54802C0F0E09E7BE6F7192B22A2
SHA-512:	8CCD5A1AEBB0C20F9EA362349BE8F04459ABEAD32DC797483CFE4D692264AE16320E8BAE1521D9EE5B93D35EBE05B4A5E2986C63879B8528B106B671A064B861
Malicious:	false
Preview:	c..R.@...................................................................................................................................................................................................................................................................... ...D...............h...s...}...........................r...r...r...r...r...r...r...r...r...SETUP.INI..Setup.exe.setup.bmp.Thumbs.db.ikernel.ex_.Setup.inx.data1.hdr.data1.cab.data2.cab.

C:\Program Files (x86)\InstallShield Installation Information\{E66DF05C-F85B-4711-A050-6A0F738964E0}\setup.ilg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	262656
Entropy (8bit):	2.7146005036435796
Encrypted:	false
SSDEEP:	3072:L6TL9kIP0HkharYV2UcOEr6OOErsgb6OOEr6OOE:
MD5:	241B20A08E16E706BEB17DF5F0B7F0B8
SHA1:	505B453E71455056B9BA46088A509F5532C9267B
SHA-256:	927FDBD19D3F40BE1A9D2DB86F14FF9E8DBA08300B235C5AE00FC82398E7E03D
SHA-512:	1D40FF52A8B9CAC4C54BC8D04E1F832CD32FCD990FA8939A835F972027020EA43F65BD04DC46328A49DEEAB7683108A555FB09FCCDF032A445070B9DFDEDB457
Malicious:	false
Preview:	......................>.......................................................}.......}...............................................................................................................................................................................................................................................................................................................................................................................................................................................".......................................................................................................$........... ...!...#...U...%.../...&...'...(...)...*...+...,...-.......C...B...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...X...G...D...E...F...T...W...I...J...K...L...M...N...O...P...Q...R...S.......V.......^...a...Y...Z...[...\...]......._...`...b...d...c.......n...f...g...h...i...j...k...l...m.......o...p...q...{...s...t...u...v...w...x...y...z...

C:\Users\Public\Desktop\e-DUCA.lnk

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Wed Nov 20 13:20:07 2024, mtime=Wed Nov 20 13:20:07 2024, atime=Thu Oct 17 17:13:52 2024, length=47616, window=hide
Category:	modified
Size (bytes):	1488
Entropy (8bit):	2.8984427373840904
Encrypted:	false
SSDEEP:	12:8i0L/CqKzI8ifdbBj7XgjA2rWvmrXYgFmLrlyZo+5l7mLRfBmV:8DLekfjz0AnvmDYKir+o+5BiRfBm
MD5:	E47363E0CFC73EB2F671E042C36A1C15
SHA1:	3E5092A888B8504E98A243A0DF276FBD4C5B6CA4
SHA-256:	9B6F80EEF24DD710C0D54B01F3BF381A82B0D43E413D44A735D888B9B2D1DF4A
SHA-512:	4732517997CF640AC0227763ABE73E4BE19C4B8D7B14F085E1AC37A77E9AE3BE2AEE0296A6528E58B8A59C19776F4611A71D68DBF55F8B375D1DC01BC35A4900
Malicious:	false
Preview:	L..................F.@.. ...Mk.LW;..Mk.LW;.....R. ...............................P.O. .:i.....+00.../C:\...................Z.1.....tY.r..int_duca..B......tY.rtY.r....\|:....................c.f.i.n.t._.d.u.c.a.....b.2.....QY.. .intduca.exe.H......tY.rtY.r.....C........................i.n.t.d.u.c.a...e.x.e.......F...............-.......E............5W......C:\int_duca\intduca.exe........\.....\.....\.i.n.t._.d.u.c.a.\.i.n.t.d.u.c.a...e.x.e...c.:.\.i.n.t._.d.u.c.a...c.:.\.i.n.t._.d.u.c.a.\.i.m.a.t.g.e.s.\.d.c.c.a.3.2.w...i.c.o.........%SystemDrive%\int_duca\imatges\dcca32w.ico..........................................................................................................................................................................................................................%.S.y.s.t.e.m.D.r.i.v.e.%.\.i.n.t._.d.u.c.a.\.i.m.a.t.g.e.s.\.d.c.c.a.3.2.w...i.c.o......................................................................................................................

C:\Users\user\AppData\Local\Temp\IECEBEB.tmp

Process:	C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe
File Type:	MS Compress archive data, SZDD variant, original size: 614532 bytes
Category:	dropped
Size (bytes):	346602
Entropy (8bit):	7.73908901473112
Encrypted:	false
SSDEEP:	6144:GnqCU025Do1BIFcsvbEfeqbnTdOJzEANlA9atuimsU7gaeaiNqltaBZv4fvxg:Aqw2qnQcs4bh+zxNeim79GqlQuK
MD5:	93B63F516482715A784BBEC3A0BF5F3A
SHA1:	2478FECA446576C33E96E708256D4C6C33E3FA68
SHA-256:	FBF95719B956B548B947436E29FEB18BB884E01F75AE31B05C030EBD76605249
SHA-512:	2C8F29DDA748E21231AB8C30C7A57735104B786120BB392EB1C20A320F2DDDDE392D136FD0C70853BB9AF851BBE47DF2955D8F9D5973B64870AC90BD12D2DD70
Malicious:	false
Preview:	SZDD..'3A..`...MZ......}.............@....................!..L.!T.his prog.ram cann.ot be ru.n in DOS. mode.....$...1"\..PL.t..L@.}.u.?LB..u..TOF...G.}.u..O_..u..u.M.ou..s._..u.CpF....G..u.{V.J..u.Rich.t.....PE..L....lh@=...../................/...........p%.%...6....#.......%.M.Z.K...........................).........te.xt..Z...%....l... ..`.r/data. T-.)..`"$....@..#..\.-. ....!N ~1+..rsrc..,........pV-....-.-.-.-.-.-.-.=..=-===M=]=m=}=.=..=.=.=.=.=.=.=.M..M-M=MMM]MmM}M.M..M.M.M.M.M.M.M.]..]-]=]M]]]m]}].]..].].].].].].].m..m-m=mMm]mmm}m.m..m.m.m.m.m.m.m.}..}-}=}M}]}m}}}.}..}.}.}.}.}.}.}.....-.=.M.].m.}....................-.=.M.].m.}....................-.=.M.].m.}....................-.=.M.].m.}....................-.=.M.].m.}....................-.=.M.].m.}....................-.=.M.].m.}....................-.=.M.].m.}................/.F........<SVW3.9.y..M.u...u..u.......u..].3..S..3.j.Q.PV.}..}...R.;........W.M.j._QV.P.0.....f.}..ul8...j.@.\|\|.E..j.P.M...." .E.

C:\Users\user\AppData\Local\Temp\ee0e.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	262656
Entropy (8bit):	2.7146005036435796
Encrypted:	false
SSDEEP:	3072:L6TL9kIP0HkharYV2UcOEr6OOErsgb6OOEr6OOE:
MD5:	241B20A08E16E706BEB17DF5F0B7F0B8
SHA1:	505B453E71455056B9BA46088A509F5532C9267B
SHA-256:	927FDBD19D3F40BE1A9D2DB86F14FF9E8DBA08300B235C5AE00FC82398E7E03D
SHA-512:	1D40FF52A8B9CAC4C54BC8D04E1F832CD32FCD990FA8939A835F972027020EA43F65BD04DC46328A49DEEAB7683108A555FB09FCCDF032A445070B9DFDEDB457
Malicious:	false
Preview:	......................>.......................................................}.......}...............................................................................................................................................................................................................................................................................................................................................................................................................................................".......................................................................................................$........... ...!...#...U...%.../...&...'...(...)...*...+...,...-.......C...B...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...X...G...D...E...F...T...W...I...J...K...L...M...N...O...P...Q...R...S.......V.......^...a...Y...Z...[...\...]......._...`...b...d...c.......n...f...g...h...i...j...k...l...m.......o...p...q...{...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\extE16C.tmp

Process:	C:\Users\user\Desktop\int_duca.exe
File Type:	Generic INItialization configuration [Dialog1001]
Category:	dropped
Size (bytes):	5248
Entropy (8bit):	4.900585489889706
Encrypted:	false
SSDEEP:	96:Kq2orCnavjFYCgENA3jOpAWaMd1ZcMeJgocuEaegn:KopxYuU2NaM9eJ4aegn
MD5:	9EFCC61A0BAA38A6D7C67A05A97C7B87
SHA1:	72B713A72EF7E972DFD5BE5F79DA8E9AACEDB296
SHA-256:	7CCB3A50CA08C66A220E4DA614CBABA1D05157359EDD174223C788B86D929EDF
SHA-512:	AC57100B76826AF9F7650417DD765C23B522E31A1F3B44BFE9E70ED520BF6C6EB1978118A8147C99487B05A7A4C4AFC964F457B79F921FF8236E4D60561B1238
Malicious:	false
Preview:	[Dialog1000]..100=Welcome to the InstallShield Wizard for %s..101=The InstallShield Wizard(TM) will help install %s on your computer. To continue, click Next.....[Dialog1001]..0=License Agreement..1=Please read the following license agreement carefully...121=I &accept the terms in the license agreement..122=I &do not accept the terms in the license agreement....[Dialog1002]..0=Location to Save Files..1=Where would you like to save your files?..101=Please enter the folder where you want these files saved. If the folder does not exist, it will be created for you. To continue, click Next...102=&Save files in folder:..103=&Change.......[Dialog1003]..0=Password..1=This package has been password protected...106=&Password:..107=Enter the password required to run this package. Please note that passwords are case sensitive. Click Next to continue.....[Dialog1004]..0=Overwrite Protection..2=Cancel..109=&Yes..110=&No..111=Y&es to All..112=N&o to All..113=The following file is already on yo

C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe

Process:	C:\Users\user\Desktop\int_duca.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	56320
Entropy (8bit):	6.027925766515646
Encrypted:	false
SSDEEP:	1536:ztsySvW1Xro1uNjEaJUJTmH90vK27leQE:ZMssQNxJUJTxvK27QQE
MD5:	1AEB989E361AF85F5099DE3DA25457F4
SHA1:	4F494142E3FB00C6D6845525CD4540BA3F7BE9EF
SHA-256:	AB9E0291A763EFC32E84E7117F9A0FBC99B681C96DF0BB27A66433A726667E5C
SHA-512:	0ECD71F3DEB154C8F48EC278822820F41AB15C6EFE76B00B8F6A95E28A62A97FBB8C44EB38293CAE3FE3A0FE29FEDBC660671885C4E3F7EB0016B6DBF3B4B273
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k.z..b)..b)..b)P.h)..b);.l)..b)Gh)..b)..b)..b)..q)..b)..c)..b).)q)..b)Gi)..b)..d)..b)Rich..b)........PE..L.....;.................t...d.......$............@.....................................................................................I...........................................................................................................text....r.......t.................. ..`.rdata..:............x..............@..@.data...............................@....rsrc....I.......J..................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.ini

Process:	C:\Users\user\Desktop\int_duca.exe
File Type:	Generic INItialization configuration [Languages]
Category:	dropped
Size (bytes):	130
Entropy (8bit):	5.179760960532288
Encrypted:	false
SSDEEP:	3:3bn4db1VffzIhQsUrAVSWMGCvCYrYygZ5CcGZ:3bng1tmQJA4yYCNyW5fGZ
MD5:	0787865C68019F333FB48021BA803870
SHA1:	1F51BFE155DCCA1B9AA1D21A29019731050CC953
SHA-256:	91A95645C9545BEC182C05030EB186F7029CDBDB4453554AD6E1E25A55A5420B
SHA-512:	2E32A8025E7713FB0AF9257502FDE0D24CF352245DD38023A7846B8FAF13CC00151D8BF045433FD57F24E455F0B48B58DF0F968C31E8E34EA8822022AC2F802A
Malicious:	false
Preview:	[Startup]..AppName=int_duca..ProductGUID=E66DF05C-F85B-4711-A050-6A0F738964E0..[Languages]..Default=0x0009..count=1..key0=0x0009..

C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Thumbs.db

Process:	C:\Users\user\Desktop\int_duca.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	7.198127691217499
Encrypted:	false
SSDEEP:	384:bFomIqXrryUXw9fvoXiWiHhsBMplly4F2:bFxIMrQ9f+ZiHhsqlly4
MD5:	A50E0A5E3A87697D6F9AEC0805A69E92
SHA1:	67E2E1725F66E1E3CE665F16EF6FFEC3E96FEA7D
SHA-256:	3D954DB87F2A1602DD648B8ECBCDBD8F10315486A11CD8CCED96595C8819C439
SHA-512:	6DEE802488A9B4D2022B0E5DF8C241AC968F7BB1889517FC637E4B401E16D40EFDE4815E343169DAF800B8D33E2C2B835283F886E641EE874493224758056E47
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\data1.cab

Process:	C:\Users\user\Desktop\int_duca.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	467018
Entropy (8bit):	7.998576741017199
Encrypted:	true
SSDEEP:	12288:C2xBihWGDfPn06MOQQjn1AhO33ST6EuCWfcWeWgYwC:NxBihd46MLQhmO30bWfcW2Yl
MD5:	A4822CB09E2AECED8C7D286C10ACBE3E
SHA1:	527ECE471059332D3AA890C5D659A2E09996B1FF
SHA-256:	AB791C634DA455F464159450A8DA2C929EDFC90AE05212D1F9E11C6BA5BC711E
SHA-512:	9B9FCFE05D844F6A954135EA7F1F1361CF040F411E8177A8324A47E03970A47B048EB717774695E2F7DDA4E7D36CDD9B5957D1177B0541D9856BF53237AFDFE2
Malicious:	false
Preview:	ISc(.`.....................................................................................................................................................................................................................................................................................................................................................d.................................\.m.[..G.Pj.s.d......................'.I...i.6...<"..k.A.(..\.$1..R..@.M...a.r`.......................................................\.r"9.}....>..m....(.n.m0...8..P. ;..%.....V...f..8..P..R...h..z..+Y.w...._~....^.^.K.........QW.'...[6..^...(.r......K..E{..R../m....~.Q.^Q...?..A.{"\|......yo..]]\.$..K...1...............e.....T.i..G_xM..Z...f..v.;....k..^pB.^...b...=QD../..A...w.o.B.{+ +...?..\|...?.w`\|.:P....f.].'..pp..Q..^.wy.....-..W;...o...I.^...O.....^o..=...?......>.8.Yig.$=.fQ......U...2U....pi$^Sgz..u..iu...}.Hai.T.%...%}W~/Z...v*.$...@.........W..}.!..]....^........z.....7}6

C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\data1.hdr

Process:	C:\Users\user\Desktop\int_duca.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	34774
Entropy (8bit):	4.342563820396839
Encrypted:	false
SSDEEP:	384:aUHgH+WhsL7l3xDeGgQWGQlXENOoYyJ5H015zfTS:aUHgH+XPl3/PWmYNrS
MD5:	E633AEC9141C0EC605CC4B5423EB5728
SHA1:	87C7064CFD02A220FB2A62CA9234FBBD050D19B5
SHA-256:	C60BA909346B409DB885535BAAEC82552CED72A86F76DF3B22D997FD1BA02D28
SHA-512:	D59036A1D48666FED713FC980D47D223189A89F32D1738F3648AE0781FB0701364D6397A50EE346071F8932C3368BE432989F3BCE90060F234ECE641B87FDCF9
Malicious:	false
Preview:	ISc(.`..........G>........................................................................................................................................................................................................................................................................................................................................d.................................\.m.[..G.Pj.s.d......................'.I...i.6...<"..k.A.(..\.$1..R..@.M...a.r`.....................................................5..........G>.......G...G..................................Q..........,...,...............................,.......,...,.......,...............,...................,...................,.......................,.......-...-...-..........................................................7-..............C-..........O-......g-..............s-.......-...............-...........-...........-.......................-.......................-...-.......-.......................-...................-

C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\data2.cab

Process:	C:\Users\user\Desktop\int_duca.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	25952228
Entropy (8bit):	7.996646311375413
Encrypted:	true
SSDEEP:	393216:Z98frT9E1VQv0swxy0okaKHROUgu5zwVijcKcHrSmQsBdYNhy6ox4UZMe/vAqmSA:g/yQ8rxHdXGqncLdBdYm6mYe/Iqm8e/f
MD5:	94CB6BF5ED9392CDA3C8C1AFF18520BD
SHA1:	42C9AE127D42F70F8B0A9F05418BEFEF8AC9D578
SHA-256:	6D1CA21CEE332BB3CD9AED26A5A6442E16C753F857006D4397F8AD1206A82812
SHA-512:	EB115081A7056CA2ED5DF01EEA3E4016412195A35927367EF7E69E75AEC8E5943AEB520C2989AFA0E2BE525FEB300B364E19931567AD41467F266C236C67C2F5
Malicious:	false
Preview:	ISc(.`.....................................................................................................................................................................................................................................................................................................................................................d.................................\.m.[..G.Pj.s.d......................'.I...i.6...<"..k.A.(..\.$1..R..@.M...a.r`....................................................".K./.TP5TP5..*JQ./V./.r..y...K.Sy....K./.TP5TP5....z..V.n.6../......r.mO.-.A.... i. 7J.I..H...z.~...)Z4....o.....6A...iuF./.~...n]../...D..R...8rXq}~....>P.1.>r$.`-......T.".4.c..A57.&.O.)J..kq-EN.%.......=...&,.....;G.......KWf%........2G.q.T.#b,=B2R~n.8..k7.8....I...5....W............<n.AV..:p.'....=..CB...O..?.n.:z....ga'.[.i.X.Xu....=$.6t..s.V..A...0@n[....AssK_.c.....@B.=.=rh...;...XRG_.(HA..C...._..$.<[.D.T.i.x..lw`..Gc%.c.d.X..yf..... .Kt.G..w...W..0Y..

C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\ikernel.ex_

Process:	C:\Users\user\Desktop\int_duca.exe
File Type:	MS Compress archive data, SZDD variant, original size: 614532 bytes
Category:	dropped
Size (bytes):	346602
Entropy (8bit):	7.73908901473112
Encrypted:	false
SSDEEP:	6144:GnqCU025Do1BIFcsvbEfeqbnTdOJzEANlA9atuimsU7gaeaiNqltaBZv4fvxg:Aqw2qnQcs4bh+zxNeim79GqlQuK
MD5:	93B63F516482715A784BBEC3A0BF5F3A
SHA1:	2478FECA446576C33E96E708256D4C6C33E3FA68
SHA-256:	FBF95719B956B548B947436E29FEB18BB884E01F75AE31B05C030EBD76605249
SHA-512:	2C8F29DDA748E21231AB8C30C7A57735104B786120BB392EB1C20A320F2DDDDE392D136FD0C70853BB9AF851BBE47DF2955D8F9D5973B64870AC90BD12D2DD70
Malicious:	false
Preview:	SZDD..'3A..`...MZ......}.............@....................!..L.!T.his prog.ram cann.ot be ru.n in DOS. mode.....$...1"\..PL.t..L@.}.u.?LB..u..TOF...G.}.u..O_..u..u.M.ou..s._..u.CpF....G..u.{V.J..u.Rich.t.....PE..L....lh@=...../................/...........p%.%...6....#.......%.M.Z.K...........................).........te.xt..Z...%....l... ..`.r/data. T-.)..`"$....@..#..\.-. ....!N ~1+..rsrc..,........pV-....-.-.-.-.-.-.-.=..=-===M=]=m=}=.=..=.=.=.=.=.=.=.M..M-M=MMM]MmM}M.M..M.M.M.M.M.M.M.]..]-]=]M]]]m]}].]..].].].].].].].m..m-m=mMm]mmm}m.m..m.m.m.m.m.m.m.}..}-}=}M}]}m}}}.}..}.}.}.}.}.}.}.....-.=.M.].m.}....................-.=.M.].m.}....................-.=.M.].m.}....................-.=.M.].m.}....................-.=.M.].m.}....................-.=.M.].m.}....................-.=.M.].m.}....................-.=.M.].m.}................/.F........<SVW3.9.y..M.u...u..u.......u..].3..S..3.j.Q.PV.}..}...R.;........W.M.j._QV.P.0.....f.}..ul8...j.@.\|\|.E..j.P.M...." .E.

C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\layout.bin

Process:	C:\Users\user\Desktop\int_duca.exe
File Type:	data
Category:	dropped
Size (bytes):	453
Entropy (8bit):	2.2189873329045167
Encrypted:	false
SSDEEP:	3:o/9taaRt/flIlWlNlhtpllGCl/yqww/l9lN/VVVVVVVV3El2pas2DpZnRXnyiSTg:o/9x1GWl3VDtewtV3QllXnHSTNULT9Fn
MD5:	D97F4CD84B88DEE5BC7E8D5219B1097A
SHA1:	4EEC7DC33A26A3907837B5892528BE982C1A2A02
SHA-256:	8765D453418674FACD4E702BD73ADC6FC046C54802C0F0E09E7BE6F7192B22A2
SHA-512:	8CCD5A1AEBB0C20F9EA362349BE8F04459ABEAD32DC797483CFE4D692264AE16320E8BAE1521D9EE5B93D35EBE05B4A5E2986C63879B8528B106B671A064B861
Malicious:	false
Preview:	c..R.@...................................................................................................................................................................................................................................................................... ...D...............h...s...}...........................r...r...r...r...r...r...r...r...r...SETUP.INI..Setup.exe.setup.bmp.Thumbs.db.ikernel.ex_.Setup.inx.data1.hdr.data1.cab.data2.cab.

C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\setup.bmp

Process:	C:\Users\user\Desktop\int_duca.exe
File Type:	PC bitmap, Windows 3.x format, 520 x 316 x 24, image size 492960, resolution 3780 x 3780 px/m, cbSize 493014, bits offset 54
Category:	dropped
Size (bytes):	493014
Entropy (8bit):	2.300410574745245
Encrypted:	false
SSDEEP:	1536:beR/++5LxTVjp4m8YSqz386TDdpHKmDRP1Ze7L0sTqk8k:
MD5:	62EA03AE325B99D9BF7012E7BEABD05A
SHA1:	DE83E1BF3FEA73752B942C447334096FA8DDE590
SHA-256:	850E208BDB96010A5A6423089EFE2B8F1E71FA3E2CC5909E6179132BBB678C49
SHA-512:	BA8D9A372C476E26D4138DC871ECEDF50729CCF12112BB0CD6B904153498944D336F5D415E60CE16909A7A105081B817C21379B7164C918E13BF719762C68DAA
Malicious:	false
Preview:	BM.......6...(.......<.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\setup.inx

Process:	C:\Users\user\Desktop\int_duca.exe
File Type:	data
Category:	dropped
Size (bytes):	155231
Entropy (8bit):	4.624418700390723
Encrypted:	false
SSDEEP:	1536:tzsCbI/bLpTA2UNsAjnNS6oNi4DZ3x7O7atCjrHJ7zKWIxvqefVjGpHrwOfEO3Z/:7seRIxiefVjMrwODyW
MD5:	39F1EF347EC7A2F5C8ADFD628A3099A8
SHA1:	26663992093E086C326113BEFBE83A4E0C646A29
SHA-256:	F14C041054253A00101E58BA63B8BFFF191EC6DD423F52A8A90622A14EE6E715
SHA-512:	B372F5DCF4E6B2935AC3FB71062546F2EF8B7AD98EF969FB946634F077C393E55AF833DC6239263F5A201DC68C139FC575A40F2CD5CB2FDB2201387A810A3140
Malicious:	false
Preview:	aLuZ..Copyright (c) 1990-1999 Stirling Technologies, Ltd. All Rights Reserved...........................\|............2...]..M...............................................................J................bWin95.....bWin9X.....bWin98.....bWinMe.....bSubversion_A.....bSubversion_B.....bSubversion_C.....bVersionNotFound.......bWinNT.....bWinNT4.....bWinNT351.....bWin2000.....bWinXP.....bAdmin_Logged_On.....nServicePack.......WINNT.....WIN9X.....bShellExplorer.....bAlpha.....bIntel.....nOSMajor.....nOSMinor.....nWinMajor.....nWinMinor.......int1.....int2.......dwEventType.....dwRestorePtType.....llSequenceNumber.@...szDescription.......nStatus.....llSequenceNumber.......nYearMonth.....nDay.....nHourMin.....nSeconds.......nOSVersionInfoSize.....nMajorVersion.....nMinorVersion.....nBuildNumber.....nPlatformId.....szCSDVersion.......nOSVersionInfoSize.....nMajorVersion.....nMinorVersion.....nuildNumber.....nPlatformId.....szCSDVersion.....nServicePackMajor.....nServicePackMinor.....nSuiteMas

C:\Users\user\AppData\Local\Temp\pftE20A.tmp\pftw1.pkg

Process:	C:\Users\user\Desktop\int_duca.exe
File Type:	Microsoft Cabinet archive data, many, 26606621 bytes, 10 files, at 0x2c +A "\Disk1\data1.cab" +A "\Disk1\data1.hdr", ID 12345, number 1, 840 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	26606621
Entropy (8bit):	7.999072651991398
Encrypted:	true
SSDEEP:	786432:BKgjJ9zT7WEroyQQjISBqdS4uUyMckWF7N81g2:LH9N9BbdjkWxN52
MD5:	87EC4A7C043FA5A78989989C2EFB8B58
SHA1:	7454F7C775E542E4F6F0DF904D1D0143C8375A16
SHA-256:	46342848B8DBA5EAA9994F0E55EA87C1472A2BAE9F4BB360EAFACB576492BC61
SHA-512:	64E46B39EF2183E0610B4E634B3C963D5429513A5C55ECCC313C31613BAD6439589B9D4DDF93AD97B4D74A8B942461D63D9F2E3E3984EDE63DE992812A8D8B75
Malicious:	false
Preview:	MSCF............,...............90..y...H...J ........RY.n .\Disk1\data1.cab....J ....RY.n .\Disk1\data1.hdr..... .....RY.n .\Disk1\data2.cab..I.........6.h .\Disk1\ikernel.ex_..........RY.n .\Disk1\layout.bin..........T.e .\Disk1\setup.bmp......y....%+." .\Disk1\Setup.exe......U....RY.n .\Disk1\Setup.ini._^...V....RY.n .\Disk1\setup.inx..>..j......T.e .\Disk1\Thumbs.db....r~..CK.S.0@.%xm.m..m.m.m.m........d.yO.s..tw..J:-.dD......_......?......\|.0.....e.....;.x..%.S....<..Y..A. ...`....].CT4k.$XE...}F..x.X.$.#[.3bP._..a.sh..[.D..>y...\|.C6.........K6.....i..T)..%...WWs.....u.../.-..i5S..Qy.G....n.5.Wz..}=3.a...+....K....j...Zl.......=k..Kg1t..^....o.6O...M......)......^D.eKkmE...v..::.$-{.;U.....OK.=e.;.a.}y&.-.7.%Q.#.0..z.;.Q.-=..S...k.1g..V.e...B.........."'[.+[..=.n.v.B.^....g....'.q...}n....\...a..:.........'...un....KW...j..~v...E....T..r;..%Q.vh..+.c...=..7\|...q..f.$.9...~._.`I .L5.Qq.s...$.Jf.....'...K?>/.....A..[.>j.....T.$.q..M.Go~.P..j{.

C:\Users\user\AppData\Local\Temp\plfE16B.tmp

Process:	C:\Users\user\Desktop\int_duca.exe
File Type:	Generic INItialization configuration [Dialog1001]
Category:	dropped
Size (bytes):	5248
Entropy (8bit):	4.900585489889706
Encrypted:	false
SSDEEP:	96:Kq2orCnavjFYCgENA3jOpAWaMd1ZcMeJgocuEaegn:KopxYuU2NaM9eJ4aegn
MD5:	9EFCC61A0BAA38A6D7C67A05A97C7B87
SHA1:	72B713A72EF7E972DFD5BE5F79DA8E9AACEDB296
SHA-256:	7CCB3A50CA08C66A220E4DA614CBABA1D05157359EDD174223C788B86D929EDF
SHA-512:	AC57100B76826AF9F7650417DD765C23B522E31A1F3B44BFE9E70ED520BF6C6EB1978118A8147C99487B05A7A4C4AFC964F457B79F921FF8236E4D60561B1238
Malicious:	false
Preview:	[Dialog1000]..100=Welcome to the InstallShield Wizard for %s..101=The InstallShield Wizard(TM) will help install %s on your computer. To continue, click Next.....[Dialog1001]..0=License Agreement..1=Please read the following license agreement carefully...121=I &accept the terms in the license agreement..122=I &do not accept the terms in the license agreement....[Dialog1002]..0=Location to Save Files..1=Where would you like to save your files?..101=Please enter the folder where you want these files saved. If the folder does not exist, it will be created for you. To continue, click Next...102=&Save files in folder:..103=&Change.......[Dialog1003]..0=Password..1=This package has been password protected...106=&Password:..107=Enter the password required to run this package. Please note that passwords are case sensitive. Click Next to continue.....[Dialog1004]..0=Overwrite Protection..2=Cancel..109=&Yes..110=&No..111=Y&es to All..112=N&o to All..113=The following file is already on yo

C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\_IsRes.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	258048
Entropy (8bit):	5.801916805215816
Encrypted:	false
SSDEEP:	3072:TXRZKyskkkkknffCp5CrRb9YfMX0E9QsJB9cWe7Ka2c2DRJMn2b:ThzskkkkknffCp5CrRKluaqL
MD5:	48EA604D4FA7D9AF5B121C04DB6A2FEC
SHA1:	DC3C04977106BC1FBF1776A6B27899D7B81FB937
SHA-256:	CBE8127704F36ADCC6ADBAB60DF55D1FF8FB7E600F1337FB9C4A59644BA7AA2B
SHA-512:	9206A1235CE6BD8CEDA0FF80FC01842E9CBBEB16267B4A875A0F1E6EA202FD4CBD1A52F8A51BED35A2B38252EB2B2CD2426DC7D24B1EA715203CC0935D612707
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9...W...W...W.&.\...W.&.]...W.M.Y...W...V...W...D...W.1.]...W...Q...W.Rich..W.................PE..L.....;...........!.....0...................@...............................................................................D..(....`...w...........................................................................@...............................text....*.......0.................. ..`.rdata.......@.......@..............@..@.data........P.......P..............@....rsrc....w...`.......`..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\_IsRf0ec.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	258048
Entropy (8bit):	5.801916805215816
Encrypted:	false
SSDEEP:	3072:TXRZKyskkkkknffCp5CrRb9YfMX0E9QsJB9cWe7Ka2c2DRJMn2b:ThzskkkkknffCp5CrRKluaqL
MD5:	48EA604D4FA7D9AF5B121C04DB6A2FEC
SHA1:	DC3C04977106BC1FBF1776A6B27899D7B81FB937
SHA-256:	CBE8127704F36ADCC6ADBAB60DF55D1FF8FB7E600F1337FB9C4A59644BA7AA2B
SHA-512:	9206A1235CE6BD8CEDA0FF80FC01842E9CBBEB16267B4A875A0F1E6EA202FD4CBD1A52F8A51BED35A2B38252EB2B2CD2426DC7D24B1EA715203CC0935D612707
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9...W...W...W.&.\...W.&.]...W.M.Y...W...V...W...D...W.1.]...W...Q...W.Rich..W.................PE..L.....;...........!.....0...................@...............................................................................D..(....`...w...........................................................................@...............................text....*.......0.................. ..`.rdata.......@.......@..............@..@.data........P.......P..............@....rsrc....w...`.......`..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\defaf0dc.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	RIFF (little-endian) data, palette, 1168 bytes, data size 1028, 256 entries, extra bytes 0x6f66666c
Category:	dropped
Size (bytes):	1168
Entropy (8bit):	2.551387347019812
Encrypted:	false
SSDEEP:	12:b126a96IlDkYTYcspSuB0MRG763GDwFGrZYOFBz3WI7KEpw3f6QL7nhem:Ax96Il9T3ISMg76KJrZtT2b5X
MD5:	0ABAFE3F69D053494405061DE2629C82
SHA1:	E414B6F1E9EB416B9895012D24110B844F9F56D1
SHA-256:	8075162DB275EB52F5D691B15FC0D970CB007F5BECE33CE5DB509EDF51C1F020
SHA-512:	63448F2BEF338EA44F3BF9EF35E594EF94B4259F3B2595D77A836E872129B879CEF912E23CF48421BABF1208275E21DA1FABFDC494958BCFCD391C78308EAA27
Malicious:	false
Preview:	RIFF....PAL data..........................................................f...3..............f...3...................f...3......f...f...f...ff..f3..f...3...3...3...3f..33..3............f...3...............f...3..................f...3...............f..3.....f...f...f...ff..f3..f...3...3...3...3f..33..3................f...3...................f...3..................f...3...................f...3......f...f...f...ff..f3..f...3...3...3...3f..33..3................f...3.....f...f...f...f.f.f.3.f...f...f...f..f.f.f.3.f...f...f...f...f.i.f.3.f...ff..ff..ff..fff.ff3.ff..f3..f3..f3..f3f.f33.f3..f...f...f...f.f.f.3.f...3...3...3...3.f.3.3.3...3...3...3..3.f.3.3.3...3...3...3...3.f.3.3.3...3f..3f..3f..3ff.3f3.3f..33..33..33..33f.333.33..3...3...3...3.f.3.3.3.............f...3..............f...3...................f...3......f...f...f...ff..f3..f...3...3...3...3f..33..3............f...3.........................................................................................................

C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\default.pal (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	RIFF (little-endian) data, palette, 1168 bytes, data size 1028, 256 entries, extra bytes 0x6f66666c
Category:	dropped
Size (bytes):	1168
Entropy (8bit):	2.551387347019812
Encrypted:	false
SSDEEP:	12:b126a96IlDkYTYcspSuB0MRG763GDwFGrZYOFBz3WI7KEpw3f6QL7nhem:Ax96Il9T3ISMg76KJrZtT2b5X
MD5:	0ABAFE3F69D053494405061DE2629C82
SHA1:	E414B6F1E9EB416B9895012D24110B844F9F56D1
SHA-256:	8075162DB275EB52F5D691B15FC0D970CB007F5BECE33CE5DB509EDF51C1F020
SHA-512:	63448F2BEF338EA44F3BF9EF35E594EF94B4259F3B2595D77A836E872129B879CEF912E23CF48421BABF1208275E21DA1FABFDC494958BCFCD391C78308EAA27
Malicious:	false
Preview:	RIFF....PAL data..........................................................f...3..............f...3...................f...3......f...f...f...ff..f3..f...3...3...3...3f..33..3............f...3...............f...3..................f...3...............f..3.....f...f...f...ff..f3..f...3...3...3...3f..33..3................f...3...................f...3..................f...3...................f...3......f...f...f...ff..f3..f...3...3...3...3f..33..3................f...3.....f...f...f...f.f.f.3.f...f...f...f..f.f.f.3.f...f...f...f...f.i.f.3.f...ff..ff..ff..fff.ff3.ff..f3..f3..f3..f3f.f33.f3..f...f...f...f.f.f.3.f...3...3...3...3.f.3.3.3...3...3...3..3.f.3.3.3...3...3...3...3.f.3.3.3...3f..3f..3f..3ff.3f3.3f..33..33..33..33f.333.33..3...3...3...3.f.3.3.3.............f...3..............f...3...................f...3......f...f...f...ff..f3..f...3...3...3...3f..33..3............f...3.........................................................................................................

C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\isrt.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	331776
Entropy (8bit):	6.377016902367252
Encrypted:	false
SSDEEP:	6144:KzbdBEFj2WevDaaf4SUANAV+sckpp/+oZO2qwZ1YN3jWo5KDjr73rgE0:oBEAH33AVnpRoO1pWK/PbgE
MD5:	61C056D2DF7AB769D6FD801869B828A9
SHA1:	4213D0395692FA4181483FFB04EEF4BDA22CCEEE
SHA-256:	148D8F53BBA9A8D5558B192FB4919A5B0D9CB7FD9F8E481660F8667DE4E89B66
SHA-512:	A2DA2558C44E80973BADC2E5F283CEC254A12DFBCC66C352C8F394E03B1E50F98551303EAB6F7995AC4AFD5A503BD29B690D778B0526233EFC781695ED9E9172
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+.-.osC.osC.osC..oO.lsC..oM.tsC.lI..sC.lH.}sC.SI.jsC.osC.lsC.9lP.zsC.6PP.\|sC.osB.}rC.SH.CsC.uE.nsC.SG.nsC.RichosC.........PE..L...s.;...........!.........`...............................................0......................................pd......XM..................................H:......................................................l............................text............................... ..`.rdata..............................@..@.data....J.......0..................@....rsrc...............................@..@.reloc.. H.......P..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\isrtf0bd.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	331776
Entropy (8bit):	6.377016902367252
Encrypted:	false
SSDEEP:	6144:KzbdBEFj2WevDaaf4SUANAV+sckpp/+oZO2qwZ1YN3jWo5KDjr73rgE0:oBEAH33AVnpRoO1pWK/PbgE
MD5:	61C056D2DF7AB769D6FD801869B828A9
SHA1:	4213D0395692FA4181483FFB04EEF4BDA22CCEEE
SHA-256:	148D8F53BBA9A8D5558B192FB4919A5B0D9CB7FD9F8E481660F8667DE4E89B66
SHA-512:	A2DA2558C44E80973BADC2E5F283CEC254A12DFBCC66C352C8F394E03B1E50F98551303EAB6F7995AC4AFD5A503BD29B690D778B0526233EFC781695ED9E9172
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+.-.osC.osC.osC..oO.lsC..oM.tsC.lI..sC.lH.}sC.SI.jsC.osC.lsC.9lP.zsC.6PP.\|sC.osB.}rC.SH.CsC.uE.nsC.SG.nsC.RichosC.........PE..L...s.;...........!.........`...............................................0......................................pd......XM..................................H:......................................................l............................text............................... ..`.rdata..............................@..@.data....J.......0..................@....rsrc...............................@..@.reloc.. H.......P..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\setuf050.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	155231
Entropy (8bit):	4.624418700390723
Encrypted:	false
SSDEEP:	1536:tzsCbI/bLpTA2UNsAjnNS6oNi4DZ3x7O7atCjrHJ7zKWIxvqefVjGpHrwOfEO3Z/:7seRIxiefVjMrwODyW
MD5:	39F1EF347EC7A2F5C8ADFD628A3099A8
SHA1:	26663992093E086C326113BEFBE83A4E0C646A29
SHA-256:	F14C041054253A00101E58BA63B8BFFF191EC6DD423F52A8A90622A14EE6E715
SHA-512:	B372F5DCF4E6B2935AC3FB71062546F2EF8B7AD98EF969FB946634F077C393E55AF833DC6239263F5A201DC68C139FC575A40F2CD5CB2FDB2201387A810A3140
Malicious:	false
Preview:	aLuZ..Copyright (c) 1990-1999 Stirling Technologies, Ltd. All Rights Reserved...........................\|............2...]..M...............................................................J................bWin95.....bWin9X.....bWin98.....bWinMe.....bSubversion_A.....bSubversion_B.....bSubversion_C.....bVersionNotFound.......bWinNT.....bWinNT4.....bWinNT351.....bWin2000.....bWinXP.....bAdmin_Logged_On.....nServicePack.......WINNT.....WIN9X.....bShellExplorer.....bAlpha.....bIntel.....nOSMajor.....nOSMinor.....nWinMajor.....nWinMinor.......int1.....int2.......dwEventType.....dwRestorePtType.....llSequenceNumber.@...szDescription.......nStatus.....llSequenceNumber.......nYearMonth.....nDay.....nHourMin.....nSeconds.......nOSVersionInfoSize.....nMajorVersion.....nMinorVersion.....nBuildNumber.....nPlatformId.....szCSDVersion.......nOSVersionInfoSize.....nMajorVersion.....nMinorVersion.....nuildNumber.....nPlatformId.....szCSDVersion.....nServicePackMajor.....nServicePackMinor.....nSuiteMas

C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\setup.inx (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	155231
Entropy (8bit):	4.624418700390723
Encrypted:	false
SSDEEP:	1536:tzsCbI/bLpTA2UNsAjnNS6oNi4DZ3x7O7atCjrHJ7zKWIxvqefVjGpHrwOfEO3Z/:7seRIxiefVjMrwODyW
MD5:	39F1EF347EC7A2F5C8ADFD628A3099A8
SHA1:	26663992093E086C326113BEFBE83A4E0C646A29
SHA-256:	F14C041054253A00101E58BA63B8BFFF191EC6DD423F52A8A90622A14EE6E715
SHA-512:	B372F5DCF4E6B2935AC3FB71062546F2EF8B7AD98EF969FB946634F077C393E55AF833DC6239263F5A201DC68C139FC575A40F2CD5CB2FDB2201387A810A3140
Malicious:	false
Preview:	aLuZ..Copyright (c) 1990-1999 Stirling Technologies, Ltd. All Rights Reserved...........................\|............2...]..M...............................................................J................bWin95.....bWin9X.....bWin98.....bWinMe.....bSubversion_A.....bSubversion_B.....bSubversion_C.....bVersionNotFound.......bWinNT.....bWinNT4.....bWinNT351.....bWin2000.....bWinXP.....bAdmin_Logged_On.....nServicePack.......WINNT.....WIN9X.....bShellExplorer.....bAlpha.....bIntel.....nOSMajor.....nOSMinor.....nWinMajor.....nWinMinor.......int1.....int2.......dwEventType.....dwRestorePtType.....llSequenceNumber.@...szDescription.......nStatus.....llSequenceNumber.......nYearMonth.....nDay.....nHourMin.....nSeconds.......nOSVersionInfoSize.....nMajorVersion.....nMinorVersion.....nBuildNumber.....nPlatformId.....szCSDVersion.......nOSVersionInfoSize.....nMajorVersion.....nMinorVersion.....nuildNumber.....nPlatformId.....szCSDVersion.....nServicePackMajor.....nServicePackMinor.....nSuiteMas

C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\value.shl (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Generic INItialization configuration [Data]
Category:	dropped
Size (bytes):	689
Entropy (8bit):	5.474407114724194
Encrypted:	false
SSDEEP:	12:1M8UyN/D8FrPrwar96AAuJ0ECFiKBRfmz03hAXLD27XF2hhZ0SXs1upGdeM0GAy:1MZ9JAuJ9CLBtmz04LD2TArZNuupQP9
MD5:	F1B36845AAD8E21B2E52F4EC97562B96
SHA1:	FBF236A6F22371F19407D29CB571EFDF671DBEC2
SHA-256:	C08A426E66C3EE36A65ED303399183207877968B5FB18101A872E06FAEE215C6
SHA-512:	1C1E7096E8FDADAA9DF6B784D81C873F329FE9F8DB06128D614A176EA8150A53F2C5AA13C32BD644CCCB852938FC96E63C2D423FCA85087B91DA132F9A0DFFDC
Malicious:	false
Preview:	[General]..Type=STRINGTABLESPECIFIC..Version=1.00.000..Language=0009....[Data]..ERROR_VGARESOLUTION=This program requires VGA or better resolution...TITLE_MAIN=e-DUCA..TITLE_CAPTIONBAR=int_duca Setup..UNINST_KEY=e-DUCA..UNINST_DISPLAY_NAME=e-DUCA..COMPANY_NAME=Ag.ncia Catalana de l'Aigua..PRODUCT_NAME=e-DUCA..PRODUCT_VERSION=1.00.000..PRODUCT_KEY=intduca.exe..ERROR_MOVEDATA=An error occurred during the move data process: %d..ERROR_UNINSTSETUP=unInstaller setup failed to initialize. You may not be able to uninstall this product...COMPANY_NAME16=Company..PRODUCT_NAME16=Product..ERROR_COMPONENT=Component:..ERROR_FILEGROUP=File Group:..ERROR_FILE=File:..DIRSYS=c:\windows\system32....

C:\Users\user\AppData\Local\Temp\{E66DF05C-F85B-4711-A050-6A0F738964E0}\valuf09e.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Generic INItialization configuration [Data]
Category:	dropped
Size (bytes):	689
Entropy (8bit):	5.474407114724194
Encrypted:	false
SSDEEP:	12:1M8UyN/D8FrPrwar96AAuJ0ECFiKBRfmz03hAXLD27XF2hhZ0SXs1upGdeM0GAy:1MZ9JAuJ9CLBtmz04LD2TArZNuupQP9
MD5:	F1B36845AAD8E21B2E52F4EC97562B96
SHA1:	FBF236A6F22371F19407D29CB571EFDF671DBEC2
SHA-256:	C08A426E66C3EE36A65ED303399183207877968B5FB18101A872E06FAEE215C6
SHA-512:	1C1E7096E8FDADAA9DF6B784D81C873F329FE9F8DB06128D614A176EA8150A53F2C5AA13C32BD644CCCB852938FC96E63C2D423FCA85087B91DA132F9A0DFFDC
Malicious:	false
Preview:	[General]..Type=STRINGTABLESPECIFIC..Version=1.00.000..Language=0009....[Data]..ERROR_VGARESOLUTION=This program requires VGA or better resolution...TITLE_MAIN=e-DUCA..TITLE_CAPTIONBAR=int_duca Setup..UNINST_KEY=e-DUCA..UNINST_DISPLAY_NAME=e-DUCA..COMPANY_NAME=Ag.ncia Catalana de l'Aigua..PRODUCT_NAME=e-DUCA..PRODUCT_VERSION=1.00.000..PRODUCT_KEY=intduca.exe..ERROR_MOVEDATA=An error occurred during the move data process: %d..ERROR_UNINSTSETUP=unInstaller setup failed to initialize. You may not be able to uninstall this product...COMPANY_NAME16=Company..PRODUCT_NAME16=Product..ERROR_COMPONENT=Component:..ERROR_FILEGROUP=File Group:..ERROR_FILE=File:..DIRSYS=c:\windows\system32....

C:\int_duca\Consf764.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	27
Entropy (8bit):	3.884155094595805
Encrypted:	false
SSDEEP:	3:LSI88Wn:/Wn
MD5:	085963D5D297A1663783E37A353CD7B1
SHA1:	F0CCF14C25DDB8C2032589103B7F81A05754AC24
SHA-256:	81243FE1346D5D841577E2BCC2B94529012B3EE1790E5F773A77FA7D3FA9FDC6
SHA-512:	5B5572A97F11B406B12AECF4609C1E9CD83D904C8D524012A9A2E8AD43F0BBB2C155934EB6D2A9954D17FDCC820C132CDAAE7114BEE401921C11663F050CB023
Malicious:	false
Preview:	ren %1.mdb %2.mdb..exit....

C:\int_duca\Duca35b.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Microsoft Access Database
Category:	dropped
Size (bytes):	1146880
Entropy (8bit):	2.1435288681955518
Encrypted:	false
SSDEEP:	3072:q1AmJVBwsMjy/wdVS9GA43zhGvaC7F4X6FAX+3SpWRUQyQVcx+KIa/pbUKhFWxct:hmJHwsMjy/wU7tUV
MD5:	096173E527C7D0EC2A840A36669BEB8D
SHA1:	601AABB86146D80C799B21822F9EAE307FCE1571
SHA-256:	87A4AE5AF8FC71E79E6BECF13A51E2E0BEE50F854E651611B595B65455D35BDD
SHA-512:	318483ECDDB853E4C9C73D72606D183B0984D3BB728A38E227A03D3B034B91F6B2AD1CD0F0FB7D5AC3207565532418527DC32C3EA240FA5AB03C0C6C8D7AA60F
Malicious:	false
Preview:	....Standard Jet DB......n.b`..U.gr@?..~.....1.y..0...c...F...N.].7h.....K.%..`.2{6... R.C...3c.y[..\|*..\|.....N9X...f_...$.g..'D...e....F.x....-b.T...4.0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\PBVMfb5c.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5215232
Entropy (8bit):	5.9040430515891105
Encrypted:	false
SSDEEP:	49152:JQVi+g3yBPoYLcOU6MEegRDZ0D9DQrQaCwSaWoksK3nn4ilS:JQIb3TY4OeQR10D9DbAS+ksK3nnR8
MD5:	151BAEE1FF571CAC0BB9BC8E5CF1E357
SHA1:	0764CF372AC36FF2B67B32EED7C572591D9827D9
SHA-256:	4FB27B579547DB083739C509CA98C84F1A939F43AF88E36C662C6C50E1146A50
SHA-512:	FEA4036274B53B52445A6940952DEED8E2F32FA78D66A08984D258FCD2813075F5536A346762E7132CB12FBC50C591862954D36DA514DE2BB38E2F7B2EF151AE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\...............w.F......u......qs.......n.......~......qq.........".......8....qG......qF......qv......qw......qp.....Rich............PE..L....S...........!.....z.........?.(..........w...........................B.......O...@...........................0.<....T0.\|.....3.x.....................@...................................................................................text....y......z................. ..`.rdata...@......B...~.............@..@.data.........1..v....1.............@....rsrc...x.....3......63.............@..@.reloc........@......T@.............@..B................................................................................................................................................................................................................................................................................................

C:\int_duca\Renof755.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	260
Entropy (8bit):	4.584591727500601
Encrypted:	false
SSDEEP:	6:mR2OJEZxFRNPMyvclOvcPgxwO4R14R/Ry:mYvRL0VbgKO4z4xRy
MD5:	883C5581B6BC7DFFBAF1BD036F920CF7
SHA1:	004A628530308C6485BF22107E0C132A75744473
SHA-256:	665A17269315DF9406A2583F74FD0F5D1F738CEE87AFE34B683E8B377AFCBE78
SHA-512:	6417CCE79C675046340921B9C739FAF3DA20847EA127A8780AF3D1D9F769E4F77AC366B281290EC657FF6B38434F6F182001C35BC4B8A6AE62E7F6BD20D6B9C7
Malicious:	false
Preview:	ren c:\int_duca\export.mdb %1.mdb..copy c:\int_duca\backup\export.mdb c:\int_duca\export.mdb..c:\int_duca\zip -9 -j c:\int_duca\%1.zip c:\int_duca\%1.mdb..copy c:\int_duca\%1.zip c:\int_duca\dades\%1.zip..del c:\int_duca\%1.mdb..del c:\int_duca\%1.zip..exit..

C:\int_duca\atl1fc56.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	138056
Entropy (8bit):	6.454887624220969
Encrypted:	false
SSDEEP:	3072:nHi2/YxBFZNAWH6Gk5BsyGfGM8EnwO95fF:BOFZKWaj5BstfbfDP
MD5:	00D2C06A552F782C1F16ACF77DB765A5
SHA1:	640FD59AE52C7C381D7696CE66668AEAAA25B711
SHA-256:	F54FE6535538174C139B1B0CB2AC0753B2E34412153A443482CCAE53FFBC4DC6
SHA-512:	BBDFA6945D57C49A886442A7D1032E08656D4999E614D5A0BE0D318832BE94520601D2DB9C0E3AFF5E083D7A1392C72FB38EAD2873520947E26993DAED7AC795
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H..&V.&V.&V..V.&V.0.V.&V.0.V..&V..V.&V.'V..&V.0.V.&V.0.V.&V.0.V.&V.0.V.&VRich.&V........PE..L...W._M.........."!.........x......5..............x.........................`......T.....@.................................T...(........"..............H....0..$....................................@..@...............\|...........................text...q........................... ..`.data....0..........................@....rsrc....".......$..................@..@.reloc..8 ...0..."..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\backup\blan6d5.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Microsoft Access Database
Category:	dropped
Size (bytes):	3018752
Entropy (8bit):	3.452209502294229
Encrypted:	false
SSDEEP:	12288:teMVilgcAlrgaX+ZGEmJQsIf/yQVqGuKkmk3:oByNT+ZGEmJFIf/yd
MD5:	97B3D1049CCB56A39AC066AA7DC72327
SHA1:	037C80322CC804A546D5F4644473230635FA55EF
SHA-256:	5EC0F821BB25A21B1E94671B65302B038B9AA9C4E57ACB52E5BC385E9B205714
SHA-512:	35A912C8E37D8616E45D9B13FA7E61CF259BDD3283CEDB524D93BCFE7F7C874D2FA6D2B8F81837EE04C85E73C970A44E20D1EA220AED410B1F1F237C8FB66A3E
Malicious:	false
Preview:	....Standard Jet DB......n.b`..U.gr@?..~.....1.y..0...c...F...N.^.7q.....K.<..`.1{6...9Q.C...3z.y[..\|*..\|.......5R...f_...$.g..'D...e....F.x....-b.T...4.0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\backup\blan743.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Microsoft Access Database
Category:	dropped
Size (bytes):	1314816
Entropy (8bit):	2.5186258924494584
Encrypted:	false
SSDEEP:	3072:gaAmJ/NpXndyyhx4Uu1IBPwzlWs8kF44ZD629yR3b8h3o9fnZERldrFW9dUQ+Y/F:amJ/rXndyyhxq3U9fnZERk
MD5:	913A02405A9CEDD0D3C0F090331488E4
SHA1:	CC8F6F2D7B16CC80E9277B151A87D48BC2A99E56
SHA-256:	DE71C7D076CD279AF69276AB03827AD995AD66A3B3D57F7C19F0B1D4F86FAEED
SHA-512:	A24FDFD973190B5F498B48EFDAFEB9CDBC1D387F978DC32398A0C0773D334EBFA592ADBA8AFD1F40BAAC9A5E862B9EF46DCA932E14DF1AF7640E93542FAFA36B
Malicious:	false
Preview:	....Standard Jet DB......n.b`..U.gr@?..~.....1.y..0...c...F...N.^.7g.....K...`.1{6.../Q.C...3l.y[..\|..\|........V~..f_...$.g..'D...e....F.x....-b.T...4.0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\backup\expo697.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Microsoft Access Database
Category:	dropped
Size (bytes):	1245184
Entropy (8bit):	2.995947101384081
Encrypted:	false
SSDEEP:	3072:YR43NKyRRTMEYzi9yiEPiXirIibiow3t0bs6i8He56Bv0ya/6MkzgKHFg29WHQQ8:n3NKyRRB3y
MD5:	7D51229C3D72B3716E93AD4377F7E774
SHA1:	F9DE08201F5B39EC4D5136DA735BC1AACBAFBC11
SHA-256:	246AAEE3BEB33C95EC3514AB9A1A167729139B401F359784A82BB0AF27D8FE96
SHA-512:	448F84F6001EE38432C62A03DA1C09203D4883656265FE557845CFC839EEC5C390FED2208DE5D3D0B41444C779582E823361043731BED354E8E24AF974FECE57
Malicious:	false
Preview:	....Standard Jet DB......n.b`..U.gr@?..~.....1.y..0...c...F...N8_.7....t.K...`.0{6&...P.C...3..y[A.\|*..\|......}ox...f_...$.g..'D...e....F.x....-b.T...4.0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\blan2af.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Microsoft Access Database
Category:	dropped
Size (bytes):	3018752
Entropy (8bit):	3.459460119310909
Encrypted:	false
SSDEEP:	12288:ReMVYlgcXlxgaX+ZGEmJQsIf/yQVqGuKkZkZ:87RTT+ZGEmJFIf/yw
MD5:	BD267CC70633BA3DB1BA708D14622090
SHA1:	A98129178D29EEDCF6E10900BEEEC9EED66B8752
SHA-256:	DDDEA195CE2195DD94EDFAAAEFA47E4C6EE3890F764D944374012E5721DE7008
SHA-512:	1DF34C85AA1EF7DCBB9A5C07CA291F0D5F59B80558EDEA13A5A9B3D3EB325782C8BB0A29FCE5C24D750D3382DE9F63A209781D966111FBAE3C09E2E8E7337500
Malicious:	false
Preview:	....Standard Jet DB......n.b`..U.gr@?..~.....1.y..0...c...F...N.^.7q.....K.<..`.1{6...9Q.C...3z.y[..\|*..\|.......5R...f_...$.g..'D...e....F.x....-b.T...4.0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\blan38a.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Microsoft Access Database
Category:	dropped
Size (bytes):	1314816
Entropy (8bit):	2.5179029806299154
Encrypted:	false
SSDEEP:	3072:i/AmJ/N6Xndyyhx4UuQHBPszlWs4sF44Zt6iWE/BZblkr8h3o9fnZLlfB2Sqrm1e:XmJ/0XndyyhxW3XW9fnZLLe
MD5:	38A725E59E09F9672184827550FF66BE
SHA1:	10FB06FFBA9BB2EDADD532A19A44AA279B10B5BC
SHA-256:	AC551AAA6474B275180B280374B0B6C28E337159E02372643E2B741906235C3E
SHA-512:	9FCB2F142D40450E9D482E999B16E6FF048E23DF1FA5D104489366BD81555CF331A7C3EF2D7641C19F5BAE4FD29E01E0D539EE49D9F57FEF265D21A801B02FF9
Malicious:	false
Preview:	....Standard Jet DB......n.b`..U.gr@?..~.....1.y..0...c...F...N.^.7g.....K...`.1{6.../Q.C...3l.y[..\|..\|........V~..f_...$.g..'D...e....F.x....-b.T...4.0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\blan3c8.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Windows Registry text (Win95 or above)
Category:	dropped
Size (bytes):	546
Entropy (8bit):	5.48164762091006
Encrypted:	false
SSDEEP:	12:bOv8LUCXEKl2wZEQ7m/JT//ITqkmLUxuLUxwVUdpjj/mN/:pwUEKl2dxjITPmwxuwx2G4N/
MD5:	BE8FF9E45D16A49C92B67AAA7A5D6DB5
SHA1:	7AE9CE06707EA19D708B06E08FAC937193ABF900
SHA-256:	FCB23B147C9382906F7564E2A36A507003158F578B9BD9698B2D02EA898ED3E4
SHA-512:	3CBE2014FED1F5A5EF67D1CA070E9BE3F683216F6A59F411E471A9B240C6E88A354477D3536C30976F85598DE3FC1794255CB53A0C85EA052B440EBFCC661947
Malicious:	false
Preview:	REGEDIT4....[HKEY_LOCAL_MACHINE\Software\ODBC\ODBC.INI\blankexp].."Driver"="C:\\WINNT\\System32\\odbcjt32.dll".."DBQ"="C:\\int_duca\\blankexp.mdb".."Description"="Blank exportacion".."DriverId"=dword:00000019.."FIL"="MS Access;".."SafeTransactions"=dword:00000000.."UID"=""....[HKEY_LOCAL_MACHINE\Software\ODBC\ODBC.INI\blankexp\Engines]....[HKEY_LOCAL_MACHINE\Software\ODBC\ODBC.INI\blankexp\Engines\Jet].."ImplicitCommitSync"="".."MaxBufferSize"=dword:00000800.."PageTimeout"=dword:00000005.."Threads"=dword:00000003.."UserCommitSync"="Yes"....

C:\int_duca\copif735.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.2516291673878226
Encrypted:	false
SSDEEP:	3:urn:urn
MD5:	3BE7DDC8793A29DFA8EF708BACB5C781
SHA1:	63E656EA835817B63FEA080EEA0F27906C4CE1C2
SHA-256:	A96EF3A78C93F6DCD354287B2D8AFC7F2DE1F1E4E9FB82FBF22A44A7D267B55D
SHA-512:	54E946E7EC908D187AF9843ACEDC4AD9AE305CA0786B271F8A822A5C1EDFD2237CA0D9821FD33DF5FECCD72DEE2CDD893DC1852456110F6D08B71E29E27FD834
Malicious:	false
Preview:	copy %1 %2..

C:\int_duca\copif8bc.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:S9Pn:S9Pn
MD5:	A97300FE168D8B13E46A567829381C6C
SHA1:	056261EF19004C941F84D3ED3746C30EF41E12B7
SHA-256:	B7DDD9064EC65B7B2C812E5D91BC0F8A9DCC10C3AF936D6A64AEBB3667514795
SHA-512:	8CFF22C4945E89B4079363B3AAF067443430FF759501596385BD4B92C3E0B9AE2CB8FB713B875A8E080A297B35563157826914A05EE3FDA5FEB0E62DA4D633CE
Malicious:	false
Preview:	copy %4 %5..exit

C:\int_duca\delf745.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.407224354697621
Encrypted:	false
SSDEEP:	3:d4R6rBXKVM6sEZxB2KR6rBK:d4RqKVMJEZxFRf
MD5:	7BB4867B929EC733C6A6E39F53FD6B9B
SHA1:	DC8D9690D668AC7A132050E54E1965143F73588F
SHA-256:	21127803DCC9EEC70BE966FE11B632580E1916F113DFB74371D5AC76976CFD8F
SHA-512:	6E334060A9E3C7824D8309BF7DBBE8FC548A0E0FAB9EFCAE7EE2006C0357EB617F7BEB4504E6CC3800036FA196F3FCAEE6FB3BA801856659CA913A0EB3900C11
Malicious:	false
Preview:	del c:\int_duca\export.mdb ..copy c:\int_duca\backup\export.mdb c:\int_duca\export.mdb..exit

C:\int_duca\duca3e7.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	3.3629998518684
Encrypted:	false
SSDEEP:	1536:fybZ0o9kRg/j5wH3J4NaPDS5wUq+TRxw:GZ0o9kRg/NS3J4ALWwUq6Rxw
MD5:	CC36F6CCC8FE3147C7A7B4653A2D336B
SHA1:	055EB51A449EACEA3CE699BF524105E7C36AA799
SHA-256:	D557A83A5899172B0975A4391466FE6DC32028FD3EC8AAAAE85F11B85A683888
SHA-512:	6B26C03CA4C909D3DE138C12A788F63FFCFCB92263FE211ED590EB076E5D0B8BB6F851D78D6632236B36B0CF07B0892CE128649EFB62A1A505712A5B0647548F
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.r..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\duca3f7.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	256512
Entropy (8bit):	3.6506040449227233
Encrypted:	false
SSDEEP:	768:fj+UqQ2gMIorHZkJqWirdIUsikblo2I6wa9KAzio:fj+RQ2gMIorHZkJEIUsT5io
MD5:	72BA90293964A03FE39FA6B4AC8770A6
SHA1:	F919FBDF1E39F433586C16A75394BE912542FEA8
SHA-256:	69CF7BB9BE94D72115017EA343BF19FDB21A9712BBB9DBB6B7FC9953484FD421
SHA-512:	E1A7E8F5EA1B39600706A959AED7768D4DF4631E37E08F180432BAB5BAC2A20025F1050870015351C5B851FABE6071B7777E5B51A9AA1C52D0050CDDDDF53D4B
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.r..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\duca407.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	364032
Entropy (8bit):	3.208319811096564
Encrypted:	false
SSDEEP:	6144:FhVTQZUo9sp6WhMc++dpEM8l3Gcegq9EPf1E6v:dDy/
MD5:	17472571C1BC37E4D266FF9812159059
SHA1:	234DCCE94DAB0C9130414AD016ACCB99F5EA4FD7
SHA-256:	47077E22F11274056008D0FE21A0F69BB2BD05076ABCBCF34B074FA409853976
SHA-512:	F5C3008C511697278BA9F9BD78D412A6C9C783DFD5D00AEE40183F0F379AC0C4498F7D3FF1740798BC64388E9A0A6308BF303590373386A1ACA1BF62032A2B69
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.s..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\duca426.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	439808
Entropy (8bit):	3.503403309521647
Encrypted:	false
SSDEEP:	3072:nIdPLaXako+4qM0pJ07WSCedD5IjS9p1OAzuiBTJWfmXD:8GXG5IjBodR
MD5:	11BB6B92823685E6F4F1FD55EFC47332
SHA1:	2D691FCC8AC4AE9A4E288AA30C0965EC7AB10033
SHA-256:	7DEC382B7DDFB63E89F5E7E5FA223D7597A1F33A4129ACCF3801785D37D42377
SHA-512:	DA79E5B27BAB15258D2DB0AEE06CF3C7028EDE2977F14995F6A40E32F54894A82CB9F8C7A4FFF7AE04BEAEF2D2C900D17F9D505C24B1B6BE707F27BCB775D92D
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.s..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\duca445.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	250368
Entropy (8bit):	3.683176299558454
Encrypted:	false
SSDEEP:	768:T6h7Q2gMIorDZ7+eqAdjm2UOFFhBoLIBo/It2eA7lk+9C:T6h7Q2gMIorDZ7+glm2UI2eAhk+9C
MD5:	9EF3958DAC28DBFAD7D0B7EB39BF3670
SHA1:	076D6158EE0FAE3B436A685AA5394F9EB103FDB6
SHA-256:	A5E045D7A24EBA0181A8966CC9944F8AAA72906607DB522F04ABFE22D79C3930
SHA-512:	8115C4DD0EBAF51A6CEA01CEE88401DB3ED0EDBD6B9AEECEEE0FDE7DCBC3485097D1E8D1FBE14A4206AA9F05F53BED9026CFDE21CAFC530C6E9DCA56451188BA
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.v..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\duca455.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	90624
Entropy (8bit):	3.4090611834676974
Encrypted:	false
SSDEEP:	384:TTCp1i42CAcp09eM3EcOBeMkm0m2mFA2j5GhoxCzpW2:TTCpYtf
MD5:	3FF780AD05D6248FEF49F3333FA5349F
SHA1:	4FCD9EA2156356E66AE3D37B4D9246BAD353BAEE
SHA-256:	FFE65F4EFCBB9C50269EDB98FA443E14E3F48BBAF0F84CA655519AAA92D6BC3C
SHA-512:	E7B6E8C175E1A1DC828AA09D55F5EABEBFFF249921F24FD8F9B46DA17C981176A0D35A75E756181DBB3ED1274DCB2D0017A246B53DA151DBBA6AD0A9CBF80A17
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.v..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\duca464.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 2, calibration: offset 0.000000, slope 40564819207303340847894502572032.000000
Category:	dropped
Size (bytes):	120832
Entropy (8bit):	3.274517281853046
Encrypted:	false
SSDEEP:	1536:2jLyvtelBal2jtFrEEyhJPV/MRSuo7MaLVzj:mkelBe2bbYPxsSuoQaZ
MD5:	5947149EE68B45AD4F7CDD9E2AB2643A
SHA1:	251C4858EFF8029BAB054325A4181109C089D27E
SHA-256:	965EC6926F1F33B6D3AD4C40EF177014E261E2D677F1A9178E63D9E362A80021
SHA-512:	9E6497BB2FF7D1796E80D9320D49EDA821D8EB34580B8EDD7208005B6ADD7BD5B2B6420CD0DFE5D2655F011F228A4064ABB2E8A2B76DDEB9F39FC0A0605FD62B
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.w..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\duca474.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	238592
Entropy (8bit):	3.7016925669667153
Encrypted:	false
SSDEEP:	3072:9ZV4ZpauGa9RJ3olvx7G2sbveWaiO0u7Iyk:9y3J4eD
MD5:	829123BE3C420E793B8A09A7EF0570F1
SHA1:	8DC003181DA226A6403BC49E6FD53985B3A519A1
SHA-256:	E1A1D3C976DFCA9553ED4A5EBA026115DD0088DA37FB81517283DFDA5B2B04ED
SHA-512:	5E4541CA616533B2B8F4815EF8A673502EB4A918B6F9B1F1BD11353AFDE4E2E01CF0ABE6C078A0C5966A29A1E160CD3F7B5E413ECF9512139364B0B977DDB769
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.w..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\duca493.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	2199552
Entropy (8bit):	2.440544173011843
Encrypted:	false
SSDEEP:	6144:UAMOLkcUo/7Eyfzk625kMn+vdp7M8F3ole6KYcrkPX+I3ryrAQM0+zdDEM8O3oyu:/RaRXQg
MD5:	9AD3398E6AA4E167B31489BF4E691B34
SHA1:	29B791A548101E3D0FBC80F36B65012AA3EC284F
SHA-256:	4E8BBFC0E4697663EC34F58C55C2C6CEBAE43F6948EF15020129C56B9EA9EDC1
SHA-512:	CF068B63C77E752B3E0017E46FE5B12FD1691A87ACA7E74523B8619FA029057135F497679FF0F8B565CB2B6059054F3A4DB49A8267A63DF6EFD26AA8D20BA244
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.w..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\duca4e1.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	6260736
Entropy (8bit):	2.781225076570803
Encrypted:	false
SSDEEP:	24576:e7k09RFqipcVmCITR6w6fRMcIaXjhItufV:M6Ou50
MD5:	029960B1D6DC05427C2A22680B8A0F3E
SHA1:	53E0D6FE19745C616904B6CF63DA27C4F7FCF1ED
SHA-256:	06AEC141D67E5A4BD8F8B8985F273417960EC9B465460697D6910875EF088B1A
SHA-512:	00AF90844933DB9D5F90949DA3566E4C26EE2359AC364611D0EB8B8FC3CC6F526009E46AA7B5205E7607DEC40A96EBDFC80B72E22084DCCBDB6EFC3D6190CA74
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.n..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\duca59d.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	4222976
Entropy (8bit):	3.820367744184808
Encrypted:	false
SSDEEP:	12288:fuqKUdZnUuQkpSPOLBKKtUXRXHK/W5zXh5hc26HfdmBj8e1wV1tt1IN:WqJRSPOtKnXRXq/W5Lh7c26HABj8Ywx
MD5:	0998C862CFA67251F958E68DAEC8299C
SHA1:	A09B98BFE93CC43F8A52FC67E3061C446B49DC43
SHA-256:	A4EC5615E9471E183434F27433E51274F0569A6D475A4361DEB5299C5C0A8D94
SHA-512:	7E63102942CA4990114163E6F91A1E2F2EDFC61974EFB9D2A0B584318A51B51E9CD4C698BAA138A5E2BA6EBB5F2673CC2A41BFAEF5EBD692205420C6B439B1D6
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.p..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\educ668.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	HTML document, Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	115732
Entropy (8bit):	5.147541398434775
Encrypted:	false
SSDEEP:	1536:hAqOCji1yQLcBeLeIJ5YmbynefF2uuy5ecDYnKCdnYhAI6X0BnfPp:h5qhZUcDCFdRItHp
MD5:	7C66411E5531EC34FF59C3C276822B54
SHA1:	0C718CE60F0340184CCF1FE5031F9AC4FDEA1BE0
SHA-256:	C1B8A37EB966B2CE3973989FE5A4474017DC1392A4972BB55DBC3A354B8AAA83
SHA-512:	A6A32B14CACC7D4BBFF24AD7DCD7FD0B8A357580C1CD32C39CA44404394F81F59AE5DBE8462DE7C342695FE47A253E7592F65C27516BA16A6CBCE71D60ADF021
Malicious:	false
Preview:	<html>..<head>..<meta name="Author" content="Generalitat de Catalunya Ag.ncia Catalana de l'Aigua">..<meta name="Resp" content="Ag.ncia Catalana de l'Aigua">..<meta name="Content-language" content="ca">..<title>Manual d'ajuda de l'aplicació e-DUCA</title>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">..<link rel='stylesheet' href='realitzar_duca_archivos/aca_style_ie.css' type='text/css'>..<SCRIPT LANGUAGE="JavaScript">.. if (navigator.appVersion.indexOf("MSIE") != -1).. {...document.write("<link rel='stylesheet' href='realitzar_duca_archivos/aca_style_ie.css' type='text/css'>");.. }.. else.. {...document.write("<link rel='stylesheet' href='realitzar_duca_archivos/aca_style_ns.css' type='text/css'>");.. }..</SCRIPT>....</head>....<body bgcolor=white lang=CA link="#00B400" vlink="#00B400" style='tab-interval:..35.4pt;margin-left:18.7pt'>....<div class=WordSection1>....<p class=titulo1>Manual d'ajuda de l'aplicaci. <span class=SpellE>e-

C:\int_duca\educ678.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	HTML document, ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	87871
Entropy (8bit):	5.156202017784088
Encrypted:	false
SSDEEP:	1536:Wxye0eCeOeT9mkYgmifFeWPzhIWyYgnwfZVO4edeOeEeOeMx:Sahx
MD5:	4716825A58E02CE6AAD469784D605A9E
SHA1:	B84A55ADF2C650C127CA3C2CE0ABDEBA87185687
SHA-256:	F54EC49CAA568B13C323E14091E5DBAA76326EE3FB66770920DA84B416D693A6
SHA-512:	1F76FAB6EB88ED04754EF1DDE863D2704227DFF9D2854477BDCBFF23B5B5DC871BBEBB601B4A8128E61E275FC0E9FE34844654AD161C82347BAFB4E7C8C0CC49
Malicious:	false
Preview:	<html>..<head>..<meta name="Author" content="Generalitat de Catalunya Ag.ncia Catalana de l'Aigua">..<meta name="Resp" content="Ag.ncia Catalana de l'Aigua">....<title>Manual de ayuda de la aplicación e-DUCA</title>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">....<link rel='stylesheet' href='realitzar_duca_archivos/aca_style_ie.css' type='text/css'>..<SCRIPT LANGUAGE="JavaScript">.. if (navigator.appVersion.indexOf("MSIE") != -1).. {...document.write("<link rel='stylesheet' href='realitzar_duca_archivos/aca_style_ie.css' type='text/css'>");.. }.. else.. {...document.write("<link rel='stylesheet' href='realitzar_duca_archivos/aca_style_ns.css' type='text/css'>");.. }..</SCRIPT>....</head>....<body>..<body bgcolor=white lang=CA link="#00B400" vlink="#00B400" style='tab-interval:..35.4pt;margin-left:18.7pt'>....<div class=WordSection1>....<p class="titulo1"><a name="A">Manual de ayuda de la aplicación e-DUCA</a></p>..<p class="t

C:\int_duca\expofcb4.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Microsoft Access Database
Category:	dropped
Size (bytes):	34103296
Entropy (8bit):	0.8666709871576216
Encrypted:	false
SSDEEP:	24576:n87aJnilcXALVuSRdA8gfLVEIXz7b3os0okg3e98LwdlRS2P8JT9KlU:n87aJnm4
MD5:	CA847920D5743A4C95F034F5CAA8E568
SHA1:	2DFD1EFEA768C1F08387276758689F889734DFE5
SHA-256:	1673D450277A877EC74D32B3E3285FBD31BDA33D26CCCD42EF19EFA10E08B2EC
SHA-512:	3DD4FA4E9BE953E9ACC3397BDE1C64A2FBF1BA7E450B2A4484820F89CABB13E868C4BDDF043E7B94B90C1D200BB79077869ED21338B7D0A9483A8EF0C000CEAD
Malicious:	false
Preview:	....Standard Jet DB......n.b`..U.gr@?..~.....1.y..0...c...F...N8_.7....t.K...`.0{6&...P.C...3..y[A.\|*..\|......}ox...f_...$.g..'D...e....F.x....-b.T...4.0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\imatges\Acceb0c.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 32 x 21 x 4, image size 336, resolution 3790 x 3790 px/m, 16 important colors, cbSize 454, bits offset 118
Category:	dropped
Size (bytes):	454
Entropy (8bit):	2.716491055112507
Encrypted:	false
SSDEEP:	6:8xxIijcSUTLFpg7iLPiElIEp4pcvHHLNUIsJhSHsfCCmCHsCHsCHLC:8x+ig9LFpg72PLyEpcInLNUIMSMzJJrC
MD5:	8DE0295C4428E8B7D6CDC8F2E48C94F8
SHA1:	BB07FF2032AD4BC26031E04CE8B96E78C53035BD
SHA-256:	DA69954916FCDA9B005ACDE70CE37B0B5F24FEEA57C7F0B24B8C75EDE5ADCE3C
SHA-512:	7AC22C6187DE5D125C036A38C0865FBA6B6ED93E786FDB3E9C1E5DC242CC456336F62BDFED0CF7F25C3D438DE65B383BC36217519AB09C1AEAB9AD5D5E89521A
Malicious:	false
Preview:	BM........v...(... ...............P...................................................................................wwwwwwwwwwwwwwwwwwwww..wwwwwwwwwwwwwp" wwwwwwwwwwwww."".wwwwwwwwwwww."".wwwwwwwwwwwp""".wwwwwwwwwwwp""" wwwwwwwwwww.""" wwwwwwwwwww."""".wwwwwwwwwp""""".wwwwwwwww."""" wwwwwwwwp""w."" wwwwwww."".wz""".wwwwww."www."" wwwwww"".wwwz""".wwwwz.wwwww."" .wwwwz.wwwwwz""" .wwwwwwwwwww.""" .wwwwwwwwwww.""" .wwwwwwwwwww."""*wwwwwwwwwwww..".

C:\int_duca\imatges\Copyb1b.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 15 x 8, image size 240, resolution 3790 x 3780 px/m, cbSize 1318, bits offset 1078
Category:	dropped
Size (bytes):	1318
Entropy (8bit):	1.0427666363163677
Encrypted:	false
SSDEEP:	6:4lMBFfCijNUUUOE8wfOATa8wfhba8MBuu97M9GRaqXpl:4ezfCiG7MBuMtKX
MD5:	F5CB789B1BE7794E5932DDEBAC446F1C
SHA1:	9DE9B7866A4811432DB55C818F515B43E85D7630
SHA-256:	C981E3DD680198C75DB82FC8CD4FDA86D6BAAECA4D5BDB56F5F26EE83EFD391D
SHA-512:	496724F724097D001D945B28406FCC32B7F3D298A5DFE738F39AF56D4C471C42D4C676EE8E6B061A768EFC1A2EF41A3841FAD94089C7CD7B7CBB578BB1E5565A
Malicious:	false
Preview:	BM&.......6...(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\imatges\Exitb4a.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 20 x 20 x 4, image size 240, resolution 3790 x 3800 px/m, cbSize 358, bits offset 118
Category:	dropped
Size (bytes):	358
Entropy (8bit):	3.394479317744294
Encrypted:	false
SSDEEP:	6:LijcFES5haESJzJSwZhSEwvzMwoTf9yfMlBfClBfS/W8lklcDahhG:Ligq6cEKd3zLwotflklCs4
MD5:	392D30DCD71CA0A67F1DACAC51D6CFF6
SHA1:	3F18A0CC2BA03DABB9B42547CFFB294CB3DE0C57
SHA-256:	ED30A43E6E4A533D91D55EC9B677A67B5708373FF59360020C23099F60BA3801
SHA-512:	1710D5FD907DE805CA8684F3AA6AC6A3EF34C7EB2741B62C743AAEAA3F7A74B5B4E0EEC9E91C47F8AA48F6C66E5D19AC6F782BA618AC21E26BFB6534B949EBAD
Malicious:	false
Preview:	BMf.......v...(.......................................................................................................wwwwwwwwww..wwwwww.www..wwwwww..ww..wwwwww..ww..wwwwww...w..x...ww......www.........www.........wwp.........wwv....\|....~ff`...w....~fff........~fff`.......~fffn.......~fff.......~..n........ww~.......ww~.........wwwwwwww....wwwwwwwwww..

C:\int_duca\imatges\Gencb5a.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 39 x 45 x 24, image size 5400, cbSize 5454, bits offset 54
Category:	dropped
Size (bytes):	5454
Entropy (8bit):	1.0257762130530657
Encrypted:	false
SSDEEP:	12:Fm5U1jGGVpqa2v7G0x8PgeWSxXggE2a0ggxOa1OggsIgguGggu22gggLOggeQ2g5:UE
MD5:	641B862D5F58D15B919D43CD3C55D117
SHA1:	6DE201A56C5CFB217B180BE0152C29DD58059C5E
SHA-256:	4D54C4E9C842830D8A5860812131BEB5739F4803CF286A9CF29CAD4C929F5B48
SHA-512:	D29F3FC0EE286391470CCD708E077588E5623E70096F0DE23524F8866ED13F4F7EF0A2E6678966307E3EC5A1D1108601786BA9F70684DF159F8F68D1D4E4401B
Malicious:	false
Preview:	BMN.......6...(...'...-.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\imatges\Helpb69.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, OS/2 1.x format, 20 x 20 x 4, hotspot 32x32, cbSize 314, bits offset 74
Category:	dropped
Size (bytes):	314
Entropy (8bit):	3.0428076111829845
Encrypted:	false
SSDEEP:	6:1Eo87xEP/8x8v0TFbXlWkZCFo0no6BnyFf:17CxEH8x8sTFbxZCFoQa
MD5:	52C8045DDFD37B0AC86DA0CB57C7CA81
SHA1:	D50CA73E2394BA21965D48D710142D6BF262F0AA
SHA-256:	FA1F24B3E7779F1110456D9A238F739F5B43D367300A88CDD4EEFB52E6A6C5D5
SHA-512:	5FCF1353184C9079202A22790CCDEA2A192839C3B750AE361567B60FCF96E9823247CAB459F40BA8709F3BC21FE1981B72D65908EFDC58AD5BC7FBDDE92F86F0
Malicious:	false
Preview:	BM:... . .J...................................................................................................................wx.....................p.................................................................................p.........................................................................wwwy.....

C:\int_duca\imatges\Openb69.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, OS/2 1.x format, 20 x 20 x 4, hotspot 32x32, cbSize 314, bits offset 74
Category:	dropped
Size (bytes):	314
Entropy (8bit):	3.0930429101671333
Encrypted:	false
SSDEEP:	3:/tlTvlAta8tAaAAJ/X/1vd1ptyrRRBTLLMlaLLSREqzEqquESN68zX40SaAjtpS3:1Eo87xhpty1RFLLMALL0X+yz5Sw
MD5:	A6BDA424FB8F48429A07455D692FBF00
SHA1:	C94293C0C3528059B0BE9DA99E3D5FD8441518F0
SHA-256:	1E76E91F937AA5D77C4E2842839840BFC081F42E79B4C87C043A9D3145B88633
SHA-512:	55A959F48689DA998F314CDB52475F8827BC383C3A306E5E09D49189352090CEE10744B2F9EBB3D3F01B95E0A70EFF4F93C65BBD8825414C88622A3B9398C266
Malicious:	false
Preview:	BM:... . .J.........................................................................................................................................................................................wwwwwww......................p.......wwwwp.......p.........ww.........................................................

C:\int_duca\imatges\Pastb69.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 15 x 4, image size 120, cbSize 238, bits offset 118
Category:	dropped
Size (bytes):	238
Entropy (8bit):	3.0177087998873158
Encrypted:	false
SSDEEP:	3:i/lZllvlillKld3l/Ft/vl/talAotuZdtFT/2HFnLXtH3VUNfn+tftYtut9H/Pd:2GlPlAjvkOEfOuF
MD5:	D8455602BB1D5790D59A1ACF0CDF0D96
SHA1:	B74369987FA05378CEFF9D93B53D3A0053543666
SHA-256:	0ABB79AC5FE1002527F7DD8041C37491EE5691F462ADFBCC316776A820946BFE
SHA-512:	06BF7C91062EC694F5AB36D2E0B20E15D2C1934CF53B576AC7CF42C40C46A57B232E7E4B4B01100D8EADC81DD717BF0C8A10FC76F6B07C29F3FB00FC0570E2C8
Malicious:	false
Preview:	BM........v...(...................x..............................................................................................wwwx.......w.................................................................................................

C:\int_duca\imatges\Prinb79.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 15 x 8, image size 240, resolution 3790 x 3780 px/m, cbSize 1318, bits offset 1078
Category:	dropped
Size (bytes):	1318
Entropy (8bit):	0.9654502906319643
Encrypted:	false
SSDEEP:	6:4lMBFfCijdXT6PitXy9CZl3XJUYioa1xGluXOXQuXwq9QXB:4ezfCipT9gEFkoaOlPARB
MD5:	0C4E8A0D31BF2364235155834FF7A464
SHA1:	2F48101AED79A7A17A4E14209F4E6C25ACF7371A
SHA-256:	7C6B838C8E13D923E092111CF96CFCA99F52B04EA76EC5145D7AF7DD4B6E046E
SHA-512:	C5FBCF86A639BA797CEA3833224C2A97BB86261C173106BE2964B68799027561D4014D9EA84977E6AD138403901C495D2B4D29779F3416888845E99E8657A097
Malicious:	false
Preview:	BM&.......6...(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\imatges\Saveb89.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 15 x 8, image size 240, resolution 3790 x 3780 px/m, cbSize 1318, bits offset 1078
Category:	dropped
Size (bytes):	1318
Entropy (8bit):	0.955720904627428
Encrypted:	false
SSDEEP:	6:4lMBFfCij9Nww58ZS8XS6XS6XS6XS6XaGzJW:4ezfCi5XuS8C///mzw
MD5:	FEFF5592A4E03269437E1F7B901BBBE4
SHA1:	95AA1978E8B1D4AB9B420886AB34FDE36574EDB2
SHA-256:	20C2D0684F23B1339508316A9E32285688874B7F14CDCB8C0B03D60974DB1F0A
SHA-512:	308F86D77CF555311AE39F0C7A2C844E465327F1D68E9FA43E1222B67B3CC9FD40ED9E553D52F53343121AC99E97953CFF328F5B0E06F421D14576DC339640AB
Malicious:	false
Preview:	BM&.......6...(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\imatges\_canafc.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 15 x 8, image size 240, resolution 3790 x 3790 px/m, cbSize 1318, bits offset 1078
Category:	dropped
Size (bytes):	1318
Entropy (8bit):	3.1174754126123654
Encrypted:	false
SSDEEP:	3:tt/Flvlill2lvl/Ft/bt5lF3fdNvtlllFl/ltFl31Ft/ll3FNf/tll//Fl/lV3lY:4lOfCijYzHUkOWRlP5V9
MD5:	55579CB2D87D12584E45F38C502CACD8
SHA1:	5583A66886BEC4084554DD6E235BC442308C2156
SHA-256:	2A7819DF2A256A8B5238C5242A218E86EE527451CF91C997AC110B085165B724
SHA-512:	369B04A22580E862D250F2725AD1CC4646A13228A7904FFB9BB9D7597715F8AEB6D46BD1843E5242328CCAFF1FC197772BC48E165DFB6B3CDCCA53B54878FB2B
Malicious:	false
Preview:	BM&.......6...(............................................................................... @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`................@...@. .@.@.@.`.@...@...@...@...@ ..@ .@ @.@ `.@ ..@ ..@ ..@ ..@@..@@ .@@@.@@`.@@..@@..@@..@@..@`..@` .@`@.@``.@`..@`..@`..@`..@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@..@...@......... ...@...`.................. ... .. @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`...................... ...@...`.................. ... .. @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`...

C:\int_duca\imatges\acaafc.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 227 x 65 x 24, image size 44460, resolution 3780 x 3780 px/m, cbSize 44514, bits offset 54
Category:	dropped
Size (bytes):	44514
Entropy (8bit):	1.2616689732943136
Encrypted:	false
SSDEEP:	192:u5tK6Am5bQZIwSA8eHbVMY+9ari3mfXoSmToq4qob6:u56jKariWK
MD5:	F15141101873742D81880652AF70D909
SHA1:	E54D45A48E66C1F5A0D673F5C433AA9C353CCC74
SHA-256:	0802077FAF2CAFC4075F6ACFA6DCE49619A5296F51F2E2F493656B0E9F9C7B38
SHA-512:	4E6323731670D1A797C15CE40E64F175475D341BC4778619731BC374EB65908A8D18F6D549FDE58BC83FB9A4FE6FD2361D22DE1BD101A406E8C38A854E28F124
Malicious:	false
Preview:	BM.......6...(.......A.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\imatges\acab0c.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 16 colors
Category:	dropped
Size (bytes):	1406
Entropy (8bit):	3.8904887540625857
Encrypted:	false
SSDEEP:	24:h75rNnSLBqXYC7odsghRodnahn2UEX5WiWNKb:NtgLBrdVRoNaovJWiWo
MD5:	1B669927C3495369F348887303E9FA55
SHA1:	22A0D0F44DD8879144AC31D57208D19D0CDAAD0C
SHA-256:	50FCECBEE4208380816EFE16A63C76FF5EEFEF841DE6C94D813160F4C0942B24
SHA-512:	F2B402DB4A0FCA5BBF7AF571FF65891448E8D77EC924D7844CEDF151952557BAB86DF57300F784657A7EC768F3D432B1AFD0D446E19EEA85F87C5CB52D67DA66
Malicious:	false
Preview:	..............h.......(....... ...........@.................................).......................................................................!...B...................r.....G.............,........^...................,..............h...........,...............\.C.o.m.e.r.c.i.a.l.\.A.c.a.9.0.0.\.a.c.a...b.m.p...................................................................................................................................................................................................0x.......................%......0x...........&...g..SB..................SE..\|...T........,............../...Z.......l........g......8.......D............,..P...........VM..........................D...(.......`.......................0.......m?.......?...................x...................LA.l...........................J........~...........NA.....................................................................................................$...(...................$.....................

C:\int_duca\imatges\avisb1b.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 37 x 39 x 24, image size 4368, cbSize 4422, bits offset 54
Category:	dropped
Size (bytes):	4422
Entropy (8bit):	5.351503619220555
Encrypted:	false
SSDEEP:	48:hmB/tRXkJzVgCJGMJmsNeGQvKe9goVgKOviwlTOEUtmKEX4aGrUwEAGxbI:hmB/CgOJmsNUv1pVrO1mtmKEoazRxbI
MD5:	C685D449508C4D25F522CC4C9957910F
SHA1:	7B74D3F540BD25E89B718953FDEB5CD348B348BD
SHA-256:	CAE273496825ADA2F9AAC29B8DE96106C746CDCDBB3ED76BDD43B6A39CBA8112
SHA-512:	AD7FA0162B9D9FE330DF23390E043003E2FF0E1E50C0E66B9868B35FF2E946239EDBE81C659399A8CAA74EF61C9E3ACBEB1C12FC14784A93FFE3DF01B714D8C3
Malicious:	false
Preview:	BMF.......6...(...%...'...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................{{\|nnonno{{\|..............................................................................................................................................................................................................lf.XN.OC.OC.XN.nh.................................................................................f^.K7.F..G-.G,.G,.G-.H..I0.F..I6.f_...................................................................ql.I2.G+.G).E&.D$.;..5

C:\int_duca\imatges\cancb1b.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, OS/2 1.x format, 20 x 20 x 4, hotspot 32x32, cbSize 314, bits offset 74
Category:	dropped
Size (bytes):	314
Entropy (8bit):	3.375240914581773
Encrypted:	false
SSDEEP:	6:1Eo87xsDE82lURJKjtIVTcpW/T80wVlHqC:17CxhcbKj6VTcpWuVtqC
MD5:	87DB792BC11B56BCF1B8ECA4D2713580
SHA1:	6278638028CB8A4D8ABBEBB2279D261578F392C4
SHA-256:	3655FDDC617DA1C0985543955B640D410BC6754D60FEB8BD852E6205086816E7
SHA-512:	099247EBB405B27154856143568213ECD4D711AC2E5782A938071E87BA350D5FD79E30313868429E5B69FA59BA9409B2D4E7C0D4A09BE1CD1A41AAB1E1EBF608
Malicious:	false
Preview:	BM:... . .J....................................................................................................;.....;.....;....3......3....;.......;..3........3..;.........;...........;.......................3...........;.............3........3...;.......;...3......3.....;.....3.....3.....339...33...............

C:\int_duca\imatges\copyb2b.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 15 x 4, image size 120, cbSize 238, bits offset 118
Category:	dropped
Size (bytes):	238
Entropy (8bit):	2.8409174496679657
Encrypted:	false
SSDEEP:	3:i/lZllvlillKld3l/Ft/vl/talAotuZpqRqdf//xaMdfBxaMVXl52DX86BFDXllW:2GlPlAjEc3pacqUXoX8UNXGV9/jr
MD5:	E8D06D2D62E839FA811763EF8FA24051
SHA1:	2C028C15F02C2B0E028FACA2B73C9B8AFC464C55
SHA-256:	E56713EB3027597172D0CBC25F223D0CA7E82496008F9E5B0BE5883B176543F5
SHA-512:	50F76F84C02ADDF6A2D45E5F402244D3B2759BB72870F33E5FC23E7D684A2BCCF9B28354B575215522E3FB09304A7B46A0D859B4DBBE10F44288A30C3BF63DB1
Malicious:	false
Preview:	BM........v...(...................x.........................................................................................................................................................................................................

C:\int_duca\imatges\dccab2b.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 16 colors
Category:	dropped
Size (bytes):	766
Entropy (8bit):	3.8241860476823466
Encrypted:	false
SSDEEP:	12:IBwEHE9UL/jwsHn3lbbNkK0j444TQG/XEFOfn4wEX:IBwaEmwsHnBbT0j4449vKwK
MD5:	58E95130EA59D699ADBF8C32EEFB49CE
SHA1:	198F55433CAD6406B69947859E09D49984B06C7F
SHA-256:	C489BB4A4D367C33C003DD50041F40124657ABFDC4F373D20C2981CB3A55E9F3
SHA-512:	83C5119A210122FD82EE27C0F86ACF1CDB8D3ED6765041B53443382D42EBEE6E9507C54FCB23169A5AF262EC3C939D2559AF6B9CF20FEA1B0CE2C69701DF8451
Malicious:	false
Preview:	...... ..............(... ...@..................................................................................................."!...."!.....!..!.4C3D.".. ....!.DD3D33.!....!".333DCCDD.!!...!434334DD31".....CDDDCC34DD....!3333CC4C3331!..!DDD334DDDDDA"...334DDCC333CD..".4C4344DDCD33." 4C4CDC43333DD0" 33C433C3DDC33@"!DC4DDD4DC3DDD1"!C433C4D34D333A"!3DDDDD3DCC4D41"!UVfUVfUVfUVfUQ"!UVfUVfUVfUVfUQ"!UVfUVfUVfUVfUQ"!UVfUVfUVfUVfUQ"!UVfUVfUVfUVfUQ" uVfUVfUVfUVfUp" uVfUVfUVfUVfUp"".VfUVfUVfUVfU."..VfUVfUVfUVfR...!VfUVfUVfUVfQ"..!VfUVfUVfUVfQ!....fUVfUVfUVf.....!fUVfUVfUVa"...!".UVfUVfUP.!!....!.VfUVfU.!....!..!.fUVf.".. ....."!...."!....................................................................................................................................

C:\int_duca\imatges\esbob3a.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 423 x 55 x 4, image size 11660, resolution 3780 x 3780 px/m, cbSize 11778, bits offset 118
Category:	dropped
Size (bytes):	11778
Entropy (8bit):	1.4279637354146355
Encrypted:	false
SSDEEP:	192:Z+D5Gv3S9mvwCOOMvEQUUqZUbTgqSGugj6Vccc2K5SFUKmBSbVEUp2Vj/he6Ljgv:Z+D5GvC9mvwCOOMvEQUUqZUbTgqSGug0
MD5:	592F099EBB34ECE1BE8CFDA173F3A6C4
SHA1:	73CB5999FFA0D218B3DC831567DF6E8B73C05D36
SHA-256:	11FA3A6B0A4E27EEFDA11CCFD8939D100E379AE3607FA6E806DF112A2E45C351
SHA-512:	18E4BF6C4D4BEAAA337383DADF3A58E4709D8ED3A7987FF030F344F8BCE3509A04D2903D978CA13FD3F21B2981808B83E4C2504588E592D05F139C31ED825451
Malicious:	false
Preview:	BM........v...(.......7............-....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\imatges\explb4a.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 24 x 24 x 4, image size 288, resolution 3780 x 3780 px/m, cbSize 406, bits offset 118
Category:	dropped
Size (bytes):	406
Entropy (8bit):	3.7533650773751126
Encrypted:	false
SSDEEP:	6:170lAjcf1Y4p0+w0GZmCZt+yxSlUKvfg6IlLYQ1pzAVtfK8:1Yigf1YU+FDZt+yxGUKv+LXp8
MD5:	E681F72C50AF1BF3999BF0B9B55969F0
SHA1:	C6771F5FAE898299DCE0D3E8011834D3A114200C
SHA-256:	F743830C5B3AD110E84BD19B8119B49AC3317EC5A74590A1672B7CDAD8CEC4D8
SHA-512:	E56AC25D0C8740E6ABAE4F169339D893682BE6773D831333EA75DB683CC183997543563A852EF6A57F8A3514A5AE28C1A78989509BF16D9A6542449A0D844E8C
Malicious:	false
Preview:	BM........v...(................... ...................................................................................wwwwwwwwwwww...................................................................N..................s333N.3.......p............s;.......x...........~...........x..............{.........w.....................x...www..................wwx......................................................

C:\int_duca\imatges\fn10b4a.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 4, image size 130, resolution 2834 x 2834 px/m, cbSize 248, bits offset 118
Category:	dropped
Size (bytes):	248
Entropy (8bit):	2.9133810661071315
Encrypted:	false
SSDEEP:	3:ATllvl9lslxlnFe36nl/Ft/HtAiotuZvE81BalXtql/VxRacfRStlAlFaRMqlw5B:fli6wijcIO4paASXAlFHnWJun
MD5:	75A2A1EB3FA86F66979F28BAFF81A9F9
SHA1:	74A84783452CE06730EAAB8FE776BC6260A0F91D
SHA-256:	00E6A54CA20466628CDA8A28EBECFBA140BD12673B93F21935EA2C52AC0F9F43
SHA-512:	47ABDDD5D41FE8382796464AD9FDC7DA3085A7A911D62ED14CDDA00EB79CE0AB5BD074C893B86300564A4BE3B16EA4D5604CB20CCBFCB504F75C6F6BAA6860C8
Malicious:	false
Preview:	BM........v...(.......................................................................................................wwwwwwwwx..........wwwwp...........wwww........p..................................................................................

C:\int_duca\imatges\geneb5a.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 163 x 50 x 24, image size 24600, cbSize 24654, bits offset 54
Category:	dropped
Size (bytes):	24654
Entropy (8bit):	2.4366592393294493
Encrypted:	false
SSDEEP:	48:XadwkvBfRnQB22sg/C4yiMMAAYDGcfp1N1iTdCyiBMNGASet4crsmjmPt3rTXKN0:XRkpf+1BODGOH1aCrSQHmkU3DVhIlc7I
MD5:	4AF98E967D500CE8B3FCE72212586CC3
SHA1:	0EB1FF6E37CEF558E1F20B14DAA29BCD27B117B5
SHA-256:	584A8BB8E50595F7EE87A46292D033D1375924ABCB19D7B0F5CF005137A205F4
SHA-512:	27BBA8FC0AF46417B21C5E9E9C632552C6945D26B33BDFF482EB5B286F6B80822CB966E0D6DFD596301FE13668DCF0E87E3678452946E92F42A645F8AAD73A84
Malicious:	false
Preview:	BMN`......6...(.......2............`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\imatges\pastb79.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 15 x 4, image size 120, cbSize 238, bits offset 118
Category:	dropped
Size (bytes):	238
Entropy (8bit):	3.2691059132443536
Encrypted:	false
SSDEEP:	3:i/lZllvlillKld3l/Ft/vl/talAotuZ91fdqonl//3PPfqeUq1hddMdRwFq7ddqI:2GlPlAjQol3CJq1LdMDdPPTJX1
MD5:	A0AC70977E09C48A02F7AC7D43CF0993
SHA1:	3AF16C25548B5C7DE7B6157F5792AD51B042D1D1
SHA-256:	5FA5EC7DC589A02A38455EBB055242D2DCF48E5AFD5B878BD603157D0E365366
SHA-512:	8F14D1A89F464C7FDB5A412145DB859B1F40256F3EA597305E57E91735ACAD99C13FB477A761020FDA48CEE87EC6FC362A0B2534DAA149E269ACD7AC5BAFF3ED
Malicious:	false
Preview:	BM........v...(...................x..............................................................................................www........w.................................................................................................

C:\int_duca\imatges\prinb7a.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 15 x 8, image size 240, resolution 3790 x 3780 px/m, cbSize 1318, bits offset 1078
Category:	dropped
Size (bytes):	1318
Entropy (8bit):	0.9654502906319643
Encrypted:	false
SSDEEP:	6:4lMBFfCijdXT6PitXy9CZl3XJUYioa1xGluXOXQuXwq9QXB:4ezfCipT9gEFkoaOlPARB
MD5:	0C4E8A0D31BF2364235155834FF7A464
SHA1:	2F48101AED79A7A17A4E14209F4E6C25ACF7371A
SHA-256:	7C6B838C8E13D923E092111CF96CFCA99F52B04EA76EC5145D7AF7DD4B6E046E
SHA-512:	C5FBCF86A639BA797CEA3833224C2A97BB86261C173106BE2964B68799027561D4014D9EA84977E6AD138403901C495D2B4D29779F3416888845E99E8657A097
Malicious:	false
Preview:	BM&.......6...(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\imatges\simub89.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 426 x 530 x 4, image size 114480, cbSize 114598, bits offset 118
Category:	dropped
Size (bytes):	114598
Entropy (8bit):	0.6562065355928546
Encrypted:	false
SSDEEP:	384:f6IdIHsxAXmQOxz/zr8wF9/ZJGneQLsWGrouTF7+Lk7MEx7AGSr3e5r3Wx97sM7z:G
MD5:	0FD45E8C3A6F2C909600CF23286123A6
SHA1:	884C1CE96965E884330DF8C9809D17A38D59C5F3
SHA-256:	4C5711499EA9C6C8D8D0E5E986809230B728B7C564232A63CAA9D48B994194E3
SHA-512:	03F4838087AA6F1F23BE37F95A24D2A3D5BB90E03E496DED07F5FDDF8D5DECB2E49786B6AD7E92EB7181A7B1B02BE41FA0740CDB0CF3F12C553F89F7325BF458
Malicious:	false
Preview:	BM........v...(...................0.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\imatges\simuba8.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 491 x 74 x 24, image size 109224, cbSize 109278, bits offset 54
Category:	dropped
Size (bytes):	109278
Entropy (8bit):	2.811371832976779
Encrypted:	false
SSDEEP:	384:IInSiv56q/v9I0ePxY9jPeJg51UMWxkVbnvjHaWv84FUPBhtV1xfN2m/Wx:I9iA7PM/5idP7BPtq
MD5:	68F71E42F58E24CF2EC85AC04B3A463B
SHA1:	12D1195BAEDB6369552183DF7E5FC070D26DADFF
SHA-256:	AE9BF62BC25D21F0E7FACD3C6FC8EC2EFA8F212265E2AC5AC35BE7DD0DEFFBCB
SHA-512:	08D5764211C5080F829E696FE2D331FA14124D27DF0F67D3E42A7324D4D9BA88CDB8B5B4A846AB00B4048E42E1C4C5C301DAE010320D6417378C7316D62B0CE9
Malicious:	false
Preview:	BM.......6...(.......J.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\imatges\sumabb7.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 9 x 23 x 24, image size 644, cbSize 698, bits offset 54
Category:	dropped
Size (bytes):	698
Entropy (8bit):	1.0398767581475394
Encrypted:	false
SSDEEP:	12:sI+0hiiiiihHHCaHPIoFP3aShRhHUiiii7:BTiiiiig4wofZziiiii7
MD5:	7372EDCEAC3F8DDB3A7133422FA90D32
SHA1:	C43D25FF6ABB6E18D1F4FA1E0D9856E708B4C9D0
SHA-256:	9CDDC9D31E62AAC6FB3FB6889B440A731A1F64976A4639410EA2ABC79EEFCB35
SHA-512:	E9344F1AE1FAF611D91EE1D0D0F6FD3AF964EC66FA91A53A4F1AD6D60D53EC304C50F2B9A9D8AFC3BF9A07534684F85F2FCC474707F24B462A97A9D79F1CD278
Malicious:	false
Preview:	BM........6...(...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\imatges\sumabc7.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 9 x 23 x 24, image size 644, cbSize 698, bits offset 54
Category:	dropped
Size (bytes):	698
Entropy (8bit):	1.0398767581475394
Encrypted:	false
SSDEEP:	6:s/gl+01Accccc0XXXXXpnPXpsmXp9pXpqmX7qPX790X7s0XXXfcccccn:sI+06HHRbtdEijHE
MD5:	E75D8074F83FE8C809A740C15FD7FF55
SHA1:	486AB3644FFC03543863B7C0B7294FF4D322DD5E
SHA-256:	1A5973F1FF7599F28E51382942560911792058026822A39CBDE5FBDDB9018015
SHA-512:	C3B09BAB53FD1372FBEB09203AE3AE6CE90DBE61AB50C35A9BEFB41BFFA1FE02B8D0E320624A08E67B9C0C66F3DD0632004987CC0967DBA90C9BBDCEAC793D78
Malicious:	false
Preview:	BM........6...(...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\imatges\updabc7.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 14 x 24, image size 560, resolution 3780 x 3780 px/m, cbSize 614, bits offset 54
Category:	dropped
Size (bytes):	614
Entropy (8bit):	1.5387089853580784
Encrypted:	false
SSDEEP:	3:4Gljlll8lthxvX3llllllllllllllllllllllllllllllllllllll/lllllllllw:7lZci9a9a9Kw9a9aA9O9a9x9a9N
MD5:	99B06DDD05276F32E3F4CD9C29CCFFCF
SHA1:	816CC7257EFFCF59CC99CE67B5EC5EF413155F50
SHA-256:	F217EB4FA215862A904D57DB98AE2686CB4A678C3E11AE022A0A49BCD361E2E3
SHA-512:	AB7588F37DBFE486DE827245B4D72DEB82D5BEC254936D9C57BB4AA226B67C5EE090C20B023135D646CCAF49DBE491E529F4301D5018946DD48276CE0AC79005
Malicious:	false
Preview:	BMf.......6...(...................0...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\imatges\updabd7.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, OS/2 1.x format, 20 x 20 x 4, hotspot 32x32, cbSize 314, bits offset 74
Category:	dropped
Size (bytes):	314
Entropy (8bit):	2.894045179699004
Encrypted:	false
SSDEEP:	6:1Eo87xyd14d484LwD88O84b5O8ueO9NtH4:17CxH6pED88TkQ8uv9NN4
MD5:	22460DC4A7AA5BAF1F89B4861CDAA083
SHA1:	148BEC98B236859680AAEA6501E4469C20733406
SHA-256:	2E72301F5367C2EC178088C8FEE3E4C60247EE4D5C13F0E8C798B5FA583739E4
SHA-512:	37FA44E03FB2C72BDE91220BB496F2813C45CC066637ADD38E4B6B6FB0B4D886C496000DA9628A847E70F3E757CF1C546E787778333411230C49E0DCBF8540AA
Malicious:	false
Preview:	BM:... . .J.........................................................................................................................................................................]........]..........Y.]......................]......................]...........UY.......................................

C:\int_duca\imatges\valibd7.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 24 x 24 x 4, image size 288, resolution 3790 x 3780 px/m, cbSize 406, bits offset 118
Category:	dropped
Size (bytes):	406
Entropy (8bit):	4.0364011121582
Encrypted:	false
SSDEEP:	6:1xxCijpjt/S1VCaa0E/eBea5aaa0aHdaaaeQSqtMN5MTKeicTLd3llxZub:1x0ija1VCa2eoa5aasH3L2opcV3/xob
MD5:	0FA7BF7F2B58266489A0B632C782CDCD
SHA1:	0BA1540A0DB306A9BD8F14A15FF01C4784640893
SHA-256:	45DCF160039F4079036BF3D1B69949ABD893BD1521094F18CA298570F5A31A52
SHA-512:	A49096D1199ECA6A825A56B326C215FF2E6C112972CC68F2719F3A6C7F63A3015424AF43AA1F8C2A12636283886E0147F03082B60BB1D66FF302CD04AAF0FFAC
Malicious:	false
Preview:	BM........v...(................... ...................................................................................x............wwwwwwwwwwx.wwp......wx.wwp......wx.wwp.......x.wwp.......x.wwp.......x.wx........x.w.........x.w.........x.w.........x.w.........x.w.........x.w......p..x.w.........x.w.... p...x.......wwwwx.w.....wwwwx......wwwwwx.w....wwwwwx....wwwwwwwx.w.wwwwwwwwx.w.wwwwwwwwx............

C:\int_duca\imatges\vssvbd7.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	5.456575449518104
Encrypted:	false
SSDEEP:	12:wT93/Rlfl0oUMr2RODvNg6B//nl11uI5qslN0uiDll:wT93vmMsU1/lDu2qslWuiD/
MD5:	2A0193733131E622AE15DF47D5E78530
SHA1:	1DCE9092987F384D02CE8D50B0FD17CAB2ACC29D
SHA-256:	1A2AF104D276C89A6C03AB7FE5BD4340F807EC529A843E6BC8211A66C4BF7227
SHA-512:	28587C07086FAEBFDFAA6693A44026A7DF9C353C78C900173171230B87439E57F44C0B2E4E85B6105CFDFE46D3F66304F60030CB97DB4D0870E8D19877026754
Malicious:	false
Preview:	4...Q..b..1J.}.r6;{.. ..+.......J........pu.....K.....?..I.....L....&..CEf.....M......H..p.....N....H.Q.P......O.......1a;.....P.........2.....Q....L.(........R...Gp..........S.....HO.T......T....bt.........U....5..=.......V....aj.........W.....J]c.K.....X...".b.u.B.....Y...obp5.8[.....Z......\..S.....[......il.....\.......^&.....]...ZH.m.B2.....^...ZH.m......._...T..........`.............a........}......b..... ...W.....c......"E`p.....

C:\int_duca\imatges\zoomc06.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 90 x 21 x 8, image size 1932, resolution 3790 x 3800 px/m, cbSize 3010, bits offset 1078
Category:	dropped
Size (bytes):	3010
Entropy (8bit):	2.0964326008993726
Encrypted:	false
SSDEEP:	6:+xx5fCij6I6I6I6w0iiiiS6/ihhiBiih66ihh0iBih6Jihh0iBiS68uLBiP6r67D:q5fCi3BXhGihhohBziBt+PTlwkwwuba
MD5:	8440B67AB4611DBD1E86182563B55B97
SHA1:	25F5037ECB19F909FE9A1D731CA97BD9B05EC732
SHA-256:	D9B42BE1A9D109A5681319E95AC175965141CF13F889DFB7AC688A9EC64DD42C
SHA-512:	78F798A602E164A23DA07E89CEC9D6AEB89199B6AB670DFD2163649DC8E4BAB097C66DA54D60783254BCBD7DCE14B530A11591A8226EE75370D78DB89DA52EE6
Malicious:	false
Preview:	BM........6...(...Z........................................................................... @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`................@...@. .@.@.@.`.@...@...@...@...@ ..@ .@ @.@ `.@ ..@ ..@ ..@ ..@@..@@ .@@@.@@`.@@..@@..@@..@@..@`..@` .@`@.@``.@`..@`..@`..@`..@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@..@...@......... ...@...`.................. ... .. @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`...................... ...@...`.................. ... .. @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`...

C:\int_duca\infof735.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2354
Entropy (8bit):	4.6194234968789045
Encrypted:	false
SSDEEP:	48:ypSm/ThteDD+CQ/v8ebi/OTDP5bHJ3Zm3zCqkAIQl:y4yThtEQnTDP5LJ3Q3kw
MD5:	C43813503F00931BD40401F511E341D5
SHA1:	151BC38944F61EF6DFA0FBEDA2E49D8BCC5EF58D
SHA-256:	95070A28956941484B7A8A52B9E44F576673E4581F0BB0B849CF5B827D071E12
SHA-512:	C34EAB342CD6FABA4DA1EF3AAD192D07D17B112A2EE127C80FAC74B8788DD37BE71410A10312C57C88657A1B2C9661ABC66DEED538FF229F4881BD75D739F1DF
Malicious:	false
Preview:	Copyright (c) 1990-1999 Info-ZIP. All rights reserved.....For the purposes of this copyright and license, "Info-ZIP" is defined as..the following set of individuals:.... Mark Adler, John Bush, Karl Davis, Harald Denker, Jean-Michel Dubois,.. Jean-loup Gailly, Hunter Goatley, Ian Gorman, Chris Herborth, Dirk Haase,.. Greg Hartwig, Robert Heath, Jonathan Hudson, Paul Kienitz, David Kirschbaum,.. Johnny Lee, Onno van der Linden, Igor Mandrichenko, Steve P. Miller,.. Sergio Monesi, Keith Owens, George Petrov, Greg Roelofs, Kai Uwe Rommel,.. Steve Salisbury, Dave Smith, Christian Spieler, Antoine Verheijen,.. Paul von Behren, Rich Wales, Mike White....This software is provided "as is," without warranty of any kind, express..or implied. In no event shall Info-ZIP or its contributors be held liable..for any direct, indirect, incidental, special or consequential damages..arising out of the use of or inability to use this software.....Permission is granted to anyone to use this

C:\int_duca\instf745.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.050919888787394
Encrypted:	false
SSDEEP:	3:ovfhxwQrn:oHhxwQrn
MD5:	E53E20DB97314B5DF3B79865462FA781
SHA1:	19393E7A2AFA9803E4EC70CAF05EEE5563E946DC
SHA-256:	4D371655A004C3FF92EF92719C8FB3E8BA0A5DF3092F214F3E468EC5CB58D831
SHA-512:	5BC1C919BB12DC61A238355840CD6C0657505834F4BA5FB108194D68CE4ABA2C87168C7E5C6B214040408F82B3436A679523CED52290481B45561C7D59D26A79
Malicious:	false
Preview:	C:\int_duca\upgrade.exe....pause..exit....

C:\int_duca\int_3d8.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.629735294885636
Encrypted:	false
SSDEEP:	3:usyrOCDg3t1EMDgp2XKjKcedwHG7ov4+rjovn:usD35cednO4Jn
MD5:	114A1CA8D18963719E620CC1E2AE6197
SHA1:	AF60413417585112B6C03311E82497F54172AFDF
SHA-256:	B6458378C20242CC1746A86A70A8E94A581D9424B2663F828D3D0121E49FF0F7
SHA-512:	30A9FF75B37847DA311B6387D64D10B7B7B925134F215AF0D0F48DA22E84937F207B5470B2401DBA0A6E5A8CC5F4FF4378C405136FA19DECC034E56766E747D2
Malicious:	false
Preview:	[DATABASES]..DSNORIGEN=int_duca..USERORIGEN=..PWDORIGEN=..DSNDESTINO=int_duca_export..USERDESTINO=..PWDDESTINO=..

C:\int_duca\int_3e7.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Generic INItialization configuration [DATABASE3]
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.243468377856944
Encrypted:	false
SSDEEP:	6:u85wVZMRw1QiZViFH5XK29FhRy1kb/QDoyG91QiZh/Iha4Kj7+:u85wZN+0293b/QczNnK87+
MD5:	61E724D0B045B65FEE82907D789D5C85
SHA1:	1C4E666A201945038963A7F6F866EC47D090891A
SHA-256:	7888BD07B04CA664C1353D9E89EB285ACCEFD57CEF8805A4F02D76B807A408B5
SHA-512:	D0EB3A6418D9CB4A6AC89B962E413DEA7ADA2DBB003B3AC815D26FE24770B91CE73597133E0B177D54F3FC79989E2F93F2EB4C062EF7A35099C1E03E23665C1F
Malicious:	false
Preview:	[DATABASE]..DBMS = "O10"..ServerName = "itaca_pro"..AutoCommit = False..DBParm = "PBCatalogOwner='ACA_ADM'"..LogId = Mu]dI6K(..LogPass = YyQ)Up='....[DATABASE3]..DBMS = ODBC..DSN = MABRACASADDBP01..AutoCommit = False..LogId = ZiY{L{Z..LogPass = ZiY{L{Z..DBParam = CommitOnDisconnect='No'..

C:\int_duca\intd3c8.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	47616
Entropy (8bit):	4.961779533745828
Encrypted:	false
SSDEEP:	768:JsAZ3inch84zhnzeEDGAnxmnNzJuA5dIp12p:FZnNydt
MD5:	609D64D105929A0981416954C853D119
SHA1:	DFE4D0F4F3D51C935175D50B6B573D3EAA588C70
SHA-256:	88A55AF44EDB1E9C3A33FBACB700AE8BB56CE4F52C97E9C7C38C5758E219A202
SHA-512:	D75F0F92B3720FC837C30D47CCFBDD26F8B139C785820310B8823441D413EDDFEEDF45F3EF216F137DD90146C5ACDE372C415B1168EEB28FA2298A4D9AC0C0D0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B.Pt,.Pt,.Pt,.Y...Rt,.K..Xt,.K..it,.K..Ut,.Pt-..t,.K..[t,.K..Qt,.K..Qt,.RichPt,.................PE..L......S.................F...D......I........`............................................@..................................z..<....................................................................x..@............`...............................text....D.......F.................. ..`.rdata..d....`... ...J..............@..@.data................j..............@....rsrc................v..............@..@.reloc..l............x..............@..B.rsrc...............................@..@........................................................................................................................................................................................................................................................................................

C:\int_duca\libjf8bc.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	360448
Entropy (8bit):	6.0951398721054035
Encrypted:	false
SSDEEP:	6144:OObeuE82aWj9RliFR+BKjp8FKNcGzmnU:OeeuEyWj9+6OpwKqgmnU
MD5:	5B3CD60D003752061EA4A622CF8F8DD7
SHA1:	BC22B54B7790C3381B4A592275DB0D5D4CB30D3A
SHA-256:	53A5B5E2FE965EBF0FE85A5E0A2613D70EB7D5A5E5E98BD720790116BF07A949
SHA-512:	CD4EE02B0E5D70F35D3B5154B35F913EE24FE668351FD82C42137686ED9D21C669B3C4887AA680CABFA6D489335A2D03F35FB5AA0B2A7957ED4A85FA12D0A568
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?..{...{...{.......x.......y.......~.......y...{...t...{..................x...}...Z......z......z...Rich{...................PE..L...C..C...........!..... ...........*.......0.......................................................U...............8.......1..d.......H........................0...................................................0...............................text...p........ .................. ..`.rdata..{%...0...0...0..............@..@.data....3...`.......`..............@....rsrc...H............0..............@..@.reloc...6.......@...@..............@..B........................................................................................................................................................................................................................................................................................................

C:\int_duca\libjf8cc.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	2.9834019231042674
Encrypted:	false
SSDEEP:	192:FM/VSvBFaddCHtBBvNb39kcCTzwukgZM9SDcH6yXo688wAVNNhonQWwje8:S/VQBo/CNBzbofr0oQ6CoR9AVv5
MD5:	88042CD545C7604B2120FD05DF5A1688
SHA1:	4EEF8F9BCA7A1513BED6F6E7CF9185ADE15812BD
SHA-256:	7665B696A87EE9FBAF28F26BF4316AA43FC9C1764A616B6A27F6F544F1079B98
SHA-512:	CB9EE37CD377AEE058DCC03236F413783CC3812A4D288E64663EC85806F76E108AB4AC7F93D4B3E5FA7A46AA6F7D0A59E8F67020D9F2B1DC2E0767347E1B6EE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%B.tK..tK..tK.jhE..tK..kX..tK..tJ..tK..kA..tK.QrM..tK..kO..tK.Rich.tK.........PE..L......C...........!.....0...@......[/.......@.......................................................U...............C..4....@..<....`..P....................p..D....................................................@...............................text.... .......0.................. ..`.rdata.......@.......@..............@..@.data........P.......P..............@....rsrc...P....`.......`..............@..@.reloc.......p.......p..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\libjf8db.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	5.100900796766208
Encrypted:	false
SSDEEP:	768:xUjDvvbajZah9H0SJk64mqHoL4Gbx4K7x/ipSnnFFFwUBg+9:IhUSC64Wbx44xcSnnFFFnP
MD5:	6AE36632129347D5CAAF4EC6A27EB2D9
SHA1:	75AFD9DFF712E9AC40B015D469B43EE895453D73
SHA-256:	4B61000E76419D01E21798BDFEEC4F54186386A590B0C052FD0675FE5AC4EBF2
SHA-512:	2C25E3BF667F5AA292F7FA8F26DB7FB6E9C36988E619119F8BDE14F7586473C72448AEBCE9E220390CCF26D27E3FE4023E0A1D2C292787EFCD7818DE3F520366
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........1..._..._..._...S..._.s.Q..._...L..._...^..._...T..._...U..._.H.Y..._...[..._.Rich.._.................PE..L...%..C...........!.........................................................@.......................U........................<.... ..@....................0.......................................................................................text....p.......................... ..`.rdata..............................@..@.data....t....... ..................@....rsrc...@.... ......................@..@.reloc.. ....0......................@..B................................................................................................................................................................................................................................................................................................................................

C:\int_duca\mdacf774.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MS CAB-Installer self-extracting archive
Category:	dropped
Size (bytes):	7879848
Entropy (8bit):	7.997338948473388
Encrypted:	true
SSDEEP:	196608:61DmSrP6UMEvFQmoZDCsuJk8cRlkKrDHlXcX8CAWK1:6VmLENuksumf+K3lMXnK1
MD5:	76D2BA88D85771F1919307A84F370E77
SHA1:	0312438391E981DE55FBE26B68A03966AA20E157
SHA-256:	E769F2F611F8F8E2DB009C1C5F129E838DC8E8EFE1332524F31CAF1FE0B93EFC
SHA-512:	ECE120DD5A8AA5C8C2FF1D6A82FDA2650C144E79AA5A38AD70663FD1143269793BD709FA7B6729DA480F1484E284470E4BA125A7ECA0BA9D57FEE4D82EDDEF64
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Q..5......................w.....I'.......................................@x.....A.x..................................................zw..........*x.................8............................................................................text....................... .....s. ..`.data...............................@....rsrc.....w......\|w.................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\mourf735.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.0323362829877745
Encrypted:	false
SSDEEP:	3:urRFKWwcA0uZv:urO0uZv
MD5:	DAE1773D69F8D83484600A727088AFF0
SHA1:	68C1FA6ACEFAA1734F6331BDEA3F905B5BA67369
SHA-256:	25A009F8C284DDC3B118D986EC958F3B192663C723D7653FF8647954E8F377BD
SHA-512:	679E8A39ED6AA498EFAD708D4C52D57D4260CE623689953DD553DBB515B151703E3131B9D70380D223C12E4159D55E7F4EB884D06872E98538406FF1CAC1F8F0
Malicious:	false
Preview:	copy %1 %2..rd /s /q %2c_..pause..

C:\int_duca\msvcfc66.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	421200
Entropy (8bit):	6.595942471932211
Encrypted:	false
SSDEEP:	12288:Seb8zxr1aWPaHX7dGP5frhUgiW6QR7t5qv3Ooc8UHkC2e7wx:Seb8Fpa6aHX7dGP5Gv3Ooc8UHkC2ekx
MD5:	BC83108B18756547013ED443B8CDB31B
SHA1:	79BCAAD3714433E01C7F153B05B781F8D7CB318D
SHA-256:	B2AD109C15EAA92079582787B7772BA0A2F034F7D075907FF87028DF0EAEA671
SHA-512:	6E72B2D40E47567B3E506BE474DAFA7CACD0B53CD2C2D160C3B5384F2F461FC91BB5FDB614A351F628D4E516B3BBDABC2CC6D4CB4710970146D2938A687DD011
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e..d...d...d.......d.......d...d..Cd..K*...d.......d.......d.......d.......d.......d.......d.......d..Rich.d..........................PE..L...A..M.........."!.................<.............x................................(~....@.................................<...<.... ...............V..P....0..D;..p................................/..@...............p............................text...u........................... ..`.data...$:.......,..................@....rsrc........ ......................@..@.reloc...S...0...T..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\int_duca\msvcfc85.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\nlwnf8eb.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	2.1852762404625787
Encrypted:	false
SSDEEP:	192:cDswlM1zkgkXYP84lLtptsz9huZEdZntep:dtUAc9huyop
MD5:	9FF3CB81D2C201F96B734C0DB5A2AD48
SHA1:	EFD9CA0CB99CA4F74B70EB80EE69E17A8D22DBFD
SHA-256:	709EFB99250EBF69A787E11C3F3D2561165FCCAD87A064E4387515D7C9511621
SHA-512:	52C6A8007FA138D996ED5F90F2F6B5102EDE23B1BDDA1F6A2C43048A4773E7FD602E65D6FD54E176AF3A361FCAA6E9E97CD80C335CAB77D240BE8B92F1F55075
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r.......................Y...........Y.....Rich...................PE..L......C...........!.........@......)........ ...............................`.......................U..............."..v.... ..x....@..@....................P....................................................... ...............................text............................... ..`.rdata..6.... ....... ..............@..@.data...<....0.......0..............@....rsrc...@....@.......@..............@..@.reloc..>....P.......P..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\odbcf8fb.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	319488
Entropy (8bit):	5.933841267473828
Encrypted:	false
SSDEEP:	6144:kC+QLA/I1yeEgou1d8wVO/S5lSZsye9hz8SHPQyIOCZ4umG:sUyeH1ssZ18SHP3IXZ4C
MD5:	E74DAEC4957DA366BFE6B879521E5F04
SHA1:	8CE91464EA719944F3FC5CFD7A0122703A858B3D
SHA-256:	AB07DE3B9BB838A83EC1F42968D3E367FEAE77F484BE8C38C9DE1FCF0D5AF66B
SHA-512:	0EF439EC0A3C19E98F6885A1D660F059EBDA5D7521CC4C460FC5771700BD3369FD3E30524F321BDAC8FAE8CC84AD452B0F956623EA1BE161D3E20EAEA507D43C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.n$...w...w...w,.{w...w...w...w...w...w...w...w...w...w...w...w...w%..w...w...w...w...wRich...w........PE..L.....V...........!.........@.......l............'.......................................@............................w............ ..h.......................D!...................................=..@............................................text...G........................... ..`.data....i.......p..................@....sdbid..............................@....rsrc...h.... ....... ..............@..@.reloc...$.......0..................@..B................................................................................................................................................................................................................................................................................................................................

C:\int_duca\pbUIfab0.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3058176
Entropy (8bit):	7.1188527070849155
Encrypted:	false
SSDEEP:	49152:0fsstdUqwvLaE+ETaKeSU1uRzTw5tJP3O9K3qcMj3iFu+wJRoj9ghi1RebpyTIgs:0fVdUqFEVTcSU1kzTwpvO9K3bMeFu+wD
MD5:	5CFE900AE80095F4AA54E3B4BF15FDC4
SHA1:	1CF9A2A29FF4A886E82BD563359B4BC26764C23E
SHA-256:	32CB165F59361015E542A68721585F55E823D56FFEB6D8176590EC91EA5278F0
SHA-512:	FC11F0084AAAE2AC12988DD8C07F252F620BBA78A0755E369022EEBAB404DDAC04E814340C6AA2FAB792CD05598EC5F4A170913131BCD41C54F545FECF58C5A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........rh..;..;..;..;..;..;..;..;..;..;...;...;..;...;\..;...;n..;...;..;...;..;...;..;Rich..;........PE..L.....S...........!.....x...........K.......................................`/.....9./...@.................................<...T.............................,......................................e..@............................................text...gw.......x.................. ..`.rdata...............\|..............@..@.data........ ...`..................@....rsrc...h............^..............@..@.reloc........,.......+.............@..B........................................................................................................................................................................................................................................................................................................................

C:\int_duca\pbacf90a.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.9742206465398375
Encrypted:	false
SSDEEP:	192:HXIGPoOxhYUw9GxOufY8qGU89Xr6/2qNmPlO93XHPVR6qOKpOM4:HXIGPHiUM+Ou7C+1GmPlOB3PVNOKcM4
MD5:	7FCE3A560CDB096431593D9409DC09FA
SHA1:	0B69F2DB60B0D2E079979D730057F2BB1930F060
SHA-256:	276C4465BC578C91B75114AB3EA0227FD9836F8A966E74C502AB1302716BF794
SHA-512:	75D52C6BE4838AF474AE6C79153730A2FF99D16A7ED03D8EE9D77F1CF8952F6C8422DF1DA8160AB10DA908333A334B087ADC573730B8BC0AF8908814726DBC9E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)...Ho..Ho..Ho.[....Ho.....Ho.....Ho..0..Ho..0...Ho.....Ho..Hn..Ho.....Ho.....Ho......Ho.....Ho.Rich.Ho.........................PE..L.....S...........!........."......0........0............................................@..........................D..V....@.......`.. ....................p..$....0...............................>..@............0...............................text...d........................... ..`.rdata..6....0......................@..@.data........P.......,..............@....rsrc... ....`......................@..@.reloc..6....p.......2..............@..B................................................................................................................................................................................................................................................................................................

C:\int_duca\pbdpfc46.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	125904
Entropy (8bit):	6.579345169019503
Encrypted:	false
SSDEEP:	3072:YY1C4mKsiXHIMTlrfGobgiST/orwwNcpIaWIeox0yewnnFFF9nnFFFcUw:Z1C4mKsi3IMJrfGobgPorwxeg0L9
MD5:	6D5D2B3AAA9A7154AE145A15362392D7
SHA1:	463F077D5CD04A2E6B0E8B63B8FBDF5898A6E5B8
SHA-256:	F803CFB75F0407D0CD27DDDCACBEBD3D5B6F6CA8FA230C2F689A07699BDECF82
SHA-512:	87FF54A18EEF9D0EAD96B128AEB124240AB1958C18D443E0256778254D03E85A73DCA005E8F4BDDDF2CC6BA3E590E15C672205E499F4DF46C1F64222EFC9BE9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P......................7...............7.............7"......7#......7.......7.......7......Rich............PE..L....$.Z...........!.....v........../................................................w....@.........................p...x...\...x....P.......................`......................................X...@............................................text....u.......v.................. ..`.rdata...%.......&...z..............@..@.data...............................@....rsrc........P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................................................

C:\int_duca\pbdwf90a.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4296192
Entropy (8bit):	6.214139443875799
Encrypted:	false
SSDEEP:	98304:QPS3iIvEHbN+cLjq78eel0613cUcIXKqnUH:QPoiIvETLjX0K3zccm
MD5:	8A139270A4485EF11C4413CF0F60A619
SHA1:	D7A1A0AFBE1F0827E133AD548B7CFAE33FC20E1E
SHA-256:	2D295425D60CD83DD83B55C41B0030B096E2E3F64E300546914EF98220B024F8
SHA-512:	7DE50533DD9F8B7016B4ECC5E94A489444E0512B6128C54C6AF81E5212D4D377DACFD806A111E6040C0154995BAD646BB872E89BEC63003805B0DDF59517426A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.../.../.../.Y...../..P..../...../....../....../..P..../......./..P..../..P..../..P..../..P..../..P..../.Rich../.........PE..L.....S...........!......+..........W*......0+...i..........................0B.......A...@.........................`.1..R...>1.@.....2.X....................p@......A+...............................0.@............0+..............................text.....+.......+................. ..`.rdata..2....0+.......+.............@..@.data... .....1..h....1.............@....rsrc...X.....2.......2.............@..@.reloc.......p@.......?.............@..B........................................................................................................................................................................................................................................................................................................

C:\int_duca\pbjvf9b6.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	5.960294929923086
Encrypted:	false
SSDEEP:	1536:yFRhzSdMMrX/civ6qY8dpger/UMsSE7YRCW/lMOfyJQe5:szzSdMMrX/3tWrURCW/lMOfyJQe5
MD5:	B090175305CACFA401821675D2A7889A
SHA1:	DBEFBCB503030082DBD5755CCD2E56B38A650E52
SHA-256:	620DFD05F5ABD5C1A59B73B1B7A336A9E3B8BD78FC2AD782566433B3E9A45DF0
SHA-512:	4D15AD2F795CDBB2A9CE50F61592E0CA25A2B680F03783AF75505DB07919F52BD03A8BD738730F582C7C602C5DA715D7BE2AABB04E5BC49AEC0D0724B9966539
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&3V.G]..G]..G].]....G]......G]..?...G]..?...G]......G]......G]..G\..G]......G]......G]......G]......G].Rich.G].........................PE..L.....S...........!.........Z......9.....................................................@.........................p=.......6..d....P.......................p......p................................,..@...............P............................text.../........................... ..`.rdata...........0..................@..@.data...0....@......................@....rsrc........P.......2..............@..@.reloc..0....p.......D..............@..B................................................................................................................................................................................................................................................................................................

C:\int_duca\pbo1f9c6.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	370176
Entropy (8bit):	5.867771445753426
Encrypted:	false
SSDEEP:	6144:SP9eRaJoFKUSHE+hqvC91EXH6r1mY/nKrOZxQ0:zRuxHE6qxEnX
MD5:	9243B89DDDEBCBB4FD7BFBBAFBC4C332
SHA1:	AD4ACA714A7DE585274A3F53D31B27F42DB04477
SHA-256:	C41335693576381D9AB083423B0910808362F3F8EF5A952274CFC2892A3F2FA7
SHA-512:	0E6FE49705E9EE81AFCDA7DBC2B3B4109ACD807C20EEE05843F1A28EA1ECE345979273B2F12F8EDA2FF90D7D087B14B41FA95A0E8CB63518E020F38C22D7FCB6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f.#.".M.".M.".M....#.M.90.!.M.+..#.M.+..&.M.90.'.M.".L...M.90...M.90.-.M.90.#.M.90.#.M.90.#.M.Rich".M.........PE..L......S...........!......................................................................@.........@...............`.......\...d....`...M.......................#..................................x...@............................................text...8........................... ..`.rdata..............................@..@.data... ...........................@....rsrc....M...`...N...2..............@..@.reloc...$.......&..................@..B................................................................................................................................................................................................................................................................................................................

C:\int_duca\pbod687.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Generic INItialization configuration [WATCOM SQL WSQLODBC]
Category:	dropped
Size (bytes):	75798
Entropy (8bit):	5.559268371094131
Encrypted:	false
SSDEEP:	768:oDeDlDlDcDEDCJSDKDwCRLsDL3D9jWQB+ef+5OBKHstezE6NoyenUjM6CgYrxkWz:W44xsZFgYrS5wljdzPHR34mQi
MD5:	6FCA26E7A4C5A74656341AE8F5CFD659
SHA1:	72EF2A7D89912B8A29683CE13C2A52F3F12DB1FC
SHA-256:	F24C7B020E035D753522E7B5767022812F9096A145E7882657E239B8A62D52CE
SHA-512:	3BDA4C047DF2BB6FA4549E611BC1748379A96ACED2CBDCD04B02D3E5F9821BA36395439B54A6DF70FF709367B8018CDC56DB2AD599B31ADA4CF8AFB32BA1CF80
Malicious:	false
Preview:	; ******************************************************************..; DBMS Driver / DBMS Settings see comments at end of file..; ..; ******************************************************************....;[WATCOM SQL 3.0]..[WATCOM SQL WSQLODBC]..PBSyntax='WATCOM_SYNTAX'..PBDateTime='STANDARD_DATETIME'..PBFunctions='WATCOM_FUNCTIONS'..DelimitIdentifier='YES'..PBDateTimeInvalidInSearch='NO'..PBTimeInvalidInSearch='YES'..PBQualifierIsOwner='NO'..PBSpecialDataTypes='WATCOM_SPECIALDATATYPES'..PBSystemOwner='sys'....[WATCOM SQL]..PBSyntax='WATCOM50_SYNTAX'..PBDateTime='STANDARD_DATETIME'..PBFunctions='WATCOM_FUNCTIONS'..PBDefaultValues='autoincrement,current date,current time,current timestamp,timestamp,null,user'..PBDefaultCreate='YES'..PBDefaultAlter='YES'..PBDefaultExpressions='YES'..DelimitIdentifier='YES'..PBDateTimeInvalidInSearch='NO'..PBTimeInvalidInSearch='YES'..PBQualifierIsOwner='NO'..PBSpecialDataTypes='WATCOM_SPECIALDATATYPES'..IdentifierQuoteChar='"'..PBSystemOwner='sys,db

C:\int_duca\pbodf9e5.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	538624
Entropy (8bit):	6.003038977539719
Encrypted:	false
SSDEEP:	6144:wBT6R3aSu4KqJcw3DTmCBCedjYxVUnYF4dZ2qhDKkZywW5mF3JBHLyYH85d1OZ2c:hoSumcw3DTBjvikZytY/S2
MD5:	D2A8ECCFF40CD5CDB012C2051C5B6381
SHA1:	698A3C51E02E1F8599B94131EBD1CB1540D896E0
SHA-256:	4069D04384134179BDF081CB95EC74120DEAB0AF003C797CBFB4AF6AFCCB3DEC
SHA-512:	830A33C63D58F3C7E201D5604966A2089F45B584F8D27BCD58D1662BD6441CBB9B68D24EB4BD25CADE4456EF2B58BD4CC664E35FD1B11F98F03940AA0C49C606
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......TPx..1...1...1.......1.......1...I...1...I...1.......1...1...0.......1.......1.......1.......1.......1..Rich.1..........PE..L.....S...........!.....\...........e.......p...............................p......1.....@.........@................a..%...\T...........V...................0...5..pt...............................P..@............p..T............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data...hT...p...R...V..............@....rsrc....V.......X..................@..@.reloc...6...0...8..................@..B................................................................................................................................................................................................................................................................................................................

C:\int_duca\pborf9f5.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	374784
Entropy (8bit):	5.863670895562171
Encrypted:	false
SSDEEP:	6144:I/uNGh+yMnna9NHBXQEwN2qEGXpj2pd4E9lUknOZQw8x0:wuJavHpQBNzpjqlN
MD5:	8026D2B34F3C272C1EAA15D07854FC72
SHA1:	78094701ABE60D5DD84986069BFA0D33B28A454B
SHA-256:	156AAE23EDD7B32EC72EC16C6829408A7E4E357E7628F46182272C0B6E9EFF3E
SHA-512:	B3130EF2D35C35A3D87721C29C006AB2257C61575E6089D9C8E14D6197BBAB98E64D92B61B13E39282CF0D8D9489D1DAA8F516CBEEB3F42782F7364BAFA051D1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.#{#.M(#.M(#.M(...(".M(80.( .M(..(".M(..('.M(80.(&.M(#.L(..M(80.(/.M(80.(,.M(80.(".M(80.(".M(80.(".M(Rich#.M(........................PE..L......S...........!................+.....................................................@.........@...............`.......<...d....p...Q......................D$..................................X...@............................................text...x........................... ..`.rdata..............................@..@.data...`...........................@....rsrc....Q...p...R...@..............@..@.reloc...%.......&..................@..B................................................................................................................................................................................................................................................................................................

C:\int_duca\pbshfa14.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3348480
Entropy (8bit):	6.671182224264595
Encrypted:	false
SSDEEP:	49152:C8YbpKTiFexErp0WtIhxIvX5mw2h7tJZkTOYuTa6boT+CZP/xq0kD+AKo+y:RFYrpbIhm5mw2h71oI3
MD5:	B5972C4CE06AEFF5B9E6005AFB6A340D
SHA1:	99784F7EECA8C26BB8008B5418459E8BE23622C1
SHA-256:	A15F742BD0C557998E2879DCBD9A144210873BCFAB70A2279D4ACBA931DFC18E
SHA-512:	7738373E4044C82C27EBAB269A2BB1714F2D069AF1D99DE0FE48EE89F0AAC4DA25423B0ED259D1FC7996068FC7C3C7EAC6A016DBF4EB8200D8FB9580529688C5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......3Hy.w).Bw).Bw).B._.Br).Bl..Bs).B.g.B{).Bl..B.).B~Q.Bv).B~Q.Bp).B~Q.Bh).Bw).B..Bq..Bc).B.>HB.).Bw).Bm).BP.yBv).BP.zB.).Bl..BY).Bl..B.).Bl..Bv).Bl..Bv).Bl..Bv).BRichw).B........................PE..L......S...........!......'...................'..............................P=...........@......................... D..'....).h....P:.`....................p;......'...............................................'..............................text....U.......V.................. ..`.textidx.-...p.......Z.............. ..`CONST...P.....'.......'............. ..`.rdata.......'.......'.............@..@.data...4....p+......F+.............@....rsrc...`....P:......(0.............@..@.reloc..J....p;......B1.............@..B........................................................................................................................................................

C:\int_duca\pbtrfaa0.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.859138430589259
Encrypted:	false
SSDEEP:	1536:ItMPEu2W7UbPmeA6qxn5eqdMPKlFRMBtpN67Uu4KMOBaUis:IqEuhUbeePeHMOBaUi
MD5:	82CE68A7ED00E80B9AE34B7F6493494E
SHA1:	29FA5032145BB67B116D88D9AD9C8F961E33BB4E
SHA-256:	6BABB79959FFE5E9A593F183F3E284AD8BC4298045A099C89D66144F8118098E
SHA-512:	C9A3F40DCCCC2422303A58B43360697E58D89FC7BD09EFE22DA9216D6E29B942141BFBFCFAA446EA987D1BEEC706453814CE41ADCDE832D7D9607DE083FE457A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y...8o.8o.8o.-v..8o....8o....8o..N..8o.@..8o....8o.8n..8o....8o....8o....8o....8o.Rich.8o.........................PE..L.....S...........!.........x...............................................P............@.........@...............P...........x.... .......................@.....................................X...@............................................text...P........................... ..`.rdata...P.......R..................@..@.data...............................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................

C:\int_duca\realitzar_duca_archivos\Circ791.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 429x255, components 3
Category:	dropped
Size (bytes):	89241
Entropy (8bit):	7.750620248539151
Encrypted:	false
SSDEEP:	1536:1hbr17eGxWzfL3qoUujEh2fOfjlN9bIs8YhkwQvYBHCXKPm:1hbr17OfL7UuPO5UgkGCXKPm
MD5:	6D66156D37E5C919090E95679A0738AF
SHA1:	7CC7E1D34074F604775A4CE8F63F730BFF4C17F8
SHA-256:	E5AD5C172F4AE07F7A5D87B5687FC5185723D2A0B193A35D7FDDE3D2F1F28032
SHA-512:	719F456D92356560A448B9021A7FF50382CE804D66A9986177572EA1C3B3927A1BDB543D7B61D22E687F2B9DB00A2D38312DC31F07B3351C4E8E8710A597F64E
Malicious:	false
Preview:	......JFIF.....H.H.....zPhotoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p...C...P..W...............JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d.................................................................................................................................................C.p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

C:\int_duca\realitzar_duca_archivos\Circ7b0.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 429x255, components 3
Category:	dropped
Size (bytes):	89241
Entropy (8bit):	7.750620248539151
Encrypted:	false
SSDEEP:	1536:1hbr17eGxWzfL3qoUujEh2fOfjlN9bIs8YhkwQvYBHCXKPm:1hbr17OfL7UuPO5UgkGCXKPm
MD5:	6D66156D37E5C919090E95679A0738AF
SHA1:	7CC7E1D34074F604775A4CE8F63F730BFF4C17F8
SHA-256:	E5AD5C172F4AE07F7A5D87B5687FC5185723D2A0B193A35D7FDDE3D2F1F28032
SHA-512:	719F456D92356560A448B9021A7FF50382CE804D66A9986177572EA1C3B3927A1BDB543D7B61D22E687F2B9DB00A2D38312DC31F07B3351C4E8E8710A597F64E
Malicious:	false
Preview:	......JFIF.....H.H.....zPhotoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p...C...P..W...............JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d.................................................................................................................................................C.p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

C:\int_duca\realitzar_duca_archivos\Circ7cf.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 586x164, components 3
Category:	dropped
Size (bytes):	62287
Entropy (8bit):	7.716792726673564
Encrypted:	false
SSDEEP:	1536:DBRCfVlq2GkrKo6WT/R/mUneF2dZI3Q5zq:DBR6Q2Gk2o6689F2dZI3Qc
MD5:	37F73BAF566F3F86D7EAF13072408E19
SHA1:	E969CAFD6C5AEC48AF7DB01AC552230B1638229B
SHA-256:	6CF6A6578D80E0C79BE37D4DE58EC8A201020682CDA519529F891A84CCEB712C
SHA-512:	C128054DE4F7AF099356EC4587023563F7AA3DACAAE6BC93CED818E56025944833458F72C4AB89A96B8F6926E4BCC00DE647E72959719ACA00E87D91FA7057FE
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM.......e.......p.......P..(....I..........JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d...................................................................................................................................................p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

C:\int_duca\realitzar_duca_archivos\Circ7df.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 328x130, components 3
Category:	dropped
Size (bytes):	33305
Entropy (8bit):	7.691494984342802
Encrypted:	false
SSDEEP:	768:ZsZF+YyXo5nNJuEYAGEaRgSR95pyRAFRVgcKppppg:5bo5DuEYAGEaf9fyw
MD5:	D71D458D4E01E79E7368C8E2CC561743
SHA1:	CCAE69320B05E24702E3F150C994082CBAE67541
SHA-256:	2597448CA7ECCBB1B78019046D399108A73A6F31B835FA09E665D26F2718DAEA
SHA-512:	60D7A40BC7832666991653DFCEB41BE44FF4EB38871A2EDF611EB1379F3B042908B98594F8D3A4079B29AED4B777CACA2EF56B618933DDBB1AD545B855421EBD
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p...,...P..9...............JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d.................................................................................................................................................,.p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

C:\int_duca\realitzar_duca_archivos\Circ7ef.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 323x118, components 3
Category:	dropped
Size (bytes):	30150
Entropy (8bit):	7.695150837131857
Encrypted:	false
SSDEEP:	384:/hYNg7nEUbzNlB7OcGB0yjnjuLAWxj96rwqx3QK8UnN1LQo/:/hYyNbRfq/7juLAej96rbx3mU7Z
MD5:	3D32CBE4BD2B430DBFE0CFC16254EB89
SHA1:	440F0269ED82A33451A91CDF4CE51E0F8C39C526
SHA-256:	AD23A65379B2F2EAB2CB5B32CD14B357BD9F3C797B31402439F1947BE63437EE
SHA-512:	9182050E2013B3CB79FBAA7D4C90B4FED521E97FF77EBC89CE149539D568A5B417D090F9BFA2E6E8DF8B294DEE3D994A5868D2C1C373BB79411AB84C9CC5BF5F
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p...)...P..5...............JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d.................................................................................................................................................).p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

C:\int_duca\realitzar_duca_archivos\Circ7fe.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 397x128, components 3
Category:	dropped
Size (bytes):	42444
Entropy (8bit):	7.751612594458984
Encrypted:	false
SSDEEP:	768:vTOYyRvRfXh64xRqJpgccox/fKCluqy5dUXmj1u2gLqpcRuRHjKvfE7jdA+XS6p8:vqPXhdxRcgEXKuuqy3UXmxuX0cRQifYo
MD5:	6CA3CC12C5DDFA2D156DA021605FEDC2
SHA1:	CF6451547740BD16E89E7DCF87F25FA902354F55
SHA-256:	DB34F731BA89F4B060141F1A7BD9DEDA51B5E428643921D8A7AE6ECCB51C4611
SHA-512:	38162F515544BFD2E746C13A8DA0FD3E0F92939CA843FBA6B5645BF698CE5FC71EC30282FD79BF695E9B59B94C033190BDBBD43206E813B8336841DF9ACDA657
Malicious:	false
Preview:	......JFIF.....H.H.....LPhotoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p...$...P../@..............JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d.................................................................................................................................................$.p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

C:\int_duca\realitzar_duca_archivos\Circ80e.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 397x128, components 3
Category:	dropped
Size (bytes):	44110
Entropy (8bit):	7.7508050224686125
Encrypted:	false
SSDEEP:	768:no8Yympm0hFNuxBrsGpXGVp0VHkwbd4UNftt6ADyElXO3GA/RtfFND:n9qpuF932wbXIEeWYf
MD5:	3255D1538594B50747CF027FC23E32CF
SHA1:	7D8949FED94F9C6D42EDCAA12B82B837F47BB51E
SHA-256:	9F182BA6363F878E49FCA00770E0F1C6465E374AFB0D655F673F2A1378BFC54A
SHA-512:	ED3D84E954B3BE8A976DB015C39BEBFC892D894C5D2645B6A7FF867A8BA31B282390F84668E4426C0894AF1E4C8093A5491711536C9CD0A1347F014D57149D3D
Malicious:	false
Preview:	......JFIF.....H.H.....(Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p...$...P../@...\|..........JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d.................................................................................................................................................$.p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

C:\int_duca\realitzar_duca_archivos\Circ81e.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 672x175, components 3
Category:	dropped
Size (bytes):	81235
Entropy (8bit):	7.716363072958926
Encrypted:	false
SSDEEP:	1536:tIycTRToIx8qqqqqqqqqqa2lqltf9KLw6abGhS5NUs2xvZRE4ydyMzdt3X:yyqVyqqqqqqqqqqqYMoECsSVydyMzDH
MD5:	18C3F4211314F61BD739E4F5FEFF20BA
SHA1:	CE6182F14BB80AEC5ECE0FA431DE40E437EADB56
SHA-256:	F8E780C003073B37643DB4B8CADDFAD4E4C1013BE9518F8476205F0DD76B0D0B
SHA-512:	BDB14EA93A06B524723A3B260311DDE5ED260E7B4C170B5280B1DADEE7371948058C03C0F32F23C12B856011B69CBF8BB63DE1075A01996D202543631A690582
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM.......q.......p.......P..&....U..........JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d...................................................................................................................................................p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

C:\int_duca\realitzar_duca_archivos\Circ83d.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 461x118, components 3
Category:	dropped
Size (bytes):	39246
Entropy (8bit):	7.684369587692718
Encrypted:	false
SSDEEP:	384:1r6YNg7nhj4Wkt7ydoUZboZFsGh9bsuHZ9ByvkCjanJnpm//RDb9kUZpBlotbEg/:wYyN4WkxtQSvyNOu//FxkFogkaZh
MD5:	CECB947B765D6CC57F61E7EF777EC28E
SHA1:	9BC466595C0CC2B0B6F5365830CD0452BEB8696E
SHA-256:	BB257374D2E8C80917844DBBDD000EA9D03C6C66DABEC7AA17639326111A1372
SHA-512:	3B35700453335F41432025E2A09E5AC28C590D499A3ABA59352DA6397203711AFF40702E70B19C949CD09CE1F79B8B10CE91B5B1A71B09C525FBA06BA7D549B7
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM.......f.......p.......P..&....J..........JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d...................................................................................................................................................p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

C:\int_duca\realitzar_duca_archivos\Circ84c.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 435x125, components 3
Category:	dropped
Size (bytes):	41020
Entropy (8bit):	7.696640298462367
Encrypted:	false
SSDEEP:	768:0psYyCMY62xvgedfhqfhVat3hAU7ibpNn5CjtMlpyMBy:gsWy2hgSpqJV6p7ibFatOpyb
MD5:	14007D16CDB3FB74A80C69B044BE3D1E
SHA1:	DFA390E42FFD8A8999D64BB97B9EF01284DF45FD
SHA-256:	0FD80C37F1B1B11783025AA2E9D103D107E3422827C52940E03CD8ABF6F38458
SHA-512:	62D981B8FB88D962AF78C4319118EB29E456FB86F34B09EB344DFAD7E1629DD78BF002FC334106D487726522BD10BBDDC64B5EA4A5F671A5286EC1A55D779D95
Malicious:	false
Preview:	......JFIF.....H.H.....$Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p... ...P..*....x..........JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d................................................................................................................................................. .p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

C:\int_duca\realitzar_duca_archivos\Circ88b.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 688x71, components 3
Category:	dropped
Size (bytes):	28111
Entropy (8bit):	7.631687951637095
Encrypted:	false
SSDEEP:	768:yb5Yy9aaaaVaaaaXrPSmnLv516FSZnIR5s/3+Ueks/u:s5zrPSYP6FS1juA
MD5:	CC6D695AE101F5FE6D10A0BEFB9B7E7F
SHA1:	53F8A9A82F86C952CCA21171AC19F7E9D1A1CEC6
SHA-256:	121CF132C361103271477E256770E4CED5927C84A75332D666489D024B135874
SHA-512:	7BD5477E3C3B240F24C89243288B89339B421F00318BEE15EE6C3E3A1E65216FAFAA7FC7066BCC8CC61BB9A7F96070BCB73711CF24C956869A69A346BA3D3B54
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p.......P.......p..........JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d...................................................................................................................................................p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

C:\int_duca\realitzar_duca_archivos\Circ8aa.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 686x70, components 3
Category:	dropped
Size (bytes):	28065
Entropy (8bit):	7.633615432034812
Encrypted:	false
SSDEEP:	768:P7YyzYgYgYgYgYgcYgYgYgYg/ed4E/0xE9iiFF7ONktTn:TXhhhhhchhhhm4E/0xUiiGNw
MD5:	28320A60245F67D295CF3C3E56395E66
SHA1:	BEBB33C6EADA4A025A3169B7CAB2DABCF7E79DE1
SHA-256:	97011AD6A741EAE5EF56B6C2012F9BA268000E2F0054F136B79F2F768D7C578E
SHA-512:	0CC14A87E94B45E7A349A4809BA67A04176CCC9CF2B525792D5CCF19BFDE5FFA3117D27B4F701A4E65F5D5CC78AF7F02B6C161B00925FCD873239B117C8C72A2
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM.......^.......p.......P...p...B..........JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d...................................................................................................................................................p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

C:\int_duca\realitzar_duca_archivos\Circ8f8.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 632x126, components 3
Category:	dropped
Size (bytes):	51565
Entropy (8bit):	7.711082892307689
Encrypted:	false
SSDEEP:	768:KjLYygzmpcSP6Pa8K7XlX9y2UfjqunMFtDlGlW36we+r/+QKApjaLL:YMXSP6PaPVXnUfjUBwM3sYGQF8f
MD5:	FE7500D7EE23A4D6336B526110C72ACB
SHA1:	2EEBE0B90C799AF21E591C46E026CE88A3696A12
SHA-256:	D885183860A3B7592422FAD30015B690795B19CD12F0B5B284BFB582CD1F57A5
SHA-512:	ABB0FD8951BDABC0E951CFDF47C70E7215A81AAD051A33D7E018D3862FC1FF92B41F0907B0AFEDD2FD25CF6F7515D809CE4FA3292872C4B867F187B18ED78836
Malicious:	false
Preview:	......JFIF.....H.H.....~Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p.......P..................JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d...................................................................................................................................................p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

C:\int_duca\realitzar_duca_archivos\Circ946.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 751x680, components 3
Category:	dropped
Size (bytes):	185882
Entropy (8bit):	7.49584904723519
Encrypted:	false
SSDEEP:	3072:fRmX/Lk32L4+UNn5Outm9TzRUrZHnH8cMDyrXyXA+oPdn+prcTkAFR:fME2LHUN5OtTFUVHcmWjoln+poTkAFR
MD5:	CBAC2D43BB5FE9DC42A8AFBD5EAEACFE
SHA1:	BFBE8B6B8B945D95CCB2ABDEC1AFBD1E6D7B9619
SHA-256:	6E1D6988BF3E3E350DD83B0AAC4B9A818FED46F43EC0E402BDE4B5C5510A6457
SHA-512:	960332F68CC24CEB4426F82CDEA57E8C6FA25ABCBE5696A78AE64EB17D4C8876C61FE97236A656D8AB336465433C6FE775B09A8B5E8A1115DE5D43E34966E8E7
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p...e...P..................JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d.................................................................................................................................................e.p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

C:\int_duca\realitzar_duca_archivos\Circ995.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 960x720, components 3
Category:	dropped
Size (bytes):	94951
Entropy (8bit):	7.711945643115955
Encrypted:	false
SSDEEP:	1536:ChquYjT9oQ7fqptijLauzMnd/XYaq0XgRuM/C5ry4nLZb:G0SQj6tbuz4dQkM/C5maLZb
MD5:	69C988E77CFD4A9724B2861A6F3585D5
SHA1:	E7EC1028A9F07B19CA21F4B2D768D389B65A5540
SHA-256:	25BA34CF36432EB07F280F90EBF8C3EC3C969824D6A0B96516E08C83A60CB438
SHA-512:	A2DC311F7B7B1BB56249E0EE6F4569EAB28B37F31B7ED1066C713D07A933B34A356305C85598ACB538C803819D8EB270A1EE1125F2B7AC373779756838C32D04
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...+..\|k...Oc....[~.;nr...}j..,........c@........'$......cS....C..9.........(."O..Bq...q..b?.J...?.B..c......

C:\int_duca\realitzar_duca_archivos\WEB acd.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 1076x703, components 3
Category:	dropped
Size (bytes):	298830
Entropy (8bit):	7.634361939517249
Encrypted:	false
SSDEEP:	6144:2eo2lErliih+V7ggMipKT+VLVU7+LolXUYx4N5YBrXUZwQaO+AnVQPVBDqsQQP4I:QxrYih+VKipKT+VLVU7+LqUPNyU6Qa77
MD5:	E18238521B12324FD74BB247B5AA3851
SHA1:	DFAA70C058B0E12395C42EC1B065746076529538
SHA-256:	0CAED1506CFAEB707F6F07171E70EE1811E8C82BA3460F3D929C3559881CBAC2
SHA-512:	26FF9CD264B662C3D95B7DE0F66102FD8C2A40D023435E1B42879813650168EFECA8397CA64CBA2B959A05E7BF9BB2E5D72B6134D090FDBD4CA921D8E662B5D9
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p...I...P.._...............JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d.................................................................................................................................................I.p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

C:\int_duca\realitzar_duca_archivos\WEB add.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 1076x703, components 3
Category:	dropped
Size (bytes):	299381
Entropy (8bit):	7.635236150594499
Encrypted:	false
SSDEEP:	6144:deo2lErliih+V7ggMipKT+VLVU74JlXUYx4N5YBrXUZwQaO+AnVQPVBDqsQQP4I:jxrYih+VKipKT+VLVU74TUPNyU6Qa7AU
MD5:	525C425BD20D31CAE049D6D14D856D33
SHA1:	43635B6F06DA27D3BF07A259FC1C869E658D2FE3
SHA-256:	28BFA030DE43B7B9A72E84AA127AA05ABA41AC6B79BF56876EBBF339944149D9
SHA-512:	9A9C402673E1F35DE84C9C577E1005D3E6B58DEFE0638BD63B3C15F26A338E3003C357A96A36F1E00ACE02F010797FB9D63E0C62F3DB4D4CD11D1512D4C86146
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p...I...P.._...............JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d.................................................................................................................................................I.p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

C:\int_duca\realitzar_duca_archivos\aca_781.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	assembler source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11025
Entropy (8bit):	5.387223311171871
Encrypted:	false
SSDEEP:	192:JasaAaEadalsOsMsAsY992aM9vaYa4axaYayGOyLnmqaGagq9mW1rUcdEnoO5AnI:RIP
MD5:	1A6BC1384C42062E4F94B56F6E7B1B6E
SHA1:	5B3961C0AA2FD562FD52B0F6F6A69AB751489218
SHA-256:	BFAC0625495D4CD10AAB046B47B72D477F194EC5580072F5B0964466700E5B39
SHA-512:	901FE8789C3B922127C416829C901D4B57F736E4EB60853F234E0968C7D92AF04A38145CA682BFF7047242015743A4D807F4FD9A3A73C6AFD7E650C7D1077935
Malicious:	false
Preview:	BODY..{.. BACKGROUND-COLOR: #FFFFFF;.. FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;.. FONT-SIZE: 12px;.. FONT-STYLE: normal;.. FONT-WEIGHT: normal;.. TEXT-DECORATION: none;.. LINE-HEIGHT: normal; .. margin-left: 20px;.. color: #000000;.. list-style-type: circle.. text-align: left;..}....a:link..{...color:#00B400;...TEXT-DECORATION: none..}..a:visited..{...color:#00B400;...TEXT-DECORATION: none..}..a:active..{...color:#00B400;...TEXT-DECORATION: none..}..a:hover..{...color:#00B400;...TEXT-DECORATION:underline..}....A.titulo_pestania:Hover..{.. COLOR: #FFFFFF;.. FONT-SIZE: 9px;.. FONT-FAMILY: verdana;.. FONT-WEIGHT: bold;.. TEXT-DECORATION: none..}..A.titulo_pestania:active..{.. COLOR: #FFFFFF;.. FONT-SIZE: 9px;.. FONT-FAMILY: verdana;.. FONT-WEIGHT: bold;.. TEXT-DECORATION: none..}..A.titulo_pestania:visited..{.. COLOR: #FFFFFF;.. FONT-SIZE: 9px;.. FONT-FAMILY: verdana;.. FONT-WEIGHT: bold;.. TEXT-DECOR

C:\int_duca\realitzar_duca_archivos\aca_791.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	assembler source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10263
Entropy (8bit):	5.3885510316352985
Encrypted:	false
SSDEEP:	192:JapMaraAaEada5sYsNMsAsE0GaZaYa4axa/9M9u2ayGOyL5zaqwsgRTudlpov5A7:zIy
MD5:	8879F9E58EA406918F7BF110870E7710
SHA1:	8EBA3AB0297E3DCBDBB9772BEAD46BC1B22C13A1
SHA-256:	919417FB0EA73FFA177603B763FB12414F3EBA5A7F1D39022DB08B0FA13FCAF8
SHA-512:	B3A07736E63D47779C5C51BDA51D4DC47D7EF9D82B734AD64FD0BDF1C6478A84AF13D0989DE92EE593261BF15CE9DA0AC2F0CD1519B45488745D101B7A8785B5
Malicious:	false
Preview:	BODY..{.. BACKGROUND-COLOR: #FFFFFF;.. FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;.. FONT-SIZE: 12px;.. FONT-STYLE: normal;.. FONT-WEIGHT: normal;.. TEXT-DECORATION: none;.. LINE-HEIGHT: normal; .. margin-left: 20px;.. color: #000000;.. list-style-type: circle.. text-align: left;..}....a:link..{...color:#62D185;...TEXT-DECORATION: none..}..a:visited..{...color:#62D185;...TEXT-DECORATION: none..}..a:active..{...color:#62D185;...TEXT-DECORATION: none..}..a:hover..{...color:#62D185;...TEXT-DECORATION:underline..}...margen_lateral..{.. margin-left: 0px;.. border: 0px;.. background-color: #78acd4..}..titulo_pestania..{.. COLOR: #FFFFFF;.. FONT-SIZE: 9px;.. FONT-FAMILY: verdana;.. FONT-WEIGHT: bold;.. TEXT-DECORATION: none..}....A.titulo_pestania:Hover..{.. COLOR: #FFFFFF;.. FONT-SIZE: 9px;.. FONT-FAMILY: verdana;.. FONT-WEIGHT: bold;.. TEXT-DECORATION: none..}..A.titulo_pestania:active..{.. COLOR: #FFFFFF;..

C:\int_duca\realitzar_duca_archivos\e-du9a4.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 52 x 68 x 24, image size 10608, resolution 3780 x 3780 px/m, cbSize 10662, bits offset 54
Category:	dropped
Size (bytes):	10662
Entropy (8bit):	1.3158993672737511
Encrypted:	false
SSDEEP:	24:5l2ZqQg+ZqqBqxWqqqlqSqqrZqqqqqqNqqgqqqqqH/qq6FqqqqqqP5qqFFqqFql5:bIg74BVASgbT
MD5:	10DCEC83C3576328DC35D4766D868ECF
SHA1:	73EEE711ECAFF4DF26DBE9051B07F69B17199801
SHA-256:	29346F4802DDDDC6FC41AA4EA7DC1A10F422E5B9A00C31441B28C39AFF5AD7F3
SHA-512:	E9F50F823A94E6AF150E5DA38E1C0C8BF8895B59153808C9CB8B53A30ABCD258534B96F289D61C70BE6E415D4A77D433D409E189183EB34A8D05F889CD41E143
Malicious:	false
Preview:	BM.)......6...(...4...D...........p)....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\realitzar_duca_archivos\educ9b4.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 564x391, components 3
Category:	dropped
Size (bytes):	32604
Entropy (8bit):	7.655706314582852
Encrypted:	false
SSDEEP:	768:DxAIKNEIys/htYlllhEUp4E4H7qa0CHha4ea3WL7L7L7L7L7L7L7L7L7L7L7:Dy5rVYzEUpfa5WUMHHHHHHHHHH7
MD5:	2E923C128B8B58FCD0DD71DA538FCA8F
SHA1:	1DBE1ACC443EDCDCFCCD03AD022AF261CB4517E8
SHA-256:	366B57AB2C3C4F1286D93FEB7FE7550D624BD8EA399B3D82FAEDFF504FD13DBA
SHA-512:	2D4A88568872888DAC3A670C0FEE374E1282173EB9267B861263155397E2001B1F7E8DBEDEA2FD0EB073B1F454F6A403FB948092817DEFE98235A48AE808AAA4
Malicious:	false
Preview:	......JFIF.....,.,.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........4.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.........}m._.(j..P4K..e..Lm'...Z..x....~.W.....q....o.Xd..8...<a..7.....n.o.V\|.*........f.........P_!...c7; 1.rs.I9.?J..-...........+..?.-/nm.Er"..df.QU..0.....>....K..o.2.D....s$m....z..O.....6...$.....[6...+t3..Q..a......-0aov.k.....yg2.Fq....I..Jk.B._.d..x....Z.\eG..a..sD~<.......!...8.j..'.<Ku...r-.Sy..I[.....n^.#..g\.......u..W..f........-..U...}....

C:\int_duca\realitzar_duca_archivos\educ9c3.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 564x388, components 3
Category:	dropped
Size (bytes):	27873
Entropy (8bit):	7.64116112513555
Encrypted:	false
SSDEEP:	384:oXJePAzxm22XE3/31jIUE41UUzj2TcXXXXXXDI3So41GSYb6nvclkfu:oUwP1MUBUUzqgID41GAcleu
MD5:	B5586C20C8B118C5467B47E4CBCC7934
SHA1:	C77CF1CC03F7345919A1218E69E33758180E4262
SHA-256:	0995115B9751B4FC99DDC8E6C0ED2000EA5769411C8CA5649CE564712E943B64
SHA-512:	72684E02A205613EFDF75FC6A3953982D741BDC9E758337E996FDA7A703B91CAE0754D6BE83205A8D41410DB928E637BBB142A2FC368C63C0EF1FE2877F97E03
Malicious:	false
Preview:	......JFIF.....,.,.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........4.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....<ksq..v...du{.D...P.bR....^....R.4......?.:........wc;.8...Q......mWO..........\|.l.#..........i.......1"Bb...Ns..{...SQL.Wz.......s~5.n.#...{..-'...g...*...k]%/...J.4.R.\..'..m.6GB?...\|F..../b$....... #Go).N1..py..#E..:;8........8...9j_....{...."..$...M:.D.{(...._.G.K...Cp......yS.w0..n....!...\i...9D.F1;.C. ..9..Vu..Xk...Y..\|..ywK.q.FCdr>@x.Z.K.I..

C:\int_duca\realitzar_duca_archivos\educ9d3.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 577x308, components 3
Category:	dropped
Size (bytes):	35832
Entropy (8bit):	7.741291669352693
Encrypted:	false
SSDEEP:	768:xEuDvV/CCWo3a+plQvGgV591MMMQ8EkFerJHTttRfs0:xEuNCC/PlDgJ1MMMQ8EMerJHTttls0
MD5:	CFB0D9CA961F9FD7C80C29FC92123C81
SHA1:	3331DD505F5C6C27AB3897F08CAF48B0B8C8EE0B
SHA-256:	74528DA9D12BA5589BDE4C03E9ADB4C5A941380EF40594B118AFC1B397BFFEC5
SHA-512:	42EB9F44CE96F088039E60F69C0994A4A9FA3B6A5782F926B87B38646FFC02A75F8A839438D72743F2CC13A0E422095B4C350929FD309DBC739943CD515BFB04
Malicious:	false
Preview:	......JFIF.....,.,.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......4.A.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...=".F.6..$r.........}......5....o].m..i..l!].h...63.U^?..<.@....G.60Y...!....2%nG.*9.=;.e..V=7[...)..m....r...O.I..]...=ko.QU.'./..........q..E.^.<.{....9...sq<..w..%...}.H.YI.'p.w)..9.P..f...s-.v.q[.y...W...PF.0@....N...^}...2.t..<00... !.PX.$.:.d..Q\|%........X\.g.Vo,H.."..pl.u.....#.......<.zu.F.FW....e}....$#!v..........#R...[.....r.N.).T....w...Y.G3.d...

C:\int_duca\realitzar_duca_archivos\educ9e3.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 369x119, components 3
Category:	dropped
Size (bytes):	7084
Entropy (8bit):	7.897695189335595
Encrypted:	false
SSDEEP:	96:Tgb4oIvtj+AC2tMYYv9XzZvlAwNyIvkyyIczCSeEF+u2TcR2t30KKYy7CebDUDO7:NdcXYYtzIw0IvkyoFeEFbRm30KKGgF3B
MD5:	B172572A050A74EA089BB408575B636C
SHA1:	665EEB48A4B95A9687DDD7E0594DD0A59DC96EB8
SHA-256:	E34860139CE55110FA7F6359D151D48E4A7D1BA1AC831FAD7F3079E08E38B593
SHA-512:	84C74A8A915CADA9273B931F420F6A5D42EAD3FC5253F937DEFF4807B7713C625D8E78716E04A035C4CDAFC2DE7C604801339D4B7EDC4461049EC204DF1AF254
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......w.q..".......................................G..........................!1..R...."2AQT....#3BCDSUrs...5aq..$4.%Ebu...............................$.......................Q...!.12q.......(............?...........j'..H.&hu;' ..y.twY.........u....E[Z..imt....=X 7y!..P.....K6.Y...E56...m......`.nsZZ4..6...I...[..X.9.p.j..F.{._.5....#...\|.1.4.<.$...4.\|.W0.}.Kg..yX....M....U%5..h \|A..1...d.2.@..<...{....X....t.X?........o............l.s.,.u..[}....aw.k.{..;._..-..{W..:.~.m.s..f.E....;.^..m..{VC.U..V.......SE....;..}.......wG.......U.......un..o..o...d;...........SE....;.]..:..d;.]..:..UB.&.\|6U.m...^...VCo....=G..f.E.&.....z=.Q........z..VB.)....uf.os.z..._F....Qu....M6.l....;..Qu...m.....P..f..o............mu..h....f.M...\|me...'R..u..i:....)....u86....'R.Ci....!B..M6.l...

C:\int_duca\realitzar_duca_archivos\educ9f2.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 553x140, components 3
Category:	dropped
Size (bytes):	13973
Entropy (8bit):	7.9528547818477575
Encrypted:	false
SSDEEP:	384:lXrd0FBHNpUjI6YHOAfvlV9cSRhe5GEbotaPjCshA/n:pcNpUjIFlzcWhe/OaPjJAP
MD5:	1E8E0B63EAD9A56544214E37C101C7C6
SHA1:	844BF8E37E24F5214AA00331AC57A94708E0A34A
SHA-256:	0D478C6E578E9017EF5E7012EC0B4217C40318F7BA3DFA2A328A813B1FA9FA45
SHA-512:	27022D5B9CE12599844371E2EE85EC32F7BB0EBE611F2F2E71581D45189B354C9D84974459E0F5AFCEB4438603D4814EC6F5FFB95E983D14CF3D4C5B2A783A3F
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;........)..".......................................H.........................!1.."AQR..2a...STq...#3Br...4bs...$.%Uc...................................$...................Q.....1R!A..."......(............?...L....Qi.].....V...9..h.I=+.fl..T.d...=.N.>.5...t.?..:...R.J..T.i...2Ghg5b.[...77.^.g....W....7..'...>5...?.....p..{..^.t.t....A".#k...<y.=..+...C.m..]X[....,...U'H..B....Z.Mz;..eM.8....g.....i7.Ayj.o.4.4.._zR`....$..WLu..{.>..>.J= .......U..C..Wc...j..]...bL.2.'........z?..........C.T)...&V.~.u......O..5...5...O..5......$.Za.K....8....N..v_...Q.U..k..eip..5....N?:..h........DET)...&V....\../....H........D.TA..2....]....U.C.... TPUB.k..+J....y,.@.G...y,.@....!.K&V....Z.Y..Uz....,.@....!.D.ZN:{..,.@.GO5.%.....P...I2..t.X.Z\|.^....->@...!.D.ZH:s..->@..x... TlUB..L.#..V.

C:\int_duca\realitzar_duca_archivos\educa02.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 470x119, components 3
Category:	dropped
Size (bytes):	9331
Entropy (8bit):	7.891570428678495
Encrypted:	false
SSDEEP:	192:KYlrvsBZl4/T9Ufkx2xmZMuTCQMPuG8pXRCaHH7EhQAs1eEAtBrDq48AVdATu:KYlrUZl4bBx28ZferPARlH4hQAsWfrNv
MD5:	D8389E688A6D4064F40AF1FE8EB36CD0
SHA1:	FED95DD6D770809C6D15E1A21AA411615D3E7D0D
SHA-256:	C5D1160653D0C4410206B780FA871BE2282E597E5EA1DAADC0C6635F3537EDE3
SHA-512:	463EB52D2C295528A38A098B081853088E750965195EF854CAC111DBB9A8B38645B7845FD435801FE80357079570F6568778AAB1BCE0799A099F42C9EA356375
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......w....".......................................J...........................!."1R.....2AQST....Us.#34r..Baq$56t..%Eu.....................................).......................Q...!1Aa...2R........(............?........0cB[K....d.. .UWG..........h..#.).T..ZS9.........H....."...{...z6...m.)..)...iIH...9..$...[.~..9.p.j..2..&.q....DB.S.vKe...F.*'.% ...a.Z..v.?uX.J...m...NF.XM......[.Fq..Qp...8.......#..=.x....J............8.)....f..G.[.[>.....}.Kg..."...E..s.WWQ.J...?uz<(.=.....X..4Z....}..-.N{...:...=.L....\6U..xM......}z<%.......4[....U..m.O...E..m.O..@VB.-..WV.........k.........j.+!M..l..h..x.k.......w.k....S.......uk........k!.....;......o......{........}..a..XVb.-.6U.m.......d6....{......o...r....{...qt.x]..U.Y..-..WVQ..?w..~...[....~.\....\|6U.m...B.?Z.

C:\int_duca\realitzar_duca_archivos\educa12.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 512x66, components 3
Category:	dropped
Size (bytes):	6767
Entropy (8bit):	7.863421176618081
Encrypted:	false
SSDEEP:	96:Tgbs/VF4UU3bPUEm/uznJbNI0fgcl77CLlsjnTB9eGtqamKELDpxoY3EML:RVHU3bPq/uzJbSeDl72mj9tqZhxn3EML
MD5:	0568E95410A42473343C5C711DEE77F9
SHA1:	A60033ACDC65BBE59DACB6B93198A09C4C8B9497
SHA-256:	B52C2EA4000AF5F0928F96AD73853FE0B55D96696FD93B8F59EF7AFDE5FBD510
SHA-512:	428BD1A6D82DF2759556A3E87478BA89016D0F4DCF7AE8A3D78EC3E22470C0F214D9CF4B346EFB5099ECB95F4140973751AFD6205D50AC82A362231A876273ED
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......B....".......................................E............................!T..1..."2AQU..a.#q...$345Bs.Rrt....6S.......................................................QR!..1A..."a.........(............?.......K,J3X\|..0V.......9.mD.+[.....-p..Cv.rKp.']!!!....pBW....$..9 ......@...J\|..6R..hV.%`.g.....:..&..s.E.F....Gn..%.qHJ...eA@..T.....w.._..k..................CO.j.>U[..7.......].....[..K.%Ch.ZN..i.%G...U.......E[....Ca."..u....G...?...]5.u../.;;....%....B.od...N....#9.!..\j}..u.K..$7W..KJ.Q ...B.......=..Lb.......J5..1..k........)..0.......X.tNlg...C..f..P.u.6....r..<;..~.A..e.n.g..'.bf..z.a..J....``....{9..)-GC...h...NEjF...J.....q.H#..kyW.6....r.qf.(!.....ZRT....$.G..k/.1a.2M.S1.....RP...(...5..N.F....f\|U...I..gwKJB.Ts.'.......X...u..v.Bq....il...IS....A....q4

C:\int_duca\realitzar_duca_archivos\educa21.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 29x26, components 3
Category:	dropped
Size (bytes):	627
Entropy (8bit):	6.598956979498791
Encrypted:	false
SSDEEP:	12:FgLe+opUkYg4so7eee6Fr5dXVw8kcHRKs0U6MnQiulLQlU:OC+E4sozHEcYzlFiuVH
MD5:	981E3200562920E2E671489EE6AC2D77
SHA1:	13A055313039B0503C6963CA37C1D05DF432BCCC
SHA-256:	FD1A7168944128BD5F43BEF3D9F5267EDD582F8B3F60361C139B3B8227DE404B
SHA-512:	62DA255C8F2A39402A6FF84685A7AAF3D7E573ABDF54D72FF1EA10CC453FD594BF7E372BE99DD680645B1F967B48D4678848A52EBE5BF821786FFA7908FC7A2C
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;..........."......................................-........................!..1...T.."#6AS.Qt.................................................!......(............?..V.#J....%...-dyc..:...h;..Y.{.)J...<..c...$.......}#...A...,.Q..y.{dPL&j^=.@.:.]Ob6.>......u._............r.OG*.j=...U...X"S..n]DT.....S..`.Ir]E.[.4.qb....cX... ..Cs.2;/S.N.).2...^Q.......j9v:j5?.....8..P.....q....E..Q4.1.......C..Ds..K.:...s.L1...........].....?..

C:\int_duca\realitzar_duca_archivos\educa31.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 30x26, components 3
Category:	dropped
Size (bytes):	589
Entropy (8bit):	6.519649978904032
Encrypted:	false
SSDEEP:	12:FgLe+opUkYg4so7eeejUtCpQHXWP3EypyFzNE40Mo:OC+E4sozkUXGP0yTWo
MD5:	C03F59B562B79441CE737D077ECA1C0A
SHA1:	28DFCAA2F732688F5F493F467625A2FA300CE62D
SHA-256:	080C36E57A68C2E3F07DE4BDEED94AF4F56EB3CC7B4E2D1BEB3442C4DECC236B
SHA-512:	58F9B2728BDE89CF9616DFD3BE05528AFA1DA52FD0DDEF582D77F299263675791AB1A4F8F8D6E5B420313D68DDC47F5687D52843567930D5530FC91A22F2FDCB
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;...........".....................................'...........................!T...1A"#q...................................................!2Qq.......(............?.z.J.^..[O.a....>.o).J.l~@.t\...5...9..."?.../jC..O...P..i ....(.o...tJ..N.l...h.u...><.HKrZK..Y...E.....]..C.~..g..jQ=A.j....Dim...A."..p..U.Q...$.2.F..N....6..-/..........,.`Q..Q.ew/y...]..C.C[M6.Hi...m.%.@..:....b..Wr.....8...

C:\int_duca\realitzar_duca_archivos\educa40.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 492x340, components 3
Category:	dropped
Size (bytes):	16095
Entropy (8bit):	7.904371511382472
Encrypted:	false
SSDEEP:	192:AQLoIVSHCCjg4fq3dFmfb2cAPaDDDDDDDDZPyDDDDDDDDM3500r3UYV3HCYEzI+9:AQL+iCU4ifb+fPFRiYp+j2RmWG9
MD5:	D5D96D8DAF7C4AB969C01AE409CE600B
SHA1:	B9B722D285E80C0C90DA4BA18155DFE3D8A70454
SHA-256:	6086B8BE456E149BF7A64C6D0F7DD508FE84CF94DABD326A01B7CD61476790E4
SHA-512:	3049CD3B25E1BCB6A811C89A7CFD61B44A4644D46CB684DF4ED326CED22DEE674CCA32BC80037B68C298C0668770A937516C256891B27CF4D66A88B3CD9F41A8
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......T....".......................................O..........................!Q.....1ARSU...."#Ts..2356Caqr.....$4Bt.b..D...Ec................................(.....................Q...!1R.."A2q.........(............?...kv...lv(k.iL,u.F..{E...yx.....ksN7\.CH.i....?.]M.[v...........F..,".7.Y.}....L.L.O.....Z...6 ..y7...H.>.5.z......5.-k..E.n.<D..Y../u.....1....{.L. 5..^..p.K...-Z...x.. 0.....0.D/a.@7.....X..U.e.'Y3.[..=.,..<...o...p.4.O.....n.ve...J/....q.<..]F.wmL.w:V..Bf.....hqi.0.7..w_[YQ<..U":..d.1..i{@.a....>Qvl.zPn.J'......F.......2.3....x!L#...S.Y.....5.s.......q.<...m........`hv.H.d.5\...=.4.CH.x.$......Z...s-2n.y.jKE.$.JJ.&.........9.s...G.>....wg..(!...&.w...v.@..7].o...6.+...+Z[..n:f.(...79......++yd.cs..7.#..a.f...r.Q..u.w?$q.7..'..0.......4..+..S.

C:\int_duca\realitzar_duca_archivos\educa50.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	GIF image data, version 89a, 648 x 199
Category:	dropped
Size (bytes):	75385
Entropy (8bit):	7.871977779136001
Encrypted:	false
SSDEEP:	1536:089gv9pQjs3Kkt6FnUYj48fV6eUzZxLlE8ehsyOUb1vnc9RpY3X:N2luo3/tyUu/Uz3Mskb1GpGX
MD5:	C76490EE45BF39B87759DE6D99787B9F
SHA1:	523FAC785E63D05B5A8D5F4160FA8A7AA8DB83C3
SHA-256:	64A658DF1E610B74B1054F088E3AB181DACF9833072CBA0923C99BD77DFFC2F8
SHA-512:	95457CA5F080D2AB3EC4D026C72059967B98E7E430F8E7435A43474E4CC13232BBF3DBD6A5BCF4888D8A45DDBEA46DEF71E45B1D94D722E561561769DAFC74DB
Malicious:	false
Preview:	GIF89a.......ffty.....VYe...Ybjdci......srx.......33:TU[# &CAIFIQ...........iqx8BG........67C......&(/.........IRX.y.....!%(16........jq.......fYh...thw...SIU".#......3(4C7E...........................dT\B58...mhk......NBO0%).........s.......jqk...uh....yy............'0).....7A9YaZ{.{...IQJ. ...................................................................................................................qy.............{y..................{y.sq......................................................................ry...........................................................{q..........................! ..............ki\|......sq.~q.....................................................caZ......201RQQ.......................................!.......,...............H......*\....#J.H....3j.... C..I...(S.\...0c.....D.,..`a."J...f...+.5.......pj../O>?l...f..:o..a.M.5a.v].F.Z5w...G..5w..Q....4........7........\|..C.._>8./'V....\x".Ly...........~.

C:\int_duca\realitzar_duca_archivos\educa60.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	GIF image data, version 89a, 665 x 395
Category:	dropped
Size (bytes):	48458
Entropy (8bit):	7.97709895825478
Encrypted:	false
SSDEEP:	768:r2aG4AJgVG5culHhHdMbe9Yan9754cbns5X9Ihw+c6e7KiSR0JIX+g:rGBKGSoXMbCf14cLs5EzSKinng
MD5:	CC5130C91230EDB8CE6C9908F2EBB767
SHA1:	9283CE869266EA5A8E5ED0C0A1164A448F4F4DFC
SHA-256:	17B29B1354231BC378DF6A6A87C716B8205E1AFB7244EF7BA6DFE3CD66E0F735
SHA-512:	CEC254F5A1D72836BB87F367B15F28B8DCCBF074EF122588623B88F2234244E351DD8D2854C680DEB535A909BFE89FD6522A2CE4FEE1B48D05E3F30DCC0093E6
Malicious:	false
Preview:	GIF89a.........{e..........Uq..(k((JHIxy...........fy....Ea....CX.{.......ce{...(By9V..........y..........VS.(C..0tv.......4Q....Zd{0I....Ii.Vi.j......8z......v.....kqzv.....##...............Ri............Yy.{.......y{...30....IT}j...ux..t.......(k...cq......(sY..sqj...cYZcaZc.....;:8Jq.....].....0j.!#sisGE...."...,YRIJ" 302...9a.ci.. ...wi.....ji~)Q................sqs..................cac.........kil...............RQRZYZ...................s..........{....kac..........sq}...{y{RQZ...RIRZQZ{qssik............RYZ...{........ZQR...ZYR......kic......JIR..RQJs..JQR......{ys...k........kq.RYRsyss..{..kakZq.............cak...cYckqk{q{.........k..JQJ.....s.....j..{..cic...cik.............s............(ssy{sy.9I.......{..Ma..v~...si.Vbb.... k............!.......,...............H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...HK.....S.M.J.J...W.b..k.\.z.Kv.Y.h.=..-.k..w..x..7/.~.....QR.w.I..'..B...H..P.B..G.\.rf.)[...4..7..\Zug.

C:\int_duca\realitzar_duca_archivos\educa6f.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 188x27, components 3
Category:	dropped
Size (bytes):	1986
Entropy (8bit):	7.692970232172082
Encrypted:	false
SSDEEP:	48:TS9YMA7p1kQDXowUXezbDvWoz8B7McT5ApSkiER+zfpevg:TuhIpzYwUXezbrz8BIk5ApSy0fpevg
MD5:	AF6DFB70434F581C93EA496E8DDF6FB8
SHA1:	52971D14FC8C12E8DB219AD60BE41122B3DA67DE
SHA-256:	D71840D3D12E68599631DF079F923E947568DC69F85B05B9A2AE2EB85731F474
SHA-512:	2BA3DCEEC442E2444538F158813BE195460FBC1F681C20B86CA6EE6896E7C6EBAFA1ACC2E9EAB4A5278DDDC8638152F8E9897DF28E47778B0D2C59DB59B6A426
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".....................................6...........................!."#1....AV.QR..%356Bst...................................................(............?...4.......K.;...41...q......)vPI .rH...i....@........U.B.....Z.V<..m...(Zh.?.:...$.6....+w.Ld.<Q%.h.._. ...7..%..=...p....$.p...XNlA^Bc.C.%.....x..-..q...5.....Dk{...\..H...3..j7.!......D.7...r..Sm.iAj......&..8.j..G<.`q.9y......~.......F...m4...)......FPg.3w......}.......l...5..qOb..e...=...I.r..aa.P.O_....j.N^hMOWQ.S...r....L...y...W....}Z......C..`.B.+rc.py...0.".+....F.....1C.T...Z..Y..YXZ>1..=D\.pG...r.S.n6.Z..A...H....t...$....k..Y.%C..~`.....w:.uM..).[..;.h`..t.(..2)0C+H.......$..<..,O$..}.+ui...)m$..2...#.XEo...88....G...l.S.zz...'....$.Uh..VPH^c.jx....;..v.v.+.k.....,.+"..F...!.'...v8...E.....C%m

C:\int_duca\realitzar_duca_archivos\educa7f.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 283x301, components 3
Category:	dropped
Size (bytes):	13560
Entropy (8bit):	7.937941457952041
Encrypted:	false
SSDEEP:	384:C0KTAOIIRYXWDpjSsHT+WWWWWW45BdyKVnRdXyqqEwcjfMFr:WTAOIIRYXutz/5SKndXyEjfsr
MD5:	A45CE06878C091ACBCCAD690A89A5FEC
SHA1:	1DD64993050F6F3ECEA309E204A214024ABC673C
SHA-256:	8B502202DDAF94ACD00E8E9122F26C939D0ED24C08C2CA57A40799C0AE062ACD
SHA-512:	E3CF8838A31D99F9193079EF6A6407040BC39D24BF1C6B0E7E28AADC14A3F3FA14E5C39DBFF501A136FF8F0FB275F32F5D251A2D7B41B9EBB6C3ED3554A2D330
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......-...."........................................S...........................!ST..."1RU.....AQq....26ae.....$45Vtu...#3BFc...br..%.............................../...........................!"Qab.$1A...RB.2.......(............?...ZV..Kk0....0.6.+w.6.~0...\|....2...b..]..jQ..vU....T@.....,{{..~RA.e.q.m...0.V....+...7eec.'1fY.xT..s#..D(.$.....G..C.ti..g......f...F.F...:...Y...k.f.I.....`..M.:.%.'.....x.r....>..hmb.....[..yk....2.......8..Dp......JS.=j.P.=.3n..4o.....PER.NAH..74..y3..d.I.QV.Q..A,..,.....&...)s.L.#M6.....u%.-C.+.K>S.$..`.RH....&...Zq.q...sV..h..KN..#Z.N..xX..w.B..9T....^L..J.z.....O.o...U.N..V{..W-:g.Y.D\.ewD{K].pi....-w...{2s..\..eg...r.}...E..WtG.....]....z...#./..i.>..r..L.+=..L..ik...2..=...=.fG.^.r.}...8U.N..V{....]....z..ewD{K].z..$.*.L.+=.

C:\int_duca\realitzar_duca_archivos\educa8f.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	GIF image data, version 89a, 647 x 599
Category:	dropped
Size (bytes):	45014
Entropy (8bit):	7.879569879517408
Encrypted:	false
SSDEEP:	768:msaHTMePkJr/PWc0zwcnYMjBH8Hj129WsdjTeFrgi+PohTLNke9+2qL:msoTMe8JrHWc0zwc1j58Hj1AZ8XhtkeS
MD5:	51AF7B39C9D8BA2F57F11980A336D505
SHA1:	9CBE26A17C3F9151BF2E21195C77472CC9C6DA16
SHA-256:	4CADE8B1E8486A5E056EC7ADC694729A98CD04887EF74613A5E634C2602DA534
SHA-512:	5F467A36E2B8A25CDCD5AE9702D1BAC5C67BE25D5F44F723678AD2A2191EB11928D1C66D5A3365D9B00A110C035D0297B96712153664E7260914F2166530A76E
Malicious:	false
Preview:	GIF89a..W.......................! !........ZYZ{y{......989...JIJ............kik...101cac...sqsBAB........RQR......................................RIR)()...cYc...................... !...{qsZQZ!.!.y.JQR......cYZ.........ZYcJIR...JQJRIJ...ZaZ......................sys..{......caZsq{Zac......sis....................{..!..! .981{ysRQJ{q{...909kis.....sik.........189.....................y{......... .......kaksy{......901...sqk........!kqkkackic......{y....ZQR181109.........{.{RQZZYRcak......9A9......JAB......cic...98BkqscikBA9..BIJ.....B89.......JIB...BIB) !RYZ......1()10)B8BJAJ) )!()...)0)1(1)(!RYR! )9AB......BAJ.........!(!..................)(1)01...........................................................................................................!.......,......W........H......\....#J.H....3j.... C..I...(S.\...0c.I...8s...gM.@...J...H.]...P.J.J...X.j....`...I...h.]...p..K...x..........L......-@@.... K.Ly.../k..y...?..Mz...O.N.z...

C:\int_duca\realitzar_duca_archivos\educa9e.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	GIF image data, version 89a, 533 x 69
Category:	dropped
Size (bytes):	3367
Entropy (8bit):	7.619714940959413
Encrypted:	false
SSDEEP:	96:lkAfjMC2pnPrUpvnFdYxPwHDqgEYWAQJH+WM7cUS:GAgCCnkFdY53rpQWMS
MD5:	D3FBF9F24154691CF69C1064DAAB64DA
SHA1:	E302DA4A2EFFE31429C9ACEF4F7D46EAE317A292
SHA-256:	1FC6078E735BE31E455E3AF85D1A793548BB4209A4519B514882F98EF60E6C3E
SHA-512:	193385E0856E7AF93AC5BC4380030F11BB408D7A2E2A93FD58F21C76264191478DE2E4B1B892E99F51F2E4FDADA3A43F0515B58B0D8C45FE48675B09E6E07F8E
Malicious:	false
Preview:	GIF89a..E..............................cac...{y{......JIJ...kik.........101...sqs! !989ZYZ......BABRQR)()...................................................................................................!.......,......E....@.pH,...r.l:..tJ.Z..v..z..xL....z.n...\|N.....~.............................................~..E..c..J.........n...B....c...........]...B... ....C... ...B....F... ...C.... ...B......../....\|-...A....,H......(.........:.X...+p..b....=.0..E...8.@......@4p....R..<......:.R.@.......`...c..`.1.... H..-.. ........I.L...k......Lx........U...(0......r..x<....j.x.\|.`\e..<....,.{..{W...I.m.........-..+.B ...$32.........p.ok..pG...F. d3....;.....^...0..\|.........NA....qg....U@{..`.....O..B@...p@.........R`@x'e.V..\|...$.wN..pW^ (&D..!..yL.N..h......$lE.#..E..@...G....P.EJ....e..>.s\_9.h.50..l..P.J.).t.i.x..\|...m`#..j.&..6....i%..Y.Br.f."."...2.....G......_00b.Z...i............q.saDg.....(...l.V.@..$N....h.].....d..U...N.Wx..u.....Z..

C:\int_duca\realitzar_duca_archivos\educaae.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	GIF image data, version 89a, 667 x 359
Category:	dropped
Size (bytes):	42284
Entropy (8bit):	7.953095905908468
Encrypted:	false
SSDEEP:	768:KdTMv5wW/ZPonFomL42bdaNMiCH9WRJctdTgVLr6zli4SkZ5G4W:KORwCP8FT02xPiVRJct5gp6zlrZW
MD5:	4BACFE643DE945A60E52D851A5F41B24
SHA1:	C1FA810F2E01D769724CC846230DF293B8413ED4
SHA-256:	C28DE0CE85C24F9A54CC8AC5CA15F094C97BD084292B7C8D26EBD143FF696ED3
SHA-512:	B452D2220DF65E39BA3B1D79B5A83FF046FCDF3500CF9AF1841641E9F5A11A17CF292DEE75B3ADC373B820D8897818B3AE93BFC3B48D5A8CDEF31D53850552CD
Malicious:	false
Preview:	GIF89a..g....ZYZe.....I...Fa....Uq......kx........JII.........dx.........CX.)()9V.....y{....a..........%A{'A..0t4Q....Jh.SQ.878........v../I.......................Si.caZv...l.x......8z{...................Yy....Yac...............sqk.(kB;2Z.....J7B.(s...his 8.h.....M..ZYc:...51r..62..9.(2P.0kJq....IIS9a...)3I.(01AAA)Q..... k....(k..................cac......kik......sqs......{y{..................................s..siksis{.........................kak........kickac...RIJ.........{ys{q{...{............cYZ...................cYcs......{qs.... k......ZaZ...caks.....{..k.....s....k....j...........SQQ...{....KQGs... c.y....cik...kqk........sq{........cics....RIR......)0)101.(ssy{{..sys3#/)(1kqs. ....ERS.... c..." "...{...(k..s.i.s...SO..<............!.......,......g........H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.]...P.J.J...X.j....`..K...h.]......K...x.........)......}.x...?...y"...^.\|ssL....M..../O.T.z ..

C:\int_duca\realitzar_duca_archivos\fileabd.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6764
Entropy (8bit):	4.761004074724084
Encrypted:	false
SSDEEP:	24:aBwdqiOUu/M2qBRC6xPJgJuBj09XusCayyP2Qm2PuhVEQyRtc+jeh7fGM0pDrIsa:aKXHIMPVuN9qp2Rc/+McfIsIVwEmi
MD5:	806BF6FF17B2CEB4CD3E8AD57D565F48
SHA1:	9AC276795B3AF04AAD8531AC433610334F2466C2
SHA-256:	FA3671AB602C23ED5C1603CF0E58B6E1D8009C57C889BFC5F06CD0AA07957811
SHA-512:	339EB36CB10F265404AB7597B76DDC7C159E9415E90E038D49187845CE91EC9998B442EAEAF851B44E2003265ECAD2E2DA82FB1AED5925ADA7B2840779313C8F
Malicious:	false
Preview:	<xml xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:MainFile HRef="../realitzar_duca.htm"/>.. <o:File HRef="image001.gif"/>.. <o:File HRef="image002.png"/>.. <o:File HRef="image003.jpg"/>.. <o:File HRef="oledata.mso"/>.. <o:File HRef="image004.gif"/>.. <o:File HRef="image005.png"/>.. <o:File HRef="image006.jpg"/>.. <o:File HRef="image007.gif"/>.. <o:File HRef="image008.png"/>.. <o:File HRef="image009.jpg"/>.. <o:File HRef="image010.gif"/>.. <o:File HRef="image011.gif"/>.. <o:File HRef="image012.png"/>.. <o:File HRef="image013.jpg"/>.. <o:File HRef="image014.gif"/>.. <o:File HRef="image015.gif"/>.. <o:File HRef="image016.gif"/>.. <o:File HRef="image017.png"/>.. <o:File HRef="image018.jpg"/>.. <o:File HRef="image019.gif"/>.. <o:File HRef="image020.png"/>.. <o:File HRef="image021.jpg"/>.. <o:File HRef="image022.gif"/>.. <o:File HRef="image023.gif"/>.. <o:File HRef="image024.gif"/>.. <o:File HRef="image025.png"/>.. <o:File HRef="image026.jpg"/>.. <o:File HRef="image027.gif"/>.. <o

C:\int_duca\realitzar_duca_archivos\oledabd.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	7.373624802351215
Encrypted:	false
SSDEEP:	384:iZcwCHHzokv1P3iAFnOgW5zZYAHRidSp:3wCHHzooFOR5RRjp
MD5:	EA2897DD955AA4DC98DDC61758C34F54
SHA1:	423C125939DB9398DFB2323C59916E3952E119AD
SHA-256:	68E5E1E8638D5C8CA277DD9192ABF94F85181D3906F2AB44D163C858FA6D2AEA
SHA-512:	13B2C36F57FC72E2F38DCCEBEAD110347631C71E8C66D414FD8795BCC5EB0E2C740B42B28226DA4706F5ED0BAACB03FEE3E37DAD30B64B5DB0E8D184C9F3C18C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\realitzar_duca_archivos\vssvacd.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	944
Entropy (8bit):	5.767530490517826
Encrypted:	false
SSDEEP:	24:wTcllFc6N+8/reNfLZw7wcP/WYjHqK89ZOG3/D:wAl+6NVTk1w7N3WYb/6ZOGPD
MD5:	8FC9B1DAF5CE395C8B5AB08F43143F5D
SHA1:	A24282966ED3F8F4AFA645A45DBFAFB4D82A6E12
SHA-256:	30E56C110588BEBAC6CB3231D52F7B43ED26D6C5589CB344D9FF932029EA398F
SHA-512:	FD554827CBC3DED1B3FB68823D527B3199E518AD381218AEDE118C899633C1BDEC3A44CB7AEED8F854E4A48297436F1BD900D648AA98243DADE81D9198E0A89E
Malicious:	false
Preview:	4...Q..b..1J.}.r6;{.?..t,.......d...S.C.q3.....e.....Y-.]j.....f.....w...d.....g.......3.....h.....,..@.....i.......5&.....j......}.K......k.....gL-.......l.......!.=.....m...x........n.....2..C.....o.........u.....p....a8BA.......q......9../.....r.....c.uY7.....s...............t.....m..9......u..............v.....\|.!<T.....w....}...!.....x....K..u.......y....N.!w.......z....a..[.......{...z~^Yy......\|.........J.....}...qf$...z.....~...I..................._............rq...........0..W.c.............8S.b...........i.................Y9..........V...C.............ve.^.........d....E.............%...............6N...........4}s.)..........'...1...........V..............u..%.V..........<..3...........Z\|..t..........R..V.mb...........IH..............V..vQ..........#.,..............h.I...........g~0...k.........b..O'............h...+..........@,w.M............S.\A.e..........Q..i...........Ntz...............ID+H......

C:\int_duca\rendf745.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.454469305363301
Encrypted:	false
SSDEEP:	3:S9UPbn4ejv/LKGxvn:S9UPL4ejvnZ
MD5:	3899FF4FA3992859E6E20E5DE22C00CE
SHA1:	AD8D09AD672E7849EE904C5084466D52330C09BC
SHA-256:	A28661C7E21E584F93704C6E076667EBC87D9FEE1D9C426A14258FC6ED34B774
SHA-512:	22F137DD59B9AAF8C4255845FB69CEA352D602ABBA2AC7F7A226515B0227B20EC208AD46561C7BAF8917060B3FF586C372B89A4F0D9A8E5D06F81EFC5A744FE5
Malicious:	false
Preview:	copy %4 %5..copy %1blank.mdb %2..copy %1backup\blank.mdb %1..exit

C:\int_duca\renef755.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.441391799786944
Encrypted:	false
SSDEEP:	3:LeJE6mD4ekX9Qcv/LKvDxv2tAXj:KgD4ee91vmDYyT
MD5:	5C8FE25000EDEE434773A47708698E75
SHA1:	3C177942CFE0D947DCDF1CF8E5AF382D6C2F3955
SHA-256:	6E8FDF4215FA6906F627BB9606655C3E96348B6D4FD3906A8AD08592477E072D
SHA-512:	57B76D16B359A0E2ADAF1259FA68EEE4F9AE6CE6D3464739E20062FDAF72DEAAC7BCCB6ABAB84E0C2903600FFA860DFA92ABBF0747BDB8636CD800F540D45504
Malicious:	false
Preview:	ren %1blankexp.mdb %2..copy %1%2 %3..copy %1backup\blankexp.mdb %1..del %1%2..exit..

C:\int_duca\renf745.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	3.7505456804735062
Encrypted:	false
SSDEEP:	3:KejcQPu7J+UHnvK45fP5R:Kegt7JTvK4fR
MD5:	7435AD79A3D28FABCFF1F0527E0F62FE
SHA1:	72654817FC28274C742A134DFEEAC34455E07A46
SHA-256:	4F5BC17F0E1FBBDF556D62570C3D0756A75D449B7A4492B365EB7B14A666961A
SHA-512:	72E96681181F7810B9701679C3E46016E8823D5B9D92B73BA02A40BD9CC0EE53351F10EFF773069C5BFF35BD1635E0FC5BCDC2C266D3162727EBD796BD402EAB
Malicious:	false
Preview:	ren duca.r00..r00 duca.r00..ren duca.r01..r01 duca.r01..ren duca.r02..r02 duca.r02..exit

C:\int_duca\tarifas\taric15.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Microsoft Access Database
Category:	dropped
Size (bytes):	49455104
Entropy (8bit):	1.851222351673581
Encrypted:	false
SSDEEP:	49152:H75ffsyDsMI8BNH8OuMGy6ntuM/D2/5Cq8zrrmtteP838J274SH6F:H7iyoFG1qpq8zrrmttio6F
MD5:	E0CC5E60C6003BE78C63F7771CD71DC9
SHA1:	5122A75335D2252D5FB751AFD80C06128E6A2FDB
SHA-256:	70CFC5287EBF878A9A538D261A1C1E69C0E66EB47F4014D6D2241BCDCC61A985
SHA-512:	BF916844C17963C77159A2991E1777EF73BBA2A75F91BCE1CCF422188BA44676FD010AB60219F74C9E5F2ACC90FA93FFDFBF035A5C057F9962A7485FA28A6BEC
Malicious:	false
Preview:	....Standard Jet DB......n.b`..U.gr@?..~.....1.y..0...c...F...N._.7\.....K....`70{6....P.C...3W.y[..\|*..\|.....z9.N...f_...$.g..'D...e....F.x....-b.T...4.0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\unzif764.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	36
Entropy (8bit):	4.273684376262023
Encrypted:	false
SSDEEP:	3:I5Mg7rU+87:ITU+W
MD5:	FA4BF9B172F989C497D910F861460E62
SHA1:	455A73CFB3324EF17E16081FC068029AAB206712
SHA-256:	A297C635913C76F631F9312C79192A231A2EBCF5E6DF1B2A50D17B7C1B98C40D
SHA-512:	47E5C1FBE3F247113FCB92B80EFF5A82966D7871C03EBE54B192B9E2127C264E1302D0D9754A4B1E35B00C59885829C32F0964A9D6501446BFA0C9E0133A6CFC
Malicious:	false
Preview:	c:\int_duca\unzip %1%2 -d %1..exit..

C:\int_duca\unzif8ac.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	6.417619553362158
Encrypted:	false
SSDEEP:	3072:izJ+rd1/IeLWQw07eFs9mH1ayTpkGKMUxUk:BrvfLWQw07eFs9mfTIMUuk
MD5:	F8E889BC3D76B8FA4AE016FB9D5808B7
SHA1:	8B6FB88632E91FD7F910BF3AA1CEB311C4E8B425
SHA-256:	00E5ABF296E3A718BA2A7E8B1E1B4A9A0AB9367DCDAF0775866686299C488DAC
SHA-512:	5586BFB0FE23698A9322F75C08C9C27B0E356C876FDD160D6FD9F60842EA86C56718861FABCD7D0CAB656B6B28587CE83011178470D78E050A28ADF11403C3DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<...............7..........................@..........................................................................p.......................................................................................................................text....{.......\|.................. ..`.data...............................@....bss.....................................idata.......p......................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\int_duca\upgr3d8.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Generic INItialization configuration [DATABASE_EXP]
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.23614106180718
Encrypted:	false
SSDEEP:	6:u85H8gt56Py2KT7qkgvH8gt56Py2KT7PuaifTiUosLr:u85DP66pTgvDP66pX8izg
MD5:	3C57F55AF46B1F26C4BC40E3419B2783
SHA1:	6C6D5F33EC5B3165C83BE1D5801044342E5BC5E1
SHA-256:	F15DB9A1D23A468871554CD51504DA501643EC6872DFBECD55CEAB265FD99590
SHA-512:	971EF424CFB2E1D2AD273CF5118C0E8AA31BBDF425A5016A97E53E63EE522A5B2B57BC467B4E79457FDFF213F9CE8987B923C7CB3D6C2ADDB252D844704F0B4B
Malicious:	false
Preview:	[DATABASE]..DBMS=ODBC..UserId=f\|rus..DatabasePassword=tki)hyh..ServerName=ACCESS..Prompt=0....[DATABASE_EXP]..DBMS=ODBC..UserId=f\|rus..DatabasePassword=tki)hyh..ServerName=ACCESS..Prompt=0....[RSU]..INT= $0....[DB_PATH]..PATH = C:\int_duca\..ESTABLECIDO = TRUE....[sdef%5&]..fed= 1.01....

C:\int_duca\valf764.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	3.9677201004745
Encrypted:	false
SSDEEP:	3:LSI88zDNwv:/HNwv
MD5:	8BDB5170BA6864C380B493C9ECA26CE6
SHA1:	C4D9F13346E21F8CC53E64BA1835C5756E86D612
SHA-256:	8788BDDCC34F92B0E706DDBEAF479A15395CDB091F6679A69823FEEEDDBC3CE8
SHA-512:	9C6D0EBE6F8BCDE4B333E11914244C84EE99B4844B771E7B31D011645E4DA8407AFB85D7DFFDBE56F25BB8064004538CF2D84398117057786C167FE869C1EC8A
Malicious:	false
Preview:	ren %1.mdb %2.mdb..pause....

C:\int_duca\zipf764.rra

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	6.443678450897129
Encrypted:	false
SSDEEP:	768:EXeoAEIpkY1TQH4lNc33bRks6NIZJya6HyivmLiR0Klt1HrrdJsbV:EXAl+YWH443bRknI7WHRlt1HrhJsbV
MD5:	72C83BBD05EA169372C8D04ACD0C4515
SHA1:	D50903291E924CF96C2A004944BA92F47D17A01E
SHA-256:	41B79ADFB2E71B9D7222D0F30D488A8B4FC6656A99EC5D3B0534677ABA1A2537
SHA-512:	54F3B51528474F978F3512D40C8E434B2C8C09179370B70778F7774432B5C91432DBAD5BFED76AF24A3523F39FE8AA8338E404E310AB9A443059AE91FA4CE2AA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....<...............7..........................@..................................................................................................................................................................................................text...T........................... ..`.data...............................@....bss....0.... ...........................idata..............................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\Cons.bat (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	27
Entropy (8bit):	3.884155094595805
Encrypted:	false
SSDEEP:	3:LSI88Wn:/Wn
MD5:	085963D5D297A1663783E37A353CD7B1
SHA1:	F0CCF14C25DDB8C2032589103B7F81A05754AC24
SHA-256:	81243FE1346D5D841577E2BCC2B94529012B3EE1790E5F773A77FA7D3FA9FDC6
SHA-512:	5B5572A97F11B406B12AECF4609C1E9CD83D904C8D524012A9A2E8AD43F0BBB2C155934EB6D2A9954D17FDCC820C132CDAAE7114BEE401921C11663F050CB023
Malicious:	false
Preview:	ren %1.mdb %2.mdb..exit....

c:\int_duca\Duca.mdb (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Microsoft Access Database
Category:	dropped
Size (bytes):	1146880
Entropy (8bit):	2.1435288681955518
Encrypted:	false
SSDEEP:	3072:q1AmJVBwsMjy/wdVS9GA43zhGvaC7F4X6FAX+3SpWRUQyQVcx+KIa/pbUKhFWxct:hmJHwsMjy/wU7tUV
MD5:	096173E527C7D0EC2A840A36669BEB8D
SHA1:	601AABB86146D80C799B21822F9EAE307FCE1571
SHA-256:	87A4AE5AF8FC71E79E6BECF13A51E2E0BEE50F854E651611B595B65455D35BDD
SHA-512:	318483ECDDB853E4C9C73D72606D183B0984D3BB728A38E227A03D3B034B91F6B2AD1CD0F0FB7D5AC3207565532418527DC32C3EA240FA5AB03C0C6C8D7AA60F
Malicious:	false
Preview:	....Standard Jet DB......n.b`..U.gr@?..~.....1.y..0...c...F...N.].7h.....K.%..`.2{6... R.C...3c.y[..\|*..\|.....N9X...f_...$.g..'D...e....F.x....-b.T...4.0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\PBVM126.DLL (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5215232
Entropy (8bit):	5.9040430515891105
Encrypted:	false
SSDEEP:	49152:JQVi+g3yBPoYLcOU6MEegRDZ0D9DQrQaCwSaWoksK3nn4ilS:JQIb3TY4OeQR10D9DbAS+ksK3nnR8
MD5:	151BAEE1FF571CAC0BB9BC8E5CF1E357
SHA1:	0764CF372AC36FF2B67B32EED7C572591D9827D9
SHA-256:	4FB27B579547DB083739C509CA98C84F1A939F43AF88E36C662C6C50E1146A50
SHA-512:	FEA4036274B53B52445A6940952DEED8E2F32FA78D66A08984D258FCD2813075F5536A346762E7132CB12FBC50C591862954D36DA514DE2BB38E2F7B2EF151AE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\...............w.F......u......qs.......n.......~......qq.........".......8....qG......qF......qv......qw......qp.....Rich............PE..L....S...........!.....z.........?.(..........w...........................B.......O...@...........................0.<....T0.\|.....3.x.....................@...................................................................................text....y......z................. ..`.rdata...@......B...~.............@..@.data.........1..v....1.............@....rsrc...x.....3......63.............@..@.reloc........@......T@.............@..B................................................................................................................................................................................................................................................................................................

c:\int_duca\Renom.bat (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	260
Entropy (8bit):	4.584591727500601
Encrypted:	false
SSDEEP:	6:mR2OJEZxFRNPMyvclOvcPgxwO4R14R/Ry:mYvRL0VbgKO4z4xRy
MD5:	883C5581B6BC7DFFBAF1BD036F920CF7
SHA1:	004A628530308C6485BF22107E0C132A75744473
SHA-256:	665A17269315DF9406A2583F74FD0F5D1F738CEE87AFE34B683E8B377AFCBE78
SHA-512:	6417CCE79C675046340921B9C739FAF3DA20847EA127A8780AF3D1D9F769E4F77AC366B281290EC657FF6B38434F6F182001C35BC4B8A6AE62E7F6BD20D6B9C7
Malicious:	false
Preview:	ren c:\int_duca\export.mdb %1.mdb..copy c:\int_duca\backup\export.mdb c:\int_duca\export.mdb..c:\int_duca\zip -9 -j c:\int_duca\%1.zip c:\int_duca\%1.mdb..copy c:\int_duca\%1.zip c:\int_duca\dades\%1.zip..del c:\int_duca\%1.mdb..del c:\int_duca\%1.zip..exit..

c:\int_duca\atl100.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	138056
Entropy (8bit):	6.454887624220969
Encrypted:	false
SSDEEP:	3072:nHi2/YxBFZNAWH6Gk5BsyGfGM8EnwO95fF:BOFZKWaj5BstfbfDP
MD5:	00D2C06A552F782C1F16ACF77DB765A5
SHA1:	640FD59AE52C7C381D7696CE66668AEAAA25B711
SHA-256:	F54FE6535538174C139B1B0CB2AC0753B2E34412153A443482CCAE53FFBC4DC6
SHA-512:	BBDFA6945D57C49A886442A7D1032E08656D4999E614D5A0BE0D318832BE94520601D2DB9C0E3AFF5E083D7A1392C72FB38EAD2873520947E26993DAED7AC795
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H..&V.&V.&V..V.&V.0.V.&V.0.V..&V..V.&V.'V..&V.0.V.&V.0.V.&V.0.V.&V.0.V.&VRich.&V........PE..L...W._M.........."!.........x......5..............x.........................`......T.....@.................................T...(........"..............H....0..$....................................@..@...............\|...........................text...q........................... ..`.data....0..........................@....rsrc....".......$..................@..@.reloc..8 ...0..."..................@..B........................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\backup\blank.mdb (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Microsoft Access Database
Category:	dropped
Size (bytes):	1314816
Entropy (8bit):	2.5186258924494584
Encrypted:	false
SSDEEP:	3072:gaAmJ/NpXndyyhx4Uu1IBPwzlWs8kF44ZD629yR3b8h3o9fnZERldrFW9dUQ+Y/F:amJ/rXndyyhxq3U9fnZERk
MD5:	913A02405A9CEDD0D3C0F090331488E4
SHA1:	CC8F6F2D7B16CC80E9277B151A87D48BC2A99E56
SHA-256:	DE71C7D076CD279AF69276AB03827AD995AD66A3B3D57F7C19F0B1D4F86FAEED
SHA-512:	A24FDFD973190B5F498B48EFDAFEB9CDBC1D387F978DC32398A0C0773D334EBFA592ADBA8AFD1F40BAAC9A5E862B9EF46DCA932E14DF1AF7640E93542FAFA36B
Malicious:	false
Preview:	....Standard Jet DB......n.b`..U.gr@?..~.....1.y..0...c...F...N.^.7g.....K...`.1{6.../Q.C...3l.y[..\|..\|........V~..f_...$.g..'D...e....F.x....-b.T...4.0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\backup\blankExp.mdb (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Microsoft Access Database
Category:	dropped
Size (bytes):	3018752
Entropy (8bit):	3.452209502294229
Encrypted:	false
SSDEEP:	12288:teMVilgcAlrgaX+ZGEmJQsIf/yQVqGuKkmk3:oByNT+ZGEmJFIf/yd
MD5:	97B3D1049CCB56A39AC066AA7DC72327
SHA1:	037C80322CC804A546D5F4644473230635FA55EF
SHA-256:	5EC0F821BB25A21B1E94671B65302B038B9AA9C4E57ACB52E5BC385E9B205714
SHA-512:	35A912C8E37D8616E45D9B13FA7E61CF259BDD3283CEDB524D93BCFE7F7C874D2FA6D2B8F81837EE04C85E73C970A44E20D1EA220AED410B1F1F237C8FB66A3E
Malicious:	false
Preview:	....Standard Jet DB......n.b`..U.gr@?..~.....1.y..0...c...F...N.^.7q.....K.<..`.1{6...9Q.C...3z.y[..\|*..\|.......5R...f_...$.g..'D...e....F.x....-b.T...4.0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\backup\export.mdb (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Microsoft Access Database
Category:	dropped
Size (bytes):	1245184
Entropy (8bit):	2.995947101384081
Encrypted:	false
SSDEEP:	3072:YR43NKyRRTMEYzi9yiEPiXirIibiow3t0bs6i8He56Bv0ya/6MkzgKHFg29WHQQ8:n3NKyRRB3y
MD5:	7D51229C3D72B3716E93AD4377F7E774
SHA1:	F9DE08201F5B39EC4D5136DA735BC1AACBAFBC11
SHA-256:	246AAEE3BEB33C95EC3514AB9A1A167729139B401F359784A82BB0AF27D8FE96
SHA-512:	448F84F6001EE38432C62A03DA1C09203D4883656265FE557845CFC839EEC5C390FED2208DE5D3D0B41444C779582E823361043731BED354E8E24AF974FECE57
Malicious:	false
Preview:	....Standard Jet DB......n.b`..U.gr@?..~.....1.y..0...c...F...N8_.7....t.K...`.0{6&...P.C...3..y[A.\|*..\|......}ox...f_...$.g..'D...e....F.x....-b.T...4.0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\blank.mdb (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Microsoft Access Database
Category:	dropped
Size (bytes):	1314816
Entropy (8bit):	2.5179029806299154
Encrypted:	false
SSDEEP:	3072:i/AmJ/N6Xndyyhx4UuQHBPszlWs4sF44Zt6iWE/BZblkr8h3o9fnZLlfB2Sqrm1e:XmJ/0XndyyhxW3XW9fnZLLe
MD5:	38A725E59E09F9672184827550FF66BE
SHA1:	10FB06FFBA9BB2EDADD532A19A44AA279B10B5BC
SHA-256:	AC551AAA6474B275180B280374B0B6C28E337159E02372643E2B741906235C3E
SHA-512:	9FCB2F142D40450E9D482E999B16E6FF048E23DF1FA5D104489366BD81555CF331A7C3EF2D7641C19F5BAE4FD29E01E0D539EE49D9F57FEF265D21A801B02FF9
Malicious:	false
Preview:	....Standard Jet DB......n.b`..U.gr@?..~.....1.y..0...c...F...N.^.7g.....K...`.1{6.../Q.C...3l.y[..\|..\|........V~..f_...$.g..'D...e....F.x....-b.T...4.0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\blankExp.mdb (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Microsoft Access Database
Category:	dropped
Size (bytes):	3018752
Entropy (8bit):	3.459460119310909
Encrypted:	false
SSDEEP:	12288:ReMVYlgcXlxgaX+ZGEmJQsIf/yQVqGuKkZkZ:87RTT+ZGEmJFIf/yw
MD5:	BD267CC70633BA3DB1BA708D14622090
SHA1:	A98129178D29EEDCF6E10900BEEEC9EED66B8752
SHA-256:	DDDEA195CE2195DD94EDFAAAEFA47E4C6EE3890F764D944374012E5721DE7008
SHA-512:	1DF34C85AA1EF7DCBB9A5C07CA291F0D5F59B80558EDEA13A5A9B3D3EB325782C8BB0A29FCE5C24D750D3382DE9F63A209781D966111FBAE3C09E2E8E7337500
Malicious:	false
Preview:	....Standard Jet DB......n.b`..U.gr@?..~.....1.y..0...c...F...N.^.7q.....K.<..`.1{6...9Q.C...3z.y[..\|*..\|.......5R...f_...$.g..'D...e....F.x....-b.T...4.0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\blankexp.reg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Windows Registry text (Win95 or above)
Category:	dropped
Size (bytes):	546
Entropy (8bit):	5.48164762091006
Encrypted:	false
SSDEEP:	12:bOv8LUCXEKl2wZEQ7m/JT//ITqkmLUxuLUxwVUdpjj/mN/:pwUEKl2dxjITPmwxuwx2G4N/
MD5:	BE8FF9E45D16A49C92B67AAA7A5D6DB5
SHA1:	7AE9CE06707EA19D708B06E08FAC937193ABF900
SHA-256:	FCB23B147C9382906F7564E2A36A507003158F578B9BD9698B2D02EA898ED3E4
SHA-512:	3CBE2014FED1F5A5EF67D1CA070E9BE3F683216F6A59F411E471A9B240C6E88A354477D3536C30976F85598DE3FC1794255CB53A0C85EA052B440EBFCC661947
Malicious:	false
Preview:	REGEDIT4....[HKEY_LOCAL_MACHINE\Software\ODBC\ODBC.INI\blankexp].."Driver"="C:\\WINNT\\System32\\odbcjt32.dll".."DBQ"="C:\\int_duca\\blankexp.mdb".."Description"="Blank exportacion".."DriverId"=dword:00000019.."FIL"="MS Access;".."SafeTransactions"=dword:00000000.."UID"=""....[HKEY_LOCAL_MACHINE\Software\ODBC\ODBC.INI\blankexp\Engines]....[HKEY_LOCAL_MACHINE\Software\ODBC\ODBC.INI\blankexp\Engines\Jet].."ImplicitCommitSync"="".."MaxBufferSize"=dword:00000800.."PageTimeout"=dword:00000005.."Threads"=dword:00000003.."UserCommitSync"="Yes"....

c:\int_duca\copia_zip.cmd (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.2516291673878226
Encrypted:	false
SSDEEP:	3:urn:urn
MD5:	3BE7DDC8793A29DFA8EF708BACB5C781
SHA1:	63E656EA835817B63FEA080EEA0F27906C4CE1C2
SHA-256:	A96EF3A78C93F6DCD354287B2D8AFC7F2DE1F1E4E9FB82FBF22A44A7D267B55D
SHA-512:	54E946E7EC908D187AF9843ACEDC4AD9AE305CA0786B271F8A822A5C1EDFD2237CA0D9821FD33DF5FECCD72DEE2CDD893DC1852456110F6D08B71E29E27FD834
Malicious:	false
Preview:	copy %1 %2..

c:\int_duca\copiaduca_migra.bat (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:S9Pn:S9Pn
MD5:	A97300FE168D8B13E46A567829381C6C
SHA1:	056261EF19004C941F84D3ED3746C30EF41E12B7
SHA-256:	B7DDD9064EC65B7B2C812E5D91BC0F8A9DCC10C3AF936D6A64AEBB3667514795
SHA-512:	8CFF22C4945E89B4079363B3AAF067443430FF759501596385BD4B92C3E0B9AE2CB8FB713B875A8E080A297B35563157826914A05EE3FDA5FEB0E62DA4D633CE
Malicious:	false
Preview:	copy %4 %5..exit

c:\int_duca\del.bat (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.407224354697621
Encrypted:	false
SSDEEP:	3:d4R6rBXKVM6sEZxB2KR6rBK:d4RqKVMJEZxFRf
MD5:	7BB4867B929EC733C6A6E39F53FD6B9B
SHA1:	DC8D9690D668AC7A132050E54E1965143F73588F
SHA-256:	21127803DCC9EEC70BE966FE11B632580E1916F113DFB74371D5AC76976CFD8F
SHA-512:	6E334060A9E3C7824D8309BF7DBBE8FC548A0E0FAB9EFCAE7EE2006C0357EB617F7BEB4504E6CC3800036FA196F3FCAEE6FB3BA801856659CA913A0EB3900C11
Malicious:	false
Preview:	del c:\int_duca\export.mdb ..copy c:\int_duca\backup\export.mdb c:\int_duca\export.mdb..exit

c:\int_duca\ducaol.pbd (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	4222976
Entropy (8bit):	3.820367744184808
Encrypted:	false
SSDEEP:	12288:fuqKUdZnUuQkpSPOLBKKtUXRXHK/W5zXh5hc26HfdmBj8e1wV1tt1IN:WqJRSPOtKnXRXq/W5Lh7c26HABj8Ywx
MD5:	0998C862CFA67251F958E68DAEC8299C
SHA1:	A09B98BFE93CC43F8A52FC67E3061C446B49DC43
SHA-256:	A4EC5615E9471E183434F27433E51274F0569A6D475A4361DEB5299C5C0A8D94
SHA-512:	7E63102942CA4990114163E6F91A1E2F2EDFC61974EFB9D2A0B584318A51B51E9CD4C698BAA138A5E2BA6EBB5F2673CC2A41BFAEF5EBD692205420C6B439B1D6
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.p..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\ducaol_base.pbd (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	3.3629998518684
Encrypted:	false
SSDEEP:	1536:fybZ0o9kRg/j5wH3J4NaPDS5wUq+TRxw:GZ0o9kRg/NS3J4ALWwUq6Rxw
MD5:	CC36F6CCC8FE3147C7A7B4653A2D336B
SHA1:	055EB51A449EACEA3CE699BF524105E7C36AA799
SHA-256:	D557A83A5899172B0975A4391466FE6DC32028FD3EC8AAAAE85F11B85A683888
SHA-512:	6B26C03CA4C909D3DE138C12A788F63FFCFCB92263FE211ED590EB076E5D0B8BB6F851D78D6632236B36B0CF07B0892CE128649EFB62A1A505712A5B0647548F
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.r..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\ducaol_consolida.pbd (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	256512
Entropy (8bit):	3.6506040449227233
Encrypted:	false
SSDEEP:	768:fj+UqQ2gMIorHZkJqWirdIUsikblo2I6wa9KAzio:fj+RQ2gMIorHZkJEIUsT5io
MD5:	72BA90293964A03FE39FA6B4AC8770A6
SHA1:	F919FBDF1E39F433586C16A75394BE912542FEA8
SHA-256:	69CF7BB9BE94D72115017EA343BF19FDB21A9712BBB9DBB6B7FC9953484FD421
SHA-512:	E1A7E8F5EA1B39600706A959AED7768D4DF4631E37E08F180432BAB5BAC2A20025F1050870015351C5B851FABE6071B7777E5B51A9AA1C52D0050CDDDDF53D4B
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.r..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\ducaol_copy.pbd (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	364032
Entropy (8bit):	3.208319811096564
Encrypted:	false
SSDEEP:	6144:FhVTQZUo9sp6WhMc++dpEM8l3Gcegq9EPf1E6v:dDy/
MD5:	17472571C1BC37E4D266FF9812159059
SHA1:	234DCCE94DAB0C9130414AD016ACCB99F5EA4FD7
SHA-256:	47077E22F11274056008D0FE21A0F69BB2BD05076ABCBCF34B074FA409853976
SHA-512:	F5C3008C511697278BA9F9BD78D412A6C9C783DFD5D00AEE40183F0F379AC0C4498F7D3FF1740798BC64388E9A0A6308BF303590373386A1ACA1BF62032A2B69
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.s..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\ducaol_estruct.pbd (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	439808
Entropy (8bit):	3.503403309521647
Encrypted:	false
SSDEEP:	3072:nIdPLaXako+4qM0pJ07WSCedD5IjS9p1OAzuiBTJWfmXD:8GXG5IjBodR
MD5:	11BB6B92823685E6F4F1FD55EFC47332
SHA1:	2D691FCC8AC4AE9A4E288AA30C0965EC7AB10033
SHA-256:	7DEC382B7DDFB63E89F5E7E5FA223D7597A1F33A4129ACCF3801785D37D42377
SHA-512:	DA79E5B27BAB15258D2DB0AEE06CF3C7028EDE2977F14995F6A40E32F54894A82CB9F8C7A4FFF7AE04BEAEF2D2C900D17F9D505C24B1B6BE707F27BCB775D92D
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.s..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\ducaol_funcions.pbd (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	439808
Entropy (8bit):	3.503403309521647
Encrypted:	false
SSDEEP:	3072:nIdPLaXako+4qM0pJ07WSCedD5IjS9p1OAzuiBTJWfmXD:8GXG5IjBodR
MD5:	11BB6B92823685E6F4F1FD55EFC47332
SHA1:	2D691FCC8AC4AE9A4E288AA30C0965EC7AB10033
SHA-256:	7DEC382B7DDFB63E89F5E7E5FA223D7597A1F33A4129ACCF3801785D37D42377
SHA-512:	DA79E5B27BAB15258D2DB0AEE06CF3C7028EDE2977F14995F6A40E32F54894A82CB9F8C7A4FFF7AE04BEAEF2D2C900D17F9D505C24B1B6BE707F27BCB775D92D
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.s..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\ducaol_pipe.pbd (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	250368
Entropy (8bit):	3.683176299558454
Encrypted:	false
SSDEEP:	768:T6h7Q2gMIorDZ7+eqAdjm2UOFFhBoLIBo/It2eA7lk+9C:T6h7Q2gMIorDZ7+glm2UI2eAhk+9C
MD5:	9EF3958DAC28DBFAD7D0B7EB39BF3670
SHA1:	076D6158EE0FAE3B436A685AA5394F9EB103FDB6
SHA-256:	A5E045D7A24EBA0181A8966CC9944F8AAA72906607DB522F04ABFE22D79C3930
SHA-512:	8115C4DD0EBAF51A6CEA01CEE88401DB3ED0EDBD6B9AEECEEE0FDE7DCBC3485097D1E8D1FBE14A4206AA9F05F53BED9026CFDE21CAFC530C6E9DCA56451188BA
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.v..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\ducaol_pipe_gen.pbd (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	90624
Entropy (8bit):	3.4090611834676974
Encrypted:	false
SSDEEP:	384:TTCp1i42CAcp09eM3EcOBeMkm0m2mFA2j5GhoxCzpW2:TTCpYtf
MD5:	3FF780AD05D6248FEF49F3333FA5349F
SHA1:	4FCD9EA2156356E66AE3D37B4D9246BAD353BAEE
SHA-256:	FFE65F4EFCBB9C50269EDB98FA443E14E3F48BBAF0F84CA655519AAA92D6BC3C
SHA-512:	E7B6E8C175E1A1DC828AA09D55F5EABEBFFF249921F24FD8F9B46DA17C981176A0D35A75E756181DBB3ED1274DCB2D0017A246B53DA151DBBA6AD0A9CBF80A17
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.v..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\ducaol_validate.pbd (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 2, calibration: offset 0.000000, slope 40564819207303340847894502572032.000000
Category:	dropped
Size (bytes):	120832
Entropy (8bit):	3.274517281853046
Encrypted:	false
SSDEEP:	1536:2jLyvtelBal2jtFrEEyhJPV/MRSuo7MaLVzj:mkelBe2bbYPxsSuoQaZ
MD5:	5947149EE68B45AD4F7CDD9E2AB2643A
SHA1:	251C4858EFF8029BAB054325A4181109C089D27E
SHA-256:	965EC6926F1F33B6D3AD4C40EF177014E261E2D677F1A9178E63D9E362A80021
SHA-512:	9E6497BB2FF7D1796E80D9320D49EDA821D8EB34580B8EDD7208005B6ADD7BD5B2B6420CD0DFE5D2655F011F228A4064ABB2E8A2B76DDEB9F39FC0A0605FD62B
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.w..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\ducaolajuda.pbd (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	238592
Entropy (8bit):	3.7016925669667153
Encrypted:	false
SSDEEP:	3072:9ZV4ZpauGa9RJ3olvx7G2sbveWaiO0u7Iyk:9y3J4eD
MD5:	829123BE3C420E793B8A09A7EF0570F1
SHA1:	8DC003181DA226A6403BC49E6FD53985B3A519A1
SHA-256:	E1A1D3C976DFCA9553ED4A5EBA026115DD0088DA37FB81517283DFDA5B2B04ED
SHA-512:	5E4541CA616533B2B8F4815EF8A673502EB4A918B6F9B1F1BD11353AFDE4E2E01CF0ABE6C078A0C5966A29A1E160CD3F7B5E413ECF9512139364B0B977DDB769
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.w..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\ducaoldw.pbd (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	2199552
Entropy (8bit):	2.440544173011843
Encrypted:	false
SSDEEP:	6144:UAMOLkcUo/7Eyfzk625kMn+vdp7M8F3ole6KYcrkPX+I3ryrAQM0+zdDEM8O3oyu:/RaRXQg
MD5:	9AD3398E6AA4E167B31489BF4E691B34
SHA1:	29B791A548101E3D0FBC80F36B65012AA3EC284F
SHA-256:	4E8BBFC0E4697663EC34F58C55C2C6CEBAE43F6948EF15020129C56B9EA9EDC1
SHA-512:	CF068B63C77E752B3E0017E46FE5B12FD1691A87ACA7E74523B8619FA029057135F497679FF0F8B565CB2B6059054F3A4DB49A8267A63DF6EFD26AA8D20BA244
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.w..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\ducaolprint.pbd (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	6260736
Entropy (8bit):	2.781225076570803
Encrypted:	false
SSDEEP:	24576:e7k09RFqipcVmCITR6w6fRMcIaXjhItufV:M6Ou50
MD5:	029960B1D6DC05427C2A22680B8A0F3E
SHA1:	53E0D6FE19745C616904B6CF63DA27C4F7FCF1ED
SHA-256:	06AEC141D67E5A4BD8F8B8985F273417960EC9B465460697D6910875EF088B1A
SHA-512:	00AF90844933DB9D5F90949DA3566E4C26EE2359AC364611D0EB8B8FC3CC6F526009E46AA7B5205E7607DEC40A96EBDFC80B72E22084DCCBDB6EFC3D6190CA74
Malicious:	false
Preview:	HDR*P.o.w.e.r.B.u.i.l.d.e.r.....0.6.0.0.n..g............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\educa_manual.htm (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	HTML document, Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	115732
Entropy (8bit):	5.147541398434775
Encrypted:	false
SSDEEP:	1536:hAqOCji1yQLcBeLeIJ5YmbynefF2uuy5ecDYnKCdnYhAI6X0BnfPp:h5qhZUcDCFdRItHp
MD5:	7C66411E5531EC34FF59C3C276822B54
SHA1:	0C718CE60F0340184CCF1FE5031F9AC4FDEA1BE0
SHA-256:	C1B8A37EB966B2CE3973989FE5A4474017DC1392A4972BB55DBC3A354B8AAA83
SHA-512:	A6A32B14CACC7D4BBFF24AD7DCD7FD0B8A357580C1CD32C39CA44404394F81F59AE5DBE8462DE7C342695FE47A253E7592F65C27516BA16A6CBCE71D60ADF021
Malicious:	false
Preview:	<html>..<head>..<meta name="Author" content="Generalitat de Catalunya Ag.ncia Catalana de l'Aigua">..<meta name="Resp" content="Ag.ncia Catalana de l'Aigua">..<meta name="Content-language" content="ca">..<title>Manual d'ajuda de l'aplicació e-DUCA</title>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">..<link rel='stylesheet' href='realitzar_duca_archivos/aca_style_ie.css' type='text/css'>..<SCRIPT LANGUAGE="JavaScript">.. if (navigator.appVersion.indexOf("MSIE") != -1).. {...document.write("<link rel='stylesheet' href='realitzar_duca_archivos/aca_style_ie.css' type='text/css'>");.. }.. else.. {...document.write("<link rel='stylesheet' href='realitzar_duca_archivos/aca_style_ns.css' type='text/css'>");.. }..</SCRIPT>....</head>....<body bgcolor=white lang=CA link="#00B400" vlink="#00B400" style='tab-interval:..35.4pt;margin-left:18.7pt'>....<div class=WordSection1>....<p class=titulo1>Manual d'ajuda de l'aplicaci. <span class=SpellE>e-

c:\int_duca\educa_manual_es.htm (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	HTML document, ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	87871
Entropy (8bit):	5.156202017784088
Encrypted:	false
SSDEEP:	1536:Wxye0eCeOeT9mkYgmifFeWPzhIWyYgnwfZVO4edeOeEeOeMx:Sahx
MD5:	4716825A58E02CE6AAD469784D605A9E
SHA1:	B84A55ADF2C650C127CA3C2CE0ABDEBA87185687
SHA-256:	F54EC49CAA568B13C323E14091E5DBAA76326EE3FB66770920DA84B416D693A6
SHA-512:	1F76FAB6EB88ED04754EF1DDE863D2704227DFF9D2854477BDCBFF23B5B5DC871BBEBB601B4A8128E61E275FC0E9FE34844654AD161C82347BAFB4E7C8C0CC49
Malicious:	false
Preview:	<html>..<head>..<meta name="Author" content="Generalitat de Catalunya Ag.ncia Catalana de l'Aigua">..<meta name="Resp" content="Ag.ncia Catalana de l'Aigua">....<title>Manual de ayuda de la aplicación e-DUCA</title>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">....<link rel='stylesheet' href='realitzar_duca_archivos/aca_style_ie.css' type='text/css'>..<SCRIPT LANGUAGE="JavaScript">.. if (navigator.appVersion.indexOf("MSIE") != -1).. {...document.write("<link rel='stylesheet' href='realitzar_duca_archivos/aca_style_ie.css' type='text/css'>");.. }.. else.. {...document.write("<link rel='stylesheet' href='realitzar_duca_archivos/aca_style_ns.css' type='text/css'>");.. }..</SCRIPT>....</head>....<body>..<body bgcolor=white lang=CA link="#00B400" vlink="#00B400" style='tab-interval:..35.4pt;margin-left:18.7pt'>....<div class=WordSection1>....<p class="titulo1"><a name="A">Manual de ayuda de la aplicación e-DUCA</a></p>..<p class="t

c:\int_duca\export.mdb (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Microsoft Access Database
Category:	dropped
Size (bytes):	34103296
Entropy (8bit):	0.8666709871576216
Encrypted:	false
SSDEEP:	24576:n87aJnilcXALVuSRdA8gfLVEIXz7b3os0okg3e98LwdlRS2P8JT9KlU:n87aJnm4
MD5:	CA847920D5743A4C95F034F5CAA8E568
SHA1:	2DFD1EFEA768C1F08387276758689F889734DFE5
SHA-256:	1673D450277A877EC74D32B3E3285FBD31BDA33D26CCCD42EF19EFA10E08B2EC
SHA-512:	3DD4FA4E9BE953E9ACC3397BDE1C64A2FBF1BA7E450B2A4484820F89CABB13E868C4BDDF043E7B94B90C1D200BB79077869ED21338B7D0A9483A8EF0C000CEAD
Malicious:	false
Preview:	....Standard Jet DB......n.b`..U.gr@?..~.....1.y..0...c...F...N8_.7....t.K...`.0{6&...P.C...3..y[A.\|*..\|......}ox...f_...$.g..'D...e....F.x....-b.T...4.0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\imatges\Acceptar2.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 32 x 21 x 4, image size 336, resolution 3790 x 3790 px/m, 16 important colors, cbSize 454, bits offset 118
Category:	dropped
Size (bytes):	454
Entropy (8bit):	2.716491055112507
Encrypted:	false
SSDEEP:	6:8xxIijcSUTLFpg7iLPiElIEp4pcvHHLNUIsJhSHsfCCmCHsCHsCHLC:8x+ig9LFpg72PLyEpcInLNUIMSMzJJrC
MD5:	8DE0295C4428E8B7D6CDC8F2E48C94F8
SHA1:	BB07FF2032AD4BC26031E04CE8B96E78C53035BD
SHA-256:	DA69954916FCDA9B005ACDE70CE37B0B5F24FEEA57C7F0B24B8C75EDE5ADCE3C
SHA-512:	7AC22C6187DE5D125C036A38C0865FBA6B6ED93E786FDB3E9C1E5DC242CC456336F62BDFED0CF7F25C3D438DE65B383BC36217519AB09C1AEAB9AD5D5E89521A
Malicious:	false
Preview:	BM........v...(... ...............P...................................................................................wwwwwwwwwwwwwwwwwwwww..wwwwwwwwwwwwwp" wwwwwwwwwwwww."".wwwwwwwwwwww."".wwwwwwwwwwwp""".wwwwwwwwwwwp""" wwwwwwwwwww.""" wwwwwwwwwww."""".wwwwwwwwwp""""".wwwwwwwww."""" wwwwwwwwp""w."" wwwwwww."".wz""".wwwwww."www."" wwwwww"".wwwz""".wwwwz.wwwww."" .wwwwz.wwwwwz""" .wwwwwwwwwww.""" .wwwwwwwwwww.""" .wwwwwwwwwww."""*wwwwwwwwwwww..".

c:\int_duca\imatges\Copy.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 15 x 8, image size 240, resolution 3790 x 3780 px/m, cbSize 1318, bits offset 1078
Category:	dropped
Size (bytes):	1318
Entropy (8bit):	1.0427666363163677
Encrypted:	false
SSDEEP:	6:4lMBFfCijNUUUOE8wfOATa8wfhba8MBuu97M9GRaqXpl:4ezfCiG7MBuMtKX
MD5:	F5CB789B1BE7794E5932DDEBAC446F1C
SHA1:	9DE9B7866A4811432DB55C818F515B43E85D7630
SHA-256:	C981E3DD680198C75DB82FC8CD4FDA86D6BAAECA4D5BDB56F5F26EE83EFD391D
SHA-512:	496724F724097D001D945B28406FCC32B7F3D298A5DFE738F39AF56D4C471C42D4C676EE8E6B061A768EFC1A2EF41A3841FAD94089C7CD7B7CBB578BB1E5565A
Malicious:	false
Preview:	BM&.......6...(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\imatges\Exite.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 20 x 20 x 4, image size 240, resolution 3790 x 3800 px/m, cbSize 358, bits offset 118
Category:	dropped
Size (bytes):	358
Entropy (8bit):	3.394479317744294
Encrypted:	false
SSDEEP:	6:LijcFES5haESJzJSwZhSEwvzMwoTf9yfMlBfClBfS/W8lklcDahhG:Ligq6cEKd3zLwotflklCs4
MD5:	392D30DCD71CA0A67F1DACAC51D6CFF6
SHA1:	3F18A0CC2BA03DABB9B42547CFFB294CB3DE0C57
SHA-256:	ED30A43E6E4A533D91D55EC9B677A67B5708373FF59360020C23099F60BA3801
SHA-512:	1710D5FD907DE805CA8684F3AA6AC6A3EF34C7EB2741B62C743AAEAA3F7A74B5B4E0EEC9E91C47F8AA48F6C66E5D19AC6F782BA618AC21E26BFB6534B949EBAD
Malicious:	false
Preview:	BMf.......v...(.......................................................................................................wwwwwwwwww..wwwwww.www..wwwwww..ww..wwwwww..ww..wwwwww...w..x...ww......www.........www.........wwp.........wwv....\|....~ff`...w....~fff........~fff`.......~fffn.......~fff.......~..n........ww~.......ww~.........wwwwwwww....wwwwwwwwww..

c:\int_duca\imatges\Gencat1n.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 39 x 45 x 24, image size 5400, cbSize 5454, bits offset 54
Category:	dropped
Size (bytes):	5454
Entropy (8bit):	1.0257762130530657
Encrypted:	false
SSDEEP:	12:Fm5U1jGGVpqa2v7G0x8PgeWSxXggE2a0ggxOa1OggsIgguGggu22gggLOggeQ2g5:UE
MD5:	641B862D5F58D15B919D43CD3C55D117
SHA1:	6DE201A56C5CFB217B180BE0152C29DD58059C5E
SHA-256:	4D54C4E9C842830D8A5860812131BEB5739F4803CF286A9CF29CAD4C929F5B48
SHA-512:	D29F3FC0EE286391470CCD708E077588E5623E70096F0DE23524F8866ED13F4F7EF0A2E6678966307E3EC5A1D1108601786BA9F70684DF159F8F68D1D4E4401B
Malicious:	false
Preview:	BMN.......6...(...'...-.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\imatges\Help.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, OS/2 1.x format, 20 x 20 x 4, hotspot 32x32, cbSize 314, bits offset 74
Category:	dropped
Size (bytes):	314
Entropy (8bit):	3.0428076111829845
Encrypted:	false
SSDEEP:	6:1Eo87xEP/8x8v0TFbXlWkZCFo0no6BnyFf:17CxEH8x8sTFbxZCFoQa
MD5:	52C8045DDFD37B0AC86DA0CB57C7CA81
SHA1:	D50CA73E2394BA21965D48D710142D6BF262F0AA
SHA-256:	FA1F24B3E7779F1110456D9A238F739F5B43D367300A88CDD4EEFB52E6A6C5D5
SHA-512:	5FCF1353184C9079202A22790CCDEA2A192839C3B750AE361567B60FCF96E9823247CAB459F40BA8709F3BC21FE1981B72D65908EFDC58AD5BC7FBDDE92F86F0
Malicious:	false
Preview:	BM:... . .J...................................................................................................................wx.....................p.................................................................................p.........................................................................wwwy.....

c:\int_duca\imatges\Open.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, OS/2 1.x format, 20 x 20 x 4, hotspot 32x32, cbSize 314, bits offset 74
Category:	dropped
Size (bytes):	314
Entropy (8bit):	3.0930429101671333
Encrypted:	false
SSDEEP:	3:/tlTvlAta8tAaAAJ/X/1vd1ptyrRRBTLLMlaLLSREqzEqquESN68zX40SaAjtpS3:1Eo87xhpty1RFLLMALL0X+yz5Sw
MD5:	A6BDA424FB8F48429A07455D692FBF00
SHA1:	C94293C0C3528059B0BE9DA99E3D5FD8441518F0
SHA-256:	1E76E91F937AA5D77C4E2842839840BFC081F42E79B4C87C043A9D3145B88633
SHA-512:	55A959F48689DA998F314CDB52475F8827BC383C3A306E5E09D49189352090CEE10744B2F9EBB3D3F01B95E0A70EFF4F93C65BBD8825414C88622A3B9398C266
Malicious:	false
Preview:	BM:... . .J.........................................................................................................................................................................................wwwwwww......................p.......wwwwp.......p.........ww.........................................................

c:\int_duca\imatges\Paste.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 15 x 4, image size 120, cbSize 238, bits offset 118
Category:	dropped
Size (bytes):	238
Entropy (8bit):	3.0177087998873158
Encrypted:	false
SSDEEP:	3:i/lZllvlillKld3l/Ft/vl/talAotuZdtFT/2HFnLXtH3VUNfn+tftYtut9H/Pd:2GlPlAjvkOEfOuF
MD5:	D8455602BB1D5790D59A1ACF0CDF0D96
SHA1:	B74369987FA05378CEFF9D93B53D3A0053543666
SHA-256:	0ABB79AC5FE1002527F7DD8041C37491EE5691F462ADFBCC316776A820946BFE
SHA-512:	06BF7C91062EC694F5AB36D2E0B20E15D2C1934CF53B576AC7CF42C40C46A57B232E7E4B4B01100D8EADC81DD717BF0C8A10FC76F6B07C29F3FB00FC0570E2C8
Malicious:	false
Preview:	BM........v...(...................x..............................................................................................wwwx.......w.................................................................................................

c:\int_duca\imatges\Print.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 15 x 8, image size 240, resolution 3790 x 3780 px/m, cbSize 1318, bits offset 1078
Category:	dropped
Size (bytes):	1318
Entropy (8bit):	0.9654502906319643
Encrypted:	false
SSDEEP:	6:4lMBFfCijdXT6PitXy9CZl3XJUYioa1xGluXOXQuXwq9QXB:4ezfCipT9gEFkoaOlPARB
MD5:	0C4E8A0D31BF2364235155834FF7A464
SHA1:	2F48101AED79A7A17A4E14209F4E6C25ACF7371A
SHA-256:	7C6B838C8E13D923E092111CF96CFCA99F52B04EA76EC5145D7AF7DD4B6E046E
SHA-512:	C5FBCF86A639BA797CEA3833224C2A97BB86261C173106BE2964B68799027561D4014D9EA84977E6AD138403901C495D2B4D29779F3416888845E99E8657A097
Malicious:	false
Preview:	BM&.......6...(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\imatges\Print2.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 15 x 8, image size 240, resolution 3790 x 3780 px/m, cbSize 1318, bits offset 1078
Category:	dropped
Size (bytes):	1318
Entropy (8bit):	0.9654502906319643
Encrypted:	false
SSDEEP:	6:4lMBFfCijdXT6PitXy9CZl3XJUYioa1xGluXOXQuXwq9QXB:4ezfCipT9gEFkoaOlPARB
MD5:	0C4E8A0D31BF2364235155834FF7A464
SHA1:	2F48101AED79A7A17A4E14209F4E6C25ACF7371A
SHA-256:	7C6B838C8E13D923E092111CF96CFCA99F52B04EA76EC5145D7AF7DD4B6E046E
SHA-512:	C5FBCF86A639BA797CEA3833224C2A97BB86261C173106BE2964B68799027561D4014D9EA84977E6AD138403901C495D2B4D29779F3416888845E99E8657A097
Malicious:	false
Preview:	BM&.......6...(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\imatges\Save.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 15 x 8, image size 240, resolution 3790 x 3780 px/m, cbSize 1318, bits offset 1078
Category:	dropped
Size (bytes):	1318
Entropy (8bit):	0.955720904627428
Encrypted:	false
SSDEEP:	6:4lMBFfCij9Nww58ZS8XS6XS6XS6XS6XaGzJW:4ezfCi5XuS8C///mzw
MD5:	FEFF5592A4E03269437E1F7B901BBBE4
SHA1:	95AA1978E8B1D4AB9B420886AB34FDE36574EDB2
SHA-256:	20C2D0684F23B1339508316A9E32285688874B7F14CDCB8C0B03D60974DB1F0A
SHA-512:	308F86D77CF555311AE39F0C7A2C844E465327F1D68E9FA43E1222B67B3CC9FD40ED9E553D52F53343121AC99E97953CFF328F5B0E06F421D14576DC339640AB
Malicious:	false
Preview:	BM&.......6...(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\imatges\_cancel.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 15 x 8, image size 240, resolution 3790 x 3790 px/m, cbSize 1318, bits offset 1078
Category:	dropped
Size (bytes):	1318
Entropy (8bit):	3.1174754126123654
Encrypted:	false
SSDEEP:	3:tt/Flvlill2lvl/Ft/bt5lF3fdNvtlllFl/ltFl31Ft/ll3FNf/tll//Fl/lV3lY:4lOfCijYzHUkOWRlP5V9
MD5:	55579CB2D87D12584E45F38C502CACD8
SHA1:	5583A66886BEC4084554DD6E235BC442308C2156
SHA-256:	2A7819DF2A256A8B5238C5242A218E86EE527451CF91C997AC110B085165B724
SHA-512:	369B04A22580E862D250F2725AD1CC4646A13228A7904FFB9BB9D7597715F8AEB6D46BD1843E5242328CCAFF1FC197772BC48E165DFB6B3CDCCA53B54878FB2B
Malicious:	false
Preview:	BM&.......6...(............................................................................... @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`................@...@. .@.@.@.`.@...@...@...@...@ ..@ .@ @.@ `.@ ..@ ..@ ..@ ..@@..@@ .@@@.@@`.@@..@@..@@..@@..@`..@` .@`@.@``.@`..@`..@`..@`..@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@..@...@......... ...@...`.................. ... .. @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`...................... ...@...`.................. ... .. @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`...

c:\int_duca\imatges\aca.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 227 x 65 x 24, image size 44460, resolution 3780 x 3780 px/m, cbSize 44514, bits offset 54
Category:	dropped
Size (bytes):	44514
Entropy (8bit):	1.2616689732943136
Encrypted:	false
SSDEEP:	192:u5tK6Am5bQZIwSA8eHbVMY+9ari3mfXoSmToq4qob6:u56jKariWK
MD5:	F15141101873742D81880652AF70D909
SHA1:	E54D45A48E66C1F5A0D673F5C433AA9C353CCC74
SHA-256:	0802077FAF2CAFC4075F6ACFA6DCE49619A5296F51F2E2F493656B0E9F9C7B38
SHA-512:	4E6323731670D1A797C15CE40E64F175475D341BC4778619731BC374EB65908A8D18F6D549FDE58BC83FB9A4FE6FD2361D22DE1BD101A406E8C38A854E28F124
Malicious:	false
Preview:	BM.......6...(.......A.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\imatges\aca.ico (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 16 colors
Category:	dropped
Size (bytes):	1406
Entropy (8bit):	3.8904887540625857
Encrypted:	false
SSDEEP:	24:h75rNnSLBqXYC7odsghRodnahn2UEX5WiWNKb:NtgLBrdVRoNaovJWiWo
MD5:	1B669927C3495369F348887303E9FA55
SHA1:	22A0D0F44DD8879144AC31D57208D19D0CDAAD0C
SHA-256:	50FCECBEE4208380816EFE16A63C76FF5EEFEF841DE6C94D813160F4C0942B24
SHA-512:	F2B402DB4A0FCA5BBF7AF571FF65891448E8D77EC924D7844CEDF151952557BAB86DF57300F784657A7EC768F3D432B1AFD0D446E19EEA85F87C5CB52D67DA66
Malicious:	false
Preview:	..............h.......(....... ...........@.................................).......................................................................!...B...................r.....G.............,........^...................,..............h...........,...............\.C.o.m.e.r.c.i.a.l.\.A.c.a.9.0.0.\.a.c.a...b.m.p...................................................................................................................................................................................................0x.......................%......0x...........&...g..SB..................SE..\|...T........,............../...Z.......l........g......8.......D............,..P...........VM..........................D...(.......`.......................0.......m?.......?...................x...................LA.l...........................J........~...........NA.....................................................................................................$...(...................$.....................

c:\int_duca\imatges\avis.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 37 x 39 x 24, image size 4368, cbSize 4422, bits offset 54
Category:	dropped
Size (bytes):	4422
Entropy (8bit):	5.351503619220555
Encrypted:	false
SSDEEP:	48:hmB/tRXkJzVgCJGMJmsNeGQvKe9goVgKOviwlTOEUtmKEX4aGrUwEAGxbI:hmB/CgOJmsNUv1pVrO1mtmKEoazRxbI
MD5:	C685D449508C4D25F522CC4C9957910F
SHA1:	7B74D3F540BD25E89B718953FDEB5CD348B348BD
SHA-256:	CAE273496825ADA2F9AAC29B8DE96106C746CDCDBB3ED76BDD43B6A39CBA8112
SHA-512:	AD7FA0162B9D9FE330DF23390E043003E2FF0E1E50C0E66B9868B35FF2E946239EDBE81C659399A8CAA74EF61C9E3ACBEB1C12FC14784A93FFE3DF01B714D8C3
Malicious:	false
Preview:	BMF.......6...(...%...'...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................{{\|nnonno{{\|..............................................................................................................................................................................................................lf.XN.OC.OC.XN.nh.................................................................................f^.K7.F..G-.G,.G,.G-.H..I0.F..I6.f_...................................................................ql.I2.G+.G).E&.D$.;..5

c:\int_duca\imatges\cancel.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, OS/2 1.x format, 20 x 20 x 4, hotspot 32x32, cbSize 314, bits offset 74
Category:	dropped
Size (bytes):	314
Entropy (8bit):	3.375240914581773
Encrypted:	false
SSDEEP:	6:1Eo87xsDE82lURJKjtIVTcpW/T80wVlHqC:17CxhcbKj6VTcpWuVtqC
MD5:	87DB792BC11B56BCF1B8ECA4D2713580
SHA1:	6278638028CB8A4D8ABBEBB2279D261578F392C4
SHA-256:	3655FDDC617DA1C0985543955B640D410BC6754D60FEB8BD852E6205086816E7
SHA-512:	099247EBB405B27154856143568213ECD4D711AC2E5782A938071E87BA350D5FD79E30313868429E5B69FA59BA9409B2D4E7C0D4A09BE1CD1A41AAB1E1EBF608
Malicious:	false
Preview:	BM:... . .J....................................................................................................;.....;.....;....3......3....;.......;..3........3..;.........;...........;.......................3...........;.............3........3...;.......;...3......3.....;.....3.....3.....339...33...............

c:\int_duca\imatges\copy1.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 15 x 4, image size 120, cbSize 238, bits offset 118
Category:	dropped
Size (bytes):	238
Entropy (8bit):	2.8409174496679657
Encrypted:	false
SSDEEP:	3:i/lZllvlillKld3l/Ft/vl/talAotuZpqRqdf//xaMdfBxaMVXl52DX86BFDXllW:2GlPlAjEc3pacqUXoX8UNXGV9/jr
MD5:	E8D06D2D62E839FA811763EF8FA24051
SHA1:	2C028C15F02C2B0E028FACA2B73C9B8AFC464C55
SHA-256:	E56713EB3027597172D0CBC25F223D0CA7E82496008F9E5B0BE5883B176543F5
SHA-512:	50F76F84C02ADDF6A2D45E5F402244D3B2759BB72870F33E5FC23E7D684A2BCCF9B28354B575215522E3FB09304A7B46A0D859B4DBBE10F44288A30C3BF63DB1
Malicious:	false
Preview:	BM........v...(...................x.........................................................................................................................................................................................................

c:\int_duca\imatges\copy2.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 15 x 4, image size 120, cbSize 238, bits offset 118
Category:	dropped
Size (bytes):	238
Entropy (8bit):	2.8409174496679657
Encrypted:	false
SSDEEP:	3:i/lZllvlillKld3l/Ft/vl/talAotuZpqRqdf//xaMdfBxaMVXl52DX86BFDXllW:2GlPlAjEc3pacqUXoX8UNXGV9/jr
MD5:	E8D06D2D62E839FA811763EF8FA24051
SHA1:	2C028C15F02C2B0E028FACA2B73C9B8AFC464C55
SHA-256:	E56713EB3027597172D0CBC25F223D0CA7E82496008F9E5B0BE5883B176543F5
SHA-512:	50F76F84C02ADDF6A2D45E5F402244D3B2759BB72870F33E5FC23E7D684A2BCCF9B28354B575215522E3FB09304A7B46A0D859B4DBBE10F44288A30C3BF63DB1
Malicious:	false
Preview:	BM........v...(...................x.........................................................................................................................................................................................................

c:\int_duca\imatges\dcca32w.ico (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 16 colors
Category:	dropped
Size (bytes):	766
Entropy (8bit):	3.8241860476823466
Encrypted:	false
SSDEEP:	12:IBwEHE9UL/jwsHn3lbbNkK0j444TQG/XEFOfn4wEX:IBwaEmwsHnBbT0j4449vKwK
MD5:	58E95130EA59D699ADBF8C32EEFB49CE
SHA1:	198F55433CAD6406B69947859E09D49984B06C7F
SHA-256:	C489BB4A4D367C33C003DD50041F40124657ABFDC4F373D20C2981CB3A55E9F3
SHA-512:	83C5119A210122FD82EE27C0F86ACF1CDB8D3ED6765041B53443382D42EBEE6E9507C54FCB23169A5AF262EC3C939D2559AF6B9CF20FEA1B0CE2C69701DF8451
Malicious:	false
Preview:	...... ..............(... ...@..................................................................................................."!...."!.....!..!.4C3D.".. ....!.DD3D33.!....!".333DCCDD.!!...!434334DD31".....CDDDCC34DD....!3333CC4C3331!..!DDD334DDDDDA"...334DDCC333CD..".4C4344DDCD33." 4C4CDC43333DD0" 33C433C3DDC33@"!DC4DDD4DC3DDD1"!C433C4D34D333A"!3DDDDD3DCC4D41"!UVfUVfUVfUVfUQ"!UVfUVfUVfUVfUQ"!UVfUVfUVfUVfUQ"!UVfUVfUVfUVfUQ"!UVfUVfUVfUVfUQ" uVfUVfUVfUVfUp" uVfUVfUVfUVfUp"".VfUVfUVfUVfU."..VfUVfUVfUVfR...!VfUVfUVfUVfQ"..!VfUVfUVfUVfQ!....fUVfUVfUVf.....!fUVfUVfUVa"...!".UVfUVfUP.!!....!.VfUVfU.!....!..!.fUVf.".. ....."!...."!....................................................................................................................................

c:\int_duca\imatges\esborrany.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 423 x 55 x 4, image size 11660, resolution 3780 x 3780 px/m, cbSize 11778, bits offset 118
Category:	dropped
Size (bytes):	11778
Entropy (8bit):	1.4279637354146355
Encrypted:	false
SSDEEP:	192:Z+D5Gv3S9mvwCOOMvEQUUqZUbTgqSGugj6Vccc2K5SFUKmBSbVEUp2Vj/he6Ljgv:Z+D5GvC9mvwCOOMvEQUUqZUbTgqSGug0
MD5:	592F099EBB34ECE1BE8CFDA173F3A6C4
SHA1:	73CB5999FFA0D218B3DC831567DF6E8B73C05D36
SHA-256:	11FA3A6B0A4E27EEFDA11CCFD8939D100E379AE3607FA6E806DF112A2E45C351
SHA-512:	18E4BF6C4D4BEAAA337383DADF3A58E4709D8ED3A7987FF030F344F8BCE3509A04D2903D978CA13FD3F21B2981808B83E4C2504588E592D05F139C31ED825451
Malicious:	false
Preview:	BM........v...(.......7............-....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\imatges\esborrany_horiz.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 423 x 55 x 4, image size 11660, resolution 3780 x 3780 px/m, cbSize 11778, bits offset 118
Category:	dropped
Size (bytes):	11778
Entropy (8bit):	1.4279637354146355
Encrypted:	false
SSDEEP:	192:Z+D5Gv3S9mvwCOOMvEQUUqZUbTgqSGugj6Vccc2K5SFUKmBSbVEUp2Vj/he6Ljgv:Z+D5GvC9mvwCOOMvEQUUqZUbTgqSGug0
MD5:	592F099EBB34ECE1BE8CFDA173F3A6C4
SHA1:	73CB5999FFA0D218B3DC831567DF6E8B73C05D36
SHA-256:	11FA3A6B0A4E27EEFDA11CCFD8939D100E379AE3607FA6E806DF112A2E45C351
SHA-512:	18E4BF6C4D4BEAAA337383DADF3A58E4709D8ED3A7987FF030F344F8BCE3509A04D2903D978CA13FD3F21B2981808B83E4C2504588E592D05F139C31ED825451
Malicious:	false
Preview:	BM........v...(.......7............-....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\imatges\explorer.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 24 x 24 x 4, image size 288, resolution 3780 x 3780 px/m, cbSize 406, bits offset 118
Category:	dropped
Size (bytes):	406
Entropy (8bit):	3.7533650773751126
Encrypted:	false
SSDEEP:	6:170lAjcf1Y4p0+w0GZmCZt+yxSlUKvfg6IlLYQ1pzAVtfK8:1Yigf1YU+FDZt+yxGUKv+LXp8
MD5:	E681F72C50AF1BF3999BF0B9B55969F0
SHA1:	C6771F5FAE898299DCE0D3E8011834D3A114200C
SHA-256:	F743830C5B3AD110E84BD19B8119B49AC3317EC5A74590A1672B7CDAD8CEC4D8
SHA-512:	E56AC25D0C8740E6ABAE4F169339D893682BE6773D831333EA75DB683CC183997543563A852EF6A57F8A3514A5AE28C1A78989509BF16D9A6542449A0D844E8C
Malicious:	false
Preview:	BM........v...(................... ...................................................................................wwwwwwwwwwww...................................................................N..................s333N.3.......p............s;.......x...........~...........x..............{.........w.....................x...www..................wwx......................................................

c:\int_duca\imatges\fn1060.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 4, image size 130, resolution 2834 x 2834 px/m, cbSize 248, bits offset 118
Category:	dropped
Size (bytes):	248
Entropy (8bit):	2.9133810661071315
Encrypted:	false
SSDEEP:	3:ATllvl9lslxlnFe36nl/Ft/HtAiotuZvE81BalXtql/VxRacfRStlAlFaRMqlw5B:fli6wijcIO4paASXAlFHnWJun
MD5:	75A2A1EB3FA86F66979F28BAFF81A9F9
SHA1:	74A84783452CE06730EAAB8FE776BC6260A0F91D
SHA-256:	00E6A54CA20466628CDA8A28EBECFBA140BD12673B93F21935EA2C52AC0F9F43
SHA-512:	47ABDDD5D41FE8382796464AD9FDC7DA3085A7A911D62ED14CDDA00EB79CE0AB5BD074C893B86300564A4BE3B16EA4D5604CB20CCBFCB504F75C6F6BAA6860C8
Malicious:	false
Preview:	BM........v...(.......................................................................................................wwwwwwwwx..........wwwwp...........wwww........p..................................................................................

c:\int_duca\imatges\generalitat.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 163 x 50 x 24, image size 24600, cbSize 24654, bits offset 54
Category:	dropped
Size (bytes):	24654
Entropy (8bit):	2.4366592393294493
Encrypted:	false
SSDEEP:	48:XadwkvBfRnQB22sg/C4yiMMAAYDGcfp1N1iTdCyiBMNGASet4crsmjmPt3rTXKN0:XRkpf+1BODGOH1aCrSQHmkU3DVhIlc7I
MD5:	4AF98E967D500CE8B3FCE72212586CC3
SHA1:	0EB1FF6E37CEF558E1F20B14DAA29BCD27B117B5
SHA-256:	584A8BB8E50595F7EE87A46292D033D1375924ABCB19D7B0F5CF005137A205F4
SHA-512:	27BBA8FC0AF46417B21C5E9E9C632552C6945D26B33BDFF482EB5B286F6B80822CB966E0D6DFD596301FE13668DCF0E87E3678452946E92F42A645F8AAD73A84
Malicious:	false
Preview:	BMN`......6...(.......2............`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\imatges\paste2.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 15 x 4, image size 120, cbSize 238, bits offset 118
Category:	dropped
Size (bytes):	238
Entropy (8bit):	3.2691059132443536
Encrypted:	false
SSDEEP:	3:i/lZllvlillKld3l/Ft/vl/talAotuZ91fdqonl//3PPfqeUq1hddMdRwFq7ddqI:2GlPlAjQol3CJq1LdMDdPPTJX1
MD5:	A0AC70977E09C48A02F7AC7D43CF0993
SHA1:	3AF16C25548B5C7DE7B6157F5792AD51B042D1D1
SHA-256:	5FA5EC7DC589A02A38455EBB055242D2DCF48E5AFD5B878BD603157D0E365366
SHA-512:	8F14D1A89F464C7FDB5A412145DB859B1F40256F3EA597305E57E91735ACAD99C13FB477A761020FDA48CEE87EC6FC362A0B2534DAA149E269ACD7AC5BAFF3ED
Malicious:	false
Preview:	BM........v...(...................x..............................................................................................www........w.................................................................................................

c:\int_duca\imatges\print1.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 15 x 8, image size 240, resolution 3790 x 3780 px/m, cbSize 1318, bits offset 1078
Category:	dropped
Size (bytes):	1318
Entropy (8bit):	0.9654502906319643
Encrypted:	false
SSDEEP:	6:4lMBFfCijdXT6PitXy9CZl3XJUYioa1xGluXOXQuXwq9QXB:4ezfCipT9gEFkoaOlPARB
MD5:	0C4E8A0D31BF2364235155834FF7A464
SHA1:	2F48101AED79A7A17A4E14209F4E6C25ACF7371A
SHA-256:	7C6B838C8E13D923E092111CF96CFCA99F52B04EA76EC5145D7AF7DD4B6E046E
SHA-512:	C5FBCF86A639BA797CEA3833224C2A97BB86261C173106BE2964B68799027561D4014D9EA84977E6AD138403901C495D2B4D29779F3416888845E99E8657A097
Malicious:	false
Preview:	BM&.......6...(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\imatges\simulacio_calcul.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 426 x 530 x 4, image size 114480, cbSize 114598, bits offset 118
Category:	dropped
Size (bytes):	114598
Entropy (8bit):	0.6562065355928546
Encrypted:	false
SSDEEP:	384:f6IdIHsxAXmQOxz/zr8wF9/ZJGneQLsWGrouTF7+Lk7MEx7AGSr3e5r3Wx97sM7z:G
MD5:	0FD45E8C3A6F2C909600CF23286123A6
SHA1:	884C1CE96965E884330DF8C9809D17A38D59C5F3
SHA-256:	4C5711499EA9C6C8D8D0E5E986809230B728B7C564232A63CAA9D48B994194E3
SHA-512:	03F4838087AA6F1F23BE37F95A24D2A3D5BB90E03E496DED07F5FDDF8D5DECB2E49786B6AD7E92EB7181A7B1B02BE41FA0740CDB0CF3F12C553F89F7325BF458
Malicious:	false
Preview:	BM........v...(...................0.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\imatges\simulacio_calcul_horiz.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 491 x 74 x 24, image size 109224, cbSize 109278, bits offset 54
Category:	dropped
Size (bytes):	109278
Entropy (8bit):	2.811371832976779
Encrypted:	false
SSDEEP:	384:IInSiv56q/v9I0ePxY9jPeJg51UMWxkVbnvjHaWv84FUPBhtV1xfN2m/Wx:I9iA7PM/5idP7BPtq
MD5:	68F71E42F58E24CF2EC85AC04B3A463B
SHA1:	12D1195BAEDB6369552183DF7E5FC070D26DADFF
SHA-256:	AE9BF62BC25D21F0E7FACD3C6FC8EC2EFA8F212265E2AC5AC35BE7DD0DEFFBCB
SHA-512:	08D5764211C5080F829E696FE2D331FA14124D27DF0F67D3E42A7324D4D9BA88CDB8B5B4A846AB00B4048E42E1C4C5C301DAE010320D6417378C7316D62B0CE9
Malicious:	false
Preview:	BM.......6...(.......J.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\imatges\sumatori.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 9 x 23 x 24, image size 644, cbSize 698, bits offset 54
Category:	dropped
Size (bytes):	698
Entropy (8bit):	1.0398767581475394
Encrypted:	false
SSDEEP:	12:sI+0hiiiiihHHCaHPIoFP3aShRhHUiiii7:BTiiiiig4wofZziiiii7
MD5:	7372EDCEAC3F8DDB3A7133422FA90D32
SHA1:	C43D25FF6ABB6E18D1F4FA1E0D9856E708B4C9D0
SHA-256:	9CDDC9D31E62AAC6FB3FB6889B440A731A1F64976A4639410EA2ABC79EEFCB35
SHA-512:	E9344F1AE1FAF611D91EE1D0D0F6FD3AF964EC66FA91A53A4F1AD6D60D53EC304C50F2B9A9D8AFC3BF9A07534684F85F2FCC474707F24B462A97A9D79F1CD278
Malicious:	false
Preview:	BM........6...(...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\imatges\sumatori_esb.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 9 x 23 x 24, image size 644, cbSize 698, bits offset 54
Category:	dropped
Size (bytes):	698
Entropy (8bit):	1.0398767581475394
Encrypted:	false
SSDEEP:	6:s/gl+01Accccc0XXXXXpnPXpsmXp9pXpqmX7qPX790X7s0XXXfcccccn:sI+06HHRbtdEijHE
MD5:	E75D8074F83FE8C809A740C15FD7FF55
SHA1:	486AB3644FFC03543863B7C0B7294FF4D322DD5E
SHA-256:	1A5973F1FF7599F28E51382942560911792058026822A39CBDE5FBDDB9018015
SHA-512:	C3B09BAB53FD1372FBEB09203AE3AE6CE90DBE61AB50C35A9BEFB41BFFA1FE02B8D0E320624A08E67B9C0C66F3DD0632004987CC0967DBA90C9BBDCEAC793D78
Malicious:	false
Preview:	BM........6...(...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\imatges\update.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 13 x 14 x 24, image size 560, resolution 3780 x 3780 px/m, cbSize 614, bits offset 54
Category:	dropped
Size (bytes):	614
Entropy (8bit):	1.5387089853580784
Encrypted:	false
SSDEEP:	3:4Gljlll8lthxvX3llllllllllllllllllllllllllllllllllllll/lllllllllw:7lZci9a9a9Kw9a9aA9O9a9x9a9N
MD5:	99B06DDD05276F32E3F4CD9C29CCFFCF
SHA1:	816CC7257EFFCF59CC99CE67B5EC5EF413155F50
SHA-256:	F217EB4FA215862A904D57DB98AE2686CB4A678C3E11AE022A0A49BCD361E2E3
SHA-512:	AB7588F37DBFE486DE827245B4D72DEB82D5BEC254936D9C57BB4AA226B67C5EE090C20B023135D646CCAF49DBE491E529F4301D5018946DD48276CE0AC79005
Malicious:	false
Preview:	BMf.......6...(...................0...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\imatges\update2.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, OS/2 1.x format, 20 x 20 x 4, hotspot 32x32, cbSize 314, bits offset 74
Category:	dropped
Size (bytes):	314
Entropy (8bit):	2.894045179699004
Encrypted:	false
SSDEEP:	6:1Eo87xyd14d484LwD88O84b5O8ueO9NtH4:17CxH6pED88TkQ8uv9NN4
MD5:	22460DC4A7AA5BAF1F89B4861CDAA083
SHA1:	148BEC98B236859680AAEA6501E4469C20733406
SHA-256:	2E72301F5367C2EC178088C8FEE3E4C60247EE4D5C13F0E8C798B5FA583739E4
SHA-512:	37FA44E03FB2C72BDE91220BB496F2813C45CC066637ADD38E4B6B6FB0B4D886C496000DA9628A847E70F3E757CF1C546E787778333411230C49E0DCBF8540AA
Malicious:	false
Preview:	BM:... . .J.........................................................................................................................................................................]........]..........Y.]......................]......................]...........UY.......................................

c:\int_duca\imatges\validate.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 24 x 24 x 4, image size 288, resolution 3790 x 3780 px/m, cbSize 406, bits offset 118
Category:	dropped
Size (bytes):	406
Entropy (8bit):	4.0364011121582
Encrypted:	false
SSDEEP:	6:1xxCijpjt/S1VCaa0E/eBea5aaa0aHdaaaeQSqtMN5MTKeicTLd3llxZub:1x0ija1VCa2eoa5aasH3L2opcV3/xob
MD5:	0FA7BF7F2B58266489A0B632C782CDCD
SHA1:	0BA1540A0DB306A9BD8F14A15FF01C4784640893
SHA-256:	45DCF160039F4079036BF3D1B69949ABD893BD1521094F18CA298570F5A31A52
SHA-512:	A49096D1199ECA6A825A56B326C215FF2E6C112972CC68F2719F3A6C7F63A3015424AF43AA1F8C2A12636283886E0147F03082B60BB1D66FF302CD04AAF0FFAC
Malicious:	false
Preview:	BM........v...(................... ...................................................................................x............wwwwwwwwwwx.wwp......wx.wwp......wx.wwp.......x.wwp.......x.wwp.......x.wx........x.w.........x.w.........x.w.........x.w.........x.w.........x.w......p..x.w.........x.w.... p...x.......wwwwx.w.....wwwwx......wwwwwx.w....wwwwwx....wwwwwwwx.w.wwwwwwwwx.w.wwwwwwwwx............

c:\int_duca\imatges\vssver.scc (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	5.456575449518104
Encrypted:	false
SSDEEP:	12:wT93/Rlfl0oUMr2RODvNg6B//nl11uI5qslN0uiDll:wT93vmMsU1/lDu2qslWuiD/
MD5:	2A0193733131E622AE15DF47D5E78530
SHA1:	1DCE9092987F384D02CE8D50B0FD17CAB2ACC29D
SHA-256:	1A2AF104D276C89A6C03AB7FE5BD4340F807EC529A843E6BC8211A66C4BF7227
SHA-512:	28587C07086FAEBFDFAA6693A44026A7DF9C353C78C900173171230B87439E57F44C0B2E4E85B6105CFDFE46D3F66304F60030CB97DB4D0870E8D19877026754
Malicious:	false
Preview:	4...Q..b..1J.}.r6;{.. ..+.......J........pu.....K.....?..I.....L....&..CEf.....M......H..p.....N....H.Q.P......O.......1a;.....P.........2.....Q....L.(........R...Gp..........S.....HO.T......T....bt.........U....5..=.......V....aj.........W.....J]c.K.....X...".b.u.B.....Y...obp5.8[.....Z......\..S.....[......il.....\.......^&.....]...ZH.m.B2.....^...ZH.m......._...T..........`.............a........}......b..... ...W.....c......"E`p.....

c:\int_duca\imatges\zooma.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 90 x 21 x 8, image size 1932, resolution 3790 x 3800 px/m, cbSize 3010, bits offset 1078
Category:	dropped
Size (bytes):	3010
Entropy (8bit):	2.0964326008993726
Encrypted:	false
SSDEEP:	6:+xx5fCij6I6I6I6w0iiiiS6/ihhiBiih66ihh0iBih6Jihh0iBiS68uLBiP6r67D:q5fCi3BXhGihhohBziBt+PTlwkwwuba
MD5:	8440B67AB4611DBD1E86182563B55B97
SHA1:	25F5037ECB19F909FE9A1D731CA97BD9B05EC732
SHA-256:	D9B42BE1A9D109A5681319E95AC175965141CF13F889DFB7AC688A9EC64DD42C
SHA-512:	78F798A602E164A23DA07E89CEC9D6AEB89199B6AB670DFD2163649DC8E4BAB097C66DA54D60783254BCBD7DCE14B530A11591A8226EE75370D78DB89DA52EE6
Malicious:	false
Preview:	BM........6...(...Z........................................................................... @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`................@...@. .@.@.@.`.@...@...@...@...@ ..@ .@ @.@ `.@ ..@ ..@ ..@ ..@@..@@ .@@@.@@`.@@..@@..@@..@@..@`..@` .@`@.@``.@`..@`..@`..@`..@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@..@...@......... ...@...`.................. ... .. @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`...................... ...@...`.................. ... .. @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`...

c:\int_duca\imatges\zoomr.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 90 x 21 x 8, image size 1932, resolution 3790 x 3800 px/m, cbSize 3010, bits offset 1078
Category:	dropped
Size (bytes):	3010
Entropy (8bit):	2.0964326008993726
Encrypted:	false
SSDEEP:	6:+xx5fCij6I6I6I6w0iiiiS6/ihhiBiih66ihh0iBih6Jihh0iBiS68uLBiP6r67D:q5fCi3BXhGihhohBziBt+PTlwkwwuba
MD5:	8440B67AB4611DBD1E86182563B55B97
SHA1:	25F5037ECB19F909FE9A1D731CA97BD9B05EC732
SHA-256:	D9B42BE1A9D109A5681319E95AC175965141CF13F889DFB7AC688A9EC64DD42C
SHA-512:	78F798A602E164A23DA07E89CEC9D6AEB89199B6AB670DFD2163649DC8E4BAB097C66DA54D60783254BCBD7DCE14B530A11591A8226EE75370D78DB89DA52EE6
Malicious:	false
Preview:	BM........6...(...Z........................................................................... @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`................@...@. .@.@.@.`.@...@...@...@...@ ..@ .@ @.@ `.@ ..@ ..@ ..@ ..@@..@@ .@@@.@@`.@@..@@..@@..@@..@`..@` .@`@.@``.@`..@`..@`..@`..@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@..@...@......... ...@...`.................. ... .. @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`...................... ...@...`.................. ... .. @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`...

c:\int_duca\infozip.txt (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2354
Entropy (8bit):	4.6194234968789045
Encrypted:	false
SSDEEP:	48:ypSm/ThteDD+CQ/v8ebi/OTDP5bHJ3Zm3zCqkAIQl:y4yThtEQnTDP5LJ3Q3kw
MD5:	C43813503F00931BD40401F511E341D5
SHA1:	151BC38944F61EF6DFA0FBEDA2E49D8BCC5EF58D
SHA-256:	95070A28956941484B7A8A52B9E44F576673E4581F0BB0B849CF5B827D071E12
SHA-512:	C34EAB342CD6FABA4DA1EF3AAD192D07D17B112A2EE127C80FAC74B8788DD37BE71410A10312C57C88657A1B2C9661ABC66DEED538FF229F4881BD75D739F1DF
Malicious:	false
Preview:	Copyright (c) 1990-1999 Info-ZIP. All rights reserved.....For the purposes of this copyright and license, "Info-ZIP" is defined as..the following set of individuals:.... Mark Adler, John Bush, Karl Davis, Harald Denker, Jean-Michel Dubois,.. Jean-loup Gailly, Hunter Goatley, Ian Gorman, Chris Herborth, Dirk Haase,.. Greg Hartwig, Robert Heath, Jonathan Hudson, Paul Kienitz, David Kirschbaum,.. Johnny Lee, Onno van der Linden, Igor Mandrichenko, Steve P. Miller,.. Sergio Monesi, Keith Owens, George Petrov, Greg Roelofs, Kai Uwe Rommel,.. Steve Salisbury, Dave Smith, Christian Spieler, Antoine Verheijen,.. Paul von Behren, Rich Wales, Mike White....This software is provided "as is," without warranty of any kind, express..or implied. In no event shall Info-ZIP or its contributors be held liable..for any direct, indirect, incidental, special or consequential damages..arising out of the use of or inability to use this software.....Permission is granted to anyone to use this

c:\int_duca\instala.bat (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.050919888787394
Encrypted:	false
SSDEEP:	3:ovfhxwQrn:oHhxwQrn
MD5:	E53E20DB97314B5DF3B79865462FA781
SHA1:	19393E7A2AFA9803E4EC70CAF05EEE5563E946DC
SHA-256:	4D371655A004C3FF92EF92719C8FB3E8BA0A5DF3092F214F3E468EC5CB58D831
SHA-512:	5BC1C919BB12DC61A238355840CD6C0657505834F4BA5FB108194D68CE4ABA2C87168C7E5C6B214040408F82B3436A679523CED52290481B45561C7D59D26A79
Malicious:	false
Preview:	C:\int_duca\upgrade.exe....pause..exit....

c:\int_duca\int_duca.ini (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.629735294885636
Encrypted:	false
SSDEEP:	3:usyrOCDg3t1EMDgp2XKjKcedwHG7ov4+rjovn:usD35cednO4Jn
MD5:	114A1CA8D18963719E620CC1E2AE6197
SHA1:	AF60413417585112B6C03311E82497F54172AFDF
SHA-256:	B6458378C20242CC1746A86A70A8E94A581D9424B2663F828D3D0121E49FF0F7
SHA-512:	30A9FF75B37847DA311B6387D64D10B7B7B925134F215AF0D0F48DA22E84937F207B5470B2401DBA0A6E5A8CC5F4FF4378C405136FA19DECC034E56766E747D2
Malicious:	false
Preview:	[DATABASES]..DSNORIGEN=int_duca..USERORIGEN=..PWDORIGEN=..DSNDESTINO=int_duca_export..USERDESTINO=..PWDDESTINO=..

c:\int_duca\int_duca_export.ini (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.629735294885636
Encrypted:	false
SSDEEP:	3:usyrOCDg3t1EMDgp2XKjKcedwHG7ov4+rjovn:usD35cednO4Jn
MD5:	114A1CA8D18963719E620CC1E2AE6197
SHA1:	AF60413417585112B6C03311E82497F54172AFDF
SHA-256:	B6458378C20242CC1746A86A70A8E94A581D9424B2663F828D3D0121E49FF0F7
SHA-512:	30A9FF75B37847DA311B6387D64D10B7B7B925134F215AF0D0F48DA22E84937F207B5470B2401DBA0A6E5A8CC5F4FF4378C405136FA19DECC034E56766E747D2
Malicious:	false
Preview:	[DATABASES]..DSNORIGEN=int_duca..USERORIGEN=..PWDORIGEN=..DSNDESTINO=int_duca_export..USERDESTINO=..PWDDESTINO=..

c:\int_duca\int_duca_server.ini (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Generic INItialization configuration [DATABASE3]
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.243468377856944
Encrypted:	false
SSDEEP:	6:u85wVZMRw1QiZViFH5XK29FhRy1kb/QDoyG91QiZh/Iha4Kj7+:u85wZN+0293b/QczNnK87+
MD5:	61E724D0B045B65FEE82907D789D5C85
SHA1:	1C4E666A201945038963A7F6F866EC47D090891A
SHA-256:	7888BD07B04CA664C1353D9E89EB285ACCEFD57CEF8805A4F02D76B807A408B5
SHA-512:	D0EB3A6418D9CB4A6AC89B962E413DEA7ADA2DBB003B3AC815D26FE24770B91CE73597133E0B177D54F3FC79989E2F93F2EB4C062EF7A35099C1E03E23665C1F
Malicious:	false
Preview:	[DATABASE]..DBMS = "O10"..ServerName = "itaca_pro"..AutoCommit = False..DBParm = "PBCatalogOwner='ACA_ADM'"..LogId = Mu]dI6K(..LogPass = YyQ)Up='....[DATABASE3]..DBMS = ODBC..DSN = MABRACASADDBP01..AutoCommit = False..LogId = ZiY{L{Z..LogPass = ZiY{L{Z..DBParam = CommitOnDisconnect='No'..

c:\int_duca\intduca.exe (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	47616
Entropy (8bit):	4.961779533745828
Encrypted:	false
SSDEEP:	768:JsAZ3inch84zhnzeEDGAnxmnNzJuA5dIp12p:FZnNydt
MD5:	609D64D105929A0981416954C853D119
SHA1:	DFE4D0F4F3D51C935175D50B6B573D3EAA588C70
SHA-256:	88A55AF44EDB1E9C3A33FBACB700AE8BB56CE4F52C97E9C7C38C5758E219A202
SHA-512:	D75F0F92B3720FC837C30D47CCFBDD26F8B139C785820310B8823441D413EDDFEEDF45F3EF216F137DD90146C5ACDE372C415B1168EEB28FA2298A4D9AC0C0D0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B.Pt,.Pt,.Pt,.Y...Rt,.K..Xt,.K..it,.K..Ut,.Pt-..t,.K..[t,.K..Qt,.K..Qt,.RichPt,.................PE..L......S.................F...D......I........`............................................@..................................z..<....................................................................x..@............`...............................text....D.......F.................. ..`.rdata..d....`... ...J..............@..@.data................j..............@....rsrc................v..............@..@.reloc..l............x..............@..B.rsrc...............................@..@........................................................................................................................................................................................................................................................................................

c:\int_duca\libjcc.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	360448
Entropy (8bit):	6.0951398721054035
Encrypted:	false
SSDEEP:	6144:OObeuE82aWj9RliFR+BKjp8FKNcGzmnU:OeeuEyWj9+6OpwKqgmnU
MD5:	5B3CD60D003752061EA4A622CF8F8DD7
SHA1:	BC22B54B7790C3381B4A592275DB0D5D4CB30D3A
SHA-256:	53A5B5E2FE965EBF0FE85A5E0A2613D70EB7D5A5E5E98BD720790116BF07A949
SHA-512:	CD4EE02B0E5D70F35D3B5154B35F913EE24FE668351FD82C42137686ED9D21C669B3C4887AA680CABFA6D489335A2D03F35FB5AA0B2A7957ED4A85FA12D0A568
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?..{...{...{.......x.......y.......~.......y...{...t...{..................x...}...Z......z......z...Rich{...................PE..L...C..C...........!..... ...........*.......0.......................................................U...............8.......1..d.......H........................0...................................................0...............................text...p........ .................. ..`.rdata..{%...0...0...0..............@..@.data....3...`.......`..............@....rsrc...H............0..............@..@.reloc...6.......@...@..............@..B........................................................................................................................................................................................................................................................................................................

c:\int_duca\libjtml.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	2.9834019231042674
Encrypted:	false
SSDEEP:	192:FM/VSvBFaddCHtBBvNb39kcCTzwukgZM9SDcH6yXo688wAVNNhonQWwje8:S/VQBo/CNBzbofr0oQ6CoR9AVv5
MD5:	88042CD545C7604B2120FD05DF5A1688
SHA1:	4EEF8F9BCA7A1513BED6F6E7CF9185ADE15812BD
SHA-256:	7665B696A87EE9FBAF28F26BF4316AA43FC9C1764A616B6A27F6F544F1079B98
SHA-512:	CB9EE37CD377AEE058DCC03236F413783CC3812A4D288E64663EC85806F76E108AB4AC7F93D4B3E5FA7A46AA6F7D0A59E8F67020D9F2B1DC2E0767347E1B6EE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%B.tK..tK..tK.jhE..tK..kX..tK..tJ..tK..kA..tK.QrM..tK..kO..tK.Rich.tK.........PE..L......C...........!.....0...@......[/.......@.......................................................U...............C..4....@..<....`..P....................p..D....................................................@...............................text.... .......0.................. ..`.rdata.......@.......@..............@..@.data........P.......P..............@....rsrc...P....`.......`..............@..@.reloc.......p.......p..............@..B........................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\libjutils.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	5.100900796766208
Encrypted:	false
SSDEEP:	768:xUjDvvbajZah9H0SJk64mqHoL4Gbx4K7x/ipSnnFFFwUBg+9:IhUSC64Wbx44xcSnnFFFnP
MD5:	6AE36632129347D5CAAF4EC6A27EB2D9
SHA1:	75AFD9DFF712E9AC40B015D469B43EE895453D73
SHA-256:	4B61000E76419D01E21798BDFEEC4F54186386A590B0C052FD0675FE5AC4EBF2
SHA-512:	2C25E3BF667F5AA292F7FA8F26DB7FB6E9C36988E619119F8BDE14F7586473C72448AEBCE9E220390CCF26D27E3FE4023E0A1D2C292787EFCD7818DE3F520366
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........1..._..._..._...S..._.s.Q..._...L..._...^..._...T..._...U..._.H.Y..._...[..._.Rich.._.................PE..L...%..C...........!.........................................................@.......................U........................<.... ..@....................0.......................................................................................text....p.......................... ..`.rdata..............................@..@.data....t....... ..................@....rsrc...@.... ......................@..@.reloc.. ....0......................@..B................................................................................................................................................................................................................................................................................................................................

c:\int_duca\mdac_typ_es.exe (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MS CAB-Installer self-extracting archive
Category:	dropped
Size (bytes):	7879848
Entropy (8bit):	7.997338948473388
Encrypted:	true
SSDEEP:	196608:61DmSrP6UMEvFQmoZDCsuJk8cRlkKrDHlXcX8CAWK1:6VmLENuksumf+K3lMXnK1
MD5:	76D2BA88D85771F1919307A84F370E77
SHA1:	0312438391E981DE55FBE26B68A03966AA20E157
SHA-256:	E769F2F611F8F8E2DB009C1C5F129E838DC8E8EFE1332524F31CAF1FE0B93EFC
SHA-512:	ECE120DD5A8AA5C8C2FF1D6A82FDA2650C144E79AA5A38AD70663FD1143269793BD709FA7B6729DA480F1484E284470E4BA125A7ECA0BA9D57FEE4D82EDDEF64
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Q..5......................w.....I'.......................................@x.....A.x..................................................zw..........*x.................8............................................................................text....................... .....s. ..`.data...............................@....rsrc.....w......\|w.................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\mouredb.cmd (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.0323362829877745
Encrypted:	false
SSDEEP:	3:urRFKWwcA0uZv:urO0uZv
MD5:	DAE1773D69F8D83484600A727088AFF0
SHA1:	68C1FA6ACEFAA1734F6331BDEA3F905B5BA67369
SHA-256:	25A009F8C284DDC3B118D986EC958F3B192663C723D7653FF8647954E8F377BD
SHA-512:	679E8A39ED6AA498EFAD708D4C52D57D4260CE623689953DD553DBB515B151703E3131B9D70380D223C12E4159D55E7F4EB884D06872E98538406FF1CAC1F8F0
Malicious:	false
Preview:	copy %1 %2..rd /s /q %2c_..pause..

c:\int_duca\msvcp100.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	421200
Entropy (8bit):	6.595942471932211
Encrypted:	false
SSDEEP:	12288:Seb8zxr1aWPaHX7dGP5frhUgiW6QR7t5qv3Ooc8UHkC2e7wx:Seb8Fpa6aHX7dGP5Gv3Ooc8UHkC2ekx
MD5:	BC83108B18756547013ED443B8CDB31B
SHA1:	79BCAAD3714433E01C7F153B05B781F8D7CB318D
SHA-256:	B2AD109C15EAA92079582787B7772BA0A2F034F7D075907FF87028DF0EAEA671
SHA-512:	6E72B2D40E47567B3E506BE474DAFA7CACD0B53CD2C2D160C3B5384F2F461FC91BB5FDB614A351F628D4E516B3BBDABC2CC6D4CB4710970146D2938A687DD011
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e..d...d...d.......d.......d...d..Cd..K*...d.......d.......d.......d.......d.......d.......d.......d..Rich.d..........................PE..L...A..M.........."!.................<.............x................................(~....@.................................<...<.... ...............V..P....0..D;..p................................/..@...............p............................text...u........................... ..`.data...$:.......,..................@....rsrc........ ......................@..@.reloc...S...0...T..................@..B........................................................................................................................................................................................................................................................................................................................................

c:\int_duca\msvcr100.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\nlwnsck.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	2.1852762404625787
Encrypted:	false
SSDEEP:	192:cDswlM1zkgkXYP84lLtptsz9huZEdZntep:dtUAc9huyop
MD5:	9FF3CB81D2C201F96B734C0DB5A2AD48
SHA1:	EFD9CA0CB99CA4F74B70EB80EE69E17A8D22DBFD
SHA-256:	709EFB99250EBF69A787E11C3F3D2561165FCCAD87A064E4387515D7C9511621
SHA-512:	52C6A8007FA138D996ED5F90F2F6B5102EDE23B1BDDA1F6A2C43048A4773E7FD602E65D6FD54E176AF3A361FCAA6E9E97CD80C335CAB77D240BE8B92F1F55075
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r.......................Y...........Y.....Rich...................PE..L......C...........!.........@......)........ ...............................`.......................U..............."..v.... ..x....@..@....................P....................................................... ...............................text............................... ..`.rdata..6.... ....... ..............@..@.data...<....0.......0..............@....rsrc...@....@.......@..............@..@.reloc..>....P.......P..............@..B........................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\odbcjt32.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	319488
Entropy (8bit):	5.933841267473828
Encrypted:	false
SSDEEP:	6144:kC+QLA/I1yeEgou1d8wVO/S5lSZsye9hz8SHPQyIOCZ4umG:sUyeH1ssZ18SHP3IXZ4C
MD5:	E74DAEC4957DA366BFE6B879521E5F04
SHA1:	8CE91464EA719944F3FC5CFD7A0122703A858B3D
SHA-256:	AB07DE3B9BB838A83EC1F42968D3E367FEAE77F484BE8C38C9DE1FCF0D5AF66B
SHA-512:	0EF439EC0A3C19E98F6885A1D660F059EBDA5D7521CC4C460FC5771700BD3369FD3E30524F321BDAC8FAE8CC84AD452B0F956623EA1BE161D3E20EAEA507D43C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.n$...w...w...w,.{w...w...w...w...w...w...w...w...w...w...w...w...w%..w...w...w...w...wRich...w........PE..L.....V...........!.........@.......l............'.......................................@............................w............ ..h.......................D!...................................=..@............................................text...G........................... ..`.data....i.......p..................@....sdbid..............................@....rsrc...h.... ....... ..............@..@.reloc...$.......0..................@..B................................................................................................................................................................................................................................................................................................................................

c:\int_duca\pbUIS126.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3058176
Entropy (8bit):	7.1188527070849155
Encrypted:	false
SSDEEP:	49152:0fsstdUqwvLaE+ETaKeSU1uRzTw5tJP3O9K3qcMj3iFu+wJRoj9ghi1RebpyTIgs:0fVdUqFEVTcSU1kzTwpvO9K3bMeFu+wD
MD5:	5CFE900AE80095F4AA54E3B4BF15FDC4
SHA1:	1CF9A2A29FF4A886E82BD563359B4BC26764C23E
SHA-256:	32CB165F59361015E542A68721585F55E823D56FFEB6D8176590EC91EA5278F0
SHA-512:	FC11F0084AAAE2AC12988DD8C07F252F620BBA78A0755E369022EEBAB404DDAC04E814340C6AA2FAB792CD05598EC5F4A170913131BCD41C54F545FECF58C5A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........rh..;..;..;..;..;..;..;..;..;..;...;...;..;...;\..;...;n..;...;..;...;..;...;..;Rich..;........PE..L.....S...........!.....x...........K.......................................`/.....9./...@.................................<...T.............................,......................................e..@............................................text...gw.......x.................. ..`.rdata...............\|..............@..@.data........ ...`..................@....rsrc...h............^..............@..@.reloc........,.......+.............@..B........................................................................................................................................................................................................................................................................................................................

c:\int_duca\pbacc126.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.9742206465398375
Encrypted:	false
SSDEEP:	192:HXIGPoOxhYUw9GxOufY8qGU89Xr6/2qNmPlO93XHPVR6qOKpOM4:HXIGPHiUM+Ou7C+1GmPlOB3PVNOKcM4
MD5:	7FCE3A560CDB096431593D9409DC09FA
SHA1:	0B69F2DB60B0D2E079979D730057F2BB1930F060
SHA-256:	276C4465BC578C91B75114AB3EA0227FD9836F8A966E74C502AB1302716BF794
SHA-512:	75D52C6BE4838AF474AE6C79153730A2FF99D16A7ED03D8EE9D77F1CF8952F6C8422DF1DA8160AB10DA908333A334B087ADC573730B8BC0AF8908814726DBC9E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)...Ho..Ho..Ho.[....Ho.....Ho.....Ho..0..Ho..0...Ho.....Ho..Hn..Ho.....Ho.....Ho......Ho.....Ho.Rich.Ho.........................PE..L.....S...........!........."......0........0............................................@..........................D..V....@.......`.. ....................p..$....0...............................>..@............0...............................text...d........................... ..`.rdata..6....0......................@..@.data........P.......,..............@....rsrc... ....`......................@..@.reloc..6....p.......2..............@..B................................................................................................................................................................................................................................................................................................

c:\int_duca\pbdpl126.DLL (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	125904
Entropy (8bit):	6.579345169019503
Encrypted:	false
SSDEEP:	3072:YY1C4mKsiXHIMTlrfGobgiST/orwwNcpIaWIeox0yewnnFFF9nnFFFcUw:Z1C4mKsi3IMJrfGobgPorwxeg0L9
MD5:	6D5D2B3AAA9A7154AE145A15362392D7
SHA1:	463F077D5CD04A2E6B0E8B63B8FBDF5898A6E5B8
SHA-256:	F803CFB75F0407D0CD27DDDCACBEBD3D5B6F6CA8FA230C2F689A07699BDECF82
SHA-512:	87FF54A18EEF9D0EAD96B128AEB124240AB1958C18D443E0256778254D03E85A73DCA005E8F4BDDDF2CC6BA3E590E15C672205E499F4DF46C1F64222EFC9BE9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P......................7...............7.............7"......7#......7.......7.......7......Rich............PE..L....$.Z...........!.....v........../................................................w....@.........................p...x...\...x....P.......................`......................................X...@............................................text....u.......v.................. ..`.rdata...%.......&...z..............@..@.data...............................@....rsrc........P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................................................

c:\int_duca\pbdwe126.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4296192
Entropy (8bit):	6.214139443875799
Encrypted:	false
SSDEEP:	98304:QPS3iIvEHbN+cLjq78eel0613cUcIXKqnUH:QPoiIvETLjX0K3zccm
MD5:	8A139270A4485EF11C4413CF0F60A619
SHA1:	D7A1A0AFBE1F0827E133AD548B7CFAE33FC20E1E
SHA-256:	2D295425D60CD83DD83B55C41B0030B096E2E3F64E300546914EF98220B024F8
SHA-512:	7DE50533DD9F8B7016B4ECC5E94A489444E0512B6128C54C6AF81E5212D4D377DACFD806A111E6040C0154995BAD646BB872E89BEC63003805B0DDF59517426A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.../.../.../.Y...../..P..../...../....../....../..P..../......./..P..../..P..../..P..../..P..../..P..../.Rich../.........PE..L.....S...........!......+..........W*......0+...i..........................0B.......A...@.........................`.1..R...>1.@.....2.X....................p@......A+...............................0.@............0+..............................text.....+.......+................. ..`.rdata..2....0+.......+.............@..@.data... .....1..h....1.............@....rsrc...X.....2.......2.............@..@.reloc.......p@.......?.............@..B........................................................................................................................................................................................................................................................................................................

c:\int_duca\pbjvm126.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	5.960294929923086
Encrypted:	false
SSDEEP:	1536:yFRhzSdMMrX/civ6qY8dpger/UMsSE7YRCW/lMOfyJQe5:szzSdMMrX/3tWrURCW/lMOfyJQe5
MD5:	B090175305CACFA401821675D2A7889A
SHA1:	DBEFBCB503030082DBD5755CCD2E56B38A650E52
SHA-256:	620DFD05F5ABD5C1A59B73B1B7A336A9E3B8BD78FC2AD782566433B3E9A45DF0
SHA-512:	4D15AD2F795CDBB2A9CE50F61592E0CA25A2B680F03783AF75505DB07919F52BD03A8BD738730F582C7C602C5DA715D7BE2AABB04E5BC49AEC0D0724B9966539
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&3V.G]..G]..G].]....G]......G]..?...G]..?...G]......G]......G]..G\..G]......G]......G]......G]......G].Rich.G].........................PE..L.....S...........!.........Z......9.....................................................@.........................p=.......6..d....P.......................p......p................................,..@...............P............................text.../........................... ..`.rdata...........0..................@..@.data...0....@......................@....rsrc........P.......2..............@..@.reloc..0....p.......D..............@..B................................................................................................................................................................................................................................................................................................

c:\int_duca\pbo10126.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	370176
Entropy (8bit):	5.867771445753426
Encrypted:	false
SSDEEP:	6144:SP9eRaJoFKUSHE+hqvC91EXH6r1mY/nKrOZxQ0:zRuxHE6qxEnX
MD5:	9243B89DDDEBCBB4FD7BFBBAFBC4C332
SHA1:	AD4ACA714A7DE585274A3F53D31B27F42DB04477
SHA-256:	C41335693576381D9AB083423B0910808362F3F8EF5A952274CFC2892A3F2FA7
SHA-512:	0E6FE49705E9EE81AFCDA7DBC2B3B4109ACD807C20EEE05843F1A28EA1ECE345979273B2F12F8EDA2FF90D7D087B14B41FA95A0E8CB63518E020F38C22D7FCB6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f.#.".M.".M.".M....#.M.90.!.M.+..#.M.+..&.M.90.'.M.".L...M.90...M.90.-.M.90.#.M.90.#.M.90.#.M.Rich".M.........PE..L......S...........!......................................................................@.........@...............`.......\...d....`...M.......................#..................................x...@............................................text...8........................... ..`.rdata..............................@..@.data... ...........................@....rsrc....M...`...N...2..............@..@.reloc...$.......&..................@..B................................................................................................................................................................................................................................................................................................................

c:\int_duca\pbodb126.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	538624
Entropy (8bit):	6.003038977539719
Encrypted:	false
SSDEEP:	6144:wBT6R3aSu4KqJcw3DTmCBCedjYxVUnYF4dZ2qhDKkZywW5mF3JBHLyYH85d1OZ2c:hoSumcw3DTBjvikZytY/S2
MD5:	D2A8ECCFF40CD5CDB012C2051C5B6381
SHA1:	698A3C51E02E1F8599B94131EBD1CB1540D896E0
SHA-256:	4069D04384134179BDF081CB95EC74120DEAB0AF003C797CBFB4AF6AFCCB3DEC
SHA-512:	830A33C63D58F3C7E201D5604966A2089F45B584F8D27BCD58D1662BD6441CBB9B68D24EB4BD25CADE4456EF2B58BD4CC664E35FD1B11F98F03940AA0C49C606
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......TPx..1...1...1.......1.......1...I...1...I...1.......1...1...0.......1.......1.......1.......1.......1..Rich.1..........PE..L.....S...........!.....\...........e.......p...............................p......1.....@.........@................a..%...\T...........V...................0...5..pt...............................P..@............p..T............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data...hT...p...R...V..............@....rsrc....V.......X..................@..@.reloc...6...0...8..................@..B................................................................................................................................................................................................................................................................................................................

c:\int_duca\pbodb126.ini (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Generic INItialization configuration [WATCOM SQL WSQLODBC]
Category:	dropped
Size (bytes):	75798
Entropy (8bit):	5.559268371094131
Encrypted:	false
SSDEEP:	768:oDeDlDlDcDEDCJSDKDwCRLsDL3D9jWQB+ef+5OBKHstezE6NoyenUjM6CgYrxkWz:W44xsZFgYrS5wljdzPHR34mQi
MD5:	6FCA26E7A4C5A74656341AE8F5CFD659
SHA1:	72EF2A7D89912B8A29683CE13C2A52F3F12DB1FC
SHA-256:	F24C7B020E035D753522E7B5767022812F9096A145E7882657E239B8A62D52CE
SHA-512:	3BDA4C047DF2BB6FA4549E611BC1748379A96ACED2CBDCD04B02D3E5F9821BA36395439B54A6DF70FF709367B8018CDC56DB2AD599B31ADA4CF8AFB32BA1CF80
Malicious:	false
Preview:	; ******************************************************************..; DBMS Driver / DBMS Settings see comments at end of file..; ..; ******************************************************************....;[WATCOM SQL 3.0]..[WATCOM SQL WSQLODBC]..PBSyntax='WATCOM_SYNTAX'..PBDateTime='STANDARD_DATETIME'..PBFunctions='WATCOM_FUNCTIONS'..DelimitIdentifier='YES'..PBDateTimeInvalidInSearch='NO'..PBTimeInvalidInSearch='YES'..PBQualifierIsOwner='NO'..PBSpecialDataTypes='WATCOM_SPECIALDATATYPES'..PBSystemOwner='sys'....[WATCOM SQL]..PBSyntax='WATCOM50_SYNTAX'..PBDateTime='STANDARD_DATETIME'..PBFunctions='WATCOM_FUNCTIONS'..PBDefaultValues='autoincrement,current date,current time,current timestamp,timestamp,null,user'..PBDefaultCreate='YES'..PBDefaultAlter='YES'..PBDefaultExpressions='YES'..DelimitIdentifier='YES'..PBDateTimeInvalidInSearch='NO'..PBTimeInvalidInSearch='YES'..PBQualifierIsOwner='NO'..PBSpecialDataTypes='WATCOM_SPECIALDATATYPES'..IdentifierQuoteChar='"'..PBSystemOwner='sys,db

c:\int_duca\pbora126.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	374784
Entropy (8bit):	5.863670895562171
Encrypted:	false
SSDEEP:	6144:I/uNGh+yMnna9NHBXQEwN2qEGXpj2pd4E9lUknOZQw8x0:wuJavHpQBNzpjqlN
MD5:	8026D2B34F3C272C1EAA15D07854FC72
SHA1:	78094701ABE60D5DD84986069BFA0D33B28A454B
SHA-256:	156AAE23EDD7B32EC72EC16C6829408A7E4E357E7628F46182272C0B6E9EFF3E
SHA-512:	B3130EF2D35C35A3D87721C29C006AB2257C61575E6089D9C8E14D6197BBAB98E64D92B61B13E39282CF0D8D9489D1DAA8F516CBEEB3F42782F7364BAFA051D1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.#{#.M(#.M(#.M(...(".M(80.( .M(..(".M(..('.M(80.(&.M(#.L(..M(80.(/.M(80.(,.M(80.(".M(80.(".M(80.(".M(Rich#.M(........................PE..L......S...........!................+.....................................................@.........@...............`.......<...d....p...Q......................D$..................................X...@............................................text...x........................... ..`.rdata..............................@..@.data...`...........................@....rsrc....Q...p...R...@..............@..@.reloc...%.......&..................@..B................................................................................................................................................................................................................................................................................................

c:\int_duca\pbshr126.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3348480
Entropy (8bit):	6.671182224264595
Encrypted:	false
SSDEEP:	49152:C8YbpKTiFexErp0WtIhxIvX5mw2h7tJZkTOYuTa6boT+CZP/xq0kD+AKo+y:RFYrpbIhm5mw2h71oI3
MD5:	B5972C4CE06AEFF5B9E6005AFB6A340D
SHA1:	99784F7EECA8C26BB8008B5418459E8BE23622C1
SHA-256:	A15F742BD0C557998E2879DCBD9A144210873BCFAB70A2279D4ACBA931DFC18E
SHA-512:	7738373E4044C82C27EBAB269A2BB1714F2D069AF1D99DE0FE48EE89F0AAC4DA25423B0ED259D1FC7996068FC7C3C7EAC6A016DBF4EB8200D8FB9580529688C5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......3Hy.w).Bw).Bw).B._.Br).Bl..Bs).B.g.B{).Bl..B.).B~Q.Bv).B~Q.Bp).B~Q.Bh).Bw).B..Bq..Bc).B.>HB.).Bw).Bm).BP.yBv).BP.zB.).Bl..BY).Bl..B.).Bl..Bv).Bl..Bv).Bl..Bv).BRichw).B........................PE..L......S...........!......'...................'..............................P=...........@......................... D..'....).h....P:.`....................p;......'...............................................'..............................text....U.......V.................. ..`.textidx.-...p.......Z.............. ..`CONST...P.....'.......'............. ..`.rdata.......'.......'.............@..@.data...4....p+......F+.............@....rsrc...`....P:......(0.............@..@.reloc..J....p;......B1.............@..B........................................................................................................................................................

c:\int_duca\pbtra126.dll (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.859138430589259
Encrypted:	false
SSDEEP:	1536:ItMPEu2W7UbPmeA6qxn5eqdMPKlFRMBtpN67Uu4KMOBaUis:IqEuhUbeePeHMOBaUi
MD5:	82CE68A7ED00E80B9AE34B7F6493494E
SHA1:	29FA5032145BB67B116D88D9AD9C8F961E33BB4E
SHA-256:	6BABB79959FFE5E9A593F183F3E284AD8BC4298045A099C89D66144F8118098E
SHA-512:	C9A3F40DCCCC2422303A58B43360697E58D89FC7BD09EFE22DA9216D6E29B942141BFBFCFAA446EA987D1BEEC706453814CE41ADCDE832D7D9607DE083FE457A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y...8o.8o.8o.-v..8o....8o....8o..N..8o.@..8o....8o.8n..8o....8o....8o....8o....8o.Rich.8o.........................PE..L.....S...........!.........x...............................................P............@.........@...............P...........x.... .......................@.....................................X...@............................................text...P........................... ..`.rdata...P.......R..................@..@.data...............................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................

c:\int_duca\realitzar_duca_archivos\Circuit de Decisi. 1.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 429x255, components 3
Category:	dropped
Size (bytes):	89241
Entropy (8bit):	7.750620248539151
Encrypted:	false
SSDEEP:	1536:1hbr17eGxWzfL3qoUujEh2fOfjlN9bIs8YhkwQvYBHCXKPm:1hbr17OfL7UuPO5UgkGCXKPm
MD5:	6D66156D37E5C919090E95679A0738AF
SHA1:	7CC7E1D34074F604775A4CE8F63F730BFF4C17F8
SHA-256:	E5AD5C172F4AE07F7A5D87B5687FC5185723D2A0B193A35D7FDDE3D2F1F28032
SHA-512:	719F456D92356560A448B9021A7FF50382CE804D66A9986177572EA1C3B3927A1BDB543D7B61D22E687F2B9DB00A2D38312DC31F07B3351C4E8E8710A597F64E
Malicious:	false
Preview:	......JFIF.....H.H.....zPhotoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p...C...P..W...............JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d.................................................................................................................................................C.p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

c:\int_duca\realitzar_duca_archivos\Circuit de Decisi. 10.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 688x71, components 3
Category:	dropped
Size (bytes):	28111
Entropy (8bit):	7.631687951637095
Encrypted:	false
SSDEEP:	768:yb5Yy9aaaaVaaaaXrPSmnLv516FSZnIR5s/3+Ueks/u:s5zrPSYP6FS1juA
MD5:	CC6D695AE101F5FE6D10A0BEFB9B7E7F
SHA1:	53F8A9A82F86C952CCA21171AC19F7E9D1A1CEC6
SHA-256:	121CF132C361103271477E256770E4CED5927C84A75332D666489D024B135874
SHA-512:	7BD5477E3C3B240F24C89243288B89339B421F00318BEE15EE6C3E3A1E65216FAFAA7FC7066BCC8CC61BB9A7F96070BCB73711CF24C956869A69A346BA3D3B54
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p.......P.......p..........JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d...................................................................................................................................................p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

c:\int_duca\realitzar_duca_archivos\Circuit de Decisi. 11.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 686x70, components 3
Category:	dropped
Size (bytes):	28065
Entropy (8bit):	7.633615432034812
Encrypted:	false
SSDEEP:	768:P7YyzYgYgYgYgYgcYgYgYgYg/ed4E/0xE9iiFF7ONktTn:TXhhhhhchhhhm4E/0xUiiGNw
MD5:	28320A60245F67D295CF3C3E56395E66
SHA1:	BEBB33C6EADA4A025A3169B7CAB2DABCF7E79DE1
SHA-256:	97011AD6A741EAE5EF56B6C2012F9BA268000E2F0054F136B79F2F768D7C578E
SHA-512:	0CC14A87E94B45E7A349A4809BA67A04176CCC9CF2B525792D5CCF19BFDE5FFA3117D27B4F701A4E65F5D5CC78AF7F02B6C161B00925FCD873239B117C8C72A2
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM.......^.......p.......P...p...B..........JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d...................................................................................................................................................p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

c:\int_duca\realitzar_duca_archivos\Circuit de Decisi. 12.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 632x126, components 3
Category:	dropped
Size (bytes):	51565
Entropy (8bit):	7.711082892307689
Encrypted:	false
SSDEEP:	768:KjLYygzmpcSP6Pa8K7XlX9y2UfjqunMFtDlGlW36we+r/+QKApjaLL:YMXSP6PaPVXnUfjUBwM3sYGQF8f
MD5:	FE7500D7EE23A4D6336B526110C72ACB
SHA1:	2EEBE0B90C799AF21E591C46E026CE88A3696A12
SHA-256:	D885183860A3B7592422FAD30015B690795B19CD12F0B5B284BFB582CD1F57A5
SHA-512:	ABB0FD8951BDABC0E951CFDF47C70E7215A81AAD051A33D7E018D3862FC1FF92B41F0907B0AFEDD2FD25CF6F7515D809CE4FA3292872C4B867F187B18ED78836
Malicious:	false
Preview:	......JFIF.....H.H.....~Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p.......P..................JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d...................................................................................................................................................p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

c:\int_duca\realitzar_duca_archivos\Circuit de Decisi. 14.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 960x720, components 3
Category:	dropped
Size (bytes):	94951
Entropy (8bit):	7.711945643115955
Encrypted:	false
SSDEEP:	1536:ChquYjT9oQ7fqptijLauzMnd/XYaq0XgRuM/C5ry4nLZb:G0SQj6tbuz4dQkM/C5maLZb
MD5:	69C988E77CFD4A9724B2861A6F3585D5
SHA1:	E7EC1028A9F07B19CA21F4B2D768D389B65A5540
SHA-256:	25BA34CF36432EB07F280F90EBF8C3EC3C969824D6A0B96516E08C83A60CB438
SHA-512:	A2DC311F7B7B1BB56249E0EE6F4569EAB28B37F31B7ED1066C713D07A933B34A356305C85598ACB538C803819D8EB270A1EE1125F2B7AC373779756838C32D04
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...+..\|k...Oc....[~.;nr...}j..,........c@........'$......cS....C..9.........(."O..Bq...q..b?.J...?.B..c......

c:\int_duca\realitzar_duca_archivos\Circuit de Decisi. 1bis.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 429x255, components 3
Category:	dropped
Size (bytes):	89241
Entropy (8bit):	7.750620248539151
Encrypted:	false
SSDEEP:	1536:1hbr17eGxWzfL3qoUujEh2fOfjlN9bIs8YhkwQvYBHCXKPm:1hbr17OfL7UuPO5UgkGCXKPm
MD5:	6D66156D37E5C919090E95679A0738AF
SHA1:	7CC7E1D34074F604775A4CE8F63F730BFF4C17F8
SHA-256:	E5AD5C172F4AE07F7A5D87B5687FC5185723D2A0B193A35D7FDDE3D2F1F28032
SHA-512:	719F456D92356560A448B9021A7FF50382CE804D66A9986177572EA1C3B3927A1BDB543D7B61D22E687F2B9DB00A2D38312DC31F07B3351C4E8E8710A597F64E
Malicious:	false
Preview:	......JFIF.....H.H.....zPhotoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p...C...P..W...............JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d.................................................................................................................................................C.p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

c:\int_duca\realitzar_duca_archivos\Circuit de Decisi. 2.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 586x164, components 3
Category:	dropped
Size (bytes):	62287
Entropy (8bit):	7.716792726673564
Encrypted:	false
SSDEEP:	1536:DBRCfVlq2GkrKo6WT/R/mUneF2dZI3Q5zq:DBR6Q2Gk2o6689F2dZI3Qc
MD5:	37F73BAF566F3F86D7EAF13072408E19
SHA1:	E969CAFD6C5AEC48AF7DB01AC552230B1638229B
SHA-256:	6CF6A6578D80E0C79BE37D4DE58EC8A201020682CDA519529F891A84CCEB712C
SHA-512:	C128054DE4F7AF099356EC4587023563F7AA3DACAAE6BC93CED818E56025944833458F72C4AB89A96B8F6926E4BCC00DE647E72959719ACA00E87D91FA7057FE
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM.......e.......p.......P..(....I..........JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d...................................................................................................................................................p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

c:\int_duca\realitzar_duca_archivos\Circuit de Decisi. 3.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 328x130, components 3
Category:	dropped
Size (bytes):	33305
Entropy (8bit):	7.691494984342802
Encrypted:	false
SSDEEP:	768:ZsZF+YyXo5nNJuEYAGEaRgSR95pyRAFRVgcKppppg:5bo5DuEYAGEaf9fyw
MD5:	D71D458D4E01E79E7368C8E2CC561743
SHA1:	CCAE69320B05E24702E3F150C994082CBAE67541
SHA-256:	2597448CA7ECCBB1B78019046D399108A73A6F31B835FA09E665D26F2718DAEA
SHA-512:	60D7A40BC7832666991653DFCEB41BE44FF4EB38871A2EDF611EB1379F3B042908B98594F8D3A4079B29AED4B777CACA2EF56B618933DDBB1AD545B855421EBD
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p...,...P..9...............JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d.................................................................................................................................................,.p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

c:\int_duca\realitzar_duca_archivos\Circuit de Decisi. 4.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 323x118, components 3
Category:	dropped
Size (bytes):	30150
Entropy (8bit):	7.695150837131857
Encrypted:	false
SSDEEP:	384:/hYNg7nEUbzNlB7OcGB0yjnjuLAWxj96rwqx3QK8UnN1LQo/:/hYyNbRfq/7juLAej96rbx3mU7Z
MD5:	3D32CBE4BD2B430DBFE0CFC16254EB89
SHA1:	440F0269ED82A33451A91CDF4CE51E0F8C39C526
SHA-256:	AD23A65379B2F2EAB2CB5B32CD14B357BD9F3C797B31402439F1947BE63437EE
SHA-512:	9182050E2013B3CB79FBAA7D4C90B4FED521E97FF77EBC89CE149539D568A5B417D090F9BFA2E6E8DF8B294DEE3D994A5868D2C1C373BB79411AB84C9CC5BF5F
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p...)...P..5...............JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d.................................................................................................................................................).p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

c:\int_duca\realitzar_duca_archivos\Circuit de Decisi. 5.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 397x128, components 3
Category:	dropped
Size (bytes):	42444
Entropy (8bit):	7.751612594458984
Encrypted:	false
SSDEEP:	768:vTOYyRvRfXh64xRqJpgccox/fKCluqy5dUXmj1u2gLqpcRuRHjKvfE7jdA+XS6p8:vqPXhdxRcgEXKuuqy3UXmxuX0cRQifYo
MD5:	6CA3CC12C5DDFA2D156DA021605FEDC2
SHA1:	CF6451547740BD16E89E7DCF87F25FA902354F55
SHA-256:	DB34F731BA89F4B060141F1A7BD9DEDA51B5E428643921D8A7AE6ECCB51C4611
SHA-512:	38162F515544BFD2E746C13A8DA0FD3E0F92939CA843FBA6B5645BF698CE5FC71EC30282FD79BF695E9B59B94C033190BDBBD43206E813B8336841DF9ACDA657
Malicious:	false
Preview:	......JFIF.....H.H.....LPhotoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p...$...P../@..............JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d.................................................................................................................................................$.p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

c:\int_duca\realitzar_duca_archivos\Circuit de Decisi. 6.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 397x128, components 3
Category:	dropped
Size (bytes):	44110
Entropy (8bit):	7.7508050224686125
Encrypted:	false
SSDEEP:	768:no8Yympm0hFNuxBrsGpXGVp0VHkwbd4UNftt6ADyElXO3GA/RtfFND:n9qpuF932wbXIEeWYf
MD5:	3255D1538594B50747CF027FC23E32CF
SHA1:	7D8949FED94F9C6D42EDCAA12B82B837F47BB51E
SHA-256:	9F182BA6363F878E49FCA00770E0F1C6465E374AFB0D655F673F2A1378BFC54A
SHA-512:	ED3D84E954B3BE8A976DB015C39BEBFC892D894C5D2645B6A7FF867A8BA31B282390F84668E4426C0894AF1E4C8093A5491711536C9CD0A1347F014D57149D3D
Malicious:	false
Preview:	......JFIF.....H.H.....(Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p...$...P../@...\|..........JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d.................................................................................................................................................$.p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

c:\int_duca\realitzar_duca_archivos\Circuit de Decisi. 7.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 672x175, components 3
Category:	dropped
Size (bytes):	81235
Entropy (8bit):	7.716363072958926
Encrypted:	false
SSDEEP:	1536:tIycTRToIx8qqqqqqqqqqa2lqltf9KLw6abGhS5NUs2xvZRE4ydyMzdt3X:yyqVyqqqqqqqqqqqYMoECsSVydyMzDH
MD5:	18C3F4211314F61BD739E4F5FEFF20BA
SHA1:	CE6182F14BB80AEC5ECE0FA431DE40E437EADB56
SHA-256:	F8E780C003073B37643DB4B8CADDFAD4E4C1013BE9518F8476205F0DD76B0D0B
SHA-512:	BDB14EA93A06B524723A3B260311DDE5ED260E7B4C170B5280B1DADEE7371948058C03C0F32F23C12B856011B69CBF8BB63DE1075A01996D202543631A690582
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM.......q.......p.......P..&....U..........JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d...................................................................................................................................................p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

c:\int_duca\realitzar_duca_archivos\Circuit de Decisi. 8.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 461x118, components 3
Category:	dropped
Size (bytes):	39246
Entropy (8bit):	7.684369587692718
Encrypted:	false
SSDEEP:	384:1r6YNg7nhj4Wkt7ydoUZboZFsGh9bsuHZ9ByvkCjanJnpm//RDb9kUZpBlotbEg/:wYyN4WkxtQSvyNOu//FxkFogkaZh
MD5:	CECB947B765D6CC57F61E7EF777EC28E
SHA1:	9BC466595C0CC2B0B6F5365830CD0452BEB8696E
SHA-256:	BB257374D2E8C80917844DBBDD000EA9D03C6C66DABEC7AA17639326111A1372
SHA-512:	3B35700453335F41432025E2A09E5AC28C590D499A3ABA59352DA6397203711AFF40702E70B19C949CD09CE1F79B8B10CE91B5B1A71B09C525FBA06BA7D549B7
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM.......f.......p.......P..&....J..........JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d...................................................................................................................................................p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

c:\int_duca\realitzar_duca_archivos\Circuit de Decisi. 9.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 435x125, components 3
Category:	dropped
Size (bytes):	41020
Entropy (8bit):	7.696640298462367
Encrypted:	false
SSDEEP:	768:0psYyCMY62xvgedfhqfhVat3hAU7ibpNn5CjtMlpyMBy:gsWy2hgSpqJV6p7ibFatOpyb
MD5:	14007D16CDB3FB74A80C69B044BE3D1E
SHA1:	DFA390E42FFD8A8999D64BB97B9EF01284DF45FD
SHA-256:	0FD80C37F1B1B11783025AA2E9D103D107E3422827C52940E03CD8ABF6F38458
SHA-512:	62D981B8FB88D962AF78C4319118EB29E456FB86F34B09EB344DFAD7E1629DD78BF002FC334106D487726522BD10BBDDC64B5EA4A5F671A5286EC1A55D779D95
Malicious:	false
Preview:	......JFIF.....H.H.....$Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p... ...P..*....x..........JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d................................................................................................................................................. .p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

c:\int_duca\realitzar_duca_archivos\Circuit de decisi. 13.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 751x680, components 3
Category:	dropped
Size (bytes):	185882
Entropy (8bit):	7.49584904723519
Encrypted:	false
SSDEEP:	3072:fRmX/Lk32L4+UNn5Outm9TzRUrZHnH8cMDyrXyXA+oPdn+prcTkAFR:fME2LHUN5OtTFUVHcmWjoln+poTkAFR
MD5:	CBAC2D43BB5FE9DC42A8AFBD5EAEACFE
SHA1:	BFBE8B6B8B945D95CCB2ABDEC1AFBD1E6D7B9619
SHA-256:	6E1D6988BF3E3E350DD83B0AAC4B9A818FED46F43EC0E402BDE4B5C5510A6457
SHA-512:	960332F68CC24CEB4426F82CDEA57E8C6FA25ABCBE5696A78AE64EB17D4C8876C61FE97236A656D8AB336465433C6FE775B09A8B5E8A1115DE5D43E34966E8E7
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p...e...P..................JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d.................................................................................................................................................e.p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

c:\int_duca\realitzar_duca_archivos\WEB Entrada bis.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 1076x703, components 3
Category:	dropped
Size (bytes):	298830
Entropy (8bit):	7.634361939517249
Encrypted:	false
SSDEEP:	6144:2eo2lErliih+V7ggMipKT+VLVU7+LolXUYx4N5YBrXUZwQaO+AnVQPVBDqsQQP4I:QxrYih+VKipKT+VLVU7+LqUPNyU6Qa77
MD5:	E18238521B12324FD74BB247B5AA3851
SHA1:	DFAA70C058B0E12395C42EC1B065746076529538
SHA-256:	0CAED1506CFAEB707F6F07171E70EE1811E8C82BA3460F3D929C3559881CBAC2
SHA-512:	26FF9CD264B662C3D95B7DE0F66102FD8C2A40D023435E1B42879813650168EFECA8397CA64CBA2B959A05E7BF9BB2E5D72B6134D090FDBD4CA921D8E662B5D9
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p...I...P.._...............JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d.................................................................................................................................................I.p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

c:\int_duca\realitzar_duca_archivos\WEB Entrada.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, comment: "File written by Adobe Photoshop\250 5.0", baseline, precision 8, 1076x703, components 3
Category:	dropped
Size (bytes):	299381
Entropy (8bit):	7.635236150594499
Encrypted:	false
SSDEEP:	6144:deo2lErliih+V7ggMipKT+VLVU74JlXUYx4N5YBrXUZwQaO+AnVQPVBDqsQQP4I:jxrYih+VKipKT+VLVU74TUPNyU6Qa7AU
MD5:	525C425BD20D31CAE049D6D14D856D33
SHA1:	43635B6F06DA27D3BF07A259FC1C869E658D2FE3
SHA-256:	28BFA030DE43B7B9A72E84AA127AA05ABA41AC6B79BF56876EBBF339944149D9
SHA-512:	9A9C402673E1F35DE84C9C577E1005D3E6B58DEFE0638BD63B3C15F26A338E3003C357A96A36F1E00ACE02F010797FB9D63E0C62F3DB4D4CD11D1512D4C86146
Malicious:	false
Preview:	......JFIF.....H.H......Photoshop 3.0.8BIM.........G.......G......8BIM...........x8BIM................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM...............@...@....8BIM............8BIM...............p...I...P.._...............JFIF.....H.H.....&File written by Adobe Photoshop. 5.0....Adobe.d.................................................................................................................................................I.p.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.

c:\int_duca\realitzar_duca_archivos\aca_style_ie.css (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	assembler source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11025
Entropy (8bit):	5.387223311171871
Encrypted:	false
SSDEEP:	192:JasaAaEadalsOsMsAsY992aM9vaYa4axaYayGOyLnmqaGagq9mW1rUcdEnoO5AnI:RIP
MD5:	1A6BC1384C42062E4F94B56F6E7B1B6E
SHA1:	5B3961C0AA2FD562FD52B0F6F6A69AB751489218
SHA-256:	BFAC0625495D4CD10AAB046B47B72D477F194EC5580072F5B0964466700E5B39
SHA-512:	901FE8789C3B922127C416829C901D4B57F736E4EB60853F234E0968C7D92AF04A38145CA682BFF7047242015743A4D807F4FD9A3A73C6AFD7E650C7D1077935
Malicious:	false
Preview:	BODY..{.. BACKGROUND-COLOR: #FFFFFF;.. FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;.. FONT-SIZE: 12px;.. FONT-STYLE: normal;.. FONT-WEIGHT: normal;.. TEXT-DECORATION: none;.. LINE-HEIGHT: normal; .. margin-left: 20px;.. color: #000000;.. list-style-type: circle.. text-align: left;..}....a:link..{...color:#00B400;...TEXT-DECORATION: none..}..a:visited..{...color:#00B400;...TEXT-DECORATION: none..}..a:active..{...color:#00B400;...TEXT-DECORATION: none..}..a:hover..{...color:#00B400;...TEXT-DECORATION:underline..}....A.titulo_pestania:Hover..{.. COLOR: #FFFFFF;.. FONT-SIZE: 9px;.. FONT-FAMILY: verdana;.. FONT-WEIGHT: bold;.. TEXT-DECORATION: none..}..A.titulo_pestania:active..{.. COLOR: #FFFFFF;.. FONT-SIZE: 9px;.. FONT-FAMILY: verdana;.. FONT-WEIGHT: bold;.. TEXT-DECORATION: none..}..A.titulo_pestania:visited..{.. COLOR: #FFFFFF;.. FONT-SIZE: 9px;.. FONT-FAMILY: verdana;.. FONT-WEIGHT: bold;.. TEXT-DECOR

c:\int_duca\realitzar_duca_archivos\aca_style_ns.css (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	assembler source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10263
Entropy (8bit):	5.3885510316352985
Encrypted:	false
SSDEEP:	192:JapMaraAaEada5sYsNMsAsE0GaZaYa4axa/9M9u2ayGOyL5zaqwsgRTudlpov5A7:zIy
MD5:	8879F9E58EA406918F7BF110870E7710
SHA1:	8EBA3AB0297E3DCBDBB9772BEAD46BC1B22C13A1
SHA-256:	919417FB0EA73FFA177603B763FB12414F3EBA5A7F1D39022DB08B0FA13FCAF8
SHA-512:	B3A07736E63D47779C5C51BDA51D4DC47D7EF9D82B734AD64FD0BDF1C6478A84AF13D0989DE92EE593261BF15CE9DA0AC2F0CD1519B45488745D101B7A8785B5
Malicious:	false
Preview:	BODY..{.. BACKGROUND-COLOR: #FFFFFF;.. FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;.. FONT-SIZE: 12px;.. FONT-STYLE: normal;.. FONT-WEIGHT: normal;.. TEXT-DECORATION: none;.. LINE-HEIGHT: normal; .. margin-left: 20px;.. color: #000000;.. list-style-type: circle.. text-align: left;..}....a:link..{...color:#62D185;...TEXT-DECORATION: none..}..a:visited..{...color:#62D185;...TEXT-DECORATION: none..}..a:active..{...color:#62D185;...TEXT-DECORATION: none..}..a:hover..{...color:#62D185;...TEXT-DECORATION:underline..}...margen_lateral..{.. margin-left: 0px;.. border: 0px;.. background-color: #78acd4..}..titulo_pestania..{.. COLOR: #FFFFFF;.. FONT-SIZE: 9px;.. FONT-FAMILY: verdana;.. FONT-WEIGHT: bold;.. TEXT-DECORATION: none..}....A.titulo_pestania:Hover..{.. COLOR: #FFFFFF;.. FONT-SIZE: 9px;.. FONT-FAMILY: verdana;.. FONT-WEIGHT: bold;.. TEXT-DECORATION: none..}..A.titulo_pestania:active..{.. COLOR: #FFFFFF;..

c:\int_duca\realitzar_duca_archivos\e-duca.bmp (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PC bitmap, Windows 3.x format, 52 x 68 x 24, image size 10608, resolution 3780 x 3780 px/m, cbSize 10662, bits offset 54
Category:	dropped
Size (bytes):	10662
Entropy (8bit):	1.3158993672737511
Encrypted:	false
SSDEEP:	24:5l2ZqQg+ZqqBqxWqqqlqSqqrZqqqqqqNqqgqqqqqH/qq6FqqqqqqP5qqFFqqFql5:bIg74BVASgbT
MD5:	10DCEC83C3576328DC35D4766D868ECF
SHA1:	73EEE711ECAFF4DF26DBE9051B07F69B17199801
SHA-256:	29346F4802DDDDC6FC41AA4EA7DC1A10F422E5B9A00C31441B28C39AFF5AD7F3
SHA-512:	E9F50F823A94E6AF150E5DA38E1C0C8BF8895B59153808C9CB8B53A30ABCD258534B96F289D61C70BE6E415D4A77D433D409E189183EB34A8D05F889CD41E143
Malicious:	false
Preview:	BM.)......6...(...4...D...........p)....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\realitzar_duca_archivos\educa_manual02.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 512x66, components 3
Category:	dropped
Size (bytes):	6767
Entropy (8bit):	7.863421176618081
Encrypted:	false
SSDEEP:	96:Tgbs/VF4UU3bPUEm/uznJbNI0fgcl77CLlsjnTB9eGtqamKELDpxoY3EML:RVHU3bPq/uzJbSeDl72mj9tqZhxn3EML
MD5:	0568E95410A42473343C5C711DEE77F9
SHA1:	A60033ACDC65BBE59DACB6B93198A09C4C8B9497
SHA-256:	B52C2EA4000AF5F0928F96AD73853FE0B55D96696FD93B8F59EF7AFDE5FBD510
SHA-512:	428BD1A6D82DF2759556A3E87478BA89016D0F4DCF7AE8A3D78EC3E22470C0F214D9CF4B346EFB5099ECB95F4140973751AFD6205D50AC82A362231A876273ED
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......B....".......................................E............................!T..1..."2AQU..a.#q...$345Bs.Rrt....6S.......................................................QR!..1A..."a.........(............?.......K,J3X\|..0V.......9.mD.+[.....-p..Cv.rKp.']!!!....pBW....$..9 ......@...J\|..6R..hV.%`.g.....:..&..s.E.F....Gn..%.qHJ...eA@..T.....w.._..k..................CO.j.>U[..7.......].....[..K.%Ch.ZN..i.%G...U.......E[....Ca."..u....G...?...]5.u../.;;....%....B.od...N....#9.!..\j}..u.K..$7W..KJ.Q ...B.......=..Lb.......J5..1..k........)..0.......X.tNlg...C..f..P.u.6....r..<;..~.A..e.n.g..'.bf..z.a..J....``....{9..)-GC...h...NEjF...J.....q.H#..kyW.6....r.qf.(!.....ZRT....$.G..k/.1a.2M.S1.....RP...(...5..N.F....f\|U...I..gwKJB.Ts.'.......X...u..v.Bq....il...IS....A....q4

c:\int_duca\realitzar_duca_archivos\educa_manual04.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 29x26, components 3
Category:	dropped
Size (bytes):	627
Entropy (8bit):	6.598956979498791
Encrypted:	false
SSDEEP:	12:FgLe+opUkYg4so7eee6Fr5dXVw8kcHRKs0U6MnQiulLQlU:OC+E4sozHEcYzlFiuVH
MD5:	981E3200562920E2E671489EE6AC2D77
SHA1:	13A055313039B0503C6963CA37C1D05DF432BCCC
SHA-256:	FD1A7168944128BD5F43BEF3D9F5267EDD582F8B3F60361C139B3B8227DE404B
SHA-512:	62DA255C8F2A39402A6FF84685A7AAF3D7E573ABDF54D72FF1EA10CC453FD594BF7E372BE99DD680645B1F967B48D4678848A52EBE5BF821786FFA7908FC7A2C
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;..........."......................................-........................!..1...T.."#6AS.Qt.................................................!......(............?..V.#J....%...-dyc..:...h;..Y.{.)J...<..c...$.......}#...A...,.Q..y.{dPL&j^=.@.:.]Ob6.>......u._............r.OG*.j=...U...X"S..n]DT.....S..`.Ir]E.[.4.qb....cX... ..Cs.2;/S.N.).2...^Q.......j9v:j5?.....8..P.....q....E..Q4.1.......C..Ds..K.:...s.L1...........].....?..

c:\int_duca\realitzar_duca_archivos\educa_manual06.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 29x26, components 3
Category:	dropped
Size (bytes):	627
Entropy (8bit):	6.598956979498791
Encrypted:	false
SSDEEP:	12:FgLe+opUkYg4so7eee6Fr5dXVw8kcHRKs0U6MnQiulLQlU:OC+E4sozHEcYzlFiuVH
MD5:	981E3200562920E2E671489EE6AC2D77
SHA1:	13A055313039B0503C6963CA37C1D05DF432BCCC
SHA-256:	FD1A7168944128BD5F43BEF3D9F5267EDD582F8B3F60361C139B3B8227DE404B
SHA-512:	62DA255C8F2A39402A6FF84685A7AAF3D7E573ABDF54D72FF1EA10CC453FD594BF7E372BE99DD680645B1F967B48D4678848A52EBE5BF821786FFA7908FC7A2C
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;..........."......................................-........................!..1...T.."#6AS.Qt.................................................!......(............?..V.#J....%...-dyc..:...h;..Y.{.)J...<..c...$.......}#...A...,.Q..y.{dPL&j^=.@.:.]Ob6.>......u._............r.OG*.j=...U...X"S..n]DT.....S..`.Ir]E.[.4.qb....cX... ..Cs.2;/S.N.).2...^Q.......j9v:j5?.....8..P.....q....E..Q4.1.......C..Ds..K.:...s.L1...........].....?..

c:\int_duca\realitzar_duca_archivos\educa_manual08.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 30x26, components 3
Category:	dropped
Size (bytes):	589
Entropy (8bit):	6.519649978904032
Encrypted:	false
SSDEEP:	12:FgLe+opUkYg4so7eeejUtCpQHXWP3EypyFzNE40Mo:OC+E4sozkUXGP0yTWo
MD5:	C03F59B562B79441CE737D077ECA1C0A
SHA1:	28DFCAA2F732688F5F493F467625A2FA300CE62D
SHA-256:	080C36E57A68C2E3F07DE4BDEED94AF4F56EB3CC7B4E2D1BEB3442C4DECC236B
SHA-512:	58F9B2728BDE89CF9616DFD3BE05528AFA1DA52FD0DDEF582D77F299263675791AB1A4F8F8D6E5B420313D68DDC47F5687D52843567930D5530FC91A22F2FDCB
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;...........".....................................'...........................!T...1A"#q...................................................!2Qq.......(............?.z.J.^..[O.a....>.o).J.l~@.t\...5...9..."?.../jC..O...P..i ....(.o...tJ..N.l...h.u...><.HKrZK..Y...E.....]..C.~..g..jQ=A.j....Dim...A."..p..U.Q...$.2.F..N....6..-/..........,.`Q..Q.ew/y...]..C.C[M6.Hi...m.%.@..:....b..Wr.....8...

c:\int_duca\realitzar_duca_archivos\educa_manual10.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 30x26, components 3
Category:	dropped
Size (bytes):	589
Entropy (8bit):	6.519649978904032
Encrypted:	false
SSDEEP:	12:FgLe+opUkYg4so7eeejUtCpQHXWP3EypyFzNE40Mo:OC+E4sozkUXGP0yTWo
MD5:	C03F59B562B79441CE737D077ECA1C0A
SHA1:	28DFCAA2F732688F5F493F467625A2FA300CE62D
SHA-256:	080C36E57A68C2E3F07DE4BDEED94AF4F56EB3CC7B4E2D1BEB3442C4DECC236B
SHA-512:	58F9B2728BDE89CF9616DFD3BE05528AFA1DA52FD0DDEF582D77F299263675791AB1A4F8F8D6E5B420313D68DDC47F5687D52843567930D5530FC91A22F2FDCB
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;...........".....................................'...........................!T...1A"#q...................................................!2Qq.......(............?.z.J.^..[O.a....>.o).J.l~@.t\...5...9..."?.../jC..O...P..i ....(.o...tJ..N.l...h.u...><.HKrZK..Y...E.....]..C.~..g..jQ=A.j....Dim...A."..p..U.Q...$.2.F..N....6..-/..........,.`Q..Q.ew/y...]..C.C[M6.Hi...m.%.@..:....b..Wr.....8...

c:\int_duca\realitzar_duca_archivos\educa_manual12.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 492x340, components 3
Category:	dropped
Size (bytes):	16095
Entropy (8bit):	7.904371511382472
Encrypted:	false
SSDEEP:	192:AQLoIVSHCCjg4fq3dFmfb2cAPaDDDDDDDDZPyDDDDDDDDM3500r3UYV3HCYEzI+9:AQL+iCU4ifb+fPFRiYp+j2RmWG9
MD5:	D5D96D8DAF7C4AB969C01AE409CE600B
SHA1:	B9B722D285E80C0C90DA4BA18155DFE3D8A70454
SHA-256:	6086B8BE456E149BF7A64C6D0F7DD508FE84CF94DABD326A01B7CD61476790E4
SHA-512:	3049CD3B25E1BCB6A811C89A7CFD61B44A4644D46CB684DF4ED326CED22DEE674CCA32BC80037B68C298C0668770A937516C256891B27CF4D66A88B3CD9F41A8
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......T....".......................................O..........................!Q.....1ARSU...."#Ts..2356Caqr.....$4Bt.b..D...Ec................................(.....................Q...!1R.."A2q.........(............?...kv...lv(k.iL,u.F..{E...yx.....ksN7\.CH.i....?.]M.[v...........F..,".7.Y.}....L.L.O.....Z...6 ..y7...H.>.5.z......5.-k..E.n.<D..Y../u.....1....{.L. 5..^..p.K...-Z...x.. 0.....0.D/a.@7.....X..U.e.'Y3.[..=.,..<...o...p.4.O.....n.ve...J/....q.<..]F.wmL.w:V..Bf.....hqi.0.7..w_[YQ<..U":..d.1..i{@.a....>Qvl.zPn.J'......F.......2.3....x!L#...S.Y.....5.s.......q.<...m........`hv.H.d.5\...=.4.CH.x.$......Z...s-2n.y.jKE.$.JJ.&.........9.s...G.>....wg..(!...&.w...v.@..7].o...6.+...+Z[..n:f.(...79......++yd.cs..7.#..a.f...r.Q..u.w?$q.7..'..0.......4..+..S.

c:\int_duca\realitzar_duca_archivos\educa_manual14.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 492x340, components 3
Category:	dropped
Size (bytes):	16095
Entropy (8bit):	7.904371511382472
Encrypted:	false
SSDEEP:	192:AQLoIVSHCCjg4fq3dFmfb2cAPaDDDDDDDDZPyDDDDDDDDM3500r3UYV3HCYEzI+9:AQL+iCU4ifb+fPFRiYp+j2RmWG9
MD5:	D5D96D8DAF7C4AB969C01AE409CE600B
SHA1:	B9B722D285E80C0C90DA4BA18155DFE3D8A70454
SHA-256:	6086B8BE456E149BF7A64C6D0F7DD508FE84CF94DABD326A01B7CD61476790E4
SHA-512:	3049CD3B25E1BCB6A811C89A7CFD61B44A4644D46CB684DF4ED326CED22DEE674CCA32BC80037B68C298C0668770A937516C256891B27CF4D66A88B3CD9F41A8
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......T....".......................................O..........................!Q.....1ARSU...."#Ts..2356Caqr.....$4Bt.b..D...Ec................................(.....................Q...!1R.."A2q.........(............?...kv...lv(k.iL,u.F..{E...yx.....ksN7\.CH.i....?.]M.[v...........F..,".7.Y.}....L.L.O.....Z...6 ..y7...H.>.5.z......5.-k..E.n.<D..Y../u.....1....{.L. 5..^..p.K...-Z...x.. 0.....0.D/a.@7.....X..U.e.'Y3.[..=.,..<...o...p.4.O.....n.ve...J/....q.<..]F.wmL.w:V..Bf.....hqi.0.7..w_[YQ<..U":..d.1..i{@.a....>Qvl.zPn.J'......F.......2.3....x!L#...S.Y.....5.s.......q.<...m........`hv.H.d.5\...=.4.CH.x.$......Z...s-2n.y.jKE.$.JJ.&.........9.s...G.>....wg..(!...&.w...v.@..7].o...6.+...+Z[..n:f.(...79......++yd.cs..7.#..a.f...r.Q..u.w?$q.7..'..0.......4..+..S.

c:\int_duca\realitzar_duca_archivos\educa_manual16.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	GIF image data, version 89a, 648 x 199
Category:	dropped
Size (bytes):	75385
Entropy (8bit):	7.871977779136001
Encrypted:	false
SSDEEP:	1536:089gv9pQjs3Kkt6FnUYj48fV6eUzZxLlE8ehsyOUb1vnc9RpY3X:N2luo3/tyUu/Uz3Mskb1GpGX
MD5:	C76490EE45BF39B87759DE6D99787B9F
SHA1:	523FAC785E63D05B5A8D5F4160FA8A7AA8DB83C3
SHA-256:	64A658DF1E610B74B1054F088E3AB181DACF9833072CBA0923C99BD77DFFC2F8
SHA-512:	95457CA5F080D2AB3EC4D026C72059967B98E7E430F8E7435A43474E4CC13232BBF3DBD6A5BCF4888D8A45DDBEA46DEF71E45B1D94D722E561561769DAFC74DB
Malicious:	false
Preview:	GIF89a.......ffty.....VYe...Ybjdci......srx.......33:TU[# &CAIFIQ...........iqx8BG........67C......&(/.........IRX.y.....!%(16........jq.......fYh...thw...SIU".#......3(4C7E...........................dT\B58...mhk......NBO0%).........s.......jqk...uh....yy............'0).....7A9YaZ{.{...IQJ. ...................................................................................................................qy.............{y..................{y.sq......................................................................ry...........................................................{q..........................! ..............ki\|......sq.~q.....................................................caZ......201RQQ.......................................!.......,...............H......*\....#J.H....3j.... C..I...(S.\...0c.....D.,..`a."J...f...+.5.......pj../O>?l...f..:o..a.M.5a.v].F.Z5w...G..5w..Q....4........7........\|..C.._>8./'V....\x".Ly...........~.

c:\int_duca\realitzar_duca_archivos\educa_manual18.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	GIF image data, version 89a, 648 x 199
Category:	dropped
Size (bytes):	75385
Entropy (8bit):	7.871977779136001
Encrypted:	false
SSDEEP:	1536:089gv9pQjs3Kkt6FnUYj48fV6eUzZxLlE8ehsyOUb1vnc9RpY3X:N2luo3/tyUu/Uz3Mskb1GpGX
MD5:	C76490EE45BF39B87759DE6D99787B9F
SHA1:	523FAC785E63D05B5A8D5F4160FA8A7AA8DB83C3
SHA-256:	64A658DF1E610B74B1054F088E3AB181DACF9833072CBA0923C99BD77DFFC2F8
SHA-512:	95457CA5F080D2AB3EC4D026C72059967B98E7E430F8E7435A43474E4CC13232BBF3DBD6A5BCF4888D8A45DDBEA46DEF71E45B1D94D722E561561769DAFC74DB
Malicious:	false
Preview:	GIF89a.......ffty.....VYe...Ybjdci......srx.......33:TU[# &CAIFIQ...........iqx8BG........67C......&(/.........IRX.y.....!%(16........jq.......fYh...thw...SIU".#......3(4C7E...........................dT\B58...mhk......NBO0%).........s.......jqk...uh....yy............'0).....7A9YaZ{.{...IQJ. ...................................................................................................................qy.............{y..................{y.sq......................................................................ry...........................................................{q..........................! ..............ki\|......sq.~q.....................................................caZ......201RQQ.......................................!.......,...............H......*\....#J.H....3j.... C..I...(S.\...0c.....D.,..`a."J...f...+.5.......pj../O>?l...f..:o..a.M.5a.v].F.Z5w...G..5w..Q....4........7........\|..C.._>8./'V....\x".Ly...........~.

c:\int_duca\realitzar_duca_archivos\educa_manual21.gif (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	GIF image data, version 89a, 648 x 199
Category:	dropped
Size (bytes):	75385
Entropy (8bit):	7.871977779136001
Encrypted:	false
SSDEEP:	1536:089gv9pQjs3Kkt6FnUYj48fV6eUzZxLlE8ehsyOUb1vnc9RpY3X:N2luo3/tyUu/Uz3Mskb1GpGX
MD5:	C76490EE45BF39B87759DE6D99787B9F
SHA1:	523FAC785E63D05B5A8D5F4160FA8A7AA8DB83C3
SHA-256:	64A658DF1E610B74B1054F088E3AB181DACF9833072CBA0923C99BD77DFFC2F8
SHA-512:	95457CA5F080D2AB3EC4D026C72059967B98E7E430F8E7435A43474E4CC13232BBF3DBD6A5BCF4888D8A45DDBEA46DEF71E45B1D94D722E561561769DAFC74DB
Malicious:	false
Preview:	GIF89a.......ffty.....VYe...Ybjdci......srx.......33:TU[# &CAIFIQ...........iqx8BG........67C......&(/.........IRX.y.....!%(16........jq.......fYh...thw...SIU".#......3(4C7E...........................dT\B58...mhk......NBO0%).........s.......jqk...uh....yy............'0).....7A9YaZ{.{...IQJ. ...................................................................................................................qy.............{y..................{y.sq......................................................................ry...........................................................{q..........................! ..............ki\|......sq.~q.....................................................caZ......201RQQ.......................................!.......,...............H......*\....#J.H....3j.... C..I...(S.\...0c.....D.,..`a."J...f...+.5.......pj../O>?l...f..:o..a.M.5a.v].F.Z5w...G..5w..Q....4........7........\|..C.._>8./'V....\x".Ly...........~.

c:\int_duca\realitzar_duca_archivos\educa_manual24.gif (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	GIF image data, version 89a, 665 x 395
Category:	dropped
Size (bytes):	48458
Entropy (8bit):	7.97709895825478
Encrypted:	false
SSDEEP:	768:r2aG4AJgVG5culHhHdMbe9Yan9754cbns5X9Ihw+c6e7KiSR0JIX+g:rGBKGSoXMbCf14cLs5EzSKinng
MD5:	CC5130C91230EDB8CE6C9908F2EBB767
SHA1:	9283CE869266EA5A8E5ED0C0A1164A448F4F4DFC
SHA-256:	17B29B1354231BC378DF6A6A87C716B8205E1AFB7244EF7BA6DFE3CD66E0F735
SHA-512:	CEC254F5A1D72836BB87F367B15F28B8DCCBF074EF122588623B88F2234244E351DD8D2854C680DEB535A909BFE89FD6522A2CE4FEE1B48D05E3F30DCC0093E6
Malicious:	false
Preview:	GIF89a.........{e..........Uq..(k((JHIxy...........fy....Ea....CX.{.......ce{...(By9V..........y..........VS.(C..0tv.......4Q....Zd{0I....Ii.Vi.j......8z......v.....kqzv.....##...............Ri............Yy.{.......y{...30....IT}j...ux..t.......(k...cq......(sY..sqj...cYZcaZc.....;:8Jq.....].....0j.!#sisGE...."...,YRIJ" 302...9a.ci.. ...wi.....ji~)Q................sqs..................cac.........kil...............RQRZYZ...................s..........{....kac..........sq}...{y{RQZ...RIRZQZ{qssik............RYZ...{........ZQR...ZYR......kic......JIR..RQJs..JQR......{ys...k........kq.RYRsyss..{..kakZq.............cak...cYckqk{q{.........k..JQJ.....s.....j..{..cic...cik.............s............(ssy{sy.9I.......{..Ma..v~...si.Vbb.... k............!.......,...............H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...HK.....S.M.J.J...W.b..k.\.z.Kv.Y.h.=..-.k..w..x..7/.~.....QR.w.I..'..B...H..P.B..G.\.rf.)[...4..7..\Zug.

c:\int_duca\realitzar_duca_archivos\educa_manual28.gif (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	GIF image data, version 89a, 665 x 395
Category:	dropped
Size (bytes):	48458
Entropy (8bit):	7.97709895825478
Encrypted:	false
SSDEEP:	768:r2aG4AJgVG5culHhHdMbe9Yan9754cbns5X9Ihw+c6e7KiSR0JIX+g:rGBKGSoXMbCf14cLs5EzSKinng
MD5:	CC5130C91230EDB8CE6C9908F2EBB767
SHA1:	9283CE869266EA5A8E5ED0C0A1164A448F4F4DFC
SHA-256:	17B29B1354231BC378DF6A6A87C716B8205E1AFB7244EF7BA6DFE3CD66E0F735
SHA-512:	CEC254F5A1D72836BB87F367B15F28B8DCCBF074EF122588623B88F2234244E351DD8D2854C680DEB535A909BFE89FD6522A2CE4FEE1B48D05E3F30DCC0093E6
Malicious:	false
Preview:	GIF89a.........{e..........Uq..(k((JHIxy...........fy....Ea....CX.{.......ce{...(By9V..........y..........VS.(C..0tv.......4Q....Zd{0I....Ii.Vi.j......8z......v.....kqzv.....##...............Ri............Yy.{.......y{...30....IT}j...ux..t.......(k...cq......(sY..sqj...cYZcaZc.....;:8Jq.....].....0j.!#sisGE...."...,YRIJ" 302...9a.ci.. ...wi.....ji~)Q................sqs..................cac.........kil...............RQRZYZ...................s..........{....kac..........sq}...{y{RQZ...RIRZQZ{qssik............RYZ...{........ZQR...ZYR......kic......JIR..RQJs..JQR......{ys...k........kq.RYRsyss..{..kakZq.............cak...cYckqk{q{.........k..JQJ.....s.....j..{..cic...cik.............s............(ssy{sy.9I.......{..Ma..v~...si.Vbb.... k............!.......,...............H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...HK.....S.M.J.J...W.b..k.\.z.Kv.Y.h.=..-.k..w..x..7/.~.....QR.w.I..'..B...H..P.B..G.\.rf.)[...4..7..\Zug.

c:\int_duca\realitzar_duca_archivos\educa_manual30.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 188x27, components 3
Category:	dropped
Size (bytes):	1986
Entropy (8bit):	7.692970232172082
Encrypted:	false
SSDEEP:	48:TS9YMA7p1kQDXowUXezbDvWoz8B7McT5ApSkiER+zfpevg:TuhIpzYwUXezbrz8BIk5ApSy0fpevg
MD5:	AF6DFB70434F581C93EA496E8DDF6FB8
SHA1:	52971D14FC8C12E8DB219AD60BE41122B3DA67DE
SHA-256:	D71840D3D12E68599631DF079F923E947568DC69F85B05B9A2AE2EB85731F474
SHA-512:	2BA3DCEEC442E2444538F158813BE195460FBC1F681C20B86CA6EE6896E7C6EBAFA1ACC2E9EAB4A5278DDDC8638152F8E9897DF28E47778B0D2C59DB59B6A426
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".....................................6...........................!."#1....AV.QR..%356Bst...................................................(............?...4.......K.;...41...q......)vPI .rH...i....@........U.B.....Z.V<..m...(Zh.?.:...$.6....+w.Ld.<Q%.h.._. ...7..%..=...p....$.p...XNlA^Bc.C.%.....x..-..q...5.....Dk{...\..H...3..j7.!......D.7...r..Sm.iAj......&..8.j..G<.`q.9y......~.......F...m4...)......FPg.3w......}.......l...5..qOb..e...=...I.r..aa.P.O_....j.N^hMOWQ.S...r....L...y...W....}Z......C..`.B.+rc.py...0.".+....F.....1C.T...Z..Y..YXZ>1..=D\.pG...r.S.n6.Z..A...H....t...$....k..Y.%C..~`.....w:.uM..).[..;.h`..t.(..2)0C+H.......$..<..,O$..}.+ui...)m$..2...#.XEo...88....G...l.S.zz...'....$.Uh..VPH^c.jx....;..v.v.+.k.....,.+"..F...!.'...v8...E.....C%m

c:\int_duca\realitzar_duca_archivos\educa_manual32.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 188x27, components 3
Category:	dropped
Size (bytes):	1986
Entropy (8bit):	7.692970232172082
Encrypted:	false
SSDEEP:	48:TS9YMA7p1kQDXowUXezbDvWoz8B7McT5ApSkiER+zfpevg:TuhIpzYwUXezbrz8BIk5ApSy0fpevg
MD5:	AF6DFB70434F581C93EA496E8DDF6FB8
SHA1:	52971D14FC8C12E8DB219AD60BE41122B3DA67DE
SHA-256:	D71840D3D12E68599631DF079F923E947568DC69F85B05B9A2AE2EB85731F474
SHA-512:	2BA3DCEEC442E2444538F158813BE195460FBC1F681C20B86CA6EE6896E7C6EBAFA1ACC2E9EAB4A5278DDDC8638152F8E9897DF28E47778B0D2C59DB59B6A426
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".....................................6...........................!."#1....AV.QR..%356Bst...................................................(............?...4.......K.;...41...q......)vPI .rH...i....@........U.B.....Z.V<..m...(Zh.?.:...$.6....+w.Ld.<Q%.h.._. ...7..%..=...p....$.p...XNlA^Bc.C.%.....x..-..q...5.....Dk{...\..H...3..j7.!......D.7...r..Sm.iAj......&..8.j..G<.`q.9y......~.......F...m4...)......FPg.3w......}.......l...5..qOb..e...=...I.r..aa.P.O_....j.N^hMOWQ.S...r....L...y...W....}Z......C..`.B.+rc.py...0.".+....F.....1C.T...Z..Y..YXZ>1..=D\.pG...r.S.n6.Z..A...H....t...$....k..Y.%C..~`.....w:.uM..).[..;.h`..t.(..2)0C+H.......$..<..,O$..}.+ui...)m$..2...#.XEo...88....G...l.S.zz...'....$.Uh..VPH^c.jx....;..v.v.+.k.....,.+"..F...!.'...v8...E.....C%m

c:\int_duca\realitzar_duca_archivos\educa_manual34.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 283x301, components 3
Category:	dropped
Size (bytes):	13560
Entropy (8bit):	7.937941457952041
Encrypted:	false
SSDEEP:	384:C0KTAOIIRYXWDpjSsHT+WWWWWW45BdyKVnRdXyqqEwcjfMFr:WTAOIIRYXutz/5SKndXyEjfsr
MD5:	A45CE06878C091ACBCCAD690A89A5FEC
SHA1:	1DD64993050F6F3ECEA309E204A214024ABC673C
SHA-256:	8B502202DDAF94ACD00E8E9122F26C939D0ED24C08C2CA57A40799C0AE062ACD
SHA-512:	E3CF8838A31D99F9193079EF6A6407040BC39D24BF1C6B0E7E28AADC14A3F3FA14E5C39DBFF501A136FF8F0FB275F32F5D251A2D7B41B9EBB6C3ED3554A2D330
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......-...."........................................S...........................!ST..."1RU.....AQq....26ae.....$45Vtu...#3BFc...br..%.............................../...........................!"Qab.$1A...RB.2.......(............?...ZV..Kk0....0.6.+w.6.~0...\|....2...b..]..jQ..vU....T@.....,{{..~RA.e.q.m...0.V....+...7eec.'1fY.xT..s#..D(.$.....G..C.ti..g......f...F.F...:...Y...k.f.I.....`..M.:.%.'.....x.r....>..hmb.....[..yk....2.......8..Dp......JS.=j.P.=.3n..4o.....PER.NAH..74..y3..d.I.QV.Q..A,..,.....&...)s.L.#M6.....u%.-C.+.K>S.$..`.RH....&...Zq.q...sV..h..KN..#Z.N..xX..w.B..9T....^L..J.z.....O.o...U.N..V{..W-:g.Y.D\.ewD{K].pi....-w...{2s..\..eg...r.}...E..WtG.....]....z...#./..i.>..r..L.+=..L..ik...2..=...=.fG.^.r.}...8U.N..V{....]....z..ewD{K].z..$.*.L.+=.

c:\int_duca\realitzar_duca_archivos\educa_manual36.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 283x301, components 3
Category:	dropped
Size (bytes):	13560
Entropy (8bit):	7.937941457952041
Encrypted:	false
SSDEEP:	384:C0KTAOIIRYXWDpjSsHT+WWWWWW45BdyKVnRdXyqqEwcjfMFr:WTAOIIRYXutz/5SKndXyEjfsr
MD5:	A45CE06878C091ACBCCAD690A89A5FEC
SHA1:	1DD64993050F6F3ECEA309E204A214024ABC673C
SHA-256:	8B502202DDAF94ACD00E8E9122F26C939D0ED24C08C2CA57A40799C0AE062ACD
SHA-512:	E3CF8838A31D99F9193079EF6A6407040BC39D24BF1C6B0E7E28AADC14A3F3FA14E5C39DBFF501A136FF8F0FB275F32F5D251A2D7B41B9EBB6C3ED3554A2D330
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......-...."........................................S...........................!ST..."1RU.....AQq....26ae.....$45Vtu...#3BFc...br..%.............................../...........................!"Qab.$1A...RB.2.......(............?...ZV..Kk0....0.6.+w.6.~0...\|....2...b..]..jQ..vU....T@.....,{{..~RA.e.q.m...0.V....+...7eec.'1fY.xT..s#..D(.$.....G..C.ti..g......f...F.F...:...Y...k.f.I.....`..M.:.%.'.....x.r....>..hmb.....[..yk....2.......8..Dp......JS.=j.P.=.3n..4o.....PER.NAH..74..y3..d.I.QV.Q..A,..,.....&...)s.L.#M6.....u%.-C.+.K>S.$..`.RH....&...Zq.q...sV..h..KN..#Z.N..xX..w.B..9T....^L..J.z.....O.o...U.N..V{..W-:g.Y.D\.ewD{K].pi....-w...{2s..\..eg...r.}...E..WtG.....]....z...#./..i.>..r..L.+=..L..ik...2..=...=.fG.^.r.}...8U.N..V{....]....z..ewD{K].z..$.*.L.+=.

c:\int_duca\realitzar_duca_archivos\educa_manual38.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 283x301, components 3
Category:	dropped
Size (bytes):	13560
Entropy (8bit):	7.937941457952041
Encrypted:	false
SSDEEP:	384:C0KTAOIIRYXWDpjSsHT+WWWWWW45BdyKVnRdXyqqEwcjfMFr:WTAOIIRYXutz/5SKndXyEjfsr
MD5:	A45CE06878C091ACBCCAD690A89A5FEC
SHA1:	1DD64993050F6F3ECEA309E204A214024ABC673C
SHA-256:	8B502202DDAF94ACD00E8E9122F26C939D0ED24C08C2CA57A40799C0AE062ACD
SHA-512:	E3CF8838A31D99F9193079EF6A6407040BC39D24BF1C6B0E7E28AADC14A3F3FA14E5C39DBFF501A136FF8F0FB275F32F5D251A2D7B41B9EBB6C3ED3554A2D330
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......-...."........................................S...........................!ST..."1RU.....AQq....26ae.....$45Vtu...#3BFc...br..%.............................../...........................!"Qab.$1A...RB.2.......(............?...ZV..Kk0....0.6.+w.6.~0...\|....2...b..]..jQ..vU....T@.....,{{..~RA.e.q.m...0.V....+...7eec.'1fY.xT..s#..D(.$.....G..C.ti..g......f...F.F...:...Y...k.f.I.....`..M.:.%.'.....x.r....>..hmb.....[..yk....2.......8..Dp......JS.=j.P.=.3n..4o.....PER.NAH..74..y3..d.I.QV.Q..A,..,.....&...)s.L.#M6.....u%.-C.+.K>S.$..`.RH....&...Zq.q...sV..h..KN..#Z.N..xX..w.B..9T....^L..J.z.....O.o...U.N..V{..W-:g.Y.D\.ewD{K].pi....-w...{2s..\..eg...r.}...E..WtG.....]....z...#./..i.>..r..L.+=..L..ik...2..=...=.fG.^.r.}...8U.N..V{....]....z..ewD{K].z..$.*.L.+=.

c:\int_duca\realitzar_duca_archivos\educa_manual40.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 283x301, components 3
Category:	dropped
Size (bytes):	13560
Entropy (8bit):	7.937941457952041
Encrypted:	false
SSDEEP:	384:C0KTAOIIRYXWDpjSsHT+WWWWWW45BdyKVnRdXyqqEwcjfMFr:WTAOIIRYXutz/5SKndXyEjfsr
MD5:	A45CE06878C091ACBCCAD690A89A5FEC
SHA1:	1DD64993050F6F3ECEA309E204A214024ABC673C
SHA-256:	8B502202DDAF94ACD00E8E9122F26C939D0ED24C08C2CA57A40799C0AE062ACD
SHA-512:	E3CF8838A31D99F9193079EF6A6407040BC39D24BF1C6B0E7E28AADC14A3F3FA14E5C39DBFF501A136FF8F0FB275F32F5D251A2D7B41B9EBB6C3ED3554A2D330
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......-...."........................................S...........................!ST..."1RU.....AQq....26ae.....$45Vtu...#3BFc...br..%.............................../...........................!"Qab.$1A...RB.2.......(............?...ZV..Kk0....0.6.+w.6.~0...\|....2...b..]..jQ..vU....T@.....,{{..~RA.e.q.m...0.V....+...7eec.'1fY.xT..s#..D(.$.....G..C.ti..g......f...F.F...:...Y...k.f.I.....`..M.:.%.'.....x.r....>..hmb.....[..yk....2.......8..Dp......JS.=j.P.=.3n..4o.....PER.NAH..74..y3..d.I.QV.Q..A,..,.....&...)s.L.#M6.....u%.-C.+.K>S.$..`.RH....&...Zq.q...sV..h..KN..#Z.N..xX..w.B..9T....^L..J.z.....O.o...U.N..V{..W-:g.Y.D\.ewD{K].pi....-w...{2s..\..eg...r.}...E..WtG.....]....z...#./..i.>..r..L.+=..L..ik...2..=...=.fG.^.r.}...8U.N..V{....]....z..ewD{K].z..$.*.L.+=.

c:\int_duca\realitzar_duca_archivos\educa_manual42.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	GIF image data, version 89a, 647 x 599
Category:	dropped
Size (bytes):	45014
Entropy (8bit):	7.879569879517408
Encrypted:	false
SSDEEP:	768:msaHTMePkJr/PWc0zwcnYMjBH8Hj129WsdjTeFrgi+PohTLNke9+2qL:msoTMe8JrHWc0zwc1j58Hj1AZ8XhtkeS
MD5:	51AF7B39C9D8BA2F57F11980A336D505
SHA1:	9CBE26A17C3F9151BF2E21195C77472CC9C6DA16
SHA-256:	4CADE8B1E8486A5E056EC7ADC694729A98CD04887EF74613A5E634C2602DA534
SHA-512:	5F467A36E2B8A25CDCD5AE9702D1BAC5C67BE25D5F44F723678AD2A2191EB11928D1C66D5A3365D9B00A110C035D0297B96712153664E7260914F2166530A76E
Malicious:	false
Preview:	GIF89a..W.......................! !........ZYZ{y{......989...JIJ............kik...101cac...sqsBAB........RQR......................................RIR)()...cYc...................... !...{qsZQZ!.!.y.JQR......cYZ.........ZYcJIR...JQJRIJ...ZaZ......................sys..{......caZsq{Zac......sis....................{..!..! .981{ysRQJ{q{...909kis.....sik.........189.....................y{......... .......kaksy{......901...sqk........!kqkkackic......{y....ZQR181109.........{.{RQZZYRcak......9A9......JAB......cic...98BkqscikBA9..BIJ.....B89.......JIB...BIB) !RYZ......1()10)B8BJAJ) )!()...)0)1(1)(!RYR! )9AB......BAJ.........!(!..................)(1)01...........................................................................................................!.......,......W........H......\....#J.H....3j.... C..I...(S.\...0c.I...8s...gM.@...J...H.]...P.J.J...X.j....`...I...h.]...p..K...x..........L......-@@.... K.Ly.../k..y...?..Mz...O.N.z...

c:\int_duca\realitzar_duca_archivos\educa_manual51.gif (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	GIF image data, version 89a, 647 x 599
Category:	dropped
Size (bytes):	45014
Entropy (8bit):	7.879569879517408
Encrypted:	false
SSDEEP:	768:msaHTMePkJr/PWc0zwcnYMjBH8Hj129WsdjTeFrgi+PohTLNke9+2qL:msoTMe8JrHWc0zwc1j58Hj1AZ8XhtkeS
MD5:	51AF7B39C9D8BA2F57F11980A336D505
SHA1:	9CBE26A17C3F9151BF2E21195C77472CC9C6DA16
SHA-256:	4CADE8B1E8486A5E056EC7ADC694729A98CD04887EF74613A5E634C2602DA534
SHA-512:	5F467A36E2B8A25CDCD5AE9702D1BAC5C67BE25D5F44F723678AD2A2191EB11928D1C66D5A3365D9B00A110C035D0297B96712153664E7260914F2166530A76E
Malicious:	false
Preview:	GIF89a..W.......................! !........ZYZ{y{......989...JIJ............kik...101cac...sqsBAB........RQR......................................RIR)()...cYc...................... !...{qsZQZ!.!.y.JQR......cYZ.........ZYcJIR...JQJRIJ...ZaZ......................sys..{......caZsq{Zac......sis....................{..!..! .981{ysRQJ{q{...909kis.....sik.........189.....................y{......... .......kaksy{......901...sqk........!kqkkackic......{y....ZQR181109.........{.{RQZZYRcak......9A9......JAB......cic...98BkqscikBA9..BIJ.....B89.......JIB...BIB) !RYZ......1()10)B8BJAJ) )!()...)0)1(1)(!RYR! )9AB......BAJ.........!(!..................)(1)01...........................................................................................................!.......,......W........H......\....#J.H....3j.... C..I...(S.\...0c.I...8s...gM.@...J...H.]...P.J.J...X.j....`...I...h.]...p..K...x..........L......-@@.... K.Ly.../k..y...?..Mz...O.N.z...

c:\int_duca\realitzar_duca_archivos\educa_manual53.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	GIF image data, version 89a, 533 x 69
Category:	dropped
Size (bytes):	3367
Entropy (8bit):	7.619714940959413
Encrypted:	false
SSDEEP:	96:lkAfjMC2pnPrUpvnFdYxPwHDqgEYWAQJH+WM7cUS:GAgCCnkFdY53rpQWMS
MD5:	D3FBF9F24154691CF69C1064DAAB64DA
SHA1:	E302DA4A2EFFE31429C9ACEF4F7D46EAE317A292
SHA-256:	1FC6078E735BE31E455E3AF85D1A793548BB4209A4519B514882F98EF60E6C3E
SHA-512:	193385E0856E7AF93AC5BC4380030F11BB408D7A2E2A93FD58F21C76264191478DE2E4B1B892E99F51F2E4FDADA3A43F0515B58B0D8C45FE48675B09E6E07F8E
Malicious:	false
Preview:	GIF89a..E..............................cac...{y{......JIJ...kik.........101...sqs! !989ZYZ......BABRQR)()...................................................................................................!.......,......E....@.pH,...r.l:..tJ.Z..v..z..xL....z.n...\|N.....~.............................................~..E..c..J.........n...B....c...........]...B... ....C... ...B....F... ...C.... ...B......../....\|-...A....,H......(.........:.X...+p..b....=.0..E...8.@......@4p....R..<......:.R.@.......`...c..`.1.... H..-.. ........I.L...k......Lx........U...(0......r..x<....j.x.\|.`\e..<....,.{..{W...I.m.........-..+.B ...$32.........p.ok..pG...F. d3....;.....^...0..\|.........NA....qg....U@{..`.....O..B@...p@.........R`@x'e.V..\|...$.wN..pW^ (&D..!..yL.N..h......$lE.#..E..@...G....P.EJ....e..>.s\_9.h.50..l..P.J.).t.i.x..\|...m`#..j.&..6....i%..Y.Br.f."."...2.....G......_00b.Z...i............q.saDg.....(...l.V.@..$N....h.].....d..U...N.Wx..u.....Z..

c:\int_duca\realitzar_duca_archivos\educa_manual55.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	GIF image data, version 89a, 533 x 69
Category:	dropped
Size (bytes):	3367
Entropy (8bit):	7.619714940959413
Encrypted:	false
SSDEEP:	96:lkAfjMC2pnPrUpvnFdYxPwHDqgEYWAQJH+WM7cUS:GAgCCnkFdY53rpQWMS
MD5:	D3FBF9F24154691CF69C1064DAAB64DA
SHA1:	E302DA4A2EFFE31429C9ACEF4F7D46EAE317A292
SHA-256:	1FC6078E735BE31E455E3AF85D1A793548BB4209A4519B514882F98EF60E6C3E
SHA-512:	193385E0856E7AF93AC5BC4380030F11BB408D7A2E2A93FD58F21C76264191478DE2E4B1B892E99F51F2E4FDADA3A43F0515B58B0D8C45FE48675B09E6E07F8E
Malicious:	false
Preview:	GIF89a..E..............................cac...{y{......JIJ...kik.........101...sqs! !989ZYZ......BABRQR)()...................................................................................................!.......,......E....@.pH,...r.l:..tJ.Z..v..z..xL....z.n...\|N.....~.............................................~..E..c..J.........n...B....c...........]...B... ....C... ...B....F... ...C.... ...B......../....\|-...A....,H......(.........:.X...+p..b....=.0..E...8.@......@4p....R..<......:.R.@.......`...c..`.1.... H..-.. ........I.L...k......Lx........U...(0......r..x<....j.x.\|.`\e..<....,.{..{W...I.m.........-..+.B ...$32.........p.ok..pG...F. d3....;.....^...0..\|.........NA....qg....U@{..`.....O..B@...p@.........R`@x'e.V..\|...$.wN..pW^ (&D..!..yL.N..h......$lE.#..E..@...G....P.EJ....e..>.s\_9.h.50..l..P.J.).t.i.x..\|...m`#..j.&..6....i%..Y.Br.f."."...2.....G......_00b.Z...i............q.saDg.....(...l.V.@..$N....h.].....d..U...N.Wx..u.....Z..

c:\int_duca\realitzar_duca_archivos\educa_manual58.gif (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	GIF image data, version 89a, 533 x 69
Category:	dropped
Size (bytes):	3367
Entropy (8bit):	7.619714940959413
Encrypted:	false
SSDEEP:	96:lkAfjMC2pnPrUpvnFdYxPwHDqgEYWAQJH+WM7cUS:GAgCCnkFdY53rpQWMS
MD5:	D3FBF9F24154691CF69C1064DAAB64DA
SHA1:	E302DA4A2EFFE31429C9ACEF4F7D46EAE317A292
SHA-256:	1FC6078E735BE31E455E3AF85D1A793548BB4209A4519B514882F98EF60E6C3E
SHA-512:	193385E0856E7AF93AC5BC4380030F11BB408D7A2E2A93FD58F21C76264191478DE2E4B1B892E99F51F2E4FDADA3A43F0515B58B0D8C45FE48675B09E6E07F8E
Malicious:	false
Preview:	GIF89a..E..............................cac...{y{......JIJ...kik.........101...sqs! !989ZYZ......BABRQR)()...................................................................................................!.......,......E....@.pH,...r.l:..tJ.Z..v..z..xL....z.n...\|N.....~.............................................~..E..c..J.........n...B....c...........]...B... ....C... ...B....F... ...C.... ...B......../....\|-...A....,H......(.........:.X...+p..b....=.0..E...8.@......@4p....R..<......:.R.@.......`...c..`.1.... H..-.. ........I.L...k......Lx........U...(0......r..x<....j.x.\|.`\e..<....,.{..{W...I.m.........-..+.B ...$32.........p.ok..pG...F. d3....;.....^...0..\|.........NA....qg....U@{..`.....O..B@...p@.........R`@x'e.V..\|...$.wN..pW^ (&D..!..yL.N..h......$lE.#..E..@...G....P.EJ....e..>.s\_9.h.50..l..P.J.).t.i.x..\|...m`#..j.&..6....i%..Y.Br.f."."...2.....G......_00b.Z...i............q.saDg.....(...l.V.@..$N....h.].....d..U...N.Wx..u.....Z..

c:\int_duca\realitzar_duca_archivos\educa_manual61.gif (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	GIF image data, version 89a, 667 x 359
Category:	dropped
Size (bytes):	42284
Entropy (8bit):	7.953095905908468
Encrypted:	false
SSDEEP:	768:KdTMv5wW/ZPonFomL42bdaNMiCH9WRJctdTgVLr6zli4SkZ5G4W:KORwCP8FT02xPiVRJct5gp6zlrZW
MD5:	4BACFE643DE945A60E52D851A5F41B24
SHA1:	C1FA810F2E01D769724CC846230DF293B8413ED4
SHA-256:	C28DE0CE85C24F9A54CC8AC5CA15F094C97BD084292B7C8D26EBD143FF696ED3
SHA-512:	B452D2220DF65E39BA3B1D79B5A83FF046FCDF3500CF9AF1841641E9F5A11A17CF292DEE75B3ADC373B820D8897818B3AE93BFC3B48D5A8CDEF31D53850552CD
Malicious:	false
Preview:	GIF89a..g....ZYZe.....I...Fa....Uq......kx........JII.........dx.........CX.)()9V.....y{....a..........%A{'A..0t4Q....Jh.SQ.878........v../I.......................Si.caZv...l.x......8z{...................Yy....Yac...............sqk.(kB;2Z.....J7B.(s...his 8.h.....M..ZYc:...51r..62..9.(2P.0kJq....IIS9a...)3I.(01AAA)Q..... k....(k..................cac......kik......sqs......{y{..................................s..siksis{.........................kak........kickac...RIJ.........{ys{q{...{............cYZ...................cYcs......{qs.... k......ZaZ...caks.....{..k.....s....k....j...........SQQ...{....KQGs... c.y....cik...kqk........sq{........cics....RIR......)0)101.(ssy{{..sys3#/)(1kqs. ....ERS.... c..." "...{...(k..s.i.s...SO..<............!.......,......g........H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.]...P.J.J...X.j....`..K...h.]......K...x.........)......}.x...?...y"...^.\|ssL....M..../O.T.z ..

c:\int_duca\realitzar_duca_archivos\educa_manual64.gif (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	GIF image data, version 89a, 667 x 359
Category:	dropped
Size (bytes):	42284
Entropy (8bit):	7.953095905908468
Encrypted:	false
SSDEEP:	768:KdTMv5wW/ZPonFomL42bdaNMiCH9WRJctdTgVLr6zli4SkZ5G4W:KORwCP8FT02xPiVRJct5gp6zlrZW
MD5:	4BACFE643DE945A60E52D851A5F41B24
SHA1:	C1FA810F2E01D769724CC846230DF293B8413ED4
SHA-256:	C28DE0CE85C24F9A54CC8AC5CA15F094C97BD084292B7C8D26EBD143FF696ED3
SHA-512:	B452D2220DF65E39BA3B1D79B5A83FF046FCDF3500CF9AF1841641E9F5A11A17CF292DEE75B3ADC373B820D8897818B3AE93BFC3B48D5A8CDEF31D53850552CD
Malicious:	false
Preview:	GIF89a..g....ZYZe.....I...Fa....Uq......kx........JII.........dx.........CX.)()9V.....y{....a..........%A{'A..0t4Q....Jh.SQ.878........v../I.......................Si.caZv...l.x......8z{...................Yy....Yac...............sqk.(kB;2Z.....J7B.(s...his 8.h.....M..ZYc:...51r..62..9.(2P.0kJq....IIS9a...)3I.(01AAA)Q..... k....(k..................cac......kik......sqs......{y{..................................s..siksis{.........................kak........kickac...RIJ.........{ys{q{...{............cYZ...................cYcs......{qs.... k......ZaZ...caks.....{..k.....s....k....j...........SQQ...{....KQGs... c.y....cik...kqk........sq{........cics....RIR......)0)101.(ssy{{..sys3#/)(1kqs. ....ERS.... c..." "...{...(k..s.i.s...SO..<............!.......,......g........H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.]...P.J.J...X.j....`..K...h.]......K...x.........)......}.x...?...y"...^.\|ssL....M..../O.T.z ..

c:\int_duca\realitzar_duca_archivos\educa_manual71.gif (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	GIF image data, version 89a, 667 x 359
Category:	dropped
Size (bytes):	42284
Entropy (8bit):	7.953095905908468
Encrypted:	false
SSDEEP:	768:KdTMv5wW/ZPonFomL42bdaNMiCH9WRJctdTgVLr6zli4SkZ5G4W:KORwCP8FT02xPiVRJct5gp6zlrZW
MD5:	4BACFE643DE945A60E52D851A5F41B24
SHA1:	C1FA810F2E01D769724CC846230DF293B8413ED4
SHA-256:	C28DE0CE85C24F9A54CC8AC5CA15F094C97BD084292B7C8D26EBD143FF696ED3
SHA-512:	B452D2220DF65E39BA3B1D79B5A83FF046FCDF3500CF9AF1841641E9F5A11A17CF292DEE75B3ADC373B820D8897818B3AE93BFC3B48D5A8CDEF31D53850552CD
Malicious:	false
Preview:	GIF89a..g....ZYZe.....I...Fa....Uq......kx........JII.........dx.........CX.)()9V.....y{....a..........%A{'A..0t4Q....Jh.SQ.878........v../I.......................Si.caZv...l.x......8z{...................Yy....Yac...............sqk.(kB;2Z.....J7B.(s...his 8.h.....M..ZYc:...51r..62..9.(2P.0kJq....IIS9a...)3I.(01AAA)Q..... k....(k..................cac......kik......sqs......{y{..................................s..siksis{.........................kak........kickac...RIJ.........{ys{q{...{............cYZ...................cYcs......{qs.... k......ZaZ...caks.....{..k.....s....k....j...........SQQ...{....KQGs... c.y....cik...kqk........sq{........cics....RIR......)0)101.(ssy{{..sys3#/)(1kqs. ....ERS.... c..." "...{...(k..s.i.s...SO..<............!.......,......g........H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.]...P.J.J...X.j....`..K...h.]......K...x.........)......}.x...?...y"...^.\|ssL....M..../O.T.z ..

c:\int_duca\realitzar_duca_archivos\educa_manual_224.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 564x391, components 3
Category:	dropped
Size (bytes):	32604
Entropy (8bit):	7.655706314582852
Encrypted:	false
SSDEEP:	768:DxAIKNEIys/htYlllhEUp4E4H7qa0CHha4ea3WL7L7L7L7L7L7L7L7L7L7L7:Dy5rVYzEUpfa5WUMHHHHHHHHHH7
MD5:	2E923C128B8B58FCD0DD71DA538FCA8F
SHA1:	1DBE1ACC443EDCDCFCCD03AD022AF261CB4517E8
SHA-256:	366B57AB2C3C4F1286D93FEB7FE7550D624BD8EA399B3D82FAEDFF504FD13DBA
SHA-512:	2D4A88568872888DAC3A670C0FEE374E1282173EB9267B861263155397E2001B1F7E8DBEDEA2FD0EB073B1F454F6A403FB948092817DEFE98235A48AE808AAA4
Malicious:	false
Preview:	......JFIF.....,.,.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........4.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.........}m._.(j..P4K..e..Lm'...Z..x....~.W.....q....o.Xd..8...<a..7.....n.o.V\|.*........f.........P_!...c7; 1.rs.I9.?J..-...........+..?.-/nm.Er"..df.QU..0.....>....K..o.2.D....s$m....z..O.....6...$.....[6...+t3..Q..a......-0aov.k.....yg2.Fq....I..Jk.B._.d..x....Z.\eG..a..sD~<.......!...8.j..'.<Ku...r-.Sy..I[.....n^.#..g\.......u..W..f........-..U...}....

c:\int_duca\realitzar_duca_archivos\educa_manual_225.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 564x388, components 3
Category:	dropped
Size (bytes):	27873
Entropy (8bit):	7.64116112513555
Encrypted:	false
SSDEEP:	384:oXJePAzxm22XE3/31jIUE41UUzj2TcXXXXXXDI3So41GSYb6nvclkfu:oUwP1MUBUUzqgID41GAcleu
MD5:	B5586C20C8B118C5467B47E4CBCC7934
SHA1:	C77CF1CC03F7345919A1218E69E33758180E4262
SHA-256:	0995115B9751B4FC99DDC8E6C0ED2000EA5769411C8CA5649CE564712E943B64
SHA-512:	72684E02A205613EFDF75FC6A3953982D741BDC9E758337E996FDA7A703B91CAE0754D6BE83205A8D41410DB928E637BBB142A2FC368C63C0EF1FE2877F97E03
Malicious:	false
Preview:	......JFIF.....,.,.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........4.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....<ksq..v...du{.D...P.bR....^....R.4......?.:........wc;.8...Q......mWO..........\|.l.#..........i.......1"Bb...Ns..{...SQL.Wz.......s~5.n.#...{..-'...g...*...k]%/...J.4.R.\..'..m.6GB?...\|F..../b$....... #Go).N1..py..#E..:;8........8...9j_....{...."..$...M:.D.{(...._.G.K...Cp......yS.w0..n....!...\i...9D.F1;.C. ..9..Vu..Xk...Y..\|..ywK.q.FCdr>@x.Z.K.I..

c:\int_duca\realitzar_duca_archivos\educa_manual_226.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 577x308, components 3
Category:	dropped
Size (bytes):	35832
Entropy (8bit):	7.741291669352693
Encrypted:	false
SSDEEP:	768:xEuDvV/CCWo3a+plQvGgV591MMMQ8EkFerJHTttRfs0:xEuNCC/PlDgJ1MMMQ8EMerJHTttls0
MD5:	CFB0D9CA961F9FD7C80C29FC92123C81
SHA1:	3331DD505F5C6C27AB3897F08CAF48B0B8C8EE0B
SHA-256:	74528DA9D12BA5589BDE4C03E9ADB4C5A941380EF40594B118AFC1B397BFFEC5
SHA-512:	42EB9F44CE96F088039E60F69C0994A4A9FA3B6A5782F926B87B38646FFC02A75F8A839438D72743F2CC13A0E422095B4C350929FD309DBC739943CD515BFB04
Malicious:	false
Preview:	......JFIF.....,.,.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......4.A.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...=".F.6..$r.........}......5....o].m..i..l!].h...63.U^?..<.@....G.60Y...!....2%nG.*9.=;.e..V=7[...)..m....r...O.I..]...=ko.QU.'./..........q..E.^.<.{....9...sq<..w..%...}.H.YI.'p.w)..9.P..f...s-.v.q[.y...W...PF.0@....N...^}...2.t..<00... !.PX.$.:.d..Q\|%........X\.g.Vo,H.."..pl.u.....#.......<.zu.F.FW....e}....$#!v..........#R...[.....r.N.).T....w...Y.G3.d...

c:\int_duca\realitzar_duca_archivos\educa_manual_241.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 369x119, components 3
Category:	dropped
Size (bytes):	7084
Entropy (8bit):	7.897695189335595
Encrypted:	false
SSDEEP:	96:Tgb4oIvtj+AC2tMYYv9XzZvlAwNyIvkyyIczCSeEF+u2TcR2t30KKYy7CebDUDO7:NdcXYYtzIw0IvkyoFeEFbRm30KKGgF3B
MD5:	B172572A050A74EA089BB408575B636C
SHA1:	665EEB48A4B95A9687DDD7E0594DD0A59DC96EB8
SHA-256:	E34860139CE55110FA7F6359D151D48E4A7D1BA1AC831FAD7F3079E08E38B593
SHA-512:	84C74A8A915CADA9273B931F420F6A5D42EAD3FC5253F937DEFF4807B7713C625D8E78716E04A035C4CDAFC2DE7C604801339D4B7EDC4461049EC204DF1AF254
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......w.q..".......................................G..........................!1..R...."2AQT....#3BCDSUrs...5aq..$4.%Ebu...............................$.......................Q...!.12q.......(............?...........j'..H.&hu;' ..y.twY.........u....E[Z..imt....=X 7y!..P.....K6.Y...E56...m......`.nsZZ4..6...I...[..X.9.p.j..F.{._.5....#...\|.1.4.<.$...4.\|.W0.}.Kg..yX....M....U%5..h \|A..1...d.2.@..<...{....X....t.X?........o............l.s.,.u..[}....aw.k.{..;._..-..{W..:.~.m.s..f.E....;.^..m..{VC.U..V.......SE....;..}.......wG.......U.......un..o..o...d;...........SE....;.]..:..d;.]..:..UB.&.\|6U.m...^...VCo....=G..f.E.&.....z=.Q........z..VB.)....uf.os.z..._F....Qu....M6.l....;..Qu...m.....P..f..o............mu..h....f.M...\|me...'R..u..i:....)....u86....'R.Ci....!B..M6.l...

c:\int_duca\realitzar_duca_archivos\educa_manual_242.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 553x140, components 3
Category:	dropped
Size (bytes):	13973
Entropy (8bit):	7.9528547818477575
Encrypted:	false
SSDEEP:	384:lXrd0FBHNpUjI6YHOAfvlV9cSRhe5GEbotaPjCshA/n:pcNpUjIFlzcWhe/OaPjJAP
MD5:	1E8E0B63EAD9A56544214E37C101C7C6
SHA1:	844BF8E37E24F5214AA00331AC57A94708E0A34A
SHA-256:	0D478C6E578E9017EF5E7012EC0B4217C40318F7BA3DFA2A328A813B1FA9FA45
SHA-512:	27022D5B9CE12599844371E2EE85EC32F7BB0EBE611F2F2E71581D45189B354C9D84974459E0F5AFCEB4438603D4814EC6F5FFB95E983D14CF3D4C5B2A783A3F
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;........)..".......................................H.........................!1.."AQR..2a...STq...#3Br...4bs...$.%Uc...................................$...................Q.....1R!A..."......(............?...L....Qi.].....V...9..h.I=+.fl..T.d...=.N.>.5...t.?..:...R.J..T.i...2Ghg5b.[...77.^.g....W....7..'...>5...?.....p..{..^.t.t....A".#k...<y.=..+...C.m..]X[....,...U'H..B....Z.Mz;..eM.8....g.....i7.Ayj.o.4.4.._zR`....$..WLu..{.>..>.J= .......U..C..Wc...j..]...bL.2.'........z?..........C.T)...&V.~.u......O..5...5...O..5......$.Za.K....8....N..v_...Q.U..k..eip..5....N?:..h........DET)...&V....\../....H........D.TA..2....]....U.C.... TPUB.k..+J....y,.@.G...y,.@....!.K&V....Z.Y..Uz....,.@....!.D.ZN:{..,.@.GO5.%.....P...I2..t.X.Z\|.^....->@...!.D.ZH:s..->@..x... TlUB..L.#..V.

c:\int_duca\realitzar_duca_archivos\educa_manual_243.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 553x140, components 3
Category:	dropped
Size (bytes):	13973
Entropy (8bit):	7.9528547818477575
Encrypted:	false
SSDEEP:	384:lXrd0FBHNpUjI6YHOAfvlV9cSRhe5GEbotaPjCshA/n:pcNpUjIFlzcWhe/OaPjJAP
MD5:	1E8E0B63EAD9A56544214E37C101C7C6
SHA1:	844BF8E37E24F5214AA00331AC57A94708E0A34A
SHA-256:	0D478C6E578E9017EF5E7012EC0B4217C40318F7BA3DFA2A328A813B1FA9FA45
SHA-512:	27022D5B9CE12599844371E2EE85EC32F7BB0EBE611F2F2E71581D45189B354C9D84974459E0F5AFCEB4438603D4814EC6F5FFB95E983D14CF3D4C5B2A783A3F
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;........)..".......................................H.........................!1.."AQR..2a...STq...#3Br...4bs...$.%Uc...................................$...................Q.....1R!A..."......(............?...L....Qi.].....V...9..h.I=+.fl..T.d...=.N.>.5...t.?..:...R.J..T.i...2Ghg5b.[...77.^.g....W....7..'...>5...?.....p..{..^.t.t....A".#k...<y.=..+...C.m..]X[....,...U'H..B....Z.Mz;..eM.8....g.....i7.Ayj.o.4.4.._zR`....$..WLu..{.>..>.J= .......U..C..Wc...j..]...bL.2.'........z?..........C.T)...&V.~.u......O..5...5...O..5......$.Za.K....8....N..v_...Q.U..k..eip..5....N?:..h........DET)...&V....\../....H........D.TA..2....]....U.C.... TPUB.k..+J....y,.@.G...y,.@....!.K&V....Z.Y..Uz....,.@....!.D.ZN:{..,.@.GO5.%.....P...I2..t.X.Z\|.^....->@...!.D.ZH:s..->@..x... TlUB..L.#..V.

c:\int_duca\realitzar_duca_archivos\educa_manual_271.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 553x140, components 3
Category:	dropped
Size (bytes):	13973
Entropy (8bit):	7.9528547818477575
Encrypted:	false
SSDEEP:	384:lXrd0FBHNpUjI6YHOAfvlV9cSRhe5GEbotaPjCshA/n:pcNpUjIFlzcWhe/OaPjJAP
MD5:	1E8E0B63EAD9A56544214E37C101C7C6
SHA1:	844BF8E37E24F5214AA00331AC57A94708E0A34A
SHA-256:	0D478C6E578E9017EF5E7012EC0B4217C40318F7BA3DFA2A328A813B1FA9FA45
SHA-512:	27022D5B9CE12599844371E2EE85EC32F7BB0EBE611F2F2E71581D45189B354C9D84974459E0F5AFCEB4438603D4814EC6F5FFB95E983D14CF3D4C5B2A783A3F
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;........)..".......................................H.........................!1.."AQR..2a...STq...#3Br...4bs...$.%Uc...................................$...................Q.....1R!A..."......(............?...L....Qi.].....V...9..h.I=+.fl..T.d...=.N.>.5...t.?..:...R.J..T.i...2Ghg5b.[...77.^.g....W....7..'...>5...?.....p..{..^.t.t....A".#k...<y.=..+...C.m..]X[....,...U'H..B....Z.Mz;..eM.8....g.....i7.Ayj.o.4.4.._zR`....$..WLu..{.>..>.J= .......U..C..Wc...j..]...bL.2.'........z?..........C.T)...&V.~.u......O..5...5...O..5......$.Za.K....8....N..v_...Q.U..k..eip..5....N?:..h........DET)...&V....\../....H........D.TA..2....]....U.C.... TPUB.k..+J....y,.@.G...y,.@....!.K&V....Z.Y..Uz....,.@....!.D.ZN:{..,.@.GO5.%.....P...I2..t.X.Z\|.^....->@...!.D.ZH:s..->@..x... TlUB..L.#..V.

c:\int_duca\realitzar_duca_archivos\educa_manual_272.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 470x119, components 3
Category:	dropped
Size (bytes):	9331
Entropy (8bit):	7.891570428678495
Encrypted:	false
SSDEEP:	192:KYlrvsBZl4/T9Ufkx2xmZMuTCQMPuG8pXRCaHH7EhQAs1eEAtBrDq48AVdATu:KYlrUZl4bBx28ZferPARlH4hQAsWfrNv
MD5:	D8389E688A6D4064F40AF1FE8EB36CD0
SHA1:	FED95DD6D770809C6D15E1A21AA411615D3E7D0D
SHA-256:	C5D1160653D0C4410206B780FA871BE2282E597E5EA1DAADC0C6635F3537EDE3
SHA-512:	463EB52D2C295528A38A098B081853088E750965195EF854CAC111DBB9A8B38645B7845FD435801FE80357079570F6568778AAB1BCE0799A099F42C9EA356375
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......w....".......................................J...........................!."1R.....2AQST....Us.#34r..Baq$56t..%Eu.....................................).......................Q...!1Aa...2R........(............?........0cB[K....d.. .UWG..........h..#.).T..ZS9.........H....."...{...z6...m.)..)...iIH...9..$...[.~..9.p.j..2..&.q....DB.S.vKe...F.*'.% ...a.Z..v.?uX.J...m...NF.XM......[.Fq..Qp...8.......#..=.x....J............8.)....f..G.[.[>.....}.Kg..."...E..s.WWQ.J...?uz<(.=.....X..4Z....}..-.N{...:...=.L....\6U..xM......}z<%.......4[....U..m.O...E..m.O..@VB.-..WV.........k.........j.+!M..l..h..x.k.......w.k....S.......uk........k!.....;......o......{........}..a..XVb.-.6U.m.......d6....{......o...r....{...qt.x]..U.Y..-..WVQ..?w..~...[....~.\....\|6U.m...B.?Z.

c:\int_duca\realitzar_duca_archivos\educa_manual_273.jpg (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "Software: Microsoft Office", baseline, precision 8, 470x119, components 3
Category:	dropped
Size (bytes):	9331
Entropy (8bit):	7.891570428678495
Encrypted:	false
SSDEEP:	192:KYlrvsBZl4/T9Ufkx2xmZMuTCQMPuG8pXRCaHH7EhQAs1eEAtBrDq48AVdATu:KYlrUZl4bBx28ZferPARlH4hQAsWfrNv
MD5:	D8389E688A6D4064F40AF1FE8EB36CD0
SHA1:	FED95DD6D770809C6D15E1A21AA411615D3E7D0D
SHA-256:	C5D1160653D0C4410206B780FA871BE2282E597E5EA1DAADC0C6635F3537EDE3
SHA-512:	463EB52D2C295528A38A098B081853088E750965195EF854CAC111DBB9A8B38645B7845FD435801FE80357079570F6568778AAB1BCE0799A099F42C9EA356375
Malicious:	false
Preview:	......JFIF.....`.`......Software: Microsoft Office...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......w....".......................................J...........................!."1R.....2AQST....Us.#34r..Baq$56t..%Eu.....................................).......................Q...!1Aa...2R........(............?........0cB[K....d.. .UWG..........h..#.).T..ZS9.........H....."...{...z6...m.)..)...iIH...9..$...[.~..9.p.j..2..&.q....DB.S.vKe...F.*'.% ...a.Z..v.?uX.J...m...NF.XM......[.Fq..Qp...8.......#..=.x....J............8.)....f..G.[.[>.....}.Kg..."...E..s.WWQ.J...?uz<(.=.....X..4Z....}..-.N{...:...=.L....\6U..xM......}z<%.......4[....U..m.O...E..m.O..@VB.-..WV.........k.........j.+!M..l..h..x.k.......w.k....S.......uk........k!.....;......o......{........}..a..XVb.-.6U.m.......d6....{......o...r....{...qt.x]..U.Y..-..WVQ..?w..~...[....~.\....\|6U.m...B.?Z.

c:\int_duca\realitzar_duca_archivos\filelist.xml (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6764
Entropy (8bit):	4.761004074724084
Encrypted:	false
SSDEEP:	24:aBwdqiOUu/M2qBRC6xPJgJuBj09XusCayyP2Qm2PuhVEQyRtc+jeh7fGM0pDrIsa:aKXHIMPVuN9qp2Rc/+McfIsIVwEmi
MD5:	806BF6FF17B2CEB4CD3E8AD57D565F48
SHA1:	9AC276795B3AF04AAD8531AC433610334F2466C2
SHA-256:	FA3671AB602C23ED5C1603CF0E58B6E1D8009C57C889BFC5F06CD0AA07957811
SHA-512:	339EB36CB10F265404AB7597B76DDC7C159E9415E90E038D49187845CE91EC9998B442EAEAF851B44E2003265ECAD2E2DA82FB1AED5925ADA7B2840779313C8F
Malicious:	false
Preview:	<xml xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:MainFile HRef="../realitzar_duca.htm"/>.. <o:File HRef="image001.gif"/>.. <o:File HRef="image002.png"/>.. <o:File HRef="image003.jpg"/>.. <o:File HRef="oledata.mso"/>.. <o:File HRef="image004.gif"/>.. <o:File HRef="image005.png"/>.. <o:File HRef="image006.jpg"/>.. <o:File HRef="image007.gif"/>.. <o:File HRef="image008.png"/>.. <o:File HRef="image009.jpg"/>.. <o:File HRef="image010.gif"/>.. <o:File HRef="image011.gif"/>.. <o:File HRef="image012.png"/>.. <o:File HRef="image013.jpg"/>.. <o:File HRef="image014.gif"/>.. <o:File HRef="image015.gif"/>.. <o:File HRef="image016.gif"/>.. <o:File HRef="image017.png"/>.. <o:File HRef="image018.jpg"/>.. <o:File HRef="image019.gif"/>.. <o:File HRef="image020.png"/>.. <o:File HRef="image021.jpg"/>.. <o:File HRef="image022.gif"/>.. <o:File HRef="image023.gif"/>.. <o:File HRef="image024.gif"/>.. <o:File HRef="image025.png"/>.. <o:File HRef="image026.jpg"/>.. <o:File HRef="image027.gif"/>.. <o

c:\int_duca\realitzar_duca_archivos\oledata.mso (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	7.373624802351215
Encrypted:	false
SSDEEP:	384:iZcwCHHzokv1P3iAFnOgW5zZYAHRidSp:3wCHHzooFOR5RRjp
MD5:	EA2897DD955AA4DC98DDC61758C34F54
SHA1:	423C125939DB9398DFB2323C59916E3952E119AD
SHA-256:	68E5E1E8638D5C8CA277DD9192ABF94F85181D3906F2AB44D163C858FA6D2AEA
SHA-512:	13B2C36F57FC72E2F38DCCEBEAD110347631C71E8C66D414FD8795BCC5EB0E2C740B42B28226DA4706F5ED0BAACB03FEE3E37DAD30B64B5DB0E8D184C9F3C18C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\realitzar_duca_archivos\vssver.scc (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	data
Category:	dropped
Size (bytes):	944
Entropy (8bit):	5.767530490517826
Encrypted:	false
SSDEEP:	24:wTcllFc6N+8/reNfLZw7wcP/WYjHqK89ZOG3/D:wAl+6NVTk1w7N3WYb/6ZOGPD
MD5:	8FC9B1DAF5CE395C8B5AB08F43143F5D
SHA1:	A24282966ED3F8F4AFA645A45DBFAFB4D82A6E12
SHA-256:	30E56C110588BEBAC6CB3231D52F7B43ED26D6C5589CB344D9FF932029EA398F
SHA-512:	FD554827CBC3DED1B3FB68823D527B3199E518AD381218AEDE118C899633C1BDEC3A44CB7AEED8F854E4A48297436F1BD900D648AA98243DADE81D9198E0A89E
Malicious:	false
Preview:	4...Q..b..1J.}.r6;{.?..t,.......d...S.C.q3.....e.....Y-.]j.....f.....w...d.....g.......3.....h.....,..@.....i.......5&.....j......}.K......k.....gL-.......l.......!.=.....m...x........n.....2..C.....o.........u.....p....a8BA.......q......9../.....r.....c.uY7.....s...............t.....m..9......u..............v.....\|.!<T.....w....}...!.....x....K..u.......y....N.!w.......z....a..[.......{...z~^Yy......\|.........J.....}...qf$...z.....~...I..................._............rq...........0..W.c.............8S.b...........i.................Y9..........V...C.............ve.^.........d....E.............%...............6N...........4}s.)..........'...1...........V..............u..%.V..........<..3...........Z\|..t..........R..V.mb...........IH..............V..vQ..........#.,..............h.I...........g~0...k.........b..O'............h...+..........@,w.M............S.\A.e..........Q..i...........Ntz...............ID+H......

c:\int_duca\ren.bat (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	3.7505456804735062
Encrypted:	false
SSDEEP:	3:KejcQPu7J+UHnvK45fP5R:Kegt7JTvK4fR
MD5:	7435AD79A3D28FABCFF1F0527E0F62FE
SHA1:	72654817FC28274C742A134DFEEAC34455E07A46
SHA-256:	4F5BC17F0E1FBBDF556D62570C3D0756A75D449B7A4492B365EB7B14A666961A
SHA-512:	72E96681181F7810B9701679C3E46016E8823D5B9D92B73BA02A40BD9CC0EE53351F10EFF773069C5BFF35BD1635E0FC5BCDC2C266D3162727EBD796BD402EAB
Malicious:	false
Preview:	ren duca.r00..r00 duca.r00..ren duca.r01..r01 duca.r01..ren duca.r02..r02 duca.r02..exit

c:\int_duca\renduca2.bat (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.454469305363301
Encrypted:	false
SSDEEP:	3:S9UPbn4ejv/LKGxvn:S9UPL4ejvnZ
MD5:	3899FF4FA3992859E6E20E5DE22C00CE
SHA1:	AD8D09AD672E7849EE904C5084466D52330C09BC
SHA-256:	A28661C7E21E584F93704C6E076667EBC87D9FEE1D9C426A14258FC6ED34B774
SHA-512:	22F137DD59B9AAF8C4255845FB69CEA352D602ABBA2AC7F7A226515B0227B20EC208AD46561C7BAF8917060B3FF586C372B89A4F0D9A8E5D06F81EFC5A744FE5
Malicious:	false
Preview:	copy %4 %5..copy %1blank.mdb %2..copy %1backup\blank.mdb %1..exit

c:\int_duca\renexp.bat (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.441391799786944
Encrypted:	false
SSDEEP:	3:LeJE6mD4ekX9Qcv/LKvDxv2tAXj:KgD4ee91vmDYyT
MD5:	5C8FE25000EDEE434773A47708698E75
SHA1:	3C177942CFE0D947DCDF1CF8E5AF382D6C2F3955
SHA-256:	6E8FDF4215FA6906F627BB9606655C3E96348B6D4FD3906A8AD08592477E072D
SHA-512:	57B76D16B359A0E2ADAF1259FA68EEE4F9AE6CE6D3464739E20062FDAF72DEAAC7BCCB6ABAB84E0C2903600FFA860DFA92ABBF0747BDB8636CD800F540D45504
Malicious:	false
Preview:	ren %1blankexp.mdb %2..copy %1%2 %3..copy %1backup\blankexp.mdb %1..del %1%2..exit..

c:\int_duca\renexp2.bat (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.441391799786944
Encrypted:	false
SSDEEP:	3:LeJE6mD4ekX9Qcv/LKvDxv2tAXj:KgD4ee91vmDYyT
MD5:	5C8FE25000EDEE434773A47708698E75
SHA1:	3C177942CFE0D947DCDF1CF8E5AF382D6C2F3955
SHA-256:	6E8FDF4215FA6906F627BB9606655C3E96348B6D4FD3906A8AD08592477E072D
SHA-512:	57B76D16B359A0E2ADAF1259FA68EEE4F9AE6CE6D3464739E20062FDAF72DEAAC7BCCB6ABAB84E0C2903600FFA860DFA92ABBF0747BDB8636CD800F540D45504
Malicious:	false
Preview:	ren %1blankexp.mdb %2..copy %1%2 %3..copy %1backup\blankexp.mdb %1..del %1%2..exit..

c:\int_duca\tarifas\tarifas.mdb (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Microsoft Access Database
Category:	dropped
Size (bytes):	49455104
Entropy (8bit):	1.851222351673581
Encrypted:	false
SSDEEP:	49152:H75ffsyDsMI8BNH8OuMGy6ntuM/D2/5Cq8zrrmtteP838J274SH6F:H7iyoFG1qpq8zrrmttio6F
MD5:	E0CC5E60C6003BE78C63F7771CD71DC9
SHA1:	5122A75335D2252D5FB751AFD80C06128E6A2FDB
SHA-256:	70CFC5287EBF878A9A538D261A1C1E69C0E66EB47F4014D6D2241BCDCC61A985
SHA-512:	BF916844C17963C77159A2991E1777EF73BBA2A75F91BCE1CCF422188BA44676FD010AB60219F74C9E5F2ACC90FA93FFDFBF035A5C057F9962A7485FA28A6BEC
Malicious:	false
Preview:	....Standard Jet DB......n.b`..U.gr@?..~.....1.y..0...c...F...N._.7\.....K....`70{6....P.C...3W.y[..\|*..\|.....z9.N...f_...$.g..'D...e....F.x....-b.T...4.0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\unzip.bat (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	36
Entropy (8bit):	4.273684376262023
Encrypted:	false
SSDEEP:	3:I5Mg7rU+87:ITU+W
MD5:	FA4BF9B172F989C497D910F861460E62
SHA1:	455A73CFB3324EF17E16081FC068029AAB206712
SHA-256:	A297C635913C76F631F9312C79192A231A2EBCF5E6DF1B2A50D17B7C1B98C40D
SHA-512:	47E5C1FBE3F247113FCB92B80EFF5A82966D7871C03EBE54B192B9E2127C264E1302D0D9754A4B1E35B00C59885829C32F0964A9D6501446BFA0C9E0133A6CFC
Malicious:	false
Preview:	c:\int_duca\unzip %1%2 -d %1..exit..

c:\int_duca\unzip.exe (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	6.417619553362158
Encrypted:	false
SSDEEP:	3072:izJ+rd1/IeLWQw07eFs9mH1ayTpkGKMUxUk:BrvfLWQw07eFs9mfTIMUuk
MD5:	F8E889BC3D76B8FA4AE016FB9D5808B7
SHA1:	8B6FB88632E91FD7F910BF3AA1CEB311C4E8B425
SHA-256:	00E5ABF296E3A718BA2A7E8B1E1B4A9A0AB9367DCDAF0775866686299C488DAC
SHA-512:	5586BFB0FE23698A9322F75C08C9C27B0E356C876FDD160D6FD9F60842EA86C56718861FABCD7D0CAB656B6B28587CE83011178470D78E050A28ADF11403C3DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<...............7..........................@..........................................................................p.......................................................................................................................text....{.......\|.................. ..`.data...............................@....bss.....................................idata.......p......................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

c:\int_duca\upgrade.ini (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	Generic INItialization configuration [DATABASE_EXP]
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.23614106180718
Encrypted:	false
SSDEEP:	6:u85H8gt56Py2KT7qkgvH8gt56Py2KT7PuaifTiUosLr:u85DP66pTgvDP66pX8izg
MD5:	3C57F55AF46B1F26C4BC40E3419B2783
SHA1:	6C6D5F33EC5B3165C83BE1D5801044342E5BC5E1
SHA-256:	F15DB9A1D23A468871554CD51504DA501643EC6872DFBECD55CEAB265FD99590
SHA-512:	971EF424CFB2E1D2AD273CF5118C0E8AA31BBDF425A5016A97E53E63EE522A5B2B57BC467B4E79457FDFF213F9CE8987B923C7CB3D6C2ADDB252D844704F0B4B
Malicious:	false
Preview:	[DATABASE]..DBMS=ODBC..UserId=f\|rus..DatabasePassword=tki)hyh..ServerName=ACCESS..Prompt=0....[DATABASE_EXP]..DBMS=ODBC..UserId=f\|rus..DatabasePassword=tki)hyh..ServerName=ACCESS..Prompt=0....[RSU]..INT= $0....[DB_PATH]..PATH = C:\int_duca\..ESTABLECIDO = TRUE....[sdef%5&]..fed= 1.01....

c:\int_duca\val.BAT (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	3.9677201004745
Encrypted:	false
SSDEEP:	3:LSI88zDNwv:/HNwv
MD5:	8BDB5170BA6864C380B493C9ECA26CE6
SHA1:	C4D9F13346E21F8CC53E64BA1835C5756E86D612
SHA-256:	8788BDDCC34F92B0E706DDBEAF479A15395CDB091F6679A69823FEEEDDBC3CE8
SHA-512:	9C6D0EBE6F8BCDE4B333E11914244C84EE99B4844B771E7B31D011645E4DA8407AFB85D7DFFDBE56F25BB8064004538CF2D84398117057786C167FE869C1EC8A
Malicious:	false
Preview:	ren %1.mdb %2.mdb..pause....

c:\int_duca\zip.exe (copy)

Process:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	6.443678450897129
Encrypted:	false
SSDEEP:	768:EXeoAEIpkY1TQH4lNc33bRks6NIZJya6HyivmLiR0Klt1HrrdJsbV:EXAl+YWH443bRknI7WHRlt1HrhJsbV
MD5:	72C83BBD05EA169372C8D04ACD0C4515
SHA1:	D50903291E924CF96C2A004944BA92F47D17A01E
SHA-256:	41B79ADFB2E71B9D7222D0F30D488A8B4FC6656A99EC5D3B0534677ABA1A2537
SHA-512:	54F3B51528474F978F3512D40C8E434B2C8C09179370B70778F7774432B5C91432DBAD5BFED76AF24A3523F39FE8AA8338E404E310AB9A443059AE91FA4CE2AA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....<...............7..........................@..................................................................................................................................................................................................text...T........................... ..`.data...............................@....bss....0.... ...........................idata..............................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
Entropy (8bit):	7.9989910503939425
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% InstallShield setup (43055/19) 0.43% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	int_duca.exe
File size:	26'890'785 bytes
MD5:	134c17a4367f255176249227e7db0bae
SHA1:	98eb94e8a809b073e8b878bc164cc74efe873d0c
SHA256:	7c36ec7327b0879d33f4c579412770712e2a29f46324468dc48ceb857b3b909f
SHA512:	6f2cee4002761dd538882c19ded7b5fa1ff78e891963505699927ed4937ea91bd1b92ae0221506678a51e730245c558f633657231fd227e120b2f7ddd440e066
SSDEEP:	786432:YKgjJ9zT7WEroyQQjISBqdS4uUyMckWF7N81g2:0H9N9BbdjkWxN52
TLSH:	014733E7E4A7852EDAB401317584F14A80C55C0A0783C9FFE3297A1873376F649EEA93
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............w...w...w...w...w...h...w..sk...w...h...w...T...w...w..Iw...W...w..7q...w..Rich.w..........................PE..L....Z.;...

File Icon


Icon Hash:	89adaca1e18e0183

Static PE Info

General

Entrypoint:	0x408947
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x3B965AC1 [Wed Sep 5 17:02:57 2001 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	5a9b89741dd0eb9be8754b41c4d30c55

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 00413318h
push 0040BA80h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 58h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
call dword ptr [004131E8h]
xor edx, edx
mov dl, ah
mov dword ptr [0041635Ch], edx
mov ecx, eax
and ecx, 000000FFh
mov dword ptr [00416358h], ecx
shl ecx, 08h
add ecx, edx
mov dword ptr [00416354h], ecx
shr eax, 10h
mov dword ptr [00416350h], eax
xor esi, esi
push esi
call 00007F42BCC66245h
pop ecx
test eax, eax
jne 00007F42BCC6616Ah
push 0000001Ch
call 00007F42BCC66215h
pop ecx
mov dword ptr [ebp-04h], esi
call 00007F42BCC69076h
call dword ptr [004131ECh]
mov dword ptr [00418A24h], eax
call 00007F42BCC68F34h
mov dword ptr [00416328h], eax
call 00007F42BCC68CDDh
call 00007F42BCC68C1Fh
call 00007F42BCC6708Eh
mov dword ptr [ebp-30h], esi
lea eax, dword ptr [ebp-5Ch]
push eax
call dword ptr [004130B8h]
call 00007F42BCC68BB0h
mov dword ptr [ebp-64h], eax
test byte ptr [ebp-30h], 00000001h
je 00007F42BCC66168h
movzx eax, word ptr [ebp-2Ch]
jmp 00007F42BCC66165h
push 0000000Ah
pop eax
push eax
push dword ptr [ebp-64h]
push esi
push esi
call dword ptr [004130E0h]

Rich Headers

Programming Language:

[C++] VS98 (6.0) build 8168
[ C ] VS98 (6.0) build 8168
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13938	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x2caa8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13000	0x2fc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11b16	0x12000	e169cd9727498334799ce574858324b5	False	0.600830078125	data	6.60209928895754	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x13000	0x1950	0x2000	1d22aa58107cdb479897ec936f8bbe61	False	0.3582763671875	data	4.782525832448763	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x15000	0x4e38	0x2000	7e0cfc2e100727b4ae39786ac23b9520	False	0.2440185546875	data	2.421916530044494	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1a000	0x2caa8	0x2d000	7e7761103a947a7979262f672106374c	False	0.19073350694444444	data	7.0229392710154395	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x1bff8	0x25ba2	Device independent bitmap graphic, 164 x 314 x 24, image size 0, resolution 2834 x 2834 px/m	English	United States	0.15482430596000776
RT_BITMAP	0x41ba0	0x38e4	Device independent bitmap graphic, 180 x 75 x 8, image size 13500, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.2670282889316122
RT_ICON	0x1ad98	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5472972972972973
RT_ICON	0x1aec0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.8424855491329479
RT_ICON	0x1b428	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.5013440860215054
RT_ICON	0x1b710	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.8709386281588448
RT_DIALOG	0x45488	0x19a	data	English	United States	0.5121951219512195
RT_DIALOG	0x1a8d0	0x92	data	English	United States	0.7054794520547946
RT_DIALOG	0x1a968	0xbe	data	English	United States	0.6263157894736842
RT_DIALOG	0x1acc0	0xd6	data	English	United States	0.5841121495327103
RT_DIALOG	0x1aa28	0xae	data	English	United States	0.6091954022988506
RT_DIALOG	0x1a658	0x272	data	English	United States	0.4792332268370607
RT_DIALOG	0x1a570	0xe2	data	English	United States	0.6017699115044248
RT_DIALOG	0x1ac30	0x90	data	English	United States	0.6805555555555556
RT_DIALOG	0x1aad8	0xf0	data	English	United States	0.65
RT_DIALOG	0x1abc8	0x62	data	English	United States	0.8061224489795918
RT_STRING	0x45c90	0x632	data	English	United States	0.3291298865069357
RT_STRING	0x462c8	0x1a8	data	English	United States	0.5165094339622641
RT_STRING	0x46898	0x11a	data	English	United States	0.549645390070922
RT_STRING	0x46470	0xba	data	English	United States	0.5483870967741935
RT_STRING	0x46530	0x366	data	English	United States	0.3793103448275862
RT_STRING	0x469b8	0x98	data	English	United States	0.7302631578947368
RT_STRING	0x46a50	0x58	data	English	United States	0.4318181818181818
RT_GROUP_ICON	0x1bfb8	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x45628	0x668	data	English	United States	0.22134146341463415

Imports

DLL	Import
KERNEL32.dll	GetProcAddress, FormatMessageA, DeleteFileA, MulDiv, IsDBCSLeadByte, GetExitCodeProcess, CreateProcessA, GetTempFileNameA, GetSystemDefaultLCID, WaitForSingleObject, CompareStringA, Sleep, SetFileTime, LocalFileTimeToFileTime, DosDateTimeToFileTime, FreeLibrary, RemoveDirectoryA, FindNextFileA, WritePrivateProfileSectionA, GetStartupInfoA, WriteFile, ReadFile, SetFileAttributesA, LocalFree, LocalAlloc, LockResource, LoadResource, FindResourceA, SizeofResource, GetModuleHandleA, GlobalFree, GlobalUnlock, GlobalLock, GlobalAlloc, MultiByteToWideChar, lstrcmpiA, GetDiskFreeSpaceA, HeapAlloc, GetProcessHeap, HeapFree, GetModuleFileNameA, ExitProcess, CreateFileA, CreateFileMappingA, MapViewOfFile, UnmapViewOfFile, lstrcpynA, SetFilePointer, GetFileSize, FindFirstFileA, CreateDirectoryA, GetLastError, GetPrivateProfileStringA, FindClose, GetFileAttributesA, lstrcatA, lstrlenA, GetWindowsDirectoryA, lstrcpyA, GetSystemDirectoryA, GetTempPathA, GetPrivateProfileSectionA, LoadLibraryA, MoveFileExA, WritePrivateProfileStringA, GetShortPathNameA, FlushFileBuffers, CloseHandle, IsBadCodePtr, IsBadReadPtr, SetStdHandle, LCMapStringW, LCMapStringA, SetUnhandledExceptionFilter, GetStdHandle, SetHandleCount, GetFileType, GetEnvironmentStrings, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsA, UnhandledExceptionFilter, FreeEnvironmentStringsW, TerminateProcess, GetStringTypeW, GetCurrentProcess, GetOEMCP, GetACP, GetStringTypeA, IsBadWritePtr, HeapReAlloc, GetCPInfo, VirtualFree, HeapCreate, VirtualAlloc, GetVersion, GetCommandLineA, HeapDestroy, RtlUnwind
USER32.dll	GetParent, GetDlgItem, SetFocus, SendDlgItemMessageA, EnableWindow, CheckRadioButton, GetWindowLongA, LoadStringA, LoadImageA, MessageBoxA, CharNextA, IsDlgButtonChecked, GetDlgItemTextA, CheckDlgButton, SetDlgItemTextA, ReleaseDC, GetDC, GetWindow, PostMessageA, SetWindowTextA, wsprintfA, GetDesktopWindow, GetWindowTextA, DestroyWindow, CreateDialogParamA, FillRect, GetSysColor, GetSysColorBrush, EndPaint, BeginPaint, DrawTextA, MoveWindow, GetClientRect, ScreenToClient, GetNextDlgTabItem, SetParent, MapDialogRect, IsWindow, GetWindowRect, CreateDialogIndirectParamA, ShowWindow, InvalidateRect, IsWindowEnabled, SetWindowPos, UpdateWindow, IsDialogMessageA, SetWindowLongA, GetActiveWindow, SetActiveWindow, LoadIconA, PeekMessageA, SendMessageA, DispatchMessageA, TranslateMessage
GDI32.dll	CreateFontIndirectA, RealizePalette, SelectPalette, CreatePalette, GetObjectA, GetStockObject, CreateDIBitmap, GetTextExtentPointA, SelectObject, EnumFontFamiliesExA, DeleteDC, BitBlt, TextOutA, SetBkMode, SetBkColor, CreateCompatibleDC, CreateSolidBrush, SetTextColor, DeleteObject, GetDeviceCaps
ADVAPI32.dll	RegCloseKey, RegQueryValueExA, RegOpenKeyExA
SHELL32.dll	ShellExecuteA, SHBrowseForFolderA, SHGetPathFromIDListA, SHGetMalloc
LZ32.dll	LZOpenFileA, LZCopy, LZClose
COMCTL32.dll

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	09:19:58
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\int_duca.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\int_duca.exe"
Imagebase:	0x400000
File size:	26'890'785 bytes
MD5 hash:	134C17A4367F255176249227E7DB0BAE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	09:20:00
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\pftE20A.tmp\Disk1\Setup.exe"
Imagebase:	0x400000
File size:	56'320 bytes
MD5 hash:	1AEB989E361AF85F5099DE3DA25457F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Target ID:	2
Start time:	09:20:01
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe" -RegServer
Imagebase:	0x400000
File size:	614'532 bytes
MD5 hash:	B3FD01873BD5FD163AB465779271C58F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	3
Start time:	09:20:01
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
Wow64 process (32bit):	true
Commandline:	C:\PROGRA~2\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe -Embedding
Imagebase:	0x400000
File size:	614'532 bytes
MD5 hash:	B3FD01873BD5FD163AB465779271C58F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	4
Start time:	09:20:01
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe" /REGSERVER
Imagebase:	0x400000
File size:	614'532 bytes
MD5 hash:	B3FD01873BD5FD163AB465779271C58F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true